688 files changed, 21876 insertions, 11807 deletions
diff --git a/Documentation/ABI/testing/sysfs-bus-rbd b/Documentation/ABI/testing/sysfs-bus-rbd
new file mode 100644
index 000000000000..90a87e2a572b
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-rbd
@@ -0,0 +1,83 @@
+What:           /sys/bus/rbd/
+Date:           November 2010
+Contact:        Yehuda Sadeh <yehuda@hq.newdream.net>,
+                Sage Weil <sage@newdream.net>
+Description:
+Being used for adding and removing rbd block devices.
+Usage: <mon ip addr> <options> <pool name> <rbd image name> [snap name]
+ $ echo "192.168.0.1 name=admin rbd foo" > /sys/bus/rbd/add
+The snapshot name can be "-" or omitted to map the image read/write. A <dev-id>
+will be assigned for any registered block device. If snapshot is used, it will
+be mapped read-only.
+Removal of a device:
+  $ echo <dev-id> > /sys/bus/rbd/remove
+Entries under /sys/bus/rbd/devices/<dev-id>/
+--------------------------------------------
+client_id
+        The ceph unique client id that was assigned for this specific session.
+major
+        The block device major number.
+name
+        The name of the rbd image.
+pool
+        The pool where this rbd image resides. The pool-name pair is unique
+        per rados system.
+size
+        The size (in bytes) of the mapped block device.
+refresh
+        Writing to this file will reread the image header data and set
+        all relevant datastructures accordingly.
+current_snap
+        The current snapshot for which the device is mapped.
+create_snap
+        Create a snapshot:
+         $ echo <snap-name> > /sys/bus/rbd/devices/<dev-id>/snap_create
+rollback_snap
+        Rolls back data to the specified snapshot. This goes over the entire
+        list of rados blocks and sends a rollback command to each.
+         $ echo <snap-name> > /sys/bus/rbd/devices/<dev-id>/snap_rollback
+snap_*
+        A directory per each snapshot
+Entries under /sys/bus/rbd/devices/<dev-id>/snap_<snap-name>
+-------------------------------------------------------------
+id
+        The rados internal snapshot id assigned for this snapshot
+size
+        The size of the image when this snapshot was taken.
diff --git a/Documentation/ABI/testing/sysfs-platform-asus-laptop b/Documentation/ABI/testing/sysfs-platform-asus-laptop
index 1d775390e856..41ff8ae4dee0 100644
--- a/Documentation/ABI/testing/sysfs-platform-asus-laptop
+++ b/Documentation/ABI/testing/sysfs-platform-asus-laptop
@@ -47,6 +47,20 @@ Date:		January 2007
 KernelVersion:  2.6.20
 Contact:        "Corentin Chary" <corentincj@iksaif.net>
 Description:
-                Control the bluetooth device. 1 means on, 0 means off.
+                Control the wlan device. 1 means on, 0 means off.
                This may control the led, the device or both.
 Users:          Lapsus
+What:           /sys/devices/platform/asus_laptop/wimax
+Date:           October 2010
+KernelVersion:  2.6.37
+Contact:        "Corentin Chary" <corentincj@iksaif.net>
+Description:
+                Control the wimax device. 1 means on, 0 means off.
+What:           /sys/devices/platform/asus_laptop/wwan
+Date:           October 2010
+KernelVersion:  2.6.37
+Contact:        "Corentin Chary" <corentincj@iksaif.net>
+Description:
+                Control the wwan (3G) device. 1 means on, 0 means off.
diff --git a/Documentation/ABI/testing/sysfs-platform-eeepc-wmi b/Documentation/ABI/testing/sysfs-platform-eeepc-wmi
new file mode 100644
index 000000000000..e4b5fef5fadd
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-platform-eeepc-wmi
@@ -0,0 +1,10 @@
+What:           /sys/devices/platform/eeepc-wmi/cpufv
+Date:           Oct 2010
+KernelVersion:  2.6.37
+Contact:        "Corentin Chary" <corentincj@iksaif.net>
+Description:
+                Change CPU clock configuration (write-only).
+                There are three available clock configuration:
+                    * 0 -> Super Performance Mode
+                    * 1 -> High Performance Mode
+                    * 2 -> Power Saving Mode
diff --git a/Documentation/DocBook/sh.tmpl b/Documentation/DocBook/sh.tmpl
index d858d92cf6d9..4a38f604fa66 100644
--- a/Documentation/DocBook/sh.tmpl
+++ b/Documentation/DocBook/sh.tmpl
@@ -79,10 +79,6 @@
      </sect2>
    </sect1>
  </chapter>
-  <chapter id="clk">
-    <title>Clock Framework Extensions</title>
-!Iinclude/linux/sh_clk.h
-  </chapter>
  <chapter id="mach">
    <title>Machine Specific Interfaces</title>
    <sect1 id="dreamcast">
diff --git a/Documentation/driver-model/interface.txt b/Documentation/driver-model/interface.txt
deleted file mode 100644
index c66912bfe866..000000000000
--- a/Documentation/driver-model/interface.txt
+++ /dev/null
@@ -1,129 +0,0 @@
-Device Interfaces
-Introduction
-~~~~~~~~~~~~
-Device interfaces are the logical interfaces of device classes that correlate
-directly to userspace interfaces, like device nodes. 
-   
-Each device class may have multiple interfaces through which you can 
-access the same device. An input device may support the mouse interface, 
-the 'evdev' interface, and the touchscreen interface. A SCSI disk would 
-support the disk interface, the SCSI generic interface, and possibly a raw 
-device interface. 
-Device interfaces are registered with the class they belong to. As devices
-are added to the class, they are added to each interface registered with
-the class. The interface is responsible for determining whether the device
-supports the interface or not. 
-Programming Interface
-~~~~~~~~~~~~~~~~~~~~~
-struct device_interface {
-        char                    * name;
-        rwlock_t                lock;
-        u32                     devnum;
-        struct device_class     * devclass;
-        struct list_head        node;
-        struct driver_dir_entry dir;
-        int (*add_device)(struct device *);
-        int (*add_device)(struct intf_data *);
-};
-int interface_register(struct device_interface *);
-void interface_unregister(struct device_interface *);
-An interface must specify the device class it belongs to. It is added
-to that class's list of interfaces on registration.
-Interfaces can be added to a device class at any time. Whenever it is
-added, each device in the class is passed to the interface's
-add_device callback. When an interface is removed, each device is
-removed from the interface.
-Devices
-~~~~~~~
-Once a device is added to a device class, it is added to each
-interface that is registered with the device class. The class
-is expected to place a class-specific data structure in 
-struct device::class_data. The interface can use that (along with
-other fields of struct device) to determine whether or not the driver
-and/or device support that particular interface.
-Data
-~~~~
-struct intf_data {
-        struct list_head        node;
-        struct device_interface * intf;
-        struct device           * dev;
-        u32                     intf_num;
-};
-int interface_add_data(struct interface_data *);
-The interface is responsible for allocating and initializing a struct 
-intf_data and calling interface_add_data() to add it to the device's list
-of interfaces it belongs to. This list will be iterated over when the device
-is removed from the class (instead of all possible interfaces for a class).
-This structure should probably be embedded in whatever per-device data 
-structure the interface is allocating anyway.
-   
-Devices are enumerated within the interface. This happens in interface_add_data()
-and the enumerated value is stored in the struct intf_data for that device. 
-sysfs
-~~~~~
-Each interface is given a directory in the directory of the device
-class it belongs to:
-Interfaces get a directory in the class's directory as well:
-   class/
-   `-- input
-       |-- devices
-       |-- drivers
-       |-- mouse
-       `-- evdev
-When a device is added to the interface, a symlink is created that points 
-to the device's directory in the physical hierarchy:
-   class/
-   `-- input
-       |-- devices
-       |   `-- 1 -> ../../../root/pci0/00:1f.0/usb_bus/00:1f.2-1:0/
-       |-- drivers
-       |   `-- usb:usb_mouse -> ../../../bus/drivers/usb_mouse/
-       |-- mouse
-       |   `-- 1 -> ../../../root/pci0/00:1f.0/usb_bus/00:1f.2-1:0/
-       `-- evdev
-           `-- 1 -> ../../../root/pci0/00:1f.0/usb_bus/00:1f.2-1:0/
-Future Plans
-~~~~~~~~~~~~
-A device interface is correlated directly with a userspace interface
-for a device, specifically a device node. For instance, a SCSI disk
-exposes at least two interfaces to userspace: the standard SCSI disk
-interface and the SCSI generic interface. It might also export a raw
-device interface. 
-Many interfaces have a major number associated with them and each
-device gets a minor number. Or, multiple interfaces might share one
-major number, and each will receive a range of minor numbers (like in
-the case of input devices).
-These major and minor numbers could be stored in the interface
-structure. Major and minor allocations could happen when the interface
-is registered with the class, or via a helper function. 
diff --git a/Documentation/edac.txt b/Documentation/edac.txt
index 0b875e8da969..9ee774de57cd 100644
--- a/Documentation/edac.txt
+++ b/Documentation/edac.txt
@@ -196,7 +196,7 @@ csrow3.
 The representation of the above is reflected in the directory tree
 in EDAC's sysfs interface. Starting in directory
 /sys/devices/system/edac/mc each memory controller will be represented
-by its own 'mcX' directory, where 'X" is the index of the MC.
+by its own 'mcX' directory, where 'X' is the index of the MC.
        ..../edac/mc/
@@ -207,7 +207,7 @@ by its own 'mcX' directory, where 'X" is the index of the MC.
                   ....
 Under each 'mcX' directory each 'csrowX' is again represented by a
-'csrowX', where 'X" is the csrow index:
+'csrowX', where 'X' is the csrow index:
        .../mc/mc0/
@@ -232,7 +232,7 @@ EDAC control and attribute files.
 In 'mcX' directories are EDAC control and attribute files for
-this 'X" instance of the memory controllers:
+this 'X' instance of the memory controllers:
 Counter reset control file:
@@ -343,7 +343,7 @@ Sdram memory scrubbing rate:
 'csrowX' DIRECTORIES
 In the 'csrowX' directories are EDAC control and attribute files for
-this 'X" instance of csrow:
+this 'X' instance of csrow:
 Total Uncorrectable Errors count attribute file:
diff --git a/Documentation/fb/00-INDEX b/Documentation/fb/00-INDEX
index a618fd99c9f0..30a70542e823 100644
--- a/Documentation/fb/00-INDEX
+++ b/Documentation/fb/00-INDEX
@@ -4,33 +4,41 @@ please mail me.
                                    Geert Uytterhoeven <geert@linux-m68k.org>
 00-INDEX
-        - this file
+        - this file.
 arkfb.txt
        - info on the fbdev driver for ARK Logic chips.
 aty128fb.txt
        - info on the ATI Rage128 frame buffer driver.
 cirrusfb.txt
        - info on the driver for Cirrus Logic chipsets.
+cmap_xfbdev.txt
+        - an introduction to fbdev's cmap structures.
 deferred_io.txt
        - an introduction to deferred IO.
+efifb.txt
+        - info on the EFI platform driver for Intel based Apple computers.
+ep93xx-fb.txt
+        - info on the driver for EP93xx LCD controller.
 fbcon.txt
        - intro to and usage guide for the framebuffer console (fbcon).
 framebuffer.txt
        - introduction to frame buffer devices.
-imacfb.txt
+gxfb.txt
-        - info on the generic EFI platform driver for Intel based Macs.
+        - info on the framebuffer driver for AMD Geode GX2 based processors.
 intel810.txt
        - documentation for the Intel 810/815 framebuffer driver.
 intelfb.txt
        - docs for Intel 830M/845G/852GM/855GM/865G/915G/945G fb driver.
 internals.txt
        - quick overview of frame buffer device internals.
+lxfb.txt
+        - info on the framebuffer driver for AMD Geode LX based processors.
 matroxfb.txt
        - info on the Matrox framebuffer driver for Alpha, Intel and PPC.
+metronomefb.txt
+        - info on the driver for the Metronome display controller.
 modedb.txt
        - info on the video mode database.
-matroxfb.txt
-        - info on the Matrox frame buffer driver.
 pvr2fb.txt
        - info on the PowerVR 2 frame buffer driver.
 pxafb.txt
@@ -39,13 +47,23 @@ s3fb.txt
        - info on the fbdev driver for S3 Trio/Virge chips.
 sa1100fb.txt
        - information about the driver for the SA-1100 LCD controller.
+sh7760fb.txt
+        - info on the SH7760/SH7763 integrated LCDC Framebuffer driver.
 sisfb.txt
        - info on the framebuffer device driver for various SiS chips.
 sstfb.txt
        - info on the frame buffer driver for 3dfx' Voodoo Graphics boards.
 tgafb.txt
-        - info on the TGA (DECChip 21030) frame buffer driver
+        - info on the TGA (DECChip 21030) frame buffer driver.
+tridentfb.txt
+        info on the framebuffer driver for some Trident chip based cards.
+uvesafb.txt
+        - info on the userspace VESA (VBE2+ compliant) frame buffer device.
 vesafb.txt
-        - info on the VESA frame buffer device
+        - info on the VESA frame buffer device.
+viafb.modes
+        - list of modes for VIA Integration Graphic Chip.
+viafb.txt
+        - info on the VIA Integration Graphic Chip console framebuffer driver.
 vt8623fb.txt
        - info on the fb driver for the graphics core in VIA VT8623 chipsets.
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index ed7e5efc06d8..55c28b79d8dc 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -660,11 +660,10 @@ struct address_space_operations {
  releasepage: releasepage is called on PagePrivate pages to indicate
        that the page should be freed if possible.  ->releasepage
        should remove any private data from the page and clear the
-        PagePrivate flag.  It may also remove the page from the
+        PagePrivate flag. If releasepage() fails for some reason, it must
-        address_space.  If this fails for some reason, it may indicate
+        indicate failure with a 0 return value.
-        failure with a 0 return value.
+        releasepage() is used in two distinct though related cases.  The
-        This is used in two distinct though related cases.  The first
+        first is when the VM finds a clean page with no active users and
-        is when the VM finds a clean page with no active users and
        wants to make it a free page.  If ->releasepage succeeds, the
        page will be removed from the address_space and become free.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 92e83e53148f..cdd2a6e8a3b7 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2385,6 +2385,11 @@ and is between 256 and 4096 characters. It is defined in the file
                        improve throughput, but will also increase the
                        amount of memory reserved for use by the client.
+        swapaccount[=0|1]
+                        [KNL] Enable accounting of swap in memory resource
+                        controller if no parameter or 1 is given or disable
+                        it if 0 is given (See Documentation/cgroups/memory.txt)
        swiotlb=        [IA-64] Number of I/O TLB slabs
        switches=       [HW,M68k]
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index fe95105992c5..3c5e465296e1 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -144,6 +144,7 @@ tcp_adv_win_scale - INTEGER
        Count buffering overhead as bytes/2^tcp_adv_win_scale
        (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
        if it is <= 0.
+        Possible values are [-31, 31], inclusive.
        Default: 2
 tcp_allowed_congestion_control - STRING
diff --git a/Documentation/sh/clk.txt b/Documentation/sh/clk.txt
deleted file mode 100644
index 114b595cfa97..000000000000
--- a/Documentation/sh/clk.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-Clock framework on SuperH architecture
-The framework on SH extends existing API by the function clk_set_rate_ex,
-which prototype is as follows:
-    clk_set_rate_ex (struct clk *clk, unsigned long rate, int algo_id)
-The algo_id parameter is used to specify algorithm used to recalculate clocks,
-adjanced to clock, specified as first argument. It is assumed that algo_id==0
-means no changes to adjanced clock
-Internally, the clk_set_rate_ex forwards request to clk->ops->set_rate method,
-if it is present in ops structure. The method should set the clock rate and adjust
-all needed clocks according to the passed algo_id.
-Exact values for algo_id are machine-dependent. For the sh7722, the following
-values are defined:
-        NO_CHANGE       = 0,
-        IUS_N1_N1,      /* I:U = N:1, U:Sh = N:1 */
-        IUS_322,        /* I:U:Sh = 3:2:2        */
-        IUS_522,        /* I:U:Sh = 5:2:2        */
-        IUS_N11,        /* I:U:Sh = N:1:1        */
-        SB_N1,          /* Sh:B = N:1            */
-        SB3_N1,         /* Sh:B3 = N:1           */
-        SB3_32,         /* Sh:B3 = 3:2           */
-        SB3_43,         /* Sh:B3 = 4:3           */
-        SB3_54,         /* Sh:B3 = 5:4           */
-        BP_N1,          /* B:P   = N:1           */
-        IP_N1           /* I:P   = N:1           */
-Each of these constants means relation between clocks that can be set via the FRQCR
-register
diff --git a/MAINTAINERS b/MAINTAINERS
index a92c994ba935..1a1c27b9c557 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1359,7 +1359,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <fubar@us.ibm.com>
-L:      bonding-devel@lists.sourceforge.net
+L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
 F:      drivers/net/bonding/
@@ -2060,7 +2060,7 @@ F:	Documentation/blockdev/drbd/
 DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS
 M:      Greg Kroah-Hartman <gregkh@suse.de>
-T:      quilt kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6.git
 S:      Supported
 F:      Documentation/kobject.txt
 F:      drivers/base/
@@ -2080,7 +2080,7 @@ F:	include/drm/
 INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
 M:      Chris Wilson <chris@chris-wilson.co.uk>
-L:      intel-gfx@lists.freedesktop.org
+L:      intel-gfx@lists.freedesktop.org (subscribers-only)
 L:      dri-devel@lists.freedesktop.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel.git
 S:      Supported
@@ -2444,10 +2444,12 @@ F:	drivers/net/wan/sdla.c
 FRAMEBUFFER LAYER
 L:      linux-fbdev@vger.kernel.org
 W:      http://linux-fbdev.sourceforge.net/
+Q:      http://patchwork.kernel.org/project/linux-fbdev/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6.git
 S:      Orphan
 F:      Documentation/fb/
-F:      drivers/video/fb*
+F:      drivers/video/
+F:      include/video/
 F:      include/linux/fb.h
 FREESCALE DMA DRIVER
@@ -4062,9 +4064,8 @@ F:	drivers/scsi/NCR_D700.*
 NETEFFECT IWARP RNIC DRIVER (IW_NES)
 M:      Faisal Latif <faisal.latif@intel.com>
-M:      Chien Tung <chien.tin.tung@intel.com>
 L:      linux-rdma@vger.kernel.org
-W:      http://www.neteffect.com
+W:      http://www.intel.com/Products/Server/Adapters/Server-Cluster/Server-Cluster-overview.htm
 S:      Supported
 F:      drivers/infiniband/hw/nes/
@@ -5837,6 +5838,8 @@ M:	Chris Metcalf <cmetcalf@tilera.com>
 W:      http://www.tilera.com/scm/
 S:      Supported
 F:      arch/tile/
+F:      drivers/char/hvc_tile.c
+F:      drivers/net/tile/
 TLAN NETWORK DRIVER
 M:      Samuel Chessman <chessman@tux.org>
diff --git a/Makefile b/Makefile
index b31d21377e4c..3d94974542ea 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 37
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc5
 NAME = Flesh-Eating Bats with Fangs
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index db524e75c4a2..f1d9297b1050 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -9,7 +9,7 @@ config ARM
        select GENERIC_ATOMIC64 if (!CPU_32v6K || !AEABI)
        select HAVE_OPROFILE if (HAVE_PERF_EVENTS)
        select HAVE_ARCH_KGDB
-        select HAVE_KPROBES if (!XIP_KERNEL)
+        select HAVE_KPROBES if (!XIP_KERNEL && !THUMB2_KERNEL)
        select HAVE_KRETPROBES if (HAVE_KPROBES)
        select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
        select HAVE_FTRACE_MCOUNT_RECORD if (!XIP_KERNEL)
diff --git a/arch/arm/boot/Makefile b/arch/arm/boot/Makefile
index 4a590f4113e2..4d26f2c52a75 100644
--- a/arch/arm/boot/Makefile
+++ b/arch/arm/boot/Makefile
@@ -70,12 +70,7 @@ else
 $(obj)/uImage: LOADADDR=$(ZRELADDR)
 endif
-ifeq ($(CONFIG_THUMB2_KERNEL),y)
-# Set bit 0 to 1 so that "mov pc, rx" switches to Thumb-2 mode
-$(obj)/uImage: STARTADDR=$(shell echo $(LOADADDR) | sed -e "s/.$$/1/")
-else
 $(obj)/uImage: STARTADDR=$(LOADADDR)
-endif
 $(obj)/uImage:  $(obj)/zImage FORCE
        $(call if_changed,uimage)
diff --git a/arch/arm/boot/bootp/init.S b/arch/arm/boot/bootp/init.S
index 8b0de41c3dcb..78b508075161 100644
--- a/arch/arm/boot/bootp/init.S
+++ b/arch/arm/boot/bootp/init.S
@@ -73,6 +73,8 @@ move:		ldmia	r4!, {r7 - r10}		@ move 32-bytes at a time
                .size   _start, . - _start
+                .align
                .type   data,#object
 data:           .word   initrd_start            @ source initrd address
                .word   initrd_phys             @ destination initrd address
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 6825c34646d4..7193884ed8b0 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -125,9 +125,13 @@ wait:		mrc	p14, 0, pc, c0, c1, 0
 * sort out different calling conventions
 */
                .align
+                .arm                            @ Always enter in ARM state
 start:
                .type   start,#function
-                .rept   8
+ THUMB(         adr     r12, BSYM(1f)   )
+ THUMB(         bx      r12             )
+ THUMB(         .rept   6               )
+ ARM(           .rept   8               )
                mov     r0, r0
                .endr
@@ -135,6 +139,7 @@ start:
                .word   0x016f2818              @ Magic numbers to help the loader
                .word   start                   @ absolute load/run zImage address
                .word   _edata                  @ zImage end address
+ THUMB(         .thumb                  )
 1:              mov     r7, r1                  @ save architecture ID
                mov     r8, r2                  @ save atags pointer
@@ -174,7 +179,8 @@ not_angel:
                ldr     sp, [r0, #28]
 #ifdef CONFIG_AUTO_ZRELADDR
                @ determine final kernel image address
-                and     r4, pc, #0xf8000000
+                mov     r4, pc
+                and     r4, r4, #0xf8000000
                add     r4, r4, #TEXT_OFFSET
 #else
                ldr     r4, =zreladdr
@@ -445,7 +451,8 @@ __setup_mmu:	sub	r3, r4, #16384		@ Page directory size
 */
                mov     r1, #0x1e
                orr     r1, r1, #3 << 10
-                mov     r2, pc, lsr #20
+                mov     r2, pc
+                mov     r2, r2, lsr #20
                orr     r1, r1, r2, lsl #20
                add     r0, r3, r2, lsl #2
                str     r1, [r0], #4
@@ -1084,6 +1091,6 @@ memdump:	mov	r12, r0
 reloc_end:
                .align
-                .section ".stack", "w"
+                .section ".stack", "aw", %nobits
 user_stack:     .space  4096
 user_stack_end:
diff --git a/arch/arm/boot/compressed/vmlinux.lds.in b/arch/arm/boot/compressed/vmlinux.lds.in
index d08168941bd6..366a924019ac 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.in
+++ b/arch/arm/boot/compressed/vmlinux.lds.in
@@ -57,7 +57,7 @@ SECTIONS
  .bss                  : { *(.bss) }
  _end = .;
-  .stack (NOLOAD)       : { *(.stack) }
+  .stack                : { *(.stack) }
  .stab 0               : { *(.stab) }
  .stabstr 0            : { *(.stabstr) }
diff --git a/arch/arm/common/gic.c b/arch/arm/common/gic.c
index 772f95f1aecd..e6388dcd8cfa 100644
--- a/arch/arm/common/gic.c
+++ b/arch/arm/common/gic.c
@@ -146,9 +146,15 @@ static int gic_set_cpu(unsigned int irq, const struct cpumask *mask_val)
        unsigned int shift = (irq % 4) * 8;
        unsigned int cpu = cpumask_first(mask_val);
        u32 val;
+        struct irq_desc *desc;
        spin_lock(&irq_controller_lock);
-        irq_desc[irq].node = cpu;
+        desc = irq_to_desc(irq);
+        if (desc == NULL) {
+                spin_unlock(&irq_controller_lock);
+                return -EINVAL;
+        }
+        desc->node = cpu;
        val = readl(reg) & ~(0xff << shift);
        val |= 1 << (cpu + shift);
        writel(val, reg);
@@ -210,7 +216,7 @@ void __init gic_cascade_irq(unsigned int gic_nr, unsigned int irq)
 void __init gic_dist_init(unsigned int gic_nr, void __iomem *base,
                          unsigned int irq_start)
 {
-        unsigned int max_irq, i;
+        unsigned int gic_irqs, irq_limit, i;
        u32 cpumask = 1 << smp_processor_id();
        if (gic_nr >= MAX_GIC_NR)
@@ -226,47 +232,49 @@ void __init gic_dist_init(unsigned int gic_nr, void __iomem *base,
        /*
         * Find out how many interrupts are supported.
-         */
-        max_irq = readl(base + GIC_DIST_CTR) & 0x1f;
-        max_irq = (max_irq + 1) * 32;
-        /*
         * The GIC only supports up to 1020 interrupt sources.
-         * Limit this to either the architected maximum, or the
-         * platform maximum.
         */
-        if (max_irq > max(1020, NR_IRQS))
+        gic_irqs = readl(base + GIC_DIST_CTR) & 0x1f;
-                max_irq = max(1020, NR_IRQS);
+        gic_irqs = (gic_irqs + 1) * 32;
+        if (gic_irqs > 1020)
+                gic_irqs = 1020;
        /*
         * Set all global interrupts to be level triggered, active low.
         */
-        for (i = 32; i < max_irq; i += 16)
+        for (i = 32; i < gic_irqs; i += 16)
                writel(0, base + GIC_DIST_CONFIG + i * 4 / 16);
        /*
         * Set all global interrupts to this CPU only.
         */
-        for (i = 32; i < max_irq; i += 4)
+        for (i = 32; i < gic_irqs; i += 4)
                writel(cpumask, base + GIC_DIST_TARGET + i * 4 / 4);
        /*
         * Set priority on all global interrupts.
         */
-        for (i = 32; i < max_irq; i += 4)
+        for (i = 32; i < gic_irqs; i += 4)
                writel(0xa0a0a0a0, base + GIC_DIST_PRI + i * 4 / 4);
        /*
         * Disable all interrupts.  Leave the PPI and SGIs alone
         * as these enables are banked registers.
         */
-        for (i = 32; i < max_irq; i += 32)
+        for (i = 32; i < gic_irqs; i += 32)
                writel(0xffffffff, base + GIC_DIST_ENABLE_CLEAR + i * 4 / 32);
        /*
+         * Limit number of interrupts registered to the platform maximum
+         */
+        irq_limit = gic_data[gic_nr].irq_offset + gic_irqs;
+        if (WARN_ON(irq_limit > NR_IRQS))
+                irq_limit = NR_IRQS;
+        /*
         * Setup the Linux IRQ subsystem.
         */
-        for (i = irq_start; i < gic_data[gic_nr].irq_offset + max_irq; i++) {
+        for (i = irq_start; i < irq_limit; i++) {
                set_irq_chip(i, &gic_chip);
                set_irq_chip_data(i, &gic_data[gic_nr]);
                set_irq_handler(i, handle_level_irq);
diff --git a/arch/arm/configs/at91rm9200_defconfig b/arch/arm/configs/at91rm9200_defconfig
new file mode 100644
index 000000000000..38cb7c985426
--- /dev/null
+++ b/arch/arm/configs/at91rm9200_defconfig
@@ -0,0 +1,341 @@
+CONFIG_EXPERIMENTAL=y
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_SWAP is not set
+CONFIG_SYSVIPC=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_MODULES=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_IOSCHED_CFQ is not set
+CONFIG_ARCH_AT91=y
+CONFIG_MACH_ONEARM=y
+CONFIG_ARCH_AT91RM9200DK=y
+CONFIG_MACH_AT91RM9200EK=y
+CONFIG_MACH_CSB337=y
+CONFIG_MACH_CSB637=y
+CONFIG_MACH_CARMEVA=y
+CONFIG_MACH_ATEB9200=y
+CONFIG_MACH_KB9200=y
+CONFIG_MACH_PICOTUX2XX=y
+CONFIG_MACH_KAFA=y
+CONFIG_MACH_ECBAT91=y
+CONFIG_MACH_YL9200=y
+CONFIG_MACH_CPUAT91=y
+CONFIG_MACH_ECO920=y
+CONFIG_MTD_AT91_DATAFLASH_CARD=y
+CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
+CONFIG_AT91_TIMER_HZ=100
+# CONFIG_ARM_THUMB is not set
+CONFIG_PCCARD=y
+CONFIG_AT91_CF=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_PREEMPT=y
+CONFIG_AEABI=y
+CONFIG_LEDS=y
+CONFIG_LEDS_CPU=y
+CONFIG_ZBOOT_ROM_TEXT=0x10000000
+CONFIG_ZBOOT_ROM_BSS=0x20040000
+CONFIG_KEXEC=y
+CONFIG_FPE_NWFPE=y
+CONFIG_BINFMT_MISC=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE=m
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_IPV6_PRIVACY=y
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_MIP6=m
+CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
+CONFIG_IPV6_TUNNEL=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_BT=m
+CONFIG_BT_L2CAP=m
+CONFIG_BT_SCO=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_MTD=y
+CONFIG_MTD_CONCAT=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_AFS_PARTS=y
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_COMPLEX_MAPPINGS=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PLATRAM=y
+CONFIG_MTD_DATAFLASH=y
+CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_ATMEL=y
+CONFIG_MTD_NAND_PLATFORM=y
+CONFIG_MTD_UBI=y
+CONFIG_MTD_UBI_GLUEBI=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_ATMEL_TCLIB=y
+CONFIG_EEPROM_LEGACY=m
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=m
+CONFIG_BLK_DEV_SR_VENDOR=y
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_MULTI_LUN=y
+# CONFIG_SCSI_LOWLEVEL is not set
+CONFIG_NETDEVICES=y
+CONFIG_TUN=m
+CONFIG_PHYLIB=y
+CONFIG_DAVICOM_PHY=y
+CONFIG_SMSC_PHY=y
+CONFIG_MICREL_PHY=y
+CONFIG_NET_ETHERNET=y
+CONFIG_ARM_AT91_ETHER=y
+# CONFIG_NETDEV_1000 is not set
+# CONFIG_NETDEV_10000 is not set
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_USBNET=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_RNDIS_HOST=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_PPP=y
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_ASYNC=y
+CONFIG_PPP_DEFLATE=y
+CONFIG_PPP_BSDCOMP=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPPOE=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_SLIP_MODE_SLIP6=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=640
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=480
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_GPIO=y
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_SERIAL_ATMEL=y
+CONFIG_SERIAL_ATMEL_CONSOLE=y
+CONFIG_LEGACY_PTY_COUNT=32
+CONFIG_HW_RANDOM=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_GPIO=y
+CONFIG_SPI=y
+CONFIG_SPI_ATMEL=y
+CONFIG_SPI_BITBANG=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_HWMON=m
+CONFIG_SENSORS_ADM1021=m
+CONFIG_SENSORS_ADM1025=m
+CONFIG_SENSORS_ADM1026=m
+CONFIG_SENSORS_ADM1029=m
+CONFIG_SENSORS_ADM1031=m
+CONFIG_SENSORS_ADM9240=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_GL518SM=m
+CONFIG_SENSORS_GL520SM=m
+CONFIG_SENSORS_IT87=m
+CONFIG_SENSORS_LM63=m
+CONFIG_SENSORS_LM73=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_LM77=m
+CONFIG_SENSORS_LM78=m
+CONFIG_SENSORS_LM80=m
+CONFIG_SENSORS_LM83=m
+CONFIG_SENSORS_LM85=m
+CONFIG_SENSORS_LM87=m
+CONFIG_SENSORS_LM90=m
+CONFIG_SENSORS_LM92=m
+CONFIG_SENSORS_MAX1619=m
+CONFIG_SENSORS_PCF8591=m
+CONFIG_SENSORS_SMSC47B397=m
+CONFIG_SENSORS_W83781D=m
+CONFIG_SENSORS_W83791D=m
+CONFIG_SENSORS_W83792D=m
+CONFIG_SENSORS_W83793=m
+CONFIG_SENSORS_W83L785TS=m
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_AT91RM9200_WATCHDOG=y
+CONFIG_FB=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_TILEBLITTING=y
+CONFIG_FB_S1D13XXX=y
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+CONFIG_LCD_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_DISPLAY_SUPPORT=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FONTS=y
+CONFIG_FONT_MINI_4x6=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_USB=y
+CONFIG_USB_DEVICEFS=y
+# CONFIG_USB_DEVICE_CLASS is not set
+CONFIG_USB_MON=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_ACM=m
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_SERIAL=y
+CONFIG_USB_SERIAL_CONSOLE=y
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_FTDI_SIO=y
+CONFIG_USB_SERIAL_KEYSPAN=y
+CONFIG_USB_SERIAL_KEYSPAN_MPR=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19=y
+CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
+CONFIG_USB_SERIAL_MCT_U232=y
+CONFIG_USB_SERIAL_PL2303=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_ETH=m
+CONFIG_USB_MASS_STORAGE=m
+CONFIG_MMC=y
+CONFIG_MMC_AT91=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_DS1307=y
+CONFIG_RTC_DRV_PCF8563=y
+CONFIG_RTC_DRV_AT91RM9200=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_FS_XATTR is not set
+CONFIG_REISERFS_FS=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_NTFS_FS=m
+CONFIG_TMPFS=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_JFFS2_FS=y
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_JFFS2_COMPRESSION_OPTIONS=y
+CONFIG_JFFS2_LZO=y
+CONFIG_JFFS2_RUBIN=y
+CONFIG_CRAMFS=y
+CONFIG_MINIX_FS=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFSD=y
+CONFIG_SMB_FS=m
+CONFIG_CIFS=m
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+# CONFIG_FTRACE is not set
+CONFIG_CRYPTO_PCBC=y
+CONFIG_CRYPTO_SHA1=y
diff --git a/arch/arm/configs/at91rm9200dk_defconfig b/arch/arm/configs/at91rm9200dk_defconfig
deleted file mode 100644
index 4438e64f3bfb..000000000000
--- a/arch/arm/configs/at91rm9200dk_defconfig
+++ /dev/null
@@ -1,72 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_IOSCHED_DEADLINE is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_ARCH_AT91RM9200DK=y
-CONFIG_MACH_ECO920=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-# CONFIG_ARM_THUMB is not set
-CONFIG_PCCARD=y
-CONFIG_AT91_CF=y
-CONFIG_LEDS=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="mem=32M console=ttyS0,115200 initrd=0x20410000,3145728 root=/dev/ram0 rw"
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IPV6 is not set
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_JEDECPROBE=y
-CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_GPIO=y
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=y
-# CONFIG_VGA_CONSOLE is not set
-# CONFIG_USB_HID is not set
-CONFIG_USB=y
-CONFIG_USB_DEBUG=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_MON=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_GADGET=y
-CONFIG_MMC=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
-CONFIG_TMPFS=y
-CONFIG_CRAMFS=y
-CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_USER=y
-CONFIG_DEBUG_LL=y
diff --git a/arch/arm/configs/at91rm9200ek_defconfig b/arch/arm/configs/at91rm9200ek_defconfig
deleted file mode 100644
index ccd517c64bc7..000000000000
--- a/arch/arm/configs/at91rm9200ek_defconfig
+++ /dev/null
@@ -1,73 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_LOCALVERSION_AUTO is not set
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_IOSCHED_DEADLINE is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_AT91RM9200EK=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-# CONFIG_ARM_THUMB is not set
-CONFIG_LEDS=y
-CONFIG_LEDS_CPU=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="mem=32M console=ttyS0,115200 initrd=0x20410000,3145728 root=/dev/ram0 rw"
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IPV6 is not set
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_JEDECPROBE=y
-CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_GPIO=y
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=y
-CONFIG_FB=y
-CONFIG_FB_S1D13XXX=y
-# CONFIG_VGA_CONSOLE is not set
-# CONFIG_USB_HID is not set
-CONFIG_USB=y
-CONFIG_USB_DEBUG=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_MON=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_GADGET=y
-CONFIG_MMC=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
-CONFIG_TMPFS=y
-CONFIG_CRAMFS=y
-CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_USER=y
-CONFIG_DEBUG_LL=y
diff --git a/arch/arm/configs/ateb9200_defconfig b/arch/arm/configs/ateb9200_defconfig
deleted file mode 100644
index 1b0e9a1689bb..000000000000
--- a/arch/arm/configs/ateb9200_defconfig
+++ /dev/null
@@ -1,131 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
-CONFIG_SLAB=y
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=m
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_ATEB9200=y
-CONFIG_PCCARD=m
-CONFIG_AT91_CF=m
-CONFIG_PREEMPT=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_FPE_NWFPE=y
-CONFIG_PM=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_NET_KEY=y
-CONFIG_INET=y
-# CONFIG_IPV6 is not set
-CONFIG_BRIDGE=m
-CONFIG_VLAN_8021Q=m
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK_RO=y
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_BLK_DEV_NBD=m
-CONFIG_SCSI=m
-CONFIG_BLK_DEV_SD=m
-CONFIG_BLK_DEV_SR=m
-CONFIG_BLK_DEV_SR_VENDOR=y
-CONFIG_CHR_DEV_SG=m
-CONFIG_SCSI_MULTI_LUN=y
-CONFIG_NETDEVICES=y
-CONFIG_DUMMY=m
-CONFIG_TUN=m
-CONFIG_PHYLIB=y
-CONFIG_DAVICOM_PHY=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-CONFIG_USB_USBNET=y
-CONFIG_USB_NET_GL620A=y
-CONFIG_USB_NET_PLUSB=y
-CONFIG_USB_NET_RNDIS_HOST=y
-CONFIG_USB_ALI_M5632=y
-CONFIG_USB_AN2720=y
-CONFIG_USB_EPSON2888=y
-CONFIG_PPP=m
-CONFIG_PPP_ASYNC=m
-CONFIG_PPP_SYNC_TTY=m
-CONFIG_PPP_DEFLATE=m
-CONFIG_PPP_BSDCOMP=m
-CONFIG_PPPOE=m
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_I2C=m
-CONFIG_I2C_CHARDEV=m
-CONFIG_I2C_GPIO=m
-# CONFIG_VGA_CONSOLE is not set
-CONFIG_SOUND=y
-CONFIG_USB_HID=m
-CONFIG_HID_PID=y
-CONFIG_USB_HIDDEV=y
-CONFIG_USB=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_MON=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_ACM=m
-CONFIG_USB_PRINTER=m
-CONFIG_USB_STORAGE=m
-CONFIG_USB_STORAGE_DATAFAB=m
-CONFIG_USB_STORAGE_FREECOM=m
-CONFIG_USB_STORAGE_USBAT=m
-CONFIG_USB_STORAGE_SDDR09=m
-CONFIG_USB_STORAGE_SDDR55=m
-CONFIG_USB_STORAGE_JUMPSHOT=m
-CONFIG_USB_SERIAL=m
-CONFIG_USB_SERIAL_GENERIC=y
-CONFIG_USB_SERIAL_FTDI_SIO=m
-CONFIG_USB_SERIAL_PL2303=m
-CONFIG_USB_GADGET=m
-CONFIG_USB_ETH=m
-CONFIG_USB_GADGETFS=m
-CONFIG_USB_FILE_STORAGE=m
-CONFIG_USB_G_SERIAL=m
-CONFIG_MMC=m
-CONFIG_MMC_DEBUG=y
-CONFIG_RTC_CLASS=y
-# CONFIG_RTC_HCTOSYS is not set
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT2_FS=m
-CONFIG_EXT3_FS=m
-CONFIG_REISERFS_FS=m
-CONFIG_INOTIFY=y
-CONFIG_ISO9660_FS=m
-CONFIG_JOLIET=y
-CONFIG_ZISOFS=y
-CONFIG_UDF_FS=m
-CONFIG_MSDOS_FS=m
-CONFIG_VFAT_FS=m
-CONFIG_NTFS_FS=m
-CONFIG_NTFS_RW=y
-CONFIG_TMPFS=y
-CONFIG_CRAMFS=y
-CONFIG_NFS_FS=m
-CONFIG_NFS_V3=y
-CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=y
-CONFIG_NFSD=m
-CONFIG_NFSD_V4=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_MAC_PARTITION=y
-CONFIG_BSD_DISKLABEL=y
-CONFIG_MINIX_SUBPARTITION=y
-CONFIG_SOLARIS_X86_PARTITION=y
-CONFIG_UNIXWARE_DISKLABEL=y
-CONFIG_NLS_CODEPAGE_932=m
-CONFIG_NLS_ASCII=m
-CONFIG_NLS_ISO8859_15=m
-CONFIG_NLS_UTF8=m
-CONFIG_CRYPTO_MD5=y
-CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_ARC4=m
-CONFIG_CRC16=m
-CONFIG_LIBCRC32C=m
diff --git a/arch/arm/configs/carmeva_defconfig b/arch/arm/configs/carmeva_defconfig
deleted file mode 100644
index ac64dbd8a49c..000000000000
--- a/arch/arm/configs/carmeva_defconfig
+++ /dev/null
@@ -1,47 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
-# CONFIG_HOTPLUG is not set
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODULE_FORCE_UNLOAD=y
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_CARMEVA=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_PNP=y
-# CONFIG_IPV6 is not set
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_INPUT_MOUSEDEV is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-CONFIG_SERIO=m
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-# CONFIG_VGA_CONSOLE is not set
-CONFIG_MMC=m
-CONFIG_MMC_DEBUG=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_XATTR=y
-# CONFIG_DNOTIFY is not set
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_COMPRESSION_OPTIONS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_NFS_V4=y
-CONFIG_ROOT_NFS=y
-CONFIG_NFSD=y
diff --git a/arch/arm/configs/cpuat91_defconfig b/arch/arm/configs/cpuat91_defconfig
deleted file mode 100644
index 022aeb55b676..000000000000
--- a/arch/arm/configs/cpuat91_defconfig
+++ /dev/null
@@ -1,112 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_LOCALVERSION_AUTO is not set
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_BLK_DEV_BSG is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_CPUAT91=y
-CONFIG_AT91_TIMER_HZ=100
-# CONFIG_ARM_THUMB is not set
-CONFIG_PREEMPT=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET_XFRM_MODE_TUNNEL is not set
-# CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_IPV6 is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PLATRAM=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_NBD=y
-CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
-CONFIG_SCSI=y
-CONFIG_BLK_DEV_SD=y
-CONFIG_SCSI_MULTI_LUN=y
-# CONFIG_SCSI_LOWLEVEL is not set
-CONFIG_NETDEVICES=y
-CONFIG_PHYLIB=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
-CONFIG_PPP=y
-CONFIG_PPP_ASYNC=y
-CONFIG_PPP_DEFLATE=y
-CONFIG_PPP_BSDCOMP=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_LEGACY_PTY_COUNT=32
-# CONFIG_HW_RANDOM is not set
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_GPIO=y
-CONFIG_GPIO_SYSFS=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=y
-# CONFIG_VGA_CONSOLE is not set
-# CONFIG_HID_SUPPORT is not set
-CONFIG_USB=y
-# CONFIG_USB_DEVICE_CLASS is not set
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_STORAGE=y
-CONFIG_USB_GADGET=y
-CONFIG_USB_ETH=m
-CONFIG_MMC=y
-CONFIG_MMC_AT91=m
-CONFIG_NEW_LEDS=y
-CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_GPIO=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_LEDS_TRIGGER_TIMER=y
-CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-CONFIG_LEDS_TRIGGER_GPIO=y
-CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
-CONFIG_RTC_CLASS=y
-# CONFIG_RTC_HCTOSYS is not set
-CONFIG_RTC_DRV_DS1307=y
-CONFIG_RTC_DRV_PCF8563=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_FS_XATTR is not set
-CONFIG_INOTIFY=y
-CONFIG_AUTOFS4_FS=y
-CONFIG_MSDOS_FS=y
-CONFIG_VFAT_FS=y
-CONFIG_TMPFS=y
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_SUMMARY=y
-CONFIG_CRAMFS=y
-CONFIG_MINIX_FS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_ROOT_NFS=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_UTF8=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
diff --git a/arch/arm/configs/csb337_defconfig b/arch/arm/configs/csb337_defconfig
deleted file mode 100644
index a24c448840c4..000000000000
--- a/arch/arm/configs/csb337_defconfig
+++ /dev/null
@@ -1,104 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_BLK_DEV_BSG is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_CSB337=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-# CONFIG_ARM_THUMB is not set
-CONFIG_PCCARD=y
-CONFIG_AT91_CF=y
-CONFIG_LEDS=y
-CONFIG_LEDS_CPU=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="mem=32M console=ttyS0,38400 initrd=0x20410000,3145728 root=/dev/ram0 rw"
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_INET_LRO is not set
-# CONFIG_IPV6 is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_ATMEL_SSC=y
-CONFIG_SCSI=y
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_GPIO=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=y
-# CONFIG_VGA_CONSOLE is not set
-# CONFIG_USB_HID is not set
-CONFIG_USB=y
-CONFIG_USB_DEBUG=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_MON=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_STORAGE=y
-CONFIG_USB_SERIAL=y
-CONFIG_USB_SERIAL_CONSOLE=y
-CONFIG_USB_SERIAL_GENERIC=y
-CONFIG_USB_SERIAL_FTDI_SIO=y
-CONFIG_USB_SERIAL_KEYSPAN=y
-CONFIG_USB_SERIAL_KEYSPAN_MPR=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19=y
-CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
-CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
-CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
-CONFIG_USB_SERIAL_MCT_U232=y
-CONFIG_USB_GADGET=y
-CONFIG_MMC=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_HCTOSYS_DEVICE="rtc1"
-# CONFIG_RTC_INTF_SYSFS is not set
-CONFIG_RTC_DRV_DS1307=y
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
-CONFIG_TMPFS=y
-CONFIG_CRAMFS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_NFS_V4=y
-CONFIG_ROOT_NFS=y
-CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_USER=y
-CONFIG_DEBUG_LL=y
diff --git a/arch/arm/configs/csb637_defconfig b/arch/arm/configs/csb637_defconfig
deleted file mode 100644
index 98552adac5fb..000000000000
--- a/arch/arm/configs/csb637_defconfig
+++ /dev/null
@@ -1,98 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_BLK_DEV_BSG is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_CSB637=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-# CONFIG_ARM_THUMB is not set
-CONFIG_PCCARD=y
-CONFIG_AT91_CF=y
-CONFIG_LEDS=y
-CONFIG_LEDS_CPU=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="mem=32M console=ttyS0,38400 initrd=0x20410000,3145728 root=/dev/ram0 rw"
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_INET_LRO is not set
-# CONFIG_IPV6 is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_SCSI=y
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=y
-# CONFIG_VGA_CONSOLE is not set
-# CONFIG_USB_HID is not set
-CONFIG_USB=y
-CONFIG_USB_DEBUG=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_MON=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_STORAGE=y
-CONFIG_USB_SERIAL=y
-CONFIG_USB_SERIAL_CONSOLE=y
-CONFIG_USB_SERIAL_GENERIC=y
-CONFIG_USB_SERIAL_FTDI_SIO=y
-CONFIG_USB_SERIAL_KEYSPAN=y
-CONFIG_USB_SERIAL_KEYSPAN_MPR=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
-CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19=y
-CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
-CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
-CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
-CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
-CONFIG_USB_SERIAL_MCT_U232=y
-CONFIG_NEW_LEDS=y
-CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_GPIO=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
-CONFIG_TMPFS=y
-CONFIG_CRAMFS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_NFS_V4=y
-CONFIG_ROOT_NFS=y
-CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_USER=y
-CONFIG_DEBUG_LL=y
diff --git a/arch/arm/configs/ecbat91_defconfig b/arch/arm/configs/ecbat91_defconfig
deleted file mode 100644
index 6bb6abdcea8c..000000000000
--- a/arch/arm/configs/ecbat91_defconfig
+++ /dev/null
@@ -1,99 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-CONFIG_SYSVIPC=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_IOSCHED_DEADLINE is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_ECBAT91=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-CONFIG_PCCARD=y
-CONFIG_AT91_CF=y
-CONFIG_PREEMPT=y
-CONFIG_LEDS=y
-CONFIG_LEDS_CPU=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="rootfstype=reiserfs root=/dev/mmcblk0p1 console=ttyS0,115200n8 rootdelay=1"
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-# CONFIG_IPV6 is not set
-CONFIG_CFG80211=y
-CONFIG_MAC80211=y
-# CONFIG_STANDALONE is not set
-# CONFIG_PREVENT_FIRMWARE_BUILD is not set
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_AFS_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_DATAFLASH=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_SCSI=y
-CONFIG_BLK_DEV_SD=y
-CONFIG_CHR_DEV_SG=y
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
-CONFIG_PPP=y
-CONFIG_PPP_MULTILINK=y
-CONFIG_PPP_FILTER=y
-CONFIG_PPP_ASYNC=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_HW_RANDOM=y
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_SPI=y
-CONFIG_SPI_BITBANG=y
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-# CONFIG_VGA_CONSOLE is not set
-# CONFIG_USB_HID is not set
-CONFIG_USB=y
-CONFIG_USB_DEVICEFS=y
-# CONFIG_USB_DEVICE_CLASS is not set
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_PRINTER=y
-CONFIG_USB_STORAGE=y
-CONFIG_USB_GADGET=y
-CONFIG_MMC=y
-CONFIG_MMC_DEBUG=y
-CONFIG_MMC_AT91=m
-CONFIG_NEW_LEDS=y
-CONFIG_LEDS_CLASS=y
-CONFIG_RTC_CLASS=y
-# CONFIG_RTC_HCTOSYS is not set
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-CONFIG_REISERFS_FS=y
-CONFIG_INOTIFY=y
-CONFIG_TMPFS=y
-CONFIG_CONFIGFS_FS=y
-CONFIG_CRAMFS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=y
-CONFIG_ROOT_NFS=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_DEBUG_USER=y
-CONFIG_CRYPTO_PCBC=y
-CONFIG_CRYPTO_SHA1=y
diff --git a/arch/arm/configs/kafa_defconfig b/arch/arm/configs/kafa_defconfig
deleted file mode 100644
index 896dbe00dc6e..000000000000
--- a/arch/arm/configs/kafa_defconfig
+++ /dev/null
@@ -1,61 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_LOCALVERSION_AUTO is not set
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_KAFA=y
-# CONFIG_ARM_THUMB is not set
-CONFIG_PREEMPT=y
-CONFIG_LEDS=y
-CONFIG_LEDS_CPU=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="mem=32M console=ttyS0,115200 initrd=0x20800000,10M root=/dev/ram0 rw"
-CONFIG_FPE_NWFPE=y
-CONFIG_BINFMT_MISC=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-# CONFIG_INET_DIAG is not set
-# CONFIG_IPV6 is not set
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK_RO=y
-CONFIG_NETDEVICES=y
-CONFIG_PHYLIB=y
-CONFIG_DAVICOM_PHY=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_LEGACY_PTY_COUNT=32
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_GPIO=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=y
-# CONFIG_VGA_CONSOLE is not set
-CONFIG_RTC_CLASS=y
-# CONFIG_RTC_HCTOSYS is not set
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_FS_XATTR is not set
-CONFIG_TMPFS=y
-CONFIG_CRAMFS=y
-CONFIG_NFS_FS=m
-CONFIG_NFS_V3=y
-CONFIG_CRYPTO_MD5=y
-CONFIG_CRYPTO_DES=y
diff --git a/arch/arm/configs/kb9202_defconfig b/arch/arm/configs/kb9202_defconfig
deleted file mode 100644
index 9f906a85f5c2..000000000000
--- a/arch/arm/configs/kb9202_defconfig
+++ /dev/null
@@ -1,127 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_BSD_PROCESS_ACCT=y
-CONFIG_AUDIT=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_KALLSYMS_EXTRA_PASS=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODVERSIONS=y
-CONFIG_MODULE_SRCVERSION_ALL=y
-# CONFIG_BLK_DEV_BSG is not set
-# CONFIG_IOSCHED_DEADLINE is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_KB9200=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_PREEMPT=y
-CONFIG_AEABI=y
-CONFIG_ZBOOT_ROM_TEXT=0x10000000
-CONFIG_ZBOOT_ROM_BSS=0x20040000
-CONFIG_CMDLINE="noinitrd root=/dev/mtdblock0 rootfstype=jffs2 mem=64M"
-CONFIG_KEXEC=y
-CONFIG_FPE_NWFPE=y
-CONFIG_BINFMT_MISC=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET_XFRM_MODE_TUNNEL is not set
-# CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
-# CONFIG_INET_DIAG is not set
-# CONFIG_IPV6 is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-# CONFIG_FIRMWARE_IN_KERNEL is not set
-CONFIG_MTD=y
-CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_COMPLEX_MAPPINGS=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_NAND=y
-CONFIG_MTD_NAND_ATMEL=y
-CONFIG_MTD_UBI=y
-CONFIG_MTD_UBI_GLUEBI=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=16384
-CONFIG_ATMEL_TCLIB=y
-CONFIG_ATMEL_SSC=y
-CONFIG_SCSI=y
-CONFIG_BLK_DEV_SD=y
-CONFIG_CHR_DEV_SG=y
-CONFIG_SCSI_MULTI_LUN=y
-CONFIG_SCSI_CONSTANTS=y
-CONFIG_SCSI_LOGGING=y
-CONFIG_SCSI_SPI_ATTRS=m
-# CONFIG_SCSI_LOWLEVEL is not set
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-# CONFIG_LEGACY_PTYS is not set
-# CONFIG_HW_RANDOM is not set
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_AT91RM9200_WATCHDOG=y
-CONFIG_FB=y
-CONFIG_FB_MODE_HELPERS=y
-CONFIG_FB_TILEBLITTING=y
-CONFIG_BACKLIGHT_LCD_SUPPORT=y
-# CONFIG_LCD_CLASS_DEVICE is not set
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
-# CONFIG_BACKLIGHT_GENERIC is not set
-# CONFIG_VGA_CONSOLE is not set
-CONFIG_FRAMEBUFFER_CONSOLE=y
-CONFIG_FONTS=y
-CONFIG_FONT_MINI_4x6=y
-# CONFIG_HID_SUPPORT is not set
-CONFIG_USB=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_STORAGE=y
-CONFIG_USB_LIBUSUAL=y
-CONFIG_MMC=y
-CONFIG_MMC_AT91=m
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_DNOTIFY is not set
-CONFIG_INOTIFY=y
-CONFIG_VFAT_FS=y
-CONFIG_TMPFS=y
-CONFIG_CONFIGFS_FS=y
-CONFIG_JFFS2_FS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_ROOT_NFS=y
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_UTF8=y
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_FS=y
-CONFIG_DEBUG_KERNEL=y
-# CONFIG_SCHED_DEBUG is not set
-# CONFIG_DEBUG_PREEMPT is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
diff --git a/arch/arm/configs/onearm_defconfig b/arch/arm/configs/onearm_defconfig
deleted file mode 100644
index 1579857aeeaa..000000000000
--- a/arch/arm/configs/onearm_defconfig
+++ /dev/null
@@ -1,80 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
-CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_IOSCHED_DEADLINE is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_ONEARM=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-# CONFIG_ARM_THUMB is not set
-CONFIG_PCCARD=y
-CONFIG_AT91_CF=y
-CONFIG_LEDS=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=ttyS0,115200 root=/dev/nfs ip=bootp mem=64M"
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_BOOTP=y
-CONFIG_IPV6=y
-# CONFIG_INET6_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET6_XFRM_MODE_TUNNEL is not set
-# CONFIG_INET6_XFRM_MODE_BEET is not set
-# CONFIG_IPV6_SIT is not set
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_JEDECPROBE=y
-CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_BLK_DEV_NBD=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-# CONFIG_VT is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=y
-# CONFIG_USB_HID is not set
-CONFIG_USB=y
-CONFIG_USB_DEBUG=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_MON=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_GADGET=y
-CONFIG_MMC=y
-CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
-CONFIG_TMPFS=y
-CONFIG_CRAMFS=y
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-CONFIG_NFS_V3_ACL=y
-CONFIG_ROOT_NFS=y
-CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_USER=y
-CONFIG_DEBUG_LL=y
diff --git a/arch/arm/configs/picotux200_defconfig b/arch/arm/configs/picotux200_defconfig
deleted file mode 100644
index 4c9afa478d57..000000000000
--- a/arch/arm/configs/picotux200_defconfig
+++ /dev/null
@@ -1,242 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-CONFIG_SYSVIPC=y
-CONFIG_IKCONFIG=m
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
-# CONFIG_KALLSYMS is not set
-CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_IOSCHED_DEADLINE is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_MACH_PICOTUX2XX=y
-CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
-CONFIG_AEABI=y
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_KEXEC=y
-CONFIG_FPE_NWFPE=y
-CONFIG_BINFMT_MISC=m
-CONFIG_NET=y
-CONFIG_PACKET=m
-CONFIG_UNIX=y
-CONFIG_XFRM_USER=m
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_BOOTP=y
-CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE=m
-CONFIG_INET_AH=m
-CONFIG_INET_ESP=m
-CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
-CONFIG_INET_DIAG=m
-CONFIG_IPV6_PRIVACY=y
-CONFIG_IPV6_ROUTER_PREF=y
-CONFIG_IPV6_ROUTE_INFO=y
-CONFIG_INET6_AH=m
-CONFIG_INET6_ESP=m
-CONFIG_INET6_IPCOMP=m
-CONFIG_IPV6_MIP6=m
-CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
-CONFIG_IPV6_TUNNEL=m
-CONFIG_BRIDGE=m
-CONFIG_VLAN_8021Q=m
-CONFIG_BT=m
-CONFIG_BT_L2CAP=m
-CONFIG_BT_SCO=m
-CONFIG_BT_RFCOMM=m
-CONFIG_BT_RFCOMM_TTY=y
-CONFIG_BT_BNEP=m
-CONFIG_BT_BNEP_MC_FILTER=y
-CONFIG_BT_BNEP_PROTO_FILTER=y
-CONFIG_BT_HIDP=m
-CONFIG_FW_LOADER=m
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_EEPROM_LEGACY=m
-CONFIG_SCSI=m
-CONFIG_BLK_DEV_SD=m
-CONFIG_BLK_DEV_SR=m
-CONFIG_BLK_DEV_SR_VENDOR=y
-CONFIG_CHR_DEV_SG=m
-CONFIG_NETDEVICES=y
-CONFIG_TUN=m
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-CONFIG_USB_CATC=m
-CONFIG_USB_KAWETH=m
-CONFIG_USB_PEGASUS=m
-CONFIG_USB_RTL8150=m
-CONFIG_USB_USBNET=m
-CONFIG_USB_NET_DM9601=m
-CONFIG_USB_NET_GL620A=m
-CONFIG_USB_NET_PLUSB=m
-CONFIG_USB_NET_MCS7830=m
-CONFIG_USB_NET_RNDIS_HOST=m
-CONFIG_USB_ALI_M5632=y
-CONFIG_USB_AN2720=y
-CONFIG_USB_EPSON2888=y
-CONFIG_USB_KC2190=y
-CONFIG_PPP=m
-CONFIG_PPP_FILTER=y
-CONFIG_PPP_ASYNC=m
-CONFIG_PPP_DEFLATE=m
-CONFIG_PPP_BSDCOMP=m
-CONFIG_PPP_MPPE=m
-CONFIG_PPPOE=m
-CONFIG_SLIP=m
-CONFIG_SLIP_COMPRESSED=y
-CONFIG_SLIP_SMART=y
-CONFIG_SLIP_MODE_SLIP6=y
-# CONFIG_INPUT_MOUSEDEV is not set
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-# CONFIG_VT is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-# CONFIG_LEGACY_PTYS is not set
-CONFIG_I2C=m
-CONFIG_I2C_CHARDEV=m
-CONFIG_I2C_GPIO=m
-CONFIG_HWMON=m
-CONFIG_SENSORS_ADM1021=m
-CONFIG_SENSORS_ADM1025=m
-CONFIG_SENSORS_ADM1026=m
-CONFIG_SENSORS_ADM1029=m
-CONFIG_SENSORS_ADM1031=m
-CONFIG_SENSORS_ADM9240=m
-CONFIG_SENSORS_DS1621=m
-CONFIG_SENSORS_GL518SM=m
-CONFIG_SENSORS_GL520SM=m
-CONFIG_SENSORS_IT87=m
-CONFIG_SENSORS_LM63=m
-CONFIG_SENSORS_LM75=m
-CONFIG_SENSORS_LM77=m
-CONFIG_SENSORS_LM78=m
-CONFIG_SENSORS_LM80=m
-CONFIG_SENSORS_LM83=m
-CONFIG_SENSORS_LM85=m
-CONFIG_SENSORS_LM87=m
-CONFIG_SENSORS_LM90=m
-CONFIG_SENSORS_LM92=m
-CONFIG_SENSORS_MAX1619=m
-CONFIG_SENSORS_PCF8591=m
-CONFIG_SENSORS_SMSC47B397=m
-CONFIG_SENSORS_W83781D=m
-CONFIG_SENSORS_W83791D=m
-CONFIG_SENSORS_W83792D=m
-CONFIG_SENSORS_W83793=m
-CONFIG_SENSORS_W83L785TS=m
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_AT91RM9200_WATCHDOG=m
-CONFIG_HID=m
-CONFIG_USB=m
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_ACM=m
-CONFIG_USB_PRINTER=m
-CONFIG_USB_STORAGE=m
-CONFIG_USB_SERIAL=m
-CONFIG_USB_SERIAL_GENERIC=y
-CONFIG_USB_SERIAL_PL2303=m
-CONFIG_MMC=m
-CONFIG_MMC_AT91=m
-CONFIG_RTC_CLASS=m
-CONFIG_RTC_DRV_AT91RM9200=m
-CONFIG_EXT2_FS=m
-CONFIG_EXT3_FS=m
-# CONFIG_EXT3_FS_XATTR is not set
-CONFIG_INOTIFY=y
-CONFIG_ISO9660_FS=m
-CONFIG_JOLIET=y
-CONFIG_UDF_FS=m
-CONFIG_MSDOS_FS=m
-CONFIG_VFAT_FS=m
-CONFIG_NTFS_FS=m
-CONFIG_TMPFS=y
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_SUMMARY=y
-CONFIG_JFFS2_COMPRESSION_OPTIONS=y
-CONFIG_NFS_FS=m
-CONFIG_SMB_FS=m
-CONFIG_CIFS=m
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_AMIGA_PARTITION=y
-CONFIG_NLS_DEFAULT="utf-8"
-CONFIG_NLS_CODEPAGE_437=m
-CONFIG_NLS_CODEPAGE_737=m
-CONFIG_NLS_CODEPAGE_775=m
-CONFIG_NLS_CODEPAGE_850=m
-CONFIG_NLS_CODEPAGE_852=m
-CONFIG_NLS_CODEPAGE_855=m
-CONFIG_NLS_CODEPAGE_857=m
-CONFIG_NLS_CODEPAGE_860=m
-CONFIG_NLS_CODEPAGE_861=m
-CONFIG_NLS_CODEPAGE_862=m
-CONFIG_NLS_CODEPAGE_863=m
-CONFIG_NLS_CODEPAGE_864=m
-CONFIG_NLS_CODEPAGE_865=m
-CONFIG_NLS_CODEPAGE_866=m
-CONFIG_NLS_CODEPAGE_869=m
-CONFIG_NLS_CODEPAGE_936=m
-CONFIG_NLS_CODEPAGE_950=m
-CONFIG_NLS_CODEPAGE_932=m
-CONFIG_NLS_CODEPAGE_949=m
-CONFIG_NLS_CODEPAGE_874=m
-CONFIG_NLS_ISO8859_8=m
-CONFIG_NLS_CODEPAGE_1250=m
-CONFIG_NLS_CODEPAGE_1251=m
-CONFIG_NLS_ASCII=m
-CONFIG_NLS_ISO8859_1=m
-CONFIG_NLS_ISO8859_2=m
-CONFIG_NLS_ISO8859_3=m
-CONFIG_NLS_ISO8859_4=m
-CONFIG_NLS_ISO8859_5=m
-CONFIG_NLS_ISO8859_6=m
-CONFIG_NLS_ISO8859_7=m
-CONFIG_NLS_ISO8859_9=m
-CONFIG_NLS_ISO8859_13=m
-CONFIG_NLS_ISO8859_14=m
-CONFIG_NLS_ISO8859_15=m
-CONFIG_NLS_KOI8_R=m
-CONFIG_NLS_KOI8_U=m
-CONFIG_NLS_UTF8=m
-CONFIG_DEBUG_KERNEL=y
-# CONFIG_DEBUG_BUGVERBOSE is not set
-CONFIG_DEBUG_LL=y
-CONFIG_CRYPTO_NULL=m
-CONFIG_CRYPTO_TEST=m
-CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XCBC=m
-CONFIG_CRYPTO_MD4=m
-CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_SHA256=m
-CONFIG_CRYPTO_SHA512=m
-CONFIG_CRYPTO_TGR192=m
-CONFIG_CRYPTO_WP512=m
-CONFIG_CRYPTO_ANUBIS=m
-CONFIG_CRYPTO_BLOWFISH=m
-CONFIG_CRYPTO_CAMELLIA=m
-CONFIG_CRYPTO_CAST5=m
-CONFIG_CRYPTO_CAST6=m
-CONFIG_CRYPTO_FCRYPT=m
-CONFIG_CRYPTO_KHAZAD=m
-CONFIG_CRYPTO_SERPENT=m
-CONFIG_CRYPTO_TEA=m
-CONFIG_CRYPTO_TWOFISH=m
-CONFIG_LIBCRC32C=m
diff --git a/arch/arm/configs/yl9200_defconfig b/arch/arm/configs/yl9200_defconfig
deleted file mode 100644
index 30c537f61089..000000000000
--- a/arch/arm/configs/yl9200_defconfig
+++ /dev/null
@@ -1,137 +0,0 @@
-# CONFIG_SWAP is not set
-CONFIG_SYSVIPC=y
-CONFIG_LOG_BUF_SHIFT=14
-CONFIG_BLK_DEV_INITRD=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-# CONFIG_IOSCHED_DEADLINE is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_AT91=y
-CONFIG_ARCH_AT91RM9200DK=y
-CONFIG_MACH_YL9200=y
-# CONFIG_ARM_THUMB is not set
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="mem=32M console=ttyS0,115200 initrd=0x20410000,3145728 root=/dev/ram0 rw"
-CONFIG_FPE_NWFPE=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET_XFRM_MODE_TUNNEL is not set
-# CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
-# CONFIG_INET_DIAG is not set
-# CONFIG_IPV6 is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_MTD=y
-CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_JEDECPROBE=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_COMPLEX_MAPPINGS=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PLATRAM=y
-CONFIG_MTD_NAND=y
-CONFIG_MTD_NAND_ATMEL=y
-CONFIG_MTD_NAND_PLATFORM=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_COUNT=3
-CONFIG_BLK_DEV_RAM_SIZE=8192
-# CONFIG_MISC_DEVICES is not set
-CONFIG_BLK_DEV_SD=y
-CONFIG_ATA=y
-CONFIG_NETDEVICES=y
-CONFIG_PHYLIB=y
-CONFIG_DAVICOM_PHY=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-CONFIG_INPUT_MOUSEDEV_SCREEN_X=640
-CONFIG_INPUT_MOUSEDEV_SCREEN_Y=480
-CONFIG_INPUT_EVDEV=y
-# CONFIG_KEYBOARD_ATKBD is not set
-CONFIG_KEYBOARD_GPIO=y
-CONFIG_INPUT_TOUCHSCREEN=y
-CONFIG_TOUCHSCREEN_ADS7846=y
-# CONFIG_SERIO_SERPORT is not set
-CONFIG_SERIAL_ATMEL=y
-CONFIG_SERIAL_ATMEL_CONSOLE=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_I2C=y
-CONFIG_SPI=y
-CONFIG_SPI_DEBUG=y
-CONFIG_SPI_ATMEL=y
-CONFIG_FB=y
-CONFIG_BACKLIGHT_LCD_SUPPORT=y
-CONFIG_LCD_CLASS_DEVICE=y
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
-CONFIG_DISPLAY_SUPPORT=y
-# CONFIG_VGA_CONSOLE is not set
-CONFIG_LOGO=y
-# CONFIG_LOGO_LINUX_MONO is not set
-# CONFIG_LOGO_LINUX_VGA16 is not set
-CONFIG_USB=y
-CONFIG_USB_DEBUG=y
-CONFIG_USB_DEVICEFS=y
-# CONFIG_USB_DEVICE_CLASS is not set
-CONFIG_USB_MON=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_STORAGE=y
-CONFIG_USB_GADGET=y
-CONFIG_USB_GADGET_M66592=y
-CONFIG_USB_FILE_STORAGE=m
-CONFIG_MMC=y
-CONFIG_MMC_DEBUG=y
-# CONFIG_MMC_BLOCK_BOUNCE is not set
-CONFIG_MMC_AT91=m
-CONFIG_NEW_LEDS=y
-CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_GPIO=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_LEDS_TRIGGER_TIMER=y
-CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_AT91RM9200=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_XATTR=y
-CONFIG_EXT3_FS=y
-CONFIG_REISERFS_FS=y
-CONFIG_INOTIFY=y
-CONFIG_ISO9660_FS=y
-CONFIG_JOLIET=y
-CONFIG_ZISOFS=y
-CONFIG_UDF_FS=y
-CONFIG_MSDOS_FS=y
-CONFIG_VFAT_FS=y
-CONFIG_TMPFS=y
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_FS_DEBUG=1
-CONFIG_JFFS2_COMPRESSION_OPTIONS=y
-CONFIG_JFFS2_RUBIN=y
-CONFIG_CRAMFS=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_MAC_PARTITION=y
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_ISO8859_1=y
-# CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_DEBUG_FS=y
-CONFIG_DEBUG_KERNEL=y
-CONFIG_SLUB_DEBUG_ON=y
-CONFIG_DEBUG_KOBJECT=y
-CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_LIST=y
-CONFIG_DEBUG_USER=y
-CONFIG_DEBUG_ERRORS=y
-CONFIG_DEBUG_LL=y
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 062b58c029ab..749bb6622404 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -238,7 +238,7 @@
        @ Slightly optimised to avoid incrementing the pointer twice
        usraccoff \instr, \reg, \ptr, \inc, 0, \cond, \abort
        .if     \rept == 2
-        usraccoff \instr, \reg, \ptr, \inc, 4, \cond, \abort
+        usraccoff \instr, \reg, \ptr, \inc, \inc, \cond, \abort
        .endif
        add\cond \ptr, #\rept * \inc
diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
index 68870c776671..b4ffe9d5b526 100644
--- a/arch/arm/include/asm/mmu.h
+++ b/arch/arm/include/asm/mmu.h
@@ -13,6 +13,10 @@ typedef struct {
 #ifdef CONFIG_CPU_HAS_ASID
 #define ASID(mm)        ((mm)->context.id & 255)
+/* init_mm.context.id_lock should be initialized. */
+#define INIT_MM_CONTEXT(name)                                                 \
+        .context.id_lock    = __SPIN_LOCK_UNLOCKED(name.context.id_lock),
 #else
 #define ASID(mm)        (0)
 #endif
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index b155414192da..53d1d5deb111 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -374,6 +374,9 @@ static inline pte_t *pmd_page_vaddr(pmd_t pmd)
 #define pmd_page(pmd)           pfn_to_page(__phys_to_pfn(pmd_val(pmd)))
+/* we don't need complex calculations here as the pmd is folded into the pgd */
+#define pmd_addr_end(addr,end)  (end)
 /*
 * Conversion functions: convert a page and protection to a page entry,
 * and a page entry and page directory to the page they refer to.
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index c09e3573c5de..bb96a7d4bbf5 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -911,7 +911,7 @@ __kuser_cmpxchg:				@ 0xffff0fc0
         * A special ghost syscall is used for that (see traps.c).
         */
        stmfd   sp!, {r7, lr}
-        ldr     r7, =1f                 @ it's 20 bits
+        ldr     r7, 1f                  @ it's 20 bits
        swi     __ARM_NR_cmpxchg
        ldmfd   sp!, {r7, pc}
 1:      .word   __ARM_NR_cmpxchg
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index dd6b369ac69c..6bd82d25683c 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -85,9 +85,11 @@ ENTRY(stext)
        mrc     p15, 0, r9, c0, c0              @ get processor id
        bl      __lookup_processor_type         @ r5=procinfo r9=cpuid
        movs    r10, r5                         @ invalid processor (r5=0)?
+ THUMB( it      eq )            @ force fixup-able long branch encoding
        beq     __error_p                       @ yes, error 'p'
        bl      __lookup_machine_type           @ r5=machinfo
        movs    r8, r5                          @ invalid machine (r5=0)?
+ THUMB( it      eq )            @ force fixup-able long branch encoding
        beq     __error_a                       @ yes, error 'a'
        bl      __vet_atags
 #ifdef CONFIG_SMP_ON_UP
@@ -262,6 +264,7 @@ __create_page_tables:
        mov     pc, lr
 ENDPROC(__create_page_tables)
        .ltorg
+        .align
 __enable_mmu_loc:
        .long   .
        .long   __enable_mmu
@@ -282,6 +285,7 @@ ENTRY(secondary_startup)
        bl      __lookup_processor_type
        movs    r10, r5                         @ invalid processor?
        moveq   r0, #'p'                        @ yes, error 'p'
+ THUMB( it      eq )            @ force fixup-able long branch encoding
        beq     __error_p
        /*
@@ -308,6 +312,8 @@ ENTRY(__secondary_switched)
        b       secondary_start_kernel
 ENDPROC(__secondary_switched)
+        .align
        .type   __secondary_data, %object
 __secondary_data:
        .long   .
@@ -413,6 +419,7 @@ __fixup_smp_on_up:
        mov     pc, lr
 ENDPROC(__fixup_smp)
+        .align
 1:      .word   .
        .word   __smpalt_begin
        .word   __smpalt_end
diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
index fd26f8d65151..9cf4cbf8f95b 100644
--- a/arch/arm/kernel/relocate_kernel.S
+++ b/arch/arm/kernel/relocate_kernel.S
@@ -59,6 +59,8 @@ relocate_new_kernel:
        ldr r2,kexec_boot_atags
        mov pc,lr
+        .align
        .globl kexec_start_address
 kexec_start_address:
        .long   0x0
diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S
index 1e4cbd4e7be9..64f6bc1a9132 100644
--- a/arch/arm/lib/findbit.S
+++ b/arch/arm/lib/findbit.S
@@ -174,8 +174,8 @@ ENDPROC(_find_next_bit_be)
 */
 .L_found:
 #if __LINUX_ARM_ARCH__ >= 5
-                rsb     r1, r3, #0
+                rsb     r0, r3, #0
-                and     r3, r3, r1
+                and     r3, r3, r0
                clz     r3, r3
                rsb     r3, r3, #31
                add     r0, r2, r3
@@ -190,5 +190,7 @@ ENDPROC(_find_next_bit_be)
                addeq   r2, r2, #1
                mov     r0, r2
 #endif
+                cmp     r1, r0                  @ Clamp to maxbit
+                movlo   r0, r1
                mov     pc, lr
diff --git a/arch/arm/mach-aaec2000/include/mach/vmalloc.h b/arch/arm/mach-aaec2000/include/mach/vmalloc.h
index cff4e0a996ce..a6299e8321bd 100644
--- a/arch/arm/mach-aaec2000/include/mach/vmalloc.h
+++ b/arch/arm/mach-aaec2000/include/mach/vmalloc.h
@@ -11,6 +11,6 @@
 #ifndef __ASM_ARCH_VMALLOC_H
 #define __ASM_ARCH_VMALLOC_H
-#define VMALLOC_END             0xd0000000
+#define VMALLOC_END             0xd0000000UL
 #endif /* __ASM_ARCH_VMALLOC_H */
diff --git a/arch/arm/mach-at91/Makefile b/arch/arm/mach-at91/Makefile
index 821eb842795f..62d686f0b426 100644
--- a/arch/arm/mach-at91/Makefile
+++ b/arch/arm/mach-at91/Makefile
@@ -24,8 +24,8 @@ obj-$(CONFIG_ARCH_AT91X40)	+= at91x40.o at91x40_time.o
 # AT91RM9200 board-specific support
 obj-$(CONFIG_MACH_ONEARM)       += board-1arm.o
-obj-$(CONFIG_ARCH_AT91RM9200DK) += board-dk.o
+obj-$(CONFIG_ARCH_AT91RM9200DK) += board-rm9200dk.o
-obj-$(CONFIG_MACH_AT91RM9200EK) += board-ek.o
+obj-$(CONFIG_MACH_AT91RM9200EK) += board-rm9200ek.o
 obj-$(CONFIG_MACH_CSB337)       += board-csb337.o
 obj-$(CONFIG_MACH_CSB637)       += board-csb637.o
 obj-$(CONFIG_MACH_CARMEVA)      += board-carmeva.o
diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
index 9338825cfcd7..7b539228e0ef 100644
--- a/arch/arm/mach-at91/at91rm9200_devices.c
+++ b/arch/arm/mach-at91/at91rm9200_devices.c
@@ -1106,51 +1106,6 @@ static inline void configure_usart3_pins(unsigned pins)
 static struct platform_device *__initdata at91_uarts[ATMEL_MAX_UART];   /* the UARTs to use */
 struct platform_device *atmel_default_console_device;   /* the serial console device */
-void __init __deprecated at91_init_serial(struct at91_uart_config *config)
-{
-        int i;
-        /* Fill in list of supported UARTs */
-        for (i = 0; i < config->nr_tty; i++) {
-                switch (config->tty_map[i]) {
-                        case 0:
-                                configure_usart0_pins(ATMEL_UART_CTS | ATMEL_UART_RTS);
-                                at91_uarts[i] = &at91rm9200_uart0_device;
-                                at91_clock_associate("usart0_clk", &at91rm9200_uart0_device.dev, "usart");
-                                break;
-                        case 1:
-                                configure_usart1_pins(ATMEL_UART_CTS | ATMEL_UART_RTS | ATMEL_UART_DSR | ATMEL_UART_DTR | ATMEL_UART_DCD | ATMEL_UART_RI);
-                                at91_uarts[i] = &at91rm9200_uart1_device;
-                                at91_clock_associate("usart1_clk", &at91rm9200_uart1_device.dev, "usart");
-                                break;
-                        case 2:
-                                configure_usart2_pins(0);
-                                at91_uarts[i] = &at91rm9200_uart2_device;
-                                at91_clock_associate("usart2_clk", &at91rm9200_uart2_device.dev, "usart");
-                                break;
-                        case 3:
-                                configure_usart3_pins(0);
-                                at91_uarts[i] = &at91rm9200_uart3_device;
-                                at91_clock_associate("usart3_clk", &at91rm9200_uart3_device.dev, "usart");
-                                break;
-                        case 4:
-                                configure_dbgu_pins();
-                                at91_uarts[i] = &at91rm9200_dbgu_device;
-                                at91_clock_associate("mck", &at91rm9200_dbgu_device.dev, "usart");
-                                break;
-                        default:
-                                continue;
-                }
-                at91_uarts[i]->id = i;          /* update ID number to mapped ID */
-        }
-        /* Set serial console device */
-        if (config->console_tty < ATMEL_MAX_UART)
-                atmel_default_console_device = at91_uarts[config->console_tty];
-        if (!atmel_default_console_device)
-                printk(KERN_INFO "AT91: No default serial console defined.\n");
-}
 void __init at91_register_uart(unsigned id, unsigned portnr, unsigned pins)
 {
        struct platform_device *pdev;
diff --git a/arch/arm/mach-at91/board-1arm.c b/arch/arm/mach-at91/board-1arm.c
index 46bdc82d3fbf..8a3fc84847c1 100644
--- a/arch/arm/mach-at91/board-1arm.c
+++ b/arch/arm/mach-at91/board-1arm.c
@@ -39,24 +39,24 @@
 #include "generic.h"
-/*
- * Serial port configuration.
- *    0 .. 3 = USART0 .. USART3
- *    4      = DBGU
- */
-static struct at91_uart_config __initdata onearm_uart_config = {
-        .console_tty    = 0,                            /* ttyS0 */
-        .nr_tty         = 3,
-        .tty_map        = { 4, 0, 1, -1, -1 },          /* ttyS0, ..., ttyS4 */
-};
 static void __init onearm_map_io(void)
 {
        /* Initialize processor: 18.432 MHz crystal */
        at91rm9200_initialize(18432000, AT91RM9200_PQFP);
-        /* Setup the serial ports and console */
+        /* DBGU on ttyS0. (Rx & Tx only) */
-        at91_init_serial(&onearm_uart_config);
+        at91_register_uart(0, 0, 0);
+        /* USART0 on ttyS1 (Rx, Tx, CTS, RTS) */
+        at91_register_uart(AT91RM9200_ID_US0, 1, ATMEL_UART_CTS | ATMEL_UART_RTS);
+        /* USART1 on ttyS2 (Rx, Tx, CTS, RTS, DTR, DSR, DCD, RI) */
+        at91_register_uart(AT91RM9200_ID_US1, 2, ATMEL_UART_CTS | ATMEL_UART_RTS
+                           | ATMEL_UART_DTR | ATMEL_UART_DSR | ATMEL_UART_DCD
+                           | ATMEL_UART_RI);
+        /* set serial console to ttyS0 (ie, DBGU) */
+        at91_set_serial_console(0);
 }
 static void __init onearm_init_irq(void)
diff --git a/arch/arm/mach-at91/board-kafa.c b/arch/arm/mach-at91/board-kafa.c
index c0ce79d431a0..d2e1f4ec1fcc 100644
--- a/arch/arm/mach-at91/board-kafa.c
+++ b/arch/arm/mach-at91/board-kafa.c
@@ -39,17 +39,6 @@
 #include "generic.h"
-/*
- * Serial port configuration.
- *    0 .. 3 = USART0 .. USART3
- *    4      = DBGU
- */
-static struct at91_uart_config __initdata kafa_uart_config = {
-        .console_tty    = 0,                            /* ttyS0 */
-        .nr_tty         = 2,
-        .tty_map        = { 4, 0, -1, -1, -1 }          /* ttyS0, ..., ttyS4 */
-};
 static void __init kafa_map_io(void)
 {
        /* Initialize processor: 18.432 MHz crystal */
@@ -58,8 +47,14 @@ static void __init kafa_map_io(void)
        /* Set up the LEDs */
        at91_init_leds(AT91_PIN_PB4, AT91_PIN_PB4);
-        /* Setup the serial ports and console */
+        /* DBGU on ttyS0. (Rx & Tx only) */
-        at91_init_serial(&kafa_uart_config);
+        at91_register_uart(0, 0, 0);
+        /* USART0 on ttyS1 (Rx, Tx, CTS, RTS) */
+        at91_register_uart(AT91RM9200_ID_US0, 1, ATMEL_UART_CTS | ATMEL_UART_RTS);
+        /* set serial console to ttyS0 (ie, DBGU) */
+        at91_set_serial_console(0);
 }
 static void __init kafa_init_irq(void)
diff --git a/arch/arm/mach-at91/board-picotux200.c b/arch/arm/mach-at91/board-picotux200.c
index 9d833bbc592d..55dad3a46547 100644
--- a/arch/arm/mach-at91/board-picotux200.c
+++ b/arch/arm/mach-at91/board-picotux200.c
@@ -43,24 +43,21 @@
 #include "generic.h"
-/*
- * Serial port configuration.
- *    0 .. 3 = USART0 .. USART3
- *    4      = DBGU
- */
-static struct at91_uart_config __initdata picotux200_uart_config = {
-        .console_tty    = 0,                            /* ttyS0 */
-        .nr_tty         = 2,
-        .tty_map        = { 4, 1, -1, -1, -1 }          /* ttyS0, ..., ttyS4 */
-};
 static void __init picotux200_map_io(void)
 {
        /* Initialize processor: 18.432 MHz crystal */
        at91rm9200_initialize(18432000, AT91RM9200_BGA);
-        /* Setup the serial ports and console */
+        /* DBGU on ttyS0. (Rx & Tx only) */
-        at91_init_serial(&picotux200_uart_config);
+        at91_register_uart(0, 0, 0);
+        /* USART1 on ttyS1. (Rx, Tx, CTS, RTS, DTR, DSR, DCD, RI) */
+        at91_register_uart(AT91RM9200_ID_US1, 1, ATMEL_UART_CTS | ATMEL_UART_RTS
+                          | ATMEL_UART_DTR | ATMEL_UART_DSR | ATMEL_UART_DCD
+                          | ATMEL_UART_RI);
+        /* set serial console to ttyS0 (ie, DBGU) */
+        at91_set_serial_console(0);
 }
 static void __init picotux200_init_irq(void)
@@ -77,11 +74,6 @@ static struct at91_usbh_data __initdata picotux200_usbh_data = {
        .ports          = 1,
 };
-// static struct at91_udc_data __initdata picotux200_udc_data = {
-//      .vbus_pin       = AT91_PIN_PD4,
-//      .pullup_pin     = AT91_PIN_PD5,
-// };
 static struct at91_mmc_data __initdata picotux200_mmc_data = {
        .det_pin        = AT91_PIN_PB27,
        .slot_b         = 0,
@@ -89,21 +81,6 @@ static struct at91_mmc_data __initdata picotux200_mmc_data = {
        .wp_pin         = AT91_PIN_PA17,
 };
-// static struct spi_board_info picotux200_spi_devices[] = {
-//      {       /* DataFlash chip */
-//              .modalias       = "mtd_dataflash",
-//              .chip_select    = 0,
-//              .max_speed_hz   = 15 * 1000 * 1000,
-//      },
-// #ifdef CONFIG_MTD_AT91_DATAFLASH_CARD
-//      {       /* DataFlash card */
-//              .modalias       = "mtd_dataflash",
-//              .chip_select    = 3,
-//              .max_speed_hz   = 15 * 1000 * 1000,
-//      },
-// #endif
-// };
 #define PICOTUX200_FLASH_BASE   AT91_CHIPSELECT_0
 #define PICOTUX200_FLASH_SIZE   SZ_4M
@@ -135,21 +112,11 @@ static void __init picotux200_board_init(void)
        at91_add_device_eth(&picotux200_eth_data);
        /* USB Host */
        at91_add_device_usbh(&picotux200_usbh_data);
-        /* USB Device */
-        // at91_add_device_udc(&picotux200_udc_data);
-        // at91_set_multi_drive(picotux200_udc_data.pullup_pin, 1);     /* pullup_pin is connected to reset */
        /* I2C */
        at91_add_device_i2c(NULL, 0);
-        /* SPI */
-        // at91_add_device_spi(picotux200_spi_devices, ARRAY_SIZE(picotux200_spi_devices));
-#ifdef CONFIG_MTD_AT91_DATAFLASH_CARD
-        /* DataFlash card */
-        at91_set_gpio_output(AT91_PIN_PB22, 0);
-#else
        /* MMC */
        at91_set_gpio_output(AT91_PIN_PB22, 1); /* this MMC card slot can optionally use SPI signaling (CS3). */
        at91_add_device_mmc(0, &picotux200_mmc_data);
-#endif
        /* NOR Flash */
        platform_device_register(&picotux200_flash);
 }
diff --git a/arch/arm/mach-at91/board-dk.c b/arch/arm/mach-at91/board-rm9200dk.c
index e14f0e165680..4c1047c8200d 100644
--- a/arch/arm/mach-at91/board-dk.c
+++ b/arch/arm/mach-at91/board-rm9200dk.c
@@ -1,5 +1,5 @@
 /*
- * linux/arch/arm/mach-at91/board-dk.c
+ * linux/arch/arm/mach-at91/board-rm9200dk.c
 *
 *  Copyright (C) 2005 SAN People
 *
@@ -91,10 +91,12 @@ static struct at91_cf_data __initdata dk_cf_data = {
        // .vcc_pin     = ... always powered
 };
+#ifndef CONFIG_MTD_AT91_DATAFLASH_CARD
 static struct at91_mmc_data __initdata dk_mmc_data = {
        .slot_b         = 0,
        .wire4          = 1,
 };
+#endif
 static struct spi_board_info dk_spi_devices[] = {
        {       /* DataFlash chip */
diff --git a/arch/arm/mach-at91/board-ek.c b/arch/arm/mach-at91/board-rm9200ek.c
index 56e92c4bbc2a..9df1be8818c0 100644
--- a/arch/arm/mach-at91/board-ek.c
+++ b/arch/arm/mach-at91/board-rm9200ek.c
@@ -1,5 +1,5 @@
 /*
- * linux/arch/arm/mach-at91/board-ek.c
+ * linux/arch/arm/mach-at91/board-rm9200ek.c
 *
 *  Copyright (C) 2005 SAN People
 *
@@ -84,12 +84,14 @@ static struct at91_udc_data __initdata ek_udc_data = {
        .pullup_pin     = AT91_PIN_PD5,
 };
+#ifndef CONFIG_MTD_AT91_DATAFLASH_CARD
 static struct at91_mmc_data __initdata ek_mmc_data = {
        .det_pin        = AT91_PIN_PB27,
        .slot_b         = 0,
        .wire4          = 1,
        .wp_pin         = AT91_PIN_PA17,
 };
+#endif
 static struct spi_board_info ek_spi_devices[] = {
        {       /* DataFlash chip */
diff --git a/arch/arm/mach-at91/board-yl-9200.c b/arch/arm/mach-at91/board-yl-9200.c
index 89df00a9d2f7..e0f0080eb639 100644
--- a/arch/arm/mach-at91/board-yl-9200.c
+++ b/arch/arm/mach-at91/board-yl-9200.c
@@ -387,7 +387,7 @@ static struct spi_board_info yl9200_spi_devices[] = {
 * EPSON S1D13806 FB (discontinued chip)
 * EPSON S1D13506 FB
 */
-#if defined(CONFIG_FB_S1D135XX) || defined(CONFIG_FB_S1D13XXX_MODULE)
+#if defined(CONFIG_FB_S1D13XXX) || defined(CONFIG_FB_S1D13XXX_MODULE)
 #include <video/s1d13xxxfb.h>
diff --git a/arch/arm/mach-at91/include/mach/board.h b/arch/arm/mach-at91/include/mach/board.h
index 58528aa9c8a8..2b499eb343a1 100644
--- a/arch/arm/mach-at91/include/mach/board.h
+++ b/arch/arm/mach-at91/include/mach/board.h
@@ -137,13 +137,7 @@ extern void __init at91_add_device_spi(struct spi_board_info *devices, int nr_de
 extern void __init at91_register_uart(unsigned id, unsigned portnr, unsigned pins);
 extern void __init at91_set_serial_console(unsigned portnr);
-struct at91_uart_config {
-        unsigned short  console_tty;    /* tty number of serial console */
-        unsigned short  nr_tty;         /* number of serial tty's */
-        short           tty_map[];      /* map UART to tty number */
-};
 extern struct platform_device *atmel_default_console_device;
-extern void __init __deprecated at91_init_serial(struct at91_uart_config *config);
 struct atmel_uart_data {
        short                   use_dma_tx;     /* use transmit DMA? */
diff --git a/arch/arm/mach-bcmring/include/mach/vmalloc.h b/arch/arm/mach-bcmring/include/mach/vmalloc.h
index 3db3a09fd398..7397bd7817d9 100644
--- a/arch/arm/mach-bcmring/include/mach/vmalloc.h
+++ b/arch/arm/mach-bcmring/include/mach/vmalloc.h
@@ -22,4 +22,4 @@
 * 0xe0000000 to 0xefffffff. This gives us 256 MB of vm space and handles
 * larger physical memory designs better.
 */
-#define VMALLOC_END       0xf0000000
+#define VMALLOC_END       0xf0000000UL
diff --git a/arch/arm/mach-clps711x/include/mach/vmalloc.h b/arch/arm/mach-clps711x/include/mach/vmalloc.h
index 30b3a287ed88..467b96137e47 100644
--- a/arch/arm/mach-clps711x/include/mach/vmalloc.h
+++ b/arch/arm/mach-clps711x/include/mach/vmalloc.h
@@ -17,4 +17,4 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
-#define VMALLOC_END       0xd0000000
+#define VMALLOC_END       0xd0000000UL
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 38088c36936c..78defd71a829 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -369,7 +369,7 @@ static int __init cns3xxx_pcie_init(void)
 {
        int i;
-        hook_fault_code(16 + 6, cns3xxx_pcie_abort_handler, SIGBUS,
+        hook_fault_code(16 + 6, cns3xxx_pcie_abort_handler, SIGBUS, 0,
                        "imprecise external abort");
        for (i = 0; i < ARRAY_SIZE(cns3xxx_pcie); i++) {
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index 9be261beae7d..2652af124acd 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -359,8 +359,8 @@ static struct clk_lookup dm355_clks[] = {
        CLK(NULL, "uart1", &uart1_clk),
        CLK(NULL, "uart2", &uart2_clk),
        CLK("i2c_davinci.1", NULL, &i2c_clk),
-        CLK("davinci-asp.0", NULL, &asp0_clk),
+        CLK("davinci-mcbsp.0", NULL, &asp0_clk),
-        CLK("davinci-asp.1", NULL, &asp1_clk),
+        CLK("davinci-mcbsp.1", NULL, &asp1_clk),
        CLK("davinci_mmc.0", NULL, &mmcsd0_clk),
        CLK("davinci_mmc.1", NULL, &mmcsd1_clk),
        CLK("spi_davinci.0", NULL, &spi0_clk),
@@ -664,7 +664,7 @@ static struct resource dm355_asp1_resources[] = {
 };
 static struct platform_device dm355_asp1_device = {
-        .name           = "davinci-asp",
+        .name           = "davinci-mcbsp",
        .id             = 1,
        .num_resources  = ARRAY_SIZE(dm355_asp1_resources),
        .resource       = dm355_asp1_resources,
diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
index a12065e87266..c466d710d3c1 100644
--- a/arch/arm/mach-davinci/dm365.c
+++ b/arch/arm/mach-davinci/dm365.c
@@ -459,7 +459,7 @@ static struct clk_lookup dm365_clks[] = {
        CLK(NULL, "usb", &usb_clk),
        CLK("davinci_emac.1", NULL, &emac_clk),
        CLK("davinci_voicecodec", NULL, &voicecodec_clk),
-        CLK("davinci-asp.0", NULL, &asp0_clk),
+        CLK("davinci-mcbsp", NULL, &asp0_clk),
        CLK(NULL, "rto", &rto_clk),
        CLK(NULL, "mjcp", &mjcp_clk),
        CLK(NULL, NULL, NULL),
@@ -922,8 +922,8 @@ static struct resource dm365_asp_resources[] = {
 };
 static struct platform_device dm365_asp_device = {
-        .name           = "davinci-asp",
+        .name           = "davinci-mcbsp",
-        .id             = 0,
+        .id             = -1,
        .num_resources  = ARRAY_SIZE(dm365_asp_resources),
        .resource       = dm365_asp_resources,
 };
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 0608dd776a16..9a2376b3137c 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -302,7 +302,7 @@ static struct clk_lookup dm644x_clks[] = {
        CLK("davinci_emac.1", NULL, &emac_clk),
        CLK("i2c_davinci.1", NULL, &i2c_clk),
        CLK("palm_bk3710", NULL, &ide_clk),
-        CLK("davinci-asp", NULL, &asp_clk),
+        CLK("davinci-mcbsp", NULL, &asp_clk),
        CLK("davinci_mmc.0", NULL, &mmcsd_clk),
        CLK(NULL, "spi", &spi_clk),
        CLK(NULL, "gpio", &gpio_clk),
@@ -580,7 +580,7 @@ static struct resource dm644x_asp_resources[] = {
 };
 static struct platform_device dm644x_asp_device = {
-        .name           = "davinci-asp",
+        .name           = "davinci-mcbsp",
        .id             = -1,
        .num_resources  = ARRAY_SIZE(dm644x_asp_resources),
        .resource       = dm644x_asp_resources,
diff --git a/arch/arm/mach-ebsa110/include/mach/vmalloc.h b/arch/arm/mach-ebsa110/include/mach/vmalloc.h
index 60bde56fba4c..ea141b7a3e03 100644
--- a/arch/arm/mach-ebsa110/include/mach/vmalloc.h
+++ b/arch/arm/mach-ebsa110/include/mach/vmalloc.h
@@ -7,4 +7,4 @@
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
-#define VMALLOC_END       0xdf000000
+#define VMALLOC_END       0xdf000000UL
diff --git a/arch/arm/mach-footbridge/include/mach/vmalloc.h b/arch/arm/mach-footbridge/include/mach/vmalloc.h
index 0ffbb7c85e59..40ba78e5782b 100644
--- a/arch/arm/mach-footbridge/include/mach/vmalloc.h
+++ b/arch/arm/mach-footbridge/include/mach/vmalloc.h
@@ -7,4 +7,4 @@
 */
-#define VMALLOC_END       0xf0000000
+#define VMALLOC_END       0xf0000000UL
diff --git a/arch/arm/mach-h720x/include/mach/vmalloc.h b/arch/arm/mach-h720x/include/mach/vmalloc.h
index a45915b88756..8520b4a4d4e6 100644
--- a/arch/arm/mach-h720x/include/mach/vmalloc.h
+++ b/arch/arm/mach-h720x/include/mach/vmalloc.h
@@ -5,6 +5,6 @@
 #ifndef __ARCH_ARM_VMALLOC_H
 #define __ARCH_ARM_VMALLOC_H
-#define VMALLOC_END       0xd0000000
+#define VMALLOC_END       0xd0000000UL
 #endif
diff --git a/arch/arm/mach-imx/eukrea_mbimx27-baseboard.c b/arch/arm/mach-imx/eukrea_mbimx27-baseboard.c
index 026263c665ca..7e1e9dc2c8fc 100644
--- a/arch/arm/mach-imx/eukrea_mbimx27-baseboard.c
+++ b/arch/arm/mach-imx/eukrea_mbimx27-baseboard.c
@@ -250,9 +250,6 @@ static const struct imxuart_platform_data uart_pdata __initconst = {
        .flags = IMXUART_HAVE_RTSCTS,
 };
-#if defined(CONFIG_TOUCHSCREEN_ADS7846) \
-        || defined(CONFIG_TOUCHSCREEN_ADS7846_MODULE)
 #define ADS7846_PENDOWN (GPIO_PORTD | 25)
 static void ads7846_dev_init(void)
@@ -273,9 +270,7 @@ static struct ads7846_platform_data ads7846_config __initdata = {
        .get_pendown_state      = ads7846_get_pendown_state,
        .keep_vref_on           = 1,
 };
-#endif
-#if defined(CONFIG_SPI_IMX) || defined(CONFIG_SPI_IMX_MODULE)
 static struct spi_board_info eukrea_mbimx27_spi_board_info[] __initdata = {
        [0] = {
                .modalias       = "ads7846",
@@ -294,7 +289,6 @@ static const struct spi_imx_master eukrea_mbimx27_spi0_data __initconst = {
        .chipselect     = eukrea_mbimx27_spi_cs,
        .num_chipselect = ARRAY_SIZE(eukrea_mbimx27_spi_cs),
 };
-#endif
 static struct i2c_board_info eukrea_mbimx27_i2c_devices[] = {
        {
diff --git a/arch/arm/mach-integrator/include/mach/vmalloc.h b/arch/arm/mach-integrator/include/mach/vmalloc.h
index e056e7cf5645..2f5a2bafb11f 100644
--- a/arch/arm/mach-integrator/include/mach/vmalloc.h
+++ b/arch/arm/mach-integrator/include/mach/vmalloc.h
@@ -17,4 +17,4 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
-#define VMALLOC_END       0xd0000000
+#define VMALLOC_END       0xd0000000UL
diff --git a/arch/arm/mach-msm/include/mach/vmalloc.h b/arch/arm/mach-msm/include/mach/vmalloc.h
index 31a32ad062dc..d138448eff16 100644
--- a/arch/arm/mach-msm/include/mach/vmalloc.h
+++ b/arch/arm/mach-msm/include/mach/vmalloc.h
@@ -16,7 +16,7 @@
 #ifndef __ASM_ARCH_MSM_VMALLOC_H
 #define __ASM_ARCH_MSM_VMALLOC_H
-#define VMALLOC_END       0xd0000000
+#define VMALLOC_END       0xd0000000UL
 #endif
diff --git a/arch/arm/mach-mx25/devices-imx25.h b/arch/arm/mach-mx25/devices-imx25.h
index 93afa10b13cf..d94d282fa676 100644
--- a/arch/arm/mach-mx25/devices-imx25.h
+++ b/arch/arm/mach-mx25/devices-imx25.h
@@ -42,9 +42,9 @@ extern const struct imx_mxc_nand_data imx25_mxc_nand_data __initconst;
 #define imx25_add_mxc_nand(pdata)       \
        imx_add_mxc_nand(&imx25_mxc_nand_data, pdata)
-extern const struct imx_spi_imx_data imx25_spi_imx_data[] __initconst;
+extern const struct imx_spi_imx_data imx25_cspi_data[] __initconst;
 #define imx25_add_spi_imx(id, pdata)    \
-        imx_add_spi_imx(&imx25_spi_imx_data[id], pdata)
+        imx_add_spi_imx(&imx25_cspi_data[id], pdata)
 #define imx25_add_spi_imx0(pdata)       imx25_add_spi_imx(0, pdata)
 #define imx25_add_spi_imx1(pdata)       imx25_add_spi_imx(1, pdata)
 #define imx25_add_spi_imx2(pdata)       imx25_add_spi_imx(2, pdata)
diff --git a/arch/arm/mach-mx3/mach-pcm037_eet.c b/arch/arm/mach-mx3/mach-pcm037_eet.c
index 99e0894e07db..fda56545d2fd 100644
--- a/arch/arm/mach-mx3/mach-pcm037_eet.c
+++ b/arch/arm/mach-mx3/mach-pcm037_eet.c
@@ -14,6 +14,7 @@
 #include <mach/common.h>
 #include <mach/iomux-mx3.h>
+#include <mach/spi.h>
 #include <asm/mach-types.h>
@@ -59,14 +60,12 @@ static struct spi_board_info pcm037_spi_dev[] = {
 };
 /* Platform Data for MXC CSPI */
-#if defined(CONFIG_SPI_IMX) || defined(CONFIG_SPI_IMX_MODULE)
 static int pcm037_spi1_cs[] = {MXC_SPI_CS(1), IOMUX_TO_GPIO(MX31_PIN_KEY_COL7)};
 static const struct spi_imx_master pcm037_spi1_pdata __initconst = {
        .chipselect = pcm037_spi1_cs,
        .num_chipselect = ARRAY_SIZE(pcm037_spi1_cs),
 };
-#endif
 /* GPIO-keys input device */
 static struct gpio_keys_button pcm037_gpio_keys[] = {
@@ -171,7 +170,7 @@ static struct platform_device pcm037_gpio_keys_device = {
        },
 };
-static int eet_init_devices(void)
+static int __init eet_init_devices(void)
 {
        if (!machine_is_pcm037() || pcm037_variant() != PCM037_EET)
                return 0;
diff --git a/arch/arm/mach-netx/include/mach/vmalloc.h b/arch/arm/mach-netx/include/mach/vmalloc.h
index 7cca3574308f..871f1ef7bff5 100644
--- a/arch/arm/mach-netx/include/mach/vmalloc.h
+++ b/arch/arm/mach-netx/include/mach/vmalloc.h
@@ -16,4 +16,4 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
-#define VMALLOC_END       0xd0000000
+#define VMALLOC_END       0xd0000000UL
diff --git a/arch/arm/mach-omap1/include/mach/vmalloc.h b/arch/arm/mach-omap1/include/mach/vmalloc.h
index b001f67d695b..22ec4a479577 100644
--- a/arch/arm/mach-omap1/include/mach/vmalloc.h
+++ b/arch/arm/mach-omap1/include/mach/vmalloc.h
@@ -17,4 +17,4 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
-#define VMALLOC_END     0xd8000000
+#define VMALLOC_END     0xd8000000UL
diff --git a/arch/arm/mach-omap2/include/mach/vmalloc.h b/arch/arm/mach-omap2/include/mach/vmalloc.h
index 4da31e997efe..866319947760 100644
--- a/arch/arm/mach-omap2/include/mach/vmalloc.h
+++ b/arch/arm/mach-omap2/include/mach/vmalloc.h
@@ -17,4 +17,4 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
-#define VMALLOC_END       0xf8000000
+#define VMALLOC_END       0xf8000000UL
diff --git a/arch/arm/mach-omap2/pm24xx.c b/arch/arm/mach-omap2/pm24xx.c
index a40457d81927..c85923e56b85 100644
--- a/arch/arm/mach-omap2/pm24xx.c
+++ b/arch/arm/mach-omap2/pm24xx.c
@@ -30,6 +30,7 @@
 #include <linux/irq.h>
 #include <linux/time.h>
 #include <linux/gpio.h>
+#include <linux/console.h>
 #include <asm/mach/time.h>
 #include <asm/mach/irq.h>
@@ -118,6 +119,10 @@ static void omap2_enter_full_retention(void)
        if (omap_irq_pending())
                goto no_sleep;
+        /* Block console output in case it is on one of the OMAP UARTs */
+        if (try_acquire_console_sem())
+                goto no_sleep;
        omap_uart_prepare_idle(0);
        omap_uart_prepare_idle(1);
        omap_uart_prepare_idle(2);
@@ -131,6 +136,8 @@ static void omap2_enter_full_retention(void)
        omap_uart_resume_idle(1);
        omap_uart_resume_idle(0);
+        release_console_sem();
 no_sleep:
        if (omap2_pm_debug) {
                unsigned long long tmp;
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 75c0cd13ad8e..0ec8a04b7473 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -28,6 +28,7 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/console.h>
 #include <plat/sram.h>
 #include <plat/clockdomain.h>
@@ -385,6 +386,12 @@ void omap_sram_idle(void)
                omap3_enable_io_chain();
        }
+        /* Block console output in case it is on one of the OMAP UARTs */
+        if (per_next_state < PWRDM_POWER_ON ||
+            core_next_state < PWRDM_POWER_ON)
+                if (try_acquire_console_sem())
+                        goto console_still_active;
        /* PER */
        if (per_next_state < PWRDM_POWER_ON) {
                omap_uart_prepare_idle(2);
@@ -463,6 +470,9 @@ void omap_sram_idle(void)
                omap_uart_resume_idle(3);
        }
+        release_console_sem();
+console_still_active:
        /* Disable IO-PAD and IO-CHAIN wakeup */
        if (omap3_has_io_wakeup() &&
            (per_next_state < PWRDM_POWER_ON ||
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index becf0e38ef7e..d17960a1be25 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -27,6 +27,7 @@
 #include <linux/slab.h>
 #include <linux/serial_8250.h>
 #include <linux/pm_runtime.h>
+#include <linux/console.h>
 #ifdef CONFIG_SERIAL_OMAP
 #include <plat/omap-serial.h>
@@ -406,7 +407,7 @@ void omap_uart_resume_idle(int num)
        struct omap_uart_state *uart;
        list_for_each_entry(uart, &uart_list, node) {
-                if (num == uart->num) {
+                if (num == uart->num && uart->can_sleep) {
                        omap_uart_enable_clocks(uart);
                        /* Check for IO pad wakeup */
@@ -807,6 +808,8 @@ void __init omap_serial_init_port(int port)
        oh->dev_attr = uart;
+        acquire_console_sem(); /* in case the earlycon is on the UART */
        /*
         * Because of early UART probing, UART did not get idled
         * on init.  Now that omap_device is ready, ensure full idle
@@ -831,6 +834,8 @@ void __init omap_serial_init_port(int port)
        omap_uart_block_sleep(uart);
        uart->timeout = DEFAULT_TIMEOUT;
+        release_console_sem();
        if ((cpu_is_omap34xx() && uart->padconf) ||
            (uart->wk_en && uart->wk_mask)) {
                device_init_wakeup(&od->pdev.dev, true);
diff --git a/arch/arm/mach-pnx4008/include/mach/vmalloc.h b/arch/arm/mach-pnx4008/include/mach/vmalloc.h
index 31b65ee07b0b..184913c71141 100644
--- a/arch/arm/mach-pnx4008/include/mach/vmalloc.h
+++ b/arch/arm/mach-pnx4008/include/mach/vmalloc.h
@@ -17,4 +17,4 @@
 * The vmalloc() routines leaves a hole of 4kB between each vmalloced
 * area for the same reason. ;)
 */
-#define VMALLOC_END       0xd0000000
+#define VMALLOC_END       0xd0000000UL
diff --git a/arch/arm/mach-realview/headsmp.S b/arch/arm/mach-realview/headsmp.S
index 4075473cf68a..b34be4554d40 100644
--- a/arch/arm/mach-realview/headsmp.S
+++ b/arch/arm/mach-realview/headsmp.S
@@ -35,5 +35,6 @@ pen:	ldr	r7, [r6]
         */
        b       secondary_startup
+        .align
 1:      .long   .
        .long   pen_release
diff --git a/arch/arm/mach-rpc/include/mach/vmalloc.h b/arch/arm/mach-rpc/include/mach/vmalloc.h
index 3bcd86fadb81..fb700228637a 100644
--- a/arch/arm/mach-rpc/include/mach/vmalloc.h
+++ b/arch/arm/mach-rpc/include/mach/vmalloc.h
@@ -7,4 +7,4 @@
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
-#define VMALLOC_END       0xdc000000
+#define VMALLOC_END       0xdc000000UL
diff --git a/arch/arm/mach-s3c2410/h1940-bluetooth.c b/arch/arm/mach-s3c2410/h1940-bluetooth.c
index 8aa2f1902a94..6b86a722a7db 100644
--- a/arch/arm/mach-s3c2410/h1940-bluetooth.c
+++ b/arch/arm/mach-s3c2410/h1940-bluetooth.c
@@ -77,13 +77,13 @@ static int __devinit h1940bt_probe(struct platform_device *pdev)
        /* Configures BT serial port GPIOs */
        s3c_gpio_cfgpin(S3C2410_GPH(0), S3C2410_GPH0_nCTS0);
-        s3c_gpio_cfgpull(S3C2410_GPH(0), S3C_GPIO_PULL_NONE);
+        s3c_gpio_setpull(S3C2410_GPH(0), S3C_GPIO_PULL_NONE);
        s3c_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_OUTPUT);
-        s3c_gpio_cfgpull(S3C2410_GPH(1), S3C_GPIO_PULL_NONE);
+        s3c_gpio_setpull(S3C2410_GPH(1), S3C_GPIO_PULL_NONE);
        s3c_gpio_cfgpin(S3C2410_GPH(2), S3C2410_GPH2_TXD0);
-        s3c_gpio_cfgpull(S3C2410_GPH(2), S3C_GPIO_PULL_NONE);
+        s3c_gpio_setpull(S3C2410_GPH(2), S3C_GPIO_PULL_NONE);
        s3c_gpio_cfgpin(S3C2410_GPH(3), S3C2410_GPH3_RXD0);
-        s3c_gpio_cfgpull(S3C2410_GPH(3), S3C_GPIO_PULL_NONE);
+        s3c_gpio_setpull(S3C2410_GPH(3), S3C_GPIO_PULL_NONE);
        rfk = rfkill_alloc(DRV_NAME, &pdev->dev, RFKILL_TYPE_BLUETOOTH,
diff --git a/arch/arm/mach-s3c2412/Kconfig b/arch/arm/mach-s3c2412/Kconfig
index cef6a65637bd..fa2e5bffbb8e 100644
--- a/arch/arm/mach-s3c2412/Kconfig
+++ b/arch/arm/mach-s3c2412/Kconfig
@@ -16,7 +16,7 @@ config CPU_S3C2412
 config CPU_S3C2412_ONLY
        bool
        depends on ARCH_S3C2410 && !CPU_S3C2400 && !CPU_S3C2410 && \
-                   !CPU_2416 && !CPU_S3C2440 && !CPU_S3C2442 && \
+                   !CPU_S3C2416 && !CPU_S3C2440 && !CPU_S3C2442 && \
                   !CPU_S3C2443 && CPU_S3C2412
        default y if CPU_S3C2412
diff --git a/arch/arm/mach-s3c2416/Kconfig b/arch/arm/mach-s3c2416/Kconfig
index 87b9c9f003bd..27b3e7c9d613 100644
--- a/arch/arm/mach-s3c2416/Kconfig
+++ b/arch/arm/mach-s3c2416/Kconfig
@@ -35,9 +35,12 @@ menu "S3C2416 Machines"
 config MACH_SMDK2416
        bool "SMDK2416"
        select CPU_S3C2416
+        select MACH_SMDK
        select S3C_DEV_FB
        select S3C_DEV_HSMMC
        select S3C_DEV_HSMMC1
+        select S3C_DEV_NAND
+        select S3C_DEV_USB_HOST
        select S3C2416_PM if PM
        help
          Say Y here if you are using an SMDK2416
diff --git a/arch/arm/mach-s3c2416/irq.c b/arch/arm/mach-s3c2416/irq.c
index 084d121f368c..00174daf1526 100644
--- a/arch/arm/mach-s3c2416/irq.c
+++ b/arch/arm/mach-s3c2416/irq.c
@@ -168,12 +168,11 @@ static struct irq_chip s3c2416_irq_dma = {
 static void s3c2416_irq_demux_uart3(unsigned int irq, struct irq_desc *desc)
 {
-        s3c2416_irq_demux(IRQ_S3C2443_UART3, 3);
+        s3c2416_irq_demux(IRQ_S3C2443_RX3, 3);
 }
 #define INTMSK_UART3    (1UL << (IRQ_S3C2443_UART3 - IRQ_EINT0))
-#define SUBMSK_UART3    (0xf << (IRQ_S3C2443_RX3 - S3C2410_IRQSUB(0)))
+#define SUBMSK_UART3    (0x7 << (IRQ_S3C2443_RX3 - S3C2410_IRQSUB(0)))
 static void s3c2416_irq_uart3_mask(unsigned int irqno)
 {
diff --git a/arch/arm/mach-s3c2440/Kconfig b/arch/arm/mach-s3c2440/Kconfig
index ff024a6c0f85..a0cb2581894f 100644
--- a/arch/arm/mach-s3c2440/Kconfig
+++ b/arch/arm/mach-s3c2440/Kconfig
@@ -18,6 +18,7 @@ config CPU_S3C2440
 config CPU_S3C2442
        bool
        select CPU_ARM920T
+        select S3C_GPIO_PULL_DOWN
        select S3C2410_CLOCK
        select S3C2410_GPIO
        select S3C2410_PM if PM
@@ -178,6 +179,9 @@ config MACH_MINI2440
        bool "MINI2440 development board"
        select CPU_S3C2440
        select EEPROM_AT24
+        select NEW_LEDS
+        select LEDS_CLASS
+        select LEDS_TRIGGER
        select LEDS_TRIGGER_BACKLIGHT
        select S3C_DEV_NAND
        select S3C_DEV_USB_HOST
diff --git a/arch/arm/mach-s3c2440/s3c2440.c b/arch/arm/mach-s3c2440/s3c2440.c
index d50f3ae6173d..f7663f731ea0 100644
--- a/arch/arm/mach-s3c2440/s3c2440.c
+++ b/arch/arm/mach-s3c2440/s3c2440.c
@@ -46,9 +46,6 @@ int __init s3c2440_init(void)
 {
        printk("S3C2440: Initialising architecture\n");
-        s3c24xx_gpiocfg_default.set_pull = s3c_gpio_setpull_1up;
-        s3c24xx_gpiocfg_default.get_pull = s3c_gpio_getpull_1up;
        /* change irq for watchdog */
        s3c_device_wdt.resource[1].start = IRQ_S3C2440_WDT;
@@ -58,3 +55,11 @@ int __init s3c2440_init(void)
        return sysdev_register(&s3c2440_sysdev);
 }
+void __init s3c2440_map_io(void)
+{
+        s3c244x_map_io();
+        s3c24xx_gpiocfg_default.set_pull = s3c_gpio_setpull_1up;
+        s3c24xx_gpiocfg_default.get_pull = s3c_gpio_getpull_1up;
+}
diff --git a/arch/arm/mach-s3c2440/s3c2442.c b/arch/arm/mach-s3c2440/s3c2442.c
index 188ad1e57dc0..ecf813546554 100644
--- a/arch/arm/mach-s3c2440/s3c2442.c
+++ b/arch/arm/mach-s3c2440/s3c2442.c
@@ -32,6 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
 #include <linux/mutex.h>
+#include <linux/gpio.h>
 #include <linux/clk.h>
 #include <linux/io.h>
@@ -43,6 +44,11 @@
 #include <plat/clock.h>
 #include <plat/cpu.h>
+#include <plat/s3c244x.h>
+#include <plat/gpio-core.h>
+#include <plat/gpio-cfg.h>
+#include <plat/gpio-cfg-helpers.h>
 /* S3C2442 extended clock support */
@@ -163,3 +169,11 @@ int __init s3c2442_init(void)
        return sysdev_register(&s3c2442_sysdev);
 }
+void __init s3c2442_map_io(void)
+{
+        s3c244x_map_io();
+        s3c24xx_gpiocfg_default.set_pull = s3c_gpio_setpull_1down;
+        s3c24xx_gpiocfg_default.get_pull = s3c_gpio_getpull_1down;
+}
diff --git a/arch/arm/mach-s3c2443/Kconfig b/arch/arm/mach-s3c2443/Kconfig
index 4fef723126fa..31babec90cec 100644
--- a/arch/arm/mach-s3c2443/Kconfig
+++ b/arch/arm/mach-s3c2443/Kconfig
@@ -5,6 +5,7 @@
 config CPU_S3C2443
        bool
        depends on ARCH_S3C2410
+        select CPU_ARM920T
        select S3C2443_DMA if S3C2410_DMA
        select CPU_LLSERIAL_S3C2440
        select SAMSUNG_CLKSRC
diff --git a/arch/arm/mach-s3c2443/irq.c b/arch/arm/mach-s3c2443/irq.c
index 0e0d693f3974..893424767ce1 100644
--- a/arch/arm/mach-s3c2443/irq.c
+++ b/arch/arm/mach-s3c2443/irq.c
@@ -166,12 +166,11 @@ static struct irq_chip s3c2443_irq_dma = {
 static void s3c2443_irq_demux_uart3(unsigned int irq, struct irq_desc *desc)
 {
-        s3c2443_irq_demux(IRQ_S3C2443_UART3, 3);
+        s3c2443_irq_demux(IRQ_S3C2443_RX3, 3);
 }
 #define INTMSK_UART3    (1UL << (IRQ_S3C2443_UART3 - IRQ_EINT0))
-#define SUBMSK_UART3    (0xf << (IRQ_S3C2443_RX3 - S3C2410_IRQSUB(0)))
+#define SUBMSK_UART3    (0x7 << (IRQ_S3C2443_RX3 - S3C2410_IRQSUB(0)))
 static void s3c2443_irq_uart3_mask(unsigned int irqno)
 {
diff --git a/arch/arm/mach-s3c64xx/mach-mini6410.c b/arch/arm/mach-s3c64xx/mach-mini6410.c
index 249c62956471..89f35e02e883 100644
--- a/arch/arm/mach-s3c64xx/mach-mini6410.c
+++ b/arch/arm/mach-s3c64xx/mach-mini6410.c
@@ -45,7 +45,7 @@
 #include <video/platform_lcd.h>
-#define UCON (S3C2410_UCON_DEFAULT | S3C2410_UCON_UCLK)
+#define UCON S3C2410_UCON_DEFAULT
 #define ULCON (S3C2410_LCON_CS8 | S3C2410_LCON_PNONE | S3C2410_LCON_STOPB)
 #define UFCON (S3C2410_UFCON_RXTRIG8 | S3C2410_UFCON_FIFOMODE)
diff --git a/arch/arm/mach-s3c64xx/mach-real6410.c b/arch/arm/mach-s3c64xx/mach-real6410.c
index f9ef9b5c5f5a..4957ab0a0d4a 100644
--- a/arch/arm/mach-s3c64xx/mach-real6410.c
+++ b/arch/arm/mach-s3c64xx/mach-real6410.c
@@ -46,7 +46,7 @@
 #include <video/platform_lcd.h>
-#define UCON (S3C2410_UCON_DEFAULT | S3C2410_UCON_UCLK)
+#define UCON S3C2410_UCON_DEFAULT
 #define ULCON (S3C2410_LCON_CS8 | S3C2410_LCON_PNONE | S3C2410_LCON_STOPB)
 #define UFCON (S3C2410_UFCON_RXTRIG8 | S3C2410_UFCON_FIFOMODE)
diff --git a/arch/arm/mach-s5pv210/mach-smdkc110.c b/arch/arm/mach-s5pv210/mach-smdkc110.c
index 0ad7924fe62e..5dd1681c069e 100644
--- a/arch/arm/mach-s5pv210/mach-smdkc110.c
+++ b/arch/arm/mach-s5pv210/mach-smdkc110.c
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/serial_core.h>
 #include <linux/i2c.h>
+#include <linux/sysdev.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-s5pv210/mach-smdkv210.c b/arch/arm/mach-s5pv210/mach-smdkv210.c
index bcd7a5d53401..1fbc45b2a432 100644
--- a/arch/arm/mach-s5pv210/mach-smdkv210.c
+++ b/arch/arm/mach-s5pv210/mach-smdkv210.c
@@ -13,6 +13,7 @@
 #include <linux/i2c.h>
 #include <linux/init.h>
 #include <linux/serial_core.h>
+#include <linux/sysdev.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-shark/include/mach/vmalloc.h b/arch/arm/mach-shark/include/mach/vmalloc.h
index 8e845b6a7cb5..b10df988526d 100644
--- a/arch/arm/mach-shark/include/mach/vmalloc.h
+++ b/arch/arm/mach-shark/include/mach/vmalloc.h
@@ -1,4 +1,4 @@
 /*
 * arch/arm/mach-shark/include/mach/vmalloc.h
 */
-#define VMALLOC_END       0xd0000000
+#define VMALLOC_END       0xd0000000UL
diff --git a/arch/arm/mach-shmobile/board-ap4evb.c b/arch/arm/mach-shmobile/board-ap4evb.c
index d3260542b943..d440e5f456ad 100644
--- a/arch/arm/mach-shmobile/board-ap4evb.c
+++ b/arch/arm/mach-shmobile/board-ap4evb.c
@@ -567,38 +567,127 @@ static struct platform_device *qhd_devices[] __initdata = {
 /* FSI */
 #define IRQ_FSI         evt2irq(0x1840)
+static int __fsi_set_rate(struct clk *clk, long rate, int enable)
+{
+        int ret = 0;
+        if (rate <= 0)
+                return ret;
+        if (enable) {
+                ret = clk_set_rate(clk, rate);
+                if (0 == ret)
+                        ret = clk_enable(clk);
+        } else {
+                clk_disable(clk);
+        }
+        return ret;
+}
+static int __fsi_set_round_rate(struct clk *clk, long rate, int enable)
+{
+        return __fsi_set_rate(clk, clk_round_rate(clk, rate), enable);
+}
-static int fsi_set_rate(int is_porta, int rate)
+static int fsi_ak4642_set_rate(struct device *dev, int rate, int enable)
+{
+        struct clk *fsia_ick;
+        struct clk *fsiack;
+        int ret = -EIO;
+        fsia_ick = clk_get(dev, "icka");
+        if (IS_ERR(fsia_ick))
+                return PTR_ERR(fsia_ick);
+        /*
+         * FSIACK is connected to AK4642,
+         * and use external clock pin from it.
+         * it is parent of fsia_ick now.
+         */
+        fsiack = clk_get_parent(fsia_ick);
+        if (!fsiack)
+                goto fsia_ick_out;
+        /*
+         * we get 1/1 divided clock by setting same rate to fsiack and fsia_ick
+         *
+         ** FIXME **
+         * Because the freq_table of external clk (fsiack) are all 0,
+         * the return value of clk_round_rate became 0.
+         * So, it use __fsi_set_rate here.
+         */
+        ret = __fsi_set_rate(fsiack, rate, enable);
+        if (ret < 0)
+                goto fsiack_out;
+        ret = __fsi_set_round_rate(fsia_ick, rate, enable);
+        if ((ret < 0) && enable)
+                __fsi_set_round_rate(fsiack, rate, 0); /* disable FSI ACK */
+fsiack_out:
+        clk_put(fsiack);
+fsia_ick_out:
+        clk_put(fsia_ick);
+        return 0;
+}
+static int fsi_hdmi_set_rate(struct device *dev, int rate, int enable)
 {
        struct clk *fsib_clk;
        struct clk *fdiv_clk = &sh7372_fsidivb_clk;
+        long fsib_rate = 0;
+        long fdiv_rate = 0;
+        int ackmd_bpfmd;
        int ret;
-        /* set_rate is not needed if port A */
-        if (is_porta)
-                return 0;
-        fsib_clk = clk_get(NULL, "fsib_clk");
-        if (IS_ERR(fsib_clk))
-                return -EINVAL;
        switch (rate) {
        case 44100:
-                clk_set_rate(fsib_clk, clk_round_rate(fsib_clk, 11283000));
+                fsib_rate       = rate * 256;
-                ret = SH_FSI_ACKMD_256 | SH_FSI_BPFMD_64;
+                ackmd_bpfmd     = SH_FSI_ACKMD_256 | SH_FSI_BPFMD_64;
                break;
        case 48000:
-                clk_set_rate(fsib_clk, clk_round_rate(fsib_clk, 85428000));
+                fsib_rate       = 85428000; /* around 48kHz x 256 x 7 */
-                clk_set_rate(fdiv_clk, clk_round_rate(fdiv_clk, 12204000));
+                fdiv_rate       = rate * 256;
-                ret = SH_FSI_ACKMD_256 | SH_FSI_BPFMD_64;
+                ackmd_bpfmd     = SH_FSI_ACKMD_256 | SH_FSI_BPFMD_64;
                break;
        default:
                pr_err("unsupported rate in FSI2 port B\n");
-                ret = -EINVAL;
+                return -EINVAL;
-                break;
        }
+        /* FSI B setting */
+        fsib_clk = clk_get(dev, "ickb");
+        if (IS_ERR(fsib_clk))
+                return -EIO;
+        ret = __fsi_set_round_rate(fsib_clk, fsib_rate, enable);
        clk_put(fsib_clk);
+        if (ret < 0)
+                return ret;
+        /* FSI DIV setting */
+        ret = __fsi_set_round_rate(fdiv_clk, fdiv_rate, enable);
+        if (ret < 0) {
+                /* disable FSI B */
+                if (enable)
+                        __fsi_set_round_rate(fsib_clk, fsib_rate, 0);
+                return ret;
+        }
+        return ackmd_bpfmd;
+}
+static int fsi_set_rate(struct device *dev, int is_porta, int rate, int enable)
+{
+        int ret;
+        if (is_porta)
+                ret = fsi_ak4642_set_rate(dev, rate, enable);
+        else
+                ret = fsi_hdmi_set_rate(dev, rate, enable);
        return ret;
 }
@@ -880,6 +969,11 @@ static int __init hdmi_init_pm_clock(void)
                goto out;
        }
+        ret = clk_enable(&sh7372_pllc2_clk);
+        if (ret < 0) {
+                pr_err("Cannot enable pllc2 clock\n");
+                goto out;
+        }
        pr_debug("PLLC2 set frequency %lu\n", rate);
        ret = clk_set_parent(hdmi_ick, &sh7372_pllc2_clk);
@@ -896,23 +990,11 @@ out:
 device_initcall(hdmi_init_pm_clock);
-#define FSIACK_DUMMY_RATE 48000
 static int __init fsi_init_pm_clock(void)
 {
        struct clk *fsia_ick;
        int ret;
-        /*
-         * FSIACK is connected to AK4642,
-         * and the rate is depend on playing sound rate.
-         * So, set dummy rate (= 48k) here
-         */
-        ret = clk_set_rate(&sh7372_fsiack_clk, FSIACK_DUMMY_RATE);
-        if (ret < 0) {
-                pr_err("Cannot set FSIACK dummy rate: %d\n", ret);
-                return ret;
-        }
        fsia_ick = clk_get(&fsi_device.dev, "icka");
        if (IS_ERR(fsia_ick)) {
                ret = PTR_ERR(fsia_ick);
@@ -921,16 +1003,9 @@ static int __init fsi_init_pm_clock(void)
        }
        ret = clk_set_parent(fsia_ick, &sh7372_fsiack_clk);
-        if (ret < 0) {
-                pr_err("Cannot set FSI-A parent: %d\n", ret);
-                goto out;
-        }
-        ret = clk_set_rate(fsia_ick, FSIACK_DUMMY_RATE);
        if (ret < 0)
-                pr_err("Cannot set FSI-A rate: %d\n", ret);
+                pr_err("Cannot set FSI-A parent: %d\n", ret);
-out:
        clk_put(fsia_ick);
        return ret;
diff --git a/arch/arm/mach-shmobile/clock-sh7372.c b/arch/arm/mach-shmobile/clock-sh7372.c
index 7db31e6c6bf2..3aa026069435 100644
--- a/arch/arm/mach-shmobile/clock-sh7372.c
+++ b/arch/arm/mach-shmobile/clock-sh7372.c
@@ -220,8 +220,7 @@ static void pllc2_disable(struct clk *clk)
        __raw_writel(__raw_readl(PLLC2CR) & ~0x80000000, PLLC2CR);
 }
-static int pllc2_set_rate(struct clk *clk,
+static int pllc2_set_rate(struct clk *clk, unsigned long rate)
-                          unsigned long rate, int algo_id)
 {
        unsigned long value;
        int idx;
@@ -230,21 +229,13 @@ static int pllc2_set_rate(struct clk *clk,
        if (idx < 0)
                return idx;
-        if (rate == clk->parent->rate) {
+        if (rate == clk->parent->rate)
-                pllc2_disable(clk);
+                return -EINVAL;
-                return 0;
-        }
        value = __raw_readl(PLLC2CR) & ~(0x3f << 24);
-        if (value & 0x80000000)
-                pllc2_disable(clk);
        __raw_writel((value & ~0x80000000) | ((idx + 19) << 24), PLLC2CR);
-        if (value & 0x80000000)
-                return pllc2_enable(clk);
        return 0;
 }
@@ -453,32 +444,24 @@ static int fsidiv_enable(struct clk *clk)
        unsigned long value;
        value  = __raw_readl(clk->mapping->base) >> 16;
-        if (value < 2) {
+        if (value < 2)
-                fsidiv_disable(clk);
+                return -EIO;
-                return -ENOENT;
-        }
        __raw_writel((value << 16) | 0x3, clk->mapping->base);
        return 0;
 }
-static int fsidiv_set_rate(struct clk *clk,
+static int fsidiv_set_rate(struct clk *clk, unsigned long rate)
-                           unsigned long rate, int algo_id)
 {
        int idx;
-        if (clk->parent->rate == rate) {
-                fsidiv_disable(clk);
-                return 0;
-        }
        idx = (clk->parent->rate / rate) & 0xffff;
        if (idx < 2)
-                return -ENOENT;
+                return -EINVAL;
        __raw_writel(idx << 16, clk->mapping->base);
-        return fsidiv_enable(clk);
+        return 0;
 }
 static struct clk_ops fsidiv_clk_ops = {
@@ -609,8 +592,6 @@ static struct clk_lookup lookups[] = {
        CLKDEV_CON_ID("vck3_clk", &div6_clks[DIV6_VCK3]),
        CLKDEV_CON_ID("fmsi_clk", &div6_clks[DIV6_FMSI]),
        CLKDEV_CON_ID("fmso_clk", &div6_clks[DIV6_FMSO]),
-        CLKDEV_CON_ID("fsia_clk", &div6_reparent_clks[DIV6_FSIA]),
-        CLKDEV_CON_ID("fsib_clk", &div6_reparent_clks[DIV6_FSIB]),
        CLKDEV_CON_ID("sub_clk", &div6_clks[DIV6_SUB]),
        CLKDEV_CON_ID("spu_clk", &div6_clks[DIV6_SPU]),
        CLKDEV_CON_ID("vou_clk", &div6_clks[DIV6_VOU]),
@@ -647,8 +628,8 @@ static struct clk_lookup lookups[] = {
        CLKDEV_DEV_ID("sh_cmt.10", &mstp_clks[MSTP329]), /* CMT10 */
        CLKDEV_DEV_ID("sh_fsi2", &mstp_clks[MSTP328]), /* FSI2 */
        CLKDEV_DEV_ID("i2c-sh_mobile.1", &mstp_clks[MSTP323]), /* IIC1 */
-        CLKDEV_DEV_ID("r8a66597_hcd.0", &mstp_clks[MSTP323]), /* USB0 */
+        CLKDEV_DEV_ID("r8a66597_hcd.0", &mstp_clks[MSTP322]), /* USB0 */
-        CLKDEV_DEV_ID("r8a66597_udc.0", &mstp_clks[MSTP323]), /* USB0 */
+        CLKDEV_DEV_ID("r8a66597_udc.0", &mstp_clks[MSTP322]), /* USB0 */
        CLKDEV_DEV_ID("sh_mobile_sdhi.0", &mstp_clks[MSTP314]), /* SDHI0 */
        CLKDEV_DEV_ID("sh_mobile_sdhi.1", &mstp_clks[MSTP313]), /* SDHI1 */
        CLKDEV_DEV_ID("sh_mmcif.0", &mstp_clks[MSTP312]), /* MMC */
diff --git a/arch/arm/mach-tegra/include/mach/debug-macro.S b/arch/arm/mach-tegra/include/mach/debug-macro.S
index 8ea3bffb4e00..a0e7c12868bd 100644
--- a/arch/arm/mach-tegra/include/mach/debug-macro.S
+++ b/arch/arm/mach-tegra/include/mach/debug-macro.S
@@ -21,8 +21,8 @@
 #include <mach/io.h>
        .macro  addruart, rp, rv
-        ldreq   \rp, =IO_APB_PHYS       @ physical
+        ldr     \rp, =IO_APB_PHYS       @ physical
-        ldrne   \rv, =IO_APB_VIRT        @ virtual
+        ldr     \rv, =IO_APB_VIRT        @ virtual
 #if defined(CONFIG_TEGRA_DEBUG_UART_NONE)
 #error "A debug UART must be selected in the kernel config to use DEBUG_LL"
 #elif defined(CONFIG_TEGRA_DEBUG_UARTA)
diff --git a/arch/arm/mach-ux500/cpu.c b/arch/arm/mach-ux500/cpu.c
index 73fb1a551ec6..608a1372b172 100644
--- a/arch/arm/mach-ux500/cpu.c
+++ b/arch/arm/mach-ux500/cpu.c
@@ -75,14 +75,14 @@ void __init ux500_init_irq(void)
 static inline void ux500_cache_wait(void __iomem *reg, unsigned long mask)
 {
        /* wait for the operation to complete */
-        while (readl(reg) & mask)
+        while (readl_relaxed(reg) & mask)
                ;
 }
 static inline void ux500_cache_sync(void)
 {
        void __iomem *base = __io_address(UX500_L2CC_BASE);
-        writel(0, base + L2X0_CACHE_SYNC);
+        writel_relaxed(0, base + L2X0_CACHE_SYNC);
        ux500_cache_wait(base + L2X0_CACHE_SYNC, 1);
 }
@@ -107,7 +107,7 @@ static void ux500_l2x0_inv_all(void)
        uint32_t l2x0_way_mask = (1<<16) - 1;   /* Bitmask of active ways */
        /* invalidate all ways */
-        writel(l2x0_way_mask, l2x0_base + L2X0_INV_WAY);
+        writel_relaxed(l2x0_way_mask, l2x0_base + L2X0_INV_WAY);
        ux500_cache_wait(l2x0_base + L2X0_INV_WAY, l2x0_way_mask);
        ux500_cache_sync();
 }
diff --git a/arch/arm/mach-versatile/include/mach/vmalloc.h b/arch/arm/mach-versatile/include/mach/vmalloc.h
index ebd8a2543d3b..7d8e069ad51b 100644
--- a/arch/arm/mach-versatile/include/mach/vmalloc.h
+++ b/arch/arm/mach-versatile/include/mach/vmalloc.h
@@ -18,4 +18,4 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
-#define VMALLOC_END             0xd8000000
+#define VMALLOC_END             0xd8000000UL
diff --git a/arch/arm/mach-vexpress/headsmp.S b/arch/arm/mach-vexpress/headsmp.S
index 8a78ff68e1ee..7a3f0632947c 100644
--- a/arch/arm/mach-vexpress/headsmp.S
+++ b/arch/arm/mach-vexpress/headsmp.S
@@ -35,5 +35,6 @@ pen:	ldr	r7, [r6]
         */
        b       secondary_startup
+        .align
 1:      .long   .
        .long   pen_release
diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
index 17e7b0b57e49..55c17a6fb22f 100644
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -206,8 +206,8 @@ void __iomem * __arm_ioremap_pfn_caller(unsigned long pfn,
         */
        if (pfn_valid(pfn)) {
                printk(KERN_WARNING "BUG: Your driver calls ioremap() on system memory.  This leads\n"
-                       KERN_WARNING "to architecturally unpredictable behaviour on ARMv6+, and ioremap()\n"
+                       "to architecturally unpredictable behaviour on ARMv6+, and ioremap()\n"
-                       KERN_WARNING "will fail in the next kernel release.  Please fix your driver.\n");
+                       "will fail in the next kernel release.  Please fix your driver.\n");
                WARN_ON(1);
        }
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 53cbe2225153..9b9ff5d949fd 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -381,7 +381,7 @@ __v7_ca9mp_proc_info:
                PMD_SECT_XN | \
                PMD_SECT_AP_WRITE | \
                PMD_SECT_AP_READ
-        b       __v7_ca9mp_setup
+        W(b)    __v7_ca9mp_setup
        .long   cpu_arch_name
        .long   cpu_elf_name
        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP|HWCAP_TLS
@@ -413,7 +413,7 @@ __v7_proc_info:
                PMD_SECT_XN | \
                PMD_SECT_AP_WRITE | \
                PMD_SECT_AP_READ
-        b       __v7_setup
+        W(b)    __v7_setup
        .long   cpu_arch_name
        .long   cpu_elf_name
        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP|HWCAP_TLS
diff --git a/arch/arm/plat-iop/time.c b/arch/arm/plat-iop/time.c
index 85d3e55ca4a9..558cdfaf76b6 100644
--- a/arch/arm/plat-iop/time.c
+++ b/arch/arm/plat-iop/time.c
@@ -18,6 +18,7 @@
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/timex.h>
+#include <linux/sched.h>
 #include <linux/io.h>
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
@@ -36,7 +37,7 @@
 /*
 * IOP clocksource (free-running timer 1).
 */
-static cycle_t iop_clocksource_read(struct clocksource *unused)
+static cycle_t notrace iop_clocksource_read(struct clocksource *unused)
 {
        return 0xffffffffu - read_tcr1();
 }
diff --git a/arch/arm/plat-mxc/devices/platform-imx-dma.c b/arch/arm/plat-mxc/devices/platform-imx-dma.c
index 02d989018059..3a705c7877dd 100644
--- a/arch/arm/plat-mxc/devices/platform-imx-dma.c
+++ b/arch/arm/plat-mxc/devices/platform-imx-dma.c
@@ -12,15 +12,7 @@
 #include <mach/hardware.h>
 #include <mach/devices-common.h>
-#ifdef SDMA_IS_MERGED
 #include <mach/sdma.h>
-#else
-struct sdma_platform_data {
-        int sdma_version;
-        char *cpu_name;
-        int to_version;
-};
-#endif
 struct imx_imx_sdma_data {
        resource_size_t iobase;
diff --git a/arch/arm/plat-mxc/devices/platform-spi_imx.c b/arch/arm/plat-mxc/devices/platform-spi_imx.c
index e48340ec331e..17f724c9452d 100644
--- a/arch/arm/plat-mxc/devices/platform-spi_imx.c
+++ b/arch/arm/plat-mxc/devices/platform-spi_imx.c
@@ -27,6 +27,7 @@ const struct imx_spi_imx_data imx21_cspi_data[] __initconst = {
        imx_spi_imx_data_entry(MX21, CSPI, "imx21-cspi", _id, _hwid, SZ_4K)
        imx21_cspi_data_entry(0, 1),
        imx21_cspi_data_entry(1, 2),
+};
 #endif
 #ifdef CONFIG_ARCH_MX25
diff --git a/arch/arm/plat-nomadik/timer.c b/arch/arm/plat-nomadik/timer.c
index aedf9c1d645e..63cdc6025bd7 100644
--- a/arch/arm/plat-nomadik/timer.c
+++ b/arch/arm/plat-nomadik/timer.c
@@ -3,6 +3,7 @@
 *
 * Copyright (C) 2008 STMicroelectronics
 * Copyright (C) 2010 Alessandro Rubini
+ * Copyright (C) 2010 Linus Walleij for ST-Ericsson
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2, as
@@ -16,11 +17,13 @@
 #include <linux/clk.h>
 #include <linux/jiffies.h>
 #include <linux/err.h>
+#include <linux/cnt32_to_63.h>
+#include <linux/timer.h>
 #include <asm/mach/time.h>
 #include <plat/mtu.h>
-void __iomem *mtu_base; /* ssigned by machine code */
+void __iomem *mtu_base; /* Assigned by machine code */
 /*
 * Kernel assumes that sched_clock can be called early
@@ -48,16 +51,82 @@ static struct clocksource nmdk_clksrc = {
 /*
 * Override the global weak sched_clock symbol with this
 * local implementation which uses the clocksource to get some
- * better resolution when scheduling the kernel. We accept that
+ * better resolution when scheduling the kernel.
- * this wraps around for now, since it is just a relative time
+ *
- * stamp. (Inspired by OMAP implementation.)
+ * Because the hardware timer period may be quite short
+ * (32.3 secs on the 133 MHz MTU timer selection on ux500)
+ * and because cnt32_to_63() needs to be called at least once per
+ * half period to work properly, a kernel keepwarm() timer is set up
+ * to ensure this requirement is always met.
+ *
+ * Also the sched_clock timer will wrap around at some point,
+ * here we set it to run continously for a year.
 */
+#define SCHED_CLOCK_MIN_WRAP 3600*24*365
+static struct timer_list cnt32_to_63_keepwarm_timer;
+static u32 sched_mult;
+static u32 sched_shift;
 unsigned long long notrace sched_clock(void)
 {
-        return clocksource_cyc2ns(nmdk_clksrc.read(
+        u64 cycles;
-                                  &nmdk_clksrc),
-                                  nmdk_clksrc.mult,
+        if (unlikely(!mtu_base))
-                                  nmdk_clksrc.shift);
+                return 0;
+        cycles = cnt32_to_63(-readl(mtu_base + MTU_VAL(0)));
+        /*
+         * sched_mult is guaranteed to be even so will
+         * shift out bit 63
+         */
+        return (cycles * sched_mult) >> sched_shift;
+}
+/* Just kick sched_clock every so often */
+static void cnt32_to_63_keepwarm(unsigned long data)
+{
+        mod_timer(&cnt32_to_63_keepwarm_timer, round_jiffies(jiffies + data));
+        (void) sched_clock();
+}
+/*
+ * Set up a timer to keep sched_clock():s 32_to_63 algorithm warm
+ * once in half a 32bit timer wrap interval.
+ */
+static void __init nmdk_sched_clock_init(unsigned long rate)
+{
+        u32 v;
+        unsigned long delta;
+        u64 days;
+        /* Find the apropriate mult and shift factors */
+        clocks_calc_mult_shift(&sched_mult, &sched_shift,
+                               rate, NSEC_PER_SEC, SCHED_CLOCK_MIN_WRAP);
+        /* We need to multiply by an even number to get rid of bit 63 */
+        if (sched_mult & 1)
+                sched_mult++;
+        /* Let's see what we get, take max counter and scale it */
+        days = (0xFFFFFFFFFFFFFFFFLLU * sched_mult) >> sched_shift;
+        do_div(days, NSEC_PER_SEC);
+        do_div(days, (3600*24));
+        pr_info("sched_clock: using %d bits @ %lu Hz wrap in %lu days\n",
+                (64 - sched_shift), rate, (unsigned long) days);
+        /*
+         * Program a timer to kick us at half 32bit wraparound
+         * Formula: seconds per wrap = (2^32) / f
+         */
+        v = 0xFFFFFFFFUL / rate;
+        /* We want half of the wrap time to keep cnt32_to_63 warm */
+        v /= 2;
+        pr_debug("sched_clock: prescaled timer rate: %lu Hz, "
+                 "initialize keepwarm timer every %d seconds\n", rate, v);
+        /* Convert seconds to jiffies */
+        delta = msecs_to_jiffies(v*1000);
+        setup_timer(&cnt32_to_63_keepwarm_timer, cnt32_to_63_keepwarm, delta);
+        mod_timer(&cnt32_to_63_keepwarm_timer, round_jiffies(jiffies + delta));
 }
 /* Clockevent device: use one-shot mode */
@@ -161,13 +230,15 @@ void __init nmdk_timer_init(void)
        writel(0, mtu_base + MTU_BGLR(0));
        writel(cr | MTU_CRn_ENA, mtu_base + MTU_CR(0));
-        /* Now the scheduling clock is ready */
+        /* Now the clock source is ready */
        nmdk_clksrc.read = nmdk_read_timer;
        if (clocksource_register(&nmdk_clksrc))
                pr_err("timer: failed to initialize clock source %s\n",
                       nmdk_clksrc.name);
+        nmdk_sched_clock_init(rate);
        /* Timer 1 is used for events */
        clockevents_calc_mult_shift(&nmdk_clkevt, rate, MTU_MIN_RANGE);
diff --git a/arch/arm/plat-pxa/include/plat/sdhci.h b/arch/arm/plat-pxa/include/plat/sdhci.h
index e49c5b6fc4e2..1ab332e37d7d 100644
--- a/arch/arm/plat-pxa/include/plat/sdhci.h
+++ b/arch/arm/plat-pxa/include/plat/sdhci.h
@@ -17,6 +17,9 @@
 /* Require clock free running */
 #define PXA_FLAG_DISABLE_CLOCK_GATING (1<<0)
+/* Board design supports 8-bit data on SD/SDIO BUS */
+#define PXA_FLAG_SD_8_BIT_CAPABLE_SLOT (1<<2)
 /*
 * struct pxa_sdhci_platdata() - Platform device data for PXA SDHCI
 * @max_speed: the maximum speed supported
diff --git a/arch/arm/plat-s3c24xx/cpu.c b/arch/arm/plat-s3c24xx/cpu.c
index 76d0858c3cbb..4a10c0f684b2 100644
--- a/arch/arm/plat-s3c24xx/cpu.c
+++ b/arch/arm/plat-s3c24xx/cpu.c
@@ -88,7 +88,7 @@ static struct cpu_table cpu_ids[] __initdata = {
        {
                .idcode         = 0x32440000,
                .idmask         = 0xffffffff,
-                .map_io         = s3c244x_map_io,
+                .map_io         = s3c2440_map_io,
                .init_clocks    = s3c244x_init_clocks,
                .init_uarts     = s3c244x_init_uarts,
                .init           = s3c2440_init,
@@ -97,7 +97,7 @@ static struct cpu_table cpu_ids[] __initdata = {
        {
                .idcode         = 0x32440001,
                .idmask         = 0xffffffff,
-                .map_io         = s3c244x_map_io,
+                .map_io         = s3c2440_map_io,
                .init_clocks    = s3c244x_init_clocks,
                .init_uarts     = s3c244x_init_uarts,
                .init           = s3c2440_init,
@@ -106,7 +106,7 @@ static struct cpu_table cpu_ids[] __initdata = {
        {
                .idcode         = 0x32440aaa,
                .idmask         = 0xffffffff,
-                .map_io         = s3c244x_map_io,
+                .map_io         = s3c2442_map_io,
                .init_clocks    = s3c244x_init_clocks,
                .init_uarts     = s3c244x_init_uarts,
                .init           = s3c2442_init,
@@ -115,7 +115,7 @@ static struct cpu_table cpu_ids[] __initdata = {
        {
                .idcode         = 0x32440aab,
                .idmask         = 0xffffffff,
-                .map_io         = s3c244x_map_io,
+                .map_io         = s3c2442_map_io,
                .init_clocks    = s3c244x_init_clocks,
                .init_uarts     = s3c244x_init_uarts,
                .init           = s3c2442_init,
diff --git a/arch/arm/plat-s3c24xx/gpiolib.c b/arch/arm/plat-s3c24xx/gpiolib.c
index 24c6f5a30596..243b6411050d 100644
--- a/arch/arm/plat-s3c24xx/gpiolib.c
+++ b/arch/arm/plat-s3c24xx/gpiolib.c
@@ -82,8 +82,6 @@ static struct s3c_gpio_cfg s3c24xx_gpiocfg_banka = {
 struct s3c_gpio_cfg s3c24xx_gpiocfg_default = {
        .set_config     = s3c_gpio_setcfg_s3c24xx,
        .get_config     = s3c_gpio_getcfg_s3c24xx,
-        .set_pull       = s3c_gpio_setpull_1up,
-        .get_pull       = s3c_gpio_getpull_1up,
 };
 struct s3c_gpio_chip s3c24xx_gpios[] = {
diff --git a/arch/arm/plat-s3c24xx/include/plat/s3c244x.h b/arch/arm/plat-s3c24xx/include/plat/s3c244x.h
index 307248d1ccbb..89e8d0a25f87 100644
--- a/arch/arm/plat-s3c24xx/include/plat/s3c244x.h
+++ b/arch/arm/plat-s3c24xx/include/plat/s3c244x.h
@@ -21,17 +21,22 @@ extern void s3c244x_init_clocks(int xtal);
 #else
 #define s3c244x_init_clocks NULL
 #define s3c244x_init_uarts NULL
-#define s3c244x_map_io NULL
 #endif
 #ifdef CONFIG_CPU_S3C2440
 extern  int s3c2440_init(void);
+extern void s3c2440_map_io(void);
 #else
 #define s3c2440_init NULL
+#define s3c2440_map_io NULL
 #endif
 #ifdef CONFIG_CPU_S3C2442
 extern  int s3c2442_init(void);
+extern void s3c2442_map_io(void);
 #else
 #define s3c2442_init NULL
+#define s3c2442_map_io NULL
 #endif
diff --git a/arch/arm/plat-s3c24xx/spi-bus0-gpe11_12_13.c b/arch/arm/plat-s3c24xx/spi-bus0-gpe11_12_13.c
index 9793544a6ace..704175b0573f 100644
--- a/arch/arm/plat-s3c24xx/spi-bus0-gpe11_12_13.c
+++ b/arch/arm/plat-s3c24xx/spi-bus0-gpe11_12_13.c
@@ -29,8 +29,8 @@ void s3c24xx_spi_gpiocfg_bus0_gpe11_12_13(struct s3c2410_spi_info *spi,
        } else {
                s3c_gpio_cfgpin(S3C2410_GPE(13), S3C2410_GPIO_INPUT);
                s3c_gpio_cfgpin(S3C2410_GPE(11), S3C2410_GPIO_INPUT);
-                s3c_gpio_cfgpull(S3C2410_GPE(11), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPE(11), S3C_GPIO_PULL_NONE);
-                s3c_gpio_cfgpull(S3C2410_GPE(12), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPE(12), S3C_GPIO_PULL_NONE);
-                s3c_gpio_cfgpull(S3C2410_GPE(13), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPE(13), S3C_GPIO_PULL_NONE);
        }
 }
diff --git a/arch/arm/plat-s3c24xx/spi-bus1-gpd8_9_10.c b/arch/arm/plat-s3c24xx/spi-bus1-gpd8_9_10.c
index db9e9e477ec1..72457afd6255 100644
--- a/arch/arm/plat-s3c24xx/spi-bus1-gpd8_9_10.c
+++ b/arch/arm/plat-s3c24xx/spi-bus1-gpd8_9_10.c
@@ -31,8 +31,8 @@ void s3c24xx_spi_gpiocfg_bus1_gpd8_9_10(struct s3c2410_spi_info *spi,
        } else {
                s3c_gpio_cfgpin(S3C2410_GPD(8), S3C2410_GPIO_INPUT);
                s3c_gpio_cfgpin(S3C2410_GPD(9), S3C2410_GPIO_INPUT);
-                s3c_gpio_cfgpull(S3C2410_GPD(10), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPD(10), S3C_GPIO_PULL_NONE);
-                s3c_gpio_cfgpull(S3C2410_GPD(9), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPD(9), S3C_GPIO_PULL_NONE);
-                s3c_gpio_cfgpull(S3C2410_GPD(8), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPD(8), S3C_GPIO_PULL_NONE);
        }
 }
diff --git a/arch/arm/plat-s3c24xx/spi-bus1-gpg5_6_7.c b/arch/arm/plat-s3c24xx/spi-bus1-gpg5_6_7.c
index 8ea663a438bb..c3972b645d13 100644
--- a/arch/arm/plat-s3c24xx/spi-bus1-gpg5_6_7.c
+++ b/arch/arm/plat-s3c24xx/spi-bus1-gpg5_6_7.c
@@ -29,8 +29,8 @@ void s3c24xx_spi_gpiocfg_bus1_gpg5_6_7(struct s3c2410_spi_info *spi,
        } else {
                s3c_gpio_cfgpin(S3C2410_GPG(7), S3C2410_GPIO_INPUT);
                s3c_gpio_cfgpin(S3C2410_GPG(5), S3C2410_GPIO_INPUT);
-                s3c_gpio_cfgpull(S3C2410_GPG(5), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPG(5), S3C_GPIO_PULL_NONE);
-                s3c_gpio_cfgpull(S3C2410_GPG(6), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPG(6), S3C_GPIO_PULL_NONE);
-                s3c_gpio_cfgpull(S3C2410_GPG(7), S3C_GPIO_PULL_NONE);
+                s3c_gpio_setpull(S3C2410_GPG(7), S3C_GPIO_PULL_NONE);
        }
 }
diff --git a/arch/arm/plat-samsung/gpio-config.c b/arch/arm/plat-samsung/gpio-config.c
index b732b773b9af..0aa32f242ee4 100644
--- a/arch/arm/plat-samsung/gpio-config.c
+++ b/arch/arm/plat-samsung/gpio-config.c
@@ -280,18 +280,17 @@ s3c_gpio_pull_t s3c_gpio_getpull_updown(struct s3c_gpio_chip *chip,
 }
 #endif
-#ifdef CONFIG_S3C_GPIO_PULL_UP
+#if defined(CONFIG_S3C_GPIO_PULL_UP) || defined(CONFIG_S3C_GPIO_PULL_DOWN)
-int s3c_gpio_setpull_1up(struct s3c_gpio_chip *chip,
+static int s3c_gpio_setpull_1(struct s3c_gpio_chip *chip,
-                         unsigned int off, s3c_gpio_pull_t pull)
+                         unsigned int off, s3c_gpio_pull_t pull,
+                         s3c_gpio_pull_t updown)
 {
        void __iomem *reg = chip->base + 0x08;
        u32 pup = __raw_readl(reg);
-        pup = __raw_readl(reg);
+        if (pull == updown)
-        if (pup == S3C_GPIO_PULL_UP)
                pup &= ~(1 << off);
-        else if (pup == S3C_GPIO_PULL_NONE)
+        else if (pull == S3C_GPIO_PULL_NONE)
                pup |= (1 << off);
        else
                return -EINVAL;
@@ -300,17 +299,45 @@ int s3c_gpio_setpull_1up(struct s3c_gpio_chip *chip,
        return 0;
 }
-s3c_gpio_pull_t s3c_gpio_getpull_1up(struct s3c_gpio_chip *chip,
+static s3c_gpio_pull_t s3c_gpio_getpull_1(struct s3c_gpio_chip *chip,
-                                     unsigned int off)
+                                     unsigned int off, s3c_gpio_pull_t updown)
 {
        void __iomem *reg = chip->base + 0x08;
        u32 pup = __raw_readl(reg);
        pup &= (1 << off);
-        return pup ? S3C_GPIO_PULL_NONE : S3C_GPIO_PULL_UP;
+        return pup ? S3C_GPIO_PULL_NONE : updown;
+}
+#endif /* CONFIG_S3C_GPIO_PULL_UP || CONFIG_S3C_GPIO_PULL_DOWN */
+#ifdef CONFIG_S3C_GPIO_PULL_UP
+s3c_gpio_pull_t s3c_gpio_getpull_1up(struct s3c_gpio_chip *chip,
+                                     unsigned int off)
+{
+        return s3c_gpio_getpull_1(chip, off, S3C_GPIO_PULL_UP);
+}
+int s3c_gpio_setpull_1up(struct s3c_gpio_chip *chip,
+                         unsigned int off, s3c_gpio_pull_t pull)
+{
+        return s3c_gpio_setpull_1(chip, off, pull, S3C_GPIO_PULL_UP);
 }
 #endif /* CONFIG_S3C_GPIO_PULL_UP */
+#ifdef CONFIG_S3C_GPIO_PULL_DOWN
+s3c_gpio_pull_t s3c_gpio_getpull_1down(struct s3c_gpio_chip *chip,
+                                     unsigned int off)
+{
+        return s3c_gpio_getpull_1(chip, off, S3C_GPIO_PULL_DOWN);
+}
+int s3c_gpio_setpull_1down(struct s3c_gpio_chip *chip,
+                         unsigned int off, s3c_gpio_pull_t pull)
+{
+        return s3c_gpio_setpull_1(chip, off, pull, S3C_GPIO_PULL_DOWN);
+}
+#endif /* CONFIG_S3C_GPIO_PULL_DOWN */
 #ifdef CONFIG_S5P_GPIO_DRVSTR
 s5p_gpio_drvstr_t s5p_gpio_get_drvstr(unsigned int pin)
 {
diff --git a/arch/arm/plat-samsung/include/plat/gpio-cfg-helpers.h b/arch/arm/plat-samsung/include/plat/gpio-cfg-helpers.h
index 8fd65d8b5863..0d2c5703f1ee 100644
--- a/arch/arm/plat-samsung/include/plat/gpio-cfg-helpers.h
+++ b/arch/arm/plat-samsung/include/plat/gpio-cfg-helpers.h
@@ -210,6 +210,17 @@ extern s3c_gpio_pull_t s3c_gpio_getpull_1up(struct s3c_gpio_chip *chip,
                                            unsigned int off);
 /**
+ * s3c_gpio_getpull_1down() - Get configuration for choice of down or none
+ * @chip: The gpio chip that the GPIO pin belongs to
+ * @off: The offset to the pin to get the configuration of.
+ *
+ * This helper function reads the state of the pull-down resistor for the
+ * given GPIO in the same case as s3c_gpio_setpull_1down.
+*/
+extern s3c_gpio_pull_t s3c_gpio_getpull_1down(struct s3c_gpio_chip *chip,
+                                            unsigned int off);
+/**
 * s3c_gpio_setpull_s3c2443() - Pull configuration for s3c2443.
 * @chip: The gpio chip that is being configured.
 * @off: The offset for the GPIO being configured.
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index d66cead97d28..9897dcfc16d6 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -206,6 +206,7 @@ ENTRY(vfp_save_state)
        mov     pc, lr
 ENDPROC(vfp_save_state)
+        .align
 last_VFP_context_address:
        .word   last_VFP_context
diff --git a/arch/mn10300/include/asm/syscall.h b/arch/mn10300/include/asm/syscall.h
new file mode 100644
index 000000000000..b44b0bb75a01
--- /dev/null
+++ b/arch/mn10300/include/asm/syscall.h
@@ -0,0 +1,117 @@
+/* Access to user system call parameters and results
+ *
+ * See asm-generic/syscall.h for function descriptions.
+ *
+ * Copyright (C) 2010 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+#ifndef _ASM_SYSCALL_H
+#define _ASM_SYSCALL_H
+#include <linux/sched.h>
+#include <linux/err.h>
+extern const unsigned long sys_call_table[];
+static inline int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
+{
+        return regs->orig_d0;
+}
+static inline void syscall_rollback(struct task_struct *task,
+                                    struct pt_regs *regs)
+{
+        regs->d0 = regs->orig_d0;
+}
+static inline long syscall_get_error(struct task_struct *task,
+                                     struct pt_regs *regs)
+{
+        unsigned long error = regs->d0;
+        return IS_ERR_VALUE(error) ? error : 0;
+}
+static inline long syscall_get_return_value(struct task_struct *task,
+                                            struct pt_regs *regs)
+{
+        return regs->d0;
+}
+static inline void syscall_set_return_value(struct task_struct *task,
+                                            struct pt_regs *regs,
+                                            int error, long val)
+{
+        regs->d0 = (long) error ?: val;
+}
+static inline void syscall_get_arguments(struct task_struct *task,
+                                         struct pt_regs *regs,
+                                         unsigned int i, unsigned int n,
+                                         unsigned long *args)
+{
+        switch (i) {
+        case 0:
+                if (!n--) break;
+                *args++ = regs->a0;
+        case 1:
+                if (!n--) break;
+                *args++ = regs->d1;
+        case 2:
+                if (!n--) break;
+                *args++ = regs->a3;
+        case 3:
+                if (!n--) break;
+                *args++ = regs->a2;
+        case 4:
+                if (!n--) break;
+                *args++ = regs->d3;
+        case 5:
+                if (!n--) break;
+                *args++ = regs->d2;
+        case 6:
+                if (!n--) break;
+        default:
+                BUG();
+                break;
+        }
+}
+static inline void syscall_set_arguments(struct task_struct *task,
+                                         struct pt_regs *regs,
+                                         unsigned int i, unsigned int n,
+                                         const unsigned long *args)
+{
+        switch (i) {
+        case 0:
+                if (!n--) break;
+                regs->a0 = *args++;
+        case 1:
+                if (!n--) break;
+                regs->d1 = *args++;
+        case 2:
+                if (!n--) break;
+                regs->a3 = *args++;
+        case 3:
+                if (!n--) break;
+                regs->a2 = *args++;
+        case 4:
+                if (!n--) break;
+                regs->d3 = *args++;
+        case 5:
+                if (!n--) break;
+                regs->d2 = *args++;
+        case 6:
+                if (!n--) break;
+        default:
+                BUG();
+                break;
+        }
+}
+#endif /* _ASM_SYSCALL_H */
diff --git a/arch/mn10300/kernel/gdb-io-serial.c b/arch/mn10300/kernel/gdb-io-serial.c
index 0d5d63c91dc3..f28dc99c6f72 100644
--- a/arch/mn10300/kernel/gdb-io-serial.c
+++ b/arch/mn10300/kernel/gdb-io-serial.c
@@ -73,7 +73,8 @@ void gdbstub_io_init(void)
        GDBPORT_SERIAL_IER = UART_IER_RDI | UART_IER_RLSI;
        /* permit level 0 IRQs to take place */
-        local_change_intr_mask_level(NUM2EPSW_IM(CONFIG_GDBSTUB_IRQ_LEVEL + 1));
+        arch_local_change_intr_mask_level(
+                NUM2EPSW_IM(CONFIG_GDBSTUB_IRQ_LEVEL + 1));
 }
 /*
diff --git a/arch/mn10300/kernel/gdb-io-ttysm.c b/arch/mn10300/kernel/gdb-io-ttysm.c
index 97dfda23342c..abdeea153c89 100644
--- a/arch/mn10300/kernel/gdb-io-ttysm.c
+++ b/arch/mn10300/kernel/gdb-io-ttysm.c
@@ -87,7 +87,8 @@ void __init gdbstub_io_init(void)
        tmp = *gdbstub_port->_control;
        /* permit level 0 IRQs only */
-        local_change_intr_mask_level(NUM2EPSW_IM(CONFIG_GDBSTUB_IRQ_LEVEL + 1));
+        arch_local_change_intr_mask_level(
+                NUM2EPSW_IM(CONFIG_GDBSTUB_IRQ_LEVEL + 1));
 }
 /*
diff --git a/arch/mn10300/kernel/gdb-stub.c b/arch/mn10300/kernel/gdb-stub.c
index a5fc3f05309b..b169d99d9f20 100644
--- a/arch/mn10300/kernel/gdb-stub.c
+++ b/arch/mn10300/kernel/gdb-stub.c
@@ -1194,7 +1194,8 @@ static int gdbstub(struct pt_regs *regs, enum exception_code excep)
        asm volatile("mov mdr,%0" : "=d"(mdr));
        local_save_flags(epsw);
-        local_change_intr_mask_level(NUM2EPSW_IM(CONFIG_GDBSTUB_IRQ_LEVEL + 1));
+        arch_local_change_intr_mask_level(
+                NUM2EPSW_IM(CONFIG_GDBSTUB_IRQ_LEVEL + 1));
        gdbstub_store_fpu();
diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
index 5024f643b3b1..d7d94b845dc2 100644
--- a/arch/parisc/kernel/irq.c
+++ b/arch/parisc/kernel/irq.c
@@ -75,9 +75,6 @@ static void cpu_unmask_irq(unsigned int irq)
        smp_send_all_nop();
 }
-void no_ack_irq(unsigned int irq) { }
-void no_end_irq(unsigned int irq) { }
 void cpu_ack_irq(unsigned int irq)
 {
        unsigned long mask = EIEM_MASK(irq);
@@ -241,7 +238,7 @@ int cpu_claim_irq(unsigned int irq, struct irq_chip *type, void *data)
        /* for iosapic interrupts */
        if (type) {
-                set_irq_chip_and_handler(irq, type, handle_level_irq);
+                set_irq_chip_and_handler(irq, type, handle_percpu_irq);
                set_irq_chip_data(irq, data);
                cpu_unmask_irq(irq);
        }
@@ -392,7 +389,7 @@ static void claim_cpu_irqs(void)
        int i;
        for (i = CPU_IRQ_BASE; i <= CPU_IRQ_MAX; i++) {
                set_irq_chip_and_handler(i, &cpu_interrupt_type,
-                        handle_level_irq);
+                                         handle_percpu_irq);
        }
        set_irq_handler(TIMER_IRQ, handle_percpu_irq);
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 35c827e94e31..609a331878e7 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -98,7 +98,6 @@ void
 sys_rt_sigreturn(struct pt_regs *regs, int in_syscall)
 {
        struct rt_sigframe __user *frame;
-        struct siginfo si;
        sigset_t set;
        unsigned long usp = (regs->gr[30] & ~(0x01UL));
        unsigned long sigframe_size = PARISC_RT_SIGFRAME_SIZE;
@@ -178,13 +177,7 @@ sys_rt_sigreturn(struct pt_regs *regs, int in_syscall)
 give_sigsegv:
        DBG(1,"sys_rt_sigreturn: Sending SIGSEGV\n");
-        si.si_signo = SIGSEGV;
+        force_sig(SIGSEGV, current);
-        si.si_errno = 0;
-        si.si_code = SI_KERNEL;
-        si.si_pid = task_pid_vnr(current);
-        si.si_uid = current_uid();
-        si.si_addr = &frame->uc;
-        force_sig_info(SIGSEGV, &si, current);
        return;
 }
diff --git a/arch/powerpc/mm/pgtable.c b/arch/powerpc/mm/pgtable.c
index 2c7e801ab20b..6a3997f98dfb 100644
--- a/arch/powerpc/mm/pgtable.c
+++ b/arch/powerpc/mm/pgtable.c
@@ -92,7 +92,7 @@ static void pte_free_rcu_callback(struct rcu_head *head)
 static void pte_free_submit(struct pte_freelist_batch *batch)
 {
-        call_rcu(&batch->rcu, pte_free_rcu_callback);
+        call_rcu_sched(&batch->rcu, pte_free_rcu_callback);
 }
 void pgtable_free_tlb(struct mmu_gather *tlb, void *table, unsigned shift)
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index ac151399ef34..1995c1712fc8 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -95,7 +95,6 @@ EXPORT_SYMBOL_GPL(s390_handle_mcck);
 static int notrace s390_revalidate_registers(struct mci *mci)
 {
        int kill_task;
-        u64 tmpclock;
        u64 zero;
        void *fpt_save_area, *fpt_creg_save_area;
@@ -214,11 +213,10 @@ static int notrace s390_revalidate_registers(struct mci *mci)
                        : "0", "cc");
 #endif
        /* Revalidate clock comparator register */
-        asm volatile(
+        if (S390_lowcore.clock_comparator == -1)
-                "       stck    0(%1)\n"
+                set_clock_comparator(S390_lowcore.mcck_clock);
-                "       sckc    0(%1)"
+        else
-                : "=m" (tmpclock) : "a" (&(tmpclock)) : "cc", "memory");
+                set_clock_comparator(S390_lowcore.clock_comparator);
        /* Check if old PSW is valid */
        if (!mci->wp)
                /*
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 56c8687b29b3..7eff9b7347c0 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -19,6 +19,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/rcupdate.h>
 #include <linux/posix-timers.h>
+#include <linux/cpu.h>
 #include <asm/s390_ext.h>
 #include <asm/timer.h>
@@ -566,6 +567,23 @@ void init_cpu_vtimer(void)
        __ctl_set_bit(0,10);
 }
+static int __cpuinit s390_nohz_notify(struct notifier_block *self,
+                                      unsigned long action, void *hcpu)
+{
+        struct s390_idle_data *idle;
+        long cpu = (long) hcpu;
+        idle = &per_cpu(s390_idle, cpu);
+        switch (action) {
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                idle->nohz_delay = 0;
+        default:
+                break;
+        }
+        return NOTIFY_OK;
+}
 void __init vtime_init(void)
 {
        /* request the cpu timer external interrupt */
@@ -574,5 +592,6 @@ void __init vtime_init(void)
        /* Enable cpu timer interrupts on the boot cpu. */
        init_cpu_vtimer();
+        cpu_notifier(s390_nohz_notify, 0);
 }
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index 752b362bf651..7c37ec359ec2 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -29,17 +29,21 @@ static void __udelay_disabled(unsigned long long usecs)
 {
        unsigned long mask, cr0, cr0_saved;
        u64 clock_saved;
+        u64 end;
+        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
+        end = get_clock() + (usecs << 12);
        clock_saved = local_tick_disable();
-        set_clock_comparator(get_clock() + (usecs << 12));
        __ctl_store(cr0_saved, 0, 0);
        cr0 = (cr0_saved & 0xffff00e0) | 0x00000800;
        __ctl_load(cr0 , 0, 0);
-        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
        lockdep_off();
-        trace_hardirqs_on();
+        do {
-        __load_psw_mask(mask);
+                set_clock_comparator(end);
-        local_irq_disable();
+                trace_hardirqs_on();
+                __load_psw_mask(mask);
+                local_irq_disable();
+        } while (get_clock() < end);
        lockdep_on();
        __ctl_load(cr0_saved, 0, 0);
        local_tick_enable(clock_saved);
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 2eaeb9e59585..f48c492a68d3 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -720,32 +720,6 @@ static struct platform_device camera_devices[] = {
 };
 /* FSI */
-/*
- * FSI-B use external clock which came from da7210.
- * So, we should change parent of fsi
- */
-#define FCLKBCR         0xa415000c
-static void fsimck_init(struct clk *clk)
-{
-        u32 status = __raw_readl(clk->enable_reg);
-        /* use external clock */
-        status &= ~0x000000ff;
-        status |= 0x00000080;
-        __raw_writel(status, clk->enable_reg);
-}
-static struct clk_ops fsimck_clk_ops = {
-        .init = fsimck_init,
-};
-static struct clk fsimckb_clk = {
-        .ops            = &fsimck_clk_ops,
-        .enable_reg     = (void __iomem *)FCLKBCR,
-        .rate           = 0, /* unknown */
-};
 static struct sh_fsi_platform_info fsi_info = {
        .portb_flags = SH_FSI_BRS_INV |
                       SH_FSI_OUT_SLAVE_MODE |
@@ -1264,10 +1238,10 @@ static int __init arch_setup(void)
        /* change parent of FSI B */
        clk = clk_get(NULL, "fsib_clk");
        if (!IS_ERR(clk)) {
-                clk_register(&fsimckb_clk);
+                /* 48kHz dummy clock was used to make sure 1/1 divide */
-                clk_set_parent(clk, &fsimckb_clk);
+                clk_set_rate(&sh7724_fsimckb_clk, 48000);
-                clk_set_rate(clk, 11000);
+                clk_set_parent(clk, &sh7724_fsimckb_clk);
-                clk_set_rate(&fsimckb_clk, 11000);
+                clk_set_rate(clk, 48000);
                clk_put(clk);
        }
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index c31d228fdfc6..527a0cd956b5 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -283,31 +283,6 @@ static struct platform_device ceu1_device = {
 };
 /* FSI */
-/*
- * FSI-A use external clock which came from ak464x.
- * So, we should change parent of fsi
- */
-#define FCLKACR         0xa4150008
-static void fsimck_init(struct clk *clk)
-{
-        u32 status = __raw_readl(clk->enable_reg);
-        /* use external clock */
-        status &= ~0x000000ff;
-        status |= 0x00000080;
-        __raw_writel(status, clk->enable_reg);
-}
-static struct clk_ops fsimck_clk_ops = {
-        .init = fsimck_init,
-};
-static struct clk fsimcka_clk = {
-        .ops            = &fsimck_clk_ops,
-        .enable_reg     = (void __iomem *)FCLKACR,
-        .rate           = 0, /* unknown */
-};
 /* change J20, J21, J22 pin to 1-2 connection to use slave mode */
 static struct sh_fsi_platform_info fsi_info = {
        .porta_flags = SH_FSI_BRS_INV |
@@ -852,37 +827,29 @@ static int __init devices_setup(void)
        gpio_request(GPIO_FN_KEYOUT0,     NULL);
        /* enable FSI */
-        gpio_request(GPIO_FN_FSIMCKB,    NULL);
        gpio_request(GPIO_FN_FSIMCKA,    NULL);
+        gpio_request(GPIO_FN_FSIIASD,    NULL);
        gpio_request(GPIO_FN_FSIOASD,    NULL);
        gpio_request(GPIO_FN_FSIIABCK,   NULL);
        gpio_request(GPIO_FN_FSIIALRCK,  NULL);
        gpio_request(GPIO_FN_FSIOABCK,   NULL);
        gpio_request(GPIO_FN_FSIOALRCK,  NULL);
        gpio_request(GPIO_FN_CLKAUDIOAO, NULL);
-        gpio_request(GPIO_FN_FSIIBSD,    NULL);
-        gpio_request(GPIO_FN_FSIOBSD,    NULL);
-        gpio_request(GPIO_FN_FSIIBBCK,   NULL);
-        gpio_request(GPIO_FN_FSIIBLRCK,  NULL);
-        gpio_request(GPIO_FN_FSIOBBCK,   NULL);
-        gpio_request(GPIO_FN_FSIOBLRCK,  NULL);
-        gpio_request(GPIO_FN_CLKAUDIOBO, NULL);
-        gpio_request(GPIO_FN_FSIIASD,    NULL);
        /* set SPU2 clock to 83.4 MHz */
        clk = clk_get(NULL, "spu_clk");
-        if (clk) {
+        if (!IS_ERR(clk)) {
                clk_set_rate(clk, clk_round_rate(clk, 83333333));
                clk_put(clk);
        }
        /* change parent of FSI A */
        clk = clk_get(NULL, "fsia_clk");
-        if (clk) {
+        if (!IS_ERR(clk)) {
-                clk_register(&fsimcka_clk);
+                /* 48kHz dummy clock was used to make sure 1/1 divide */
-                clk_set_parent(clk, &fsimcka_clk);
+                clk_set_rate(&sh7724_fsimcka_clk, 48000);
-                clk_set_rate(clk, 11000);
+                clk_set_parent(clk, &sh7724_fsimcka_clk);
-                clk_set_rate(&fsimcka_clk, 11000);
+                clk_set_rate(clk, 48000);
                clk_put(clk);
        }
diff --git a/arch/sh/include/asm/cacheflush.h b/arch/sh/include/asm/cacheflush.h
index 1f4e562c5e8c..82e1eabeac98 100644
--- a/arch/sh/include/asm/cacheflush.h
+++ b/arch/sh/include/asm/cacheflush.h
@@ -96,7 +96,7 @@ void kmap_coherent_init(void);
 void *kmap_coherent(struct page *page, unsigned long addr);
 void kunmap_coherent(void *kvaddr);
-#define PG_dcache_dirty PG_arch_1
+#define PG_dcache_clean PG_arch_1
 void cpu_cache_init(void);
diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h
index 46d5179c9f49..e3c73cdd8c90 100644
--- a/arch/sh/include/asm/processor_32.h
+++ b/arch/sh/include/asm/processor_32.h
@@ -199,10 +199,13 @@ extern unsigned long get_wchan(struct task_struct *p);
 #define ARCH_HAS_PREFETCHW
 static inline void prefetch(void *x)
 {
-        __asm__ __volatile__ ("pref @%0\n\t" : : "r" (x) : "memory");
+        __builtin_prefetch(x, 0, 3);
 }
-#define prefetchw(x)    prefetch(x)
+static inline void prefetchw(void *x)
+{
+        __builtin_prefetch(x, 1, 3);
+}
 #endif
 #endif /* __KERNEL__ */
diff --git a/arch/sh/include/cpu-sh4/cpu/sh7724.h b/arch/sh/include/cpu-sh4/cpu/sh7724.h
index 4c27b68789b3..7eb435999426 100644
--- a/arch/sh/include/cpu-sh4/cpu/sh7724.h
+++ b/arch/sh/include/cpu-sh4/cpu/sh7724.h
@@ -303,4 +303,7 @@ enum {
        SHDMA_SLAVE_SDHI1_RX,
 };
+extern struct clk sh7724_fsimcka_clk;
+extern struct clk sh7724_fsimckb_clk;
 #endif /* __ASM_SH7724_H__ */
diff --git a/arch/sh/kernel/cpu/sh4/clock-sh4-202.c b/arch/sh/kernel/cpu/sh4/clock-sh4-202.c
index 4eabc68cd753..b601fa3978d1 100644
--- a/arch/sh/kernel/cpu/sh4/clock-sh4-202.c
+++ b/arch/sh/kernel/cpu/sh4/clock-sh4-202.c
@@ -110,7 +110,7 @@ static int shoc_clk_verify_rate(struct clk *clk, unsigned long rate)
        return 0;
 }
-static int shoc_clk_set_rate(struct clk *clk, unsigned long rate, int algo_id)
+static int shoc_clk_set_rate(struct clk *clk, unsigned long rate)
 {
        unsigned long frqcr3;
        unsigned int tmp;
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
index 0fe2e9329cb2..271c0b325a9a 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
@@ -111,12 +111,21 @@ static struct clk div3_clk = {
        .parent         = &pll_clk,
 };
+/* External input clock (pin name: FSIMCKA/FSIMCKB ) */
+struct clk sh7724_fsimcka_clk = {
+};
+struct clk sh7724_fsimckb_clk = {
+};
 static struct clk *main_clks[] = {
        &r_clk,
        &extal_clk,
        &fll_clk,
        &pll_clk,
        &div3_clk,
+        &sh7724_fsimcka_clk,
+        &sh7724_fsimckb_clk,
 };
 static void div4_kick(struct clk *clk)
@@ -154,16 +163,38 @@ struct clk div4_clks[DIV4_NR] = {
        [DIV4_M1] = DIV4(FRQCRB, 4, 0x2f7c, CLK_ENABLE_ON_INIT),
 };
-enum { DIV6_V, DIV6_FA, DIV6_FB, DIV6_I, DIV6_S, DIV6_NR };
+enum { DIV6_V, DIV6_I, DIV6_S, DIV6_NR };
 static struct clk div6_clks[DIV6_NR] = {
        [DIV6_V] = SH_CLK_DIV6(&div3_clk, VCLKCR, 0),
-        [DIV6_FA] = SH_CLK_DIV6(&div3_clk, FCLKACR, 0),
-        [DIV6_FB] = SH_CLK_DIV6(&div3_clk, FCLKBCR, 0),
        [DIV6_I] = SH_CLK_DIV6(&div3_clk, IRDACLKCR, 0),
        [DIV6_S] = SH_CLK_DIV6(&div3_clk, SPUCLKCR, CLK_ENABLE_ON_INIT),
 };
+enum { DIV6_FA, DIV6_FB, DIV6_REPARENT_NR };
+/* Indices are important - they are the actual src selecting values */
+static struct clk *fclkacr_parent[] = {
+        [0] = &div3_clk,
+        [1] = NULL,
+        [2] = &sh7724_fsimcka_clk,
+        [3] = NULL,
+};
+static struct clk *fclkbcr_parent[] = {
+        [0] = &div3_clk,
+        [1] = NULL,
+        [2] = &sh7724_fsimckb_clk,
+        [3] = NULL,
+};
+static struct clk div6_reparent_clks[DIV6_REPARENT_NR] = {
+        [DIV6_FA] = SH_CLK_DIV6_EXT(&div3_clk, FCLKACR, 0,
+                                      fclkacr_parent, ARRAY_SIZE(fclkacr_parent), 6, 2),
+        [DIV6_FB] = SH_CLK_DIV6_EXT(&div3_clk, FCLKBCR, 0,
+                                      fclkbcr_parent, ARRAY_SIZE(fclkbcr_parent), 6, 2),
+};
 static struct clk mstp_clks[HWBLK_NR] = {
        SH_HWBLK_CLK(HWBLK_TLB, &div4_clks[DIV4_I], CLK_ENABLE_ON_INIT),
        SH_HWBLK_CLK(HWBLK_IC, &div4_clks[DIV4_I], CLK_ENABLE_ON_INIT),
@@ -240,8 +271,8 @@ static struct clk_lookup lookups[] = {
        /* DIV6 clocks */
        CLKDEV_CON_ID("video_clk", &div6_clks[DIV6_V]),
-        CLKDEV_CON_ID("fsia_clk", &div6_clks[DIV6_FA]),
+        CLKDEV_CON_ID("fsia_clk", &div6_reparent_clks[DIV6_FA]),
-        CLKDEV_CON_ID("fsib_clk", &div6_clks[DIV6_FB]),
+        CLKDEV_CON_ID("fsib_clk", &div6_reparent_clks[DIV6_FB]),
        CLKDEV_CON_ID("irda_clk", &div6_clks[DIV6_I]),
        CLKDEV_CON_ID("spu_clk", &div6_clks[DIV6_S]),
@@ -376,6 +407,9 @@ int __init arch_clk_init(void)
                ret = sh_clk_div6_register(div6_clks, DIV6_NR);
        if (!ret)
+                ret = sh_clk_div6_reparent_register(div6_reparent_clks, DIV6_REPARENT_NR);
+        if (!ret)
                ret = sh_hwblk_clk_register(mstp_clks, HWBLK_NR);
        return ret;
diff --git a/arch/sh/kernel/sys_sh.c b/arch/sh/kernel/sys_sh.c
index 81f58371613d..8c6a350df751 100644
--- a/arch/sh/kernel/sys_sh.c
+++ b/arch/sh/kernel/sys_sh.c
@@ -88,7 +88,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len, int op)
        }
        if (op & CACHEFLUSH_I)
-                flush_cache_all();
+                flush_icache_range(addr, addr+len);
        up_read(&current->mm->mmap_sem);
        return 0;
diff --git a/arch/sh/kernel/vsyscall/vsyscall-trapa.S b/arch/sh/kernel/vsyscall/vsyscall-trapa.S
index 3b6eb34c43fa..3e70f851cdc6 100644
--- a/arch/sh/kernel/vsyscall/vsyscall-trapa.S
+++ b/arch/sh/kernel/vsyscall/vsyscall-trapa.S
@@ -8,9 +8,9 @@ __kernel_vsyscall:
         * fill out .eh_frame -- PFM. */
 .LEND_vsyscall:
        .size __kernel_vsyscall,.-.LSTART_vsyscall
-        .previous
        .section .eh_frame,"a",@progbits
+        .previous
 .LCIE:
        .ualong .LCIE_end - .LCIE_start
 .LCIE_start:
diff --git a/arch/sh/mm/cache-sh4.c b/arch/sh/mm/cache-sh4.c
index 2cfae81914aa..92eb98633ab0 100644
--- a/arch/sh/mm/cache-sh4.c
+++ b/arch/sh/mm/cache-sh4.c
@@ -114,7 +114,7 @@ static void sh4_flush_dcache_page(void *arg)
        struct address_space *mapping = page_mapping(page);
        if (mapping && !mapping_mapped(mapping))
-                set_bit(PG_dcache_dirty, &page->flags);
+                clear_bit(PG_dcache_clean, &page->flags);
        else
 #endif
                flush_cache_one(CACHE_OC_ADDRESS_ARRAY |
@@ -239,7 +239,7 @@ static void sh4_flush_cache_page(void *args)
                 * another ASID than the current one.
                 */
                map_coherent = (current_cpu_data.dcache.n_aliases &&
-                        !test_bit(PG_dcache_dirty, &page->flags) &&
+                        test_bit(PG_dcache_clean, &page->flags) &&
                        page_mapped(page));
                if (map_coherent)
                        vaddr = kmap_coherent(page, address);
diff --git a/arch/sh/mm/cache-sh7705.c b/arch/sh/mm/cache-sh7705.c
index f498da1cce7a..7729cca727eb 100644
--- a/arch/sh/mm/cache-sh7705.c
+++ b/arch/sh/mm/cache-sh7705.c
@@ -139,7 +139,7 @@ static void sh7705_flush_dcache_page(void *arg)
        struct address_space *mapping = page_mapping(page);
        if (mapping && !mapping_mapped(mapping))
-                set_bit(PG_dcache_dirty, &page->flags);
+                clear_bit(PG_dcache_clean, &page->flags);
        else
                __flush_dcache_page(__pa(page_address(page)));
 }
diff --git a/arch/sh/mm/cache.c b/arch/sh/mm/cache.c
index ba401d137bb9..88d3dc3d30d5 100644
--- a/arch/sh/mm/cache.c
+++ b/arch/sh/mm/cache.c
@@ -60,14 +60,14 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
                       unsigned long len)
 {
        if (boot_cpu_data.dcache.n_aliases && page_mapped(page) &&
-            !test_bit(PG_dcache_dirty, &page->flags)) {
+            test_bit(PG_dcache_clean, &page->flags)) {
                void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
                memcpy(vto, src, len);
                kunmap_coherent(vto);
        } else {
                memcpy(dst, src, len);
                if (boot_cpu_data.dcache.n_aliases)
-                        set_bit(PG_dcache_dirty, &page->flags);
+                        clear_bit(PG_dcache_clean, &page->flags);
        }
        if (vma->vm_flags & VM_EXEC)
@@ -79,14 +79,14 @@ void copy_from_user_page(struct vm_area_struct *vma, struct page *page,
                         unsigned long len)
 {
        if (boot_cpu_data.dcache.n_aliases && page_mapped(page) &&
-            !test_bit(PG_dcache_dirty, &page->flags)) {
+            test_bit(PG_dcache_clean, &page->flags)) {
                void *vfrom = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
                memcpy(dst, vfrom, len);
                kunmap_coherent(vfrom);
        } else {
                memcpy(dst, src, len);
                if (boot_cpu_data.dcache.n_aliases)
-                        set_bit(PG_dcache_dirty, &page->flags);
+                        clear_bit(PG_dcache_clean, &page->flags);
        }
 }
@@ -98,7 +98,7 @@ void copy_user_highpage(struct page *to, struct page *from,
        vto = kmap_atomic(to, KM_USER1);
        if (boot_cpu_data.dcache.n_aliases && page_mapped(from) &&
-            !test_bit(PG_dcache_dirty, &from->flags)) {
+            test_bit(PG_dcache_clean, &from->flags)) {
                vfrom = kmap_coherent(from, vaddr);
                copy_page(vto, vfrom);
                kunmap_coherent(vfrom);
@@ -141,7 +141,7 @@ void __update_cache(struct vm_area_struct *vma,
        page = pfn_to_page(pfn);
        if (pfn_valid(pfn)) {
-                int dirty = test_and_clear_bit(PG_dcache_dirty, &page->flags);
+                int dirty = !test_and_set_bit(PG_dcache_clean, &page->flags);
                if (dirty)
                        __flush_purge_region(page_address(page), PAGE_SIZE);
        }
@@ -153,7 +153,7 @@ void __flush_anon_page(struct page *page, unsigned long vmaddr)
        if (pages_do_alias(addr, vmaddr)) {
                if (boot_cpu_data.dcache.n_aliases && page_mapped(page) &&
-                    !test_bit(PG_dcache_dirty, &page->flags)) {
+                    test_bit(PG_dcache_clean, &page->flags)) {
                        void *kaddr;
                        kaddr = kmap_coherent(page, vmaddr);
diff --git a/arch/sh/mm/kmap.c b/arch/sh/mm/kmap.c
index 15d74ea42094..ec29e14ec5a8 100644
--- a/arch/sh/mm/kmap.c
+++ b/arch/sh/mm/kmap.c
@@ -34,7 +34,7 @@ void *kmap_coherent(struct page *page, unsigned long addr)
        enum fixed_addresses idx;
        unsigned long vaddr;
-        BUG_ON(test_bit(PG_dcache_dirty, &page->flags));
+        BUG_ON(!test_bit(PG_dcache_clean, &page->flags));
        pagefault_disable();
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 07ec8a865c1d..e11b5fcb70eb 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -329,6 +329,18 @@ endmenu  # Tilera-specific configuration
 menu "Bus options"
+config PCI
+        bool "PCI support"
+        default y
+        select PCI_DOMAINS
+        ---help---
+          Enable PCI root complex support, so PCIe endpoint devices can
+          be attached to the Tile chip.  Many, but not all, PCI devices
+          are supported under Tilera's root complex driver.
+config PCI_DOMAINS
+        bool
 config NO_IOMEM
        def_bool !PCI
diff --git a/arch/tile/include/asm/cacheflush.h b/arch/tile/include/asm/cacheflush.h
index c5741da4eeac..14a3f8556ace 100644
--- a/arch/tile/include/asm/cacheflush.h
+++ b/arch/tile/include/asm/cacheflush.h
@@ -137,4 +137,56 @@ static inline void finv_buffer(void *buffer, size_t size)
        mb_incoherent();
 }
+/*
+ * Flush & invalidate a VA range that is homed remotely on a single core,
+ * waiting until the memory controller holds the flushed values.
+ */
+static inline void finv_buffer_remote(void *buffer, size_t size)
+{
+        char *p;
+        int i;
+        /*
+         * Flush and invalidate the buffer out of the local L1/L2
+         * and request the home cache to flush and invalidate as well.
+         */
+        __finv_buffer(buffer, size);
+        /*
+         * Wait for the home cache to acknowledge that it has processed
+         * all the flush-and-invalidate requests.  This does not mean
+         * that the flushed data has reached the memory controller yet,
+         * but it does mean the home cache is processing the flushes.
+         */
+        __insn_mf();
+        /*
+         * Issue a load to the last cache line, which can't complete
+         * until all the previously-issued flushes to the same memory
+         * controller have also completed.  If we weren't striping
+         * memory, that one load would be sufficient, but since we may
+         * be, we also need to back up to the last load issued to
+         * another memory controller, which would be the point where
+         * we crossed an 8KB boundary (the granularity of striping
+         * across memory controllers).  Keep backing up and doing this
+         * until we are before the beginning of the buffer, or have
+         * hit all the controllers.
+         */
+        for (i = 0, p = (char *)buffer + size - 1;
+             i < (1 << CHIP_LOG_NUM_MSHIMS()) && p >= (char *)buffer;
+             ++i) {
+                const unsigned long STRIPE_WIDTH = 8192;
+                /* Force a load instruction to issue. */
+                *(volatile char *)p;
+                /* Jump to end of previous stripe. */
+                p -= STRIPE_WIDTH;
+                p = (char *)((unsigned long)p | (STRIPE_WIDTH - 1));
+        }
+        /* Wait for the loads (and thus flushes) to have completed. */
+        __insn_mf();
+}
 #endif /* _ASM_TILE_CACHEFLUSH_H */
diff --git a/arch/tile/include/asm/io.h b/arch/tile/include/asm/io.h
index ee43328713ab..d3cbb9b14cbe 100644
--- a/arch/tile/include/asm/io.h
+++ b/arch/tile/include/asm/io.h
@@ -55,9 +55,6 @@ extern void iounmap(volatile void __iomem *addr);
 #define ioremap_writethrough(physaddr, size)    ioremap(physaddr, size)
 #define ioremap_fullcache(physaddr, size)       ioremap(physaddr, size)
-void __iomem *ioport_map(unsigned long port, unsigned int len);
-extern inline void ioport_unmap(void __iomem *addr) {}
 #define mmiowb()
 /* Conversion between virtual and physical mappings.  */
@@ -189,12 +186,22 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
 * we never run, uses them unconditionally.
 */
-static inline int ioport_panic(void)
+static inline long ioport_panic(void)
 {
        panic("inb/outb and friends do not exist on tile");
        return 0;
 }
+static inline void __iomem *ioport_map(unsigned long port, unsigned int len)
+{
+        return (void __iomem *) ioport_panic();
+}
+static inline void ioport_unmap(void __iomem *addr)
+{
+        ioport_panic();
+}
 static inline u8 inb(unsigned long addr)
 {
        return ioport_panic();
diff --git a/arch/tile/include/asm/pci-bridge.h b/arch/tile/include/asm/pci-bridge.h
deleted file mode 100644
index e853b0e2793b..000000000000
--- a/arch/tile/include/asm/pci-bridge.h
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright 2010 Tilera Corporation. All Rights Reserved.
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of the GNU General Public License
- *   as published by the Free Software Foundation, version 2.
- *
- *   This program is distributed in the hope that it will be useful, but
- *   WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- *   NON INFRINGEMENT.  See the GNU General Public License for
- *   more details.
- */
-#ifndef _ASM_TILE_PCI_BRIDGE_H
-#define _ASM_TILE_PCI_BRIDGE_H
-#include <linux/ioport.h>
-#include <linux/pci.h>
-struct device_node;
-struct pci_controller;
-/*
- * pci_io_base returns the memory address at which you can access
- * the I/O space for PCI bus number `bus' (or NULL on error).
- */
-extern void __iomem *pci_bus_io_base(unsigned int bus);
-extern unsigned long pci_bus_io_base_phys(unsigned int bus);
-extern unsigned long pci_bus_mem_base_phys(unsigned int bus);
-/* Allocate a new PCI host bridge structure */
-extern struct pci_controller *pcibios_alloc_controller(void);
-/* Helper function for setting up resources */
-extern void pci_init_resource(struct resource *res, unsigned long start,
-                              unsigned long end, int flags, char *name);
-/* Get the PCI host controller for a bus */
-extern struct pci_controller *pci_bus_to_hose(int bus);
-/*
- * Structure of a PCI controller (host bridge)
- */
-struct pci_controller {
-        int index;              /* PCI domain number */
-        struct pci_bus *root_bus;
-        int first_busno;
-        int last_busno;
-        int hv_cfg_fd[2];       /* config{0,1} fds for this PCIe controller */
-        int hv_mem_fd;          /* fd to Hypervisor for MMIO operations */
-        struct pci_ops *ops;
-        int irq_base;           /* Base IRQ from the Hypervisor */
-        int plx_gen1;           /* flag for PLX Gen 1 configuration */
-        /* Address ranges that are routed to this controller/bridge. */
-        struct resource mem_resources[3];
-};
-static inline struct pci_controller *pci_bus_to_host(struct pci_bus *bus)
-{
-        return bus->sysdata;
-}
-extern void setup_indirect_pci_nomap(struct pci_controller *hose,
-                               void __iomem *cfg_addr, void __iomem *cfg_data);
-extern void setup_indirect_pci(struct pci_controller *hose,
-                               u32 cfg_addr, u32 cfg_data);
-extern void setup_grackle(struct pci_controller *hose);
-extern unsigned char common_swizzle(struct pci_dev *, unsigned char *);
-/*
- *   The following code swizzles for exactly one bridge.  The routine
- *   common_swizzle below handles multiple bridges.  But there are a
- *   some boards that don't follow the PCI spec's suggestion so we
- *   break this piece out separately.
- */
-static inline unsigned char bridge_swizzle(unsigned char pin,
-                unsigned char idsel)
-{
-        return (((pin-1) + idsel) % 4) + 1;
-}
-/*
- * The following macro is used to lookup irqs in a standard table
- * format for those PPC systems that do not already have PCI
- * interrupts properly routed.
- */
-/* FIXME - double check this */
-#define PCI_IRQ_TABLE_LOOKUP ({ \
-        long _ctl_ = -1; \
-        if (idsel >= min_idsel && idsel <= max_idsel && pin <= irqs_per_slot) \
-                _ctl_ = pci_irq_table[idsel - min_idsel][pin-1]; \
-        _ctl_; \
-})
-/*
- * Scan the buses below a given PCI host bridge and assign suitable
- * resources to all devices found.
- */
-extern int pciauto_bus_scan(struct pci_controller *, int);
-#ifdef CONFIG_PCI
-extern unsigned long pci_address_to_pio(phys_addr_t address);
-#else
-static inline unsigned long pci_address_to_pio(phys_addr_t address)
-{
-        return (unsigned long)-1;
-}
-#endif
-#endif /* _ASM_TILE_PCI_BRIDGE_H */
diff --git a/arch/tile/include/asm/pci.h b/arch/tile/include/asm/pci.h
index b0c15da2d5d5..c3fc458a0d32 100644
--- a/arch/tile/include/asm/pci.h
+++ b/arch/tile/include/asm/pci.h
@@ -15,7 +15,29 @@
 #ifndef _ASM_TILE_PCI_H
 #define _ASM_TILE_PCI_H
-#include <asm/pci-bridge.h>
+#include <linux/pci.h>
+/*
+ * Structure of a PCI controller (host bridge)
+ */
+struct pci_controller {
+        int index;              /* PCI domain number */
+        struct pci_bus *root_bus;
+        int first_busno;
+        int last_busno;
+        int hv_cfg_fd[2];       /* config{0,1} fds for this PCIe controller */
+        int hv_mem_fd;          /* fd to Hypervisor for MMIO operations */
+        struct pci_ops *ops;
+        int irq_base;           /* Base IRQ from the Hypervisor */
+        int plx_gen1;           /* flag for PLX Gen 1 configuration */
+        /* Address ranges that are routed to this controller/bridge. */
+        struct resource mem_resources[3];
+};
 /*
 * The hypervisor maps the entirety of CPA-space as bus addresses, so
@@ -24,56 +46,12 @@
 */
 #define PCI_DMA_BUS_IS_PHYS     1
-struct pci_controller *pci_bus_to_hose(int bus);
-unsigned char __init common_swizzle(struct pci_dev *dev, unsigned char *pinp);
 int __init tile_pci_init(void);
-void pci_iounmap(struct pci_dev *dev, void __iomem *addr);
-void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max);
-void __devinit pcibios_fixup_bus(struct pci_bus *bus);
-int __devinit _tile_cfg_read(struct pci_controller *hose,
+void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max);
-                                    int bus,
+static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr) {}
-                                    int slot,
-                                    int function,
-                                    int offset,
-                                    int size,
-                                    u32 *val);
-int __devinit _tile_cfg_write(struct pci_controller *hose,
-                                     int bus,
-                                     int slot,
-                                     int function,
-                                     int offset,
-                                     int size,
-                                     u32 val);
-/*
+void __devinit pcibios_fixup_bus(struct pci_bus *bus);
- * These are used to to config reads and writes in the early stages of
- * setup before the driver infrastructure has been set up enough to be
- * able to do config reads and writes.
- */
-#define early_cfg_read(where, size, value) \
-        _tile_cfg_read(controller, \
-                       current_bus, \
-                       pci_slot, \
-                       pci_fn, \
-                       where, \
-                       size, \
-                       value)
-#define early_cfg_write(where, size, value) \
-        _tile_cfg_write(controller, \
-                       current_bus, \
-                       pci_slot, \
-                       pci_fn, \
-                       where, \
-                       size, \
-                       value)
-#define PCICFG_BYTE     1
-#define PCICFG_WORD     2
-#define PCICFG_DWORD    4
 #define TILE_NUM_PCIE   2
@@ -88,33 +66,33 @@ static inline int pci_proc_domain(struct pci_bus *bus)
 }
 /*
- * I/O space is currently not supported.
+ * pcibios_assign_all_busses() tells whether or not the bus numbers
+ * should be reassigned, in case the BIOS didn't do it correctly, or
+ * in case we don't have a BIOS and we want to let Linux do it.
 */
+static inline int pcibios_assign_all_busses(void)
+{
+        return 1;
+}
-#define TILE_PCIE_LOWER_IO              0x0
+/*
-#define TILE_PCIE_UPPER_IO              0x10000
+ * No special bus mastering setup handling.
-#define TILE_PCIE_PCIE_IO_SIZE          0x0000FFFF
+ */
-#define _PAGE_NO_CACHE          0
-#define _PAGE_GUARDED           0
-#define pcibios_assign_all_busses()    pci_assign_all_buses
-extern int pci_assign_all_buses;
 static inline void pcibios_set_master(struct pci_dev *dev)
 {
-        /* No special bus mastering setup handling */
 }
 #define PCIBIOS_MIN_MEM         0
-#define PCIBIOS_MIN_IO          TILE_PCIE_LOWER_IO
+#define PCIBIOS_MIN_IO          0
 /*
 * This flag tells if the platform is TILEmpower that needs
 * special configuration for the PLX switch chip.
 */
-extern int blade_pci;
+extern int tile_plx_gen1;
+/* Use any cpu for PCI. */
+#define cpumask_of_pcibus(bus) cpu_online_mask
 /* implement the pci_ DMA API in terms of the generic device dma_ one */
 #include <asm-generic/pci-dma-compat.h>
@@ -122,7 +100,4 @@ extern int blade_pci;
 /* generic pci stuff */
 #include <asm-generic/pci.h>
-/* Use any cpu for PCI. */
-#define cpumask_of_pcibus(bus) cpu_online_mask
 #endif /* _ASM_TILE_PCI_H */
diff --git a/arch/tile/include/asm/processor.h b/arch/tile/include/asm/processor.h
index 1747ff3946b2..a9e7c8760334 100644
--- a/arch/tile/include/asm/processor.h
+++ b/arch/tile/include/asm/processor.h
@@ -292,8 +292,18 @@ extern int kstack_hash;
 /* Are we using huge pages in the TLB for kernel data? */
 extern int kdata_huge;
+/* Support standard Linux prefetching. */
+#define ARCH_HAS_PREFETCH
+#define prefetch(x) __builtin_prefetch(x)
 #define PREFETCH_STRIDE CHIP_L2_LINE_SIZE()
+/* Bring a value into the L1D, faulting the TLB if necessary. */
+#ifdef __tilegx__
+#define prefetch_L1(x) __insn_prefetch_l1_fault((void *)(x))
+#else
+#define prefetch_L1(x) __insn_prefetch_L1((void *)(x))
+#endif
 #else /* __ASSEMBLY__ */
 /* Do some slow action (e.g. read a slow SPR). */
diff --git a/arch/tile/include/hv/drv_xgbe_impl.h b/arch/tile/include/hv/drv_xgbe_impl.h
new file mode 100644
index 000000000000..3a73b2b44913
--- /dev/null
+++ b/arch/tile/include/hv/drv_xgbe_impl.h
@@ -0,0 +1,300 @@
+/*
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+/**
+ * @file drivers/xgbe/impl.h
+ * Implementation details for the NetIO library.
+ */
+#ifndef __DRV_XGBE_IMPL_H__
+#define __DRV_XGBE_IMPL_H__
+#include <hv/netio_errors.h>
+#include <hv/netio_intf.h>
+#include <hv/drv_xgbe_intf.h>
+/** How many groups we have (log2). */
+#define LOG2_NUM_GROUPS (12)
+/** How many groups we have. */
+#define NUM_GROUPS (1 << LOG2_NUM_GROUPS)
+/** Number of output requests we'll buffer per tile. */
+#define EPP_REQS_PER_TILE (32)
+/** Words used in an eDMA command without checksum acceleration. */
+#define EDMA_WDS_NO_CSUM      8
+/** Words used in an eDMA command with checksum acceleration. */
+#define EDMA_WDS_CSUM        10
+/** Total available words in the eDMA command FIFO. */
+#define EDMA_WDS_TOTAL      128
+/*
+ * FIXME: These definitions are internal and should have underscores!
+ * NOTE: The actual numeric values here are intentional and allow us to
+ * optimize the concept "if small ... else if large ... else ...", by
+ * checking for the low bit being set, and then for non-zero.
+ * These are used as array indices, so they must have the values (0, 1, 2)
+ * in some order.
+ */
+#define SIZE_SMALL (1)       /**< Small packet queue. */
+#define SIZE_LARGE (2)       /**< Large packet queue. */
+#define SIZE_JUMBO (0)       /**< Jumbo packet queue. */
+/** The number of "SIZE_xxx" values. */
+#define NETIO_NUM_SIZES 3
+/*
+ * Default numbers of packets for IPP drivers.  These values are chosen
+ * such that CIPP1 will not overflow its L2 cache.
+ */
+/** The default number of small packets. */
+#define NETIO_DEFAULT_SMALL_PACKETS 2750
+/** The default number of large packets. */
+#define NETIO_DEFAULT_LARGE_PACKETS 2500
+/** The default number of jumbo packets. */
+#define NETIO_DEFAULT_JUMBO_PACKETS 250
+/** Log2 of the size of a memory arena. */
+#define NETIO_ARENA_SHIFT      24      /* 16 MB */
+/** Size of a memory arena. */
+#define NETIO_ARENA_SIZE       (1 << NETIO_ARENA_SHIFT)
+/** A queue of packets.
+ *
+ * This structure partially defines a queue of packets waiting to be
+ * processed.  The queue as a whole is written to by an interrupt handler and
+ * read by non-interrupt code; this data structure is what's touched by the
+ * interrupt handler.  The other part of the queue state, the read offset, is
+ * kept in user space, not in hypervisor space, so it is in a separate data
+ * structure.
+ *
+ * The read offset (__packet_receive_read in the user part of the queue
+ * structure) points to the next packet to be read. When the read offset is
+ * equal to the write offset, the queue is empty; therefore the queue must
+ * contain one more slot than the required maximum queue size.
+ *
+ * Here's an example of all 3 state variables and what they mean.  All
+ * pointers move left to right.
+ *
+ * @code
+ *   I   I   V   V   V   V   I   I   I   I
+ *   0   1   2   3   4   5   6   7   8   9  10
+ *           ^       ^       ^               ^
+ *           |               |               |
+ *           |               |               __last_packet_plus_one
+ *           |               __buffer_write
+ *           __packet_receive_read
+ * @endcode
+ *
+ * This queue has 10 slots, and thus can hold 9 packets (_last_packet_plus_one
+ * = 10).  The read pointer is at 2, and the write pointer is at 6; thus,
+ * there are valid, unread packets in slots 2, 3, 4, and 5.  The remaining
+ * slots are invalid (do not contain a packet).
+ */
+typedef struct {
+  /** Byte offset of the next notify packet to be written: zero for the first
+   *  packet on the queue, sizeof (netio_pkt_t) for the second packet on the
+   *  queue, etc. */
+  volatile uint32_t __packet_write;
+  /** Offset of the packet after the last valid packet (i.e., when any
+   *  pointer is incremented to this value, it wraps back to zero). */
+  uint32_t __last_packet_plus_one;
+}
+__netio_packet_queue_t;
+/** A queue of buffers.
+ *
+ * This structure partially defines a queue of empty buffers which have been
+ * obtained via requests to the IPP.  (The elements of the queue are packet
+ * handles, which are transformed into a full netio_pkt_t when the buffer is
+ * retrieved.)  The queue as a whole is written to by an interrupt handler and
+ * read by non-interrupt code; this data structure is what's touched by the
+ * interrupt handler.  The other parts of the queue state, the read offset and
+ * requested write offset, are kept in user space, not in hypervisor space, so
+ * they are in a separate data structure.
+ *
+ * The read offset (__buffer_read in the user part of the queue structure)
+ * points to the next buffer to be read. When the read offset is equal to the
+ * write offset, the queue is empty; therefore the queue must contain one more
+ * slot than the required maximum queue size.
+ *
+ * The requested write offset (__buffer_requested_write in the user part of
+ * the queue structure) points to the slot which will hold the next buffer we
+ * request from the IPP, once we get around to sending such a request.  When
+ * the requested write offset is equal to the write offset, no requests for
+ * new buffers are outstanding; when the requested write offset is one greater
+ * than the read offset, no more requests may be sent.
+ *
+ * Note that, unlike the packet_queue, the buffer_queue places incoming
+ * buffers at decreasing addresses.  This makes the check for "is it time to
+ * wrap the buffer pointer" cheaper in the assembly code which receives new
+ * buffers, and means that the value which defines the queue size,
+ * __last_buffer, is different than in the packet queue.  Also, the offset
+ * used in the packet_queue is already scaled by the size of a packet; here we
+ * use unscaled slot indices for the offsets.  (These differences are
+ * historical, and in the future it's possible that the packet_queue will look
+ * more like this queue.)
+ *
+ * @code
+ * Here's an example of all 4 state variables and what they mean.  Remember:
+ * all pointers move right to left.
+ *
+ *   V   V   V   I   I   R   R   V   V   V
+ *   0   1   2   3   4   5   6   7   8   9
+ *           ^       ^       ^           ^
+ *           |       |       |           |
+ *           |       |       |           __last_buffer
+ *           |       |       __buffer_write
+ *           |       __buffer_requested_write
+ *           __buffer_read
+ * @endcode
+ *
+ * This queue has 10 slots, and thus can hold 9 buffers (_last_buffer = 9).
+ * The read pointer is at 2, and the write pointer is at 6; thus, there are
+ * valid, unread buffers in slots 2, 1, 0, 9, 8, and 7.  The requested write
+ * pointer is at 4; thus, requests have been made to the IPP for buffers which
+ * will be placed in slots 6 and 5 when they arrive.  Finally, the remaining
+ * slots are invalid (do not contain a buffer).
+ */
+typedef struct
+{
+  /** Ordinal number of the next buffer to be written: 0 for the first slot in
+   *  the queue, 1 for the second slot in the queue, etc. */
+  volatile uint32_t __buffer_write;
+  /** Ordinal number of the last buffer (i.e., when any pointer is decremented
+   *  below zero, it is reloaded with this value). */
+  uint32_t __last_buffer;
+}
+__netio_buffer_queue_t;
+/**
+ * An object for providing Ethernet packets to a process.
+ */
+typedef struct __netio_queue_impl_t
+{
+  /** The queue of packets waiting to be received. */
+  __netio_packet_queue_t __packet_receive_queue;
+  /** The intr bit mask that IDs this device. */
+  unsigned int __intr_id;
+  /** Offset to queues of empty buffers, one per size. */
+  uint32_t __buffer_queue[NETIO_NUM_SIZES];
+  /** The address of the first EPP tile, or -1 if no EPP. */
+  /* ISSUE: Actually this is always "0" or "~0". */
+  uint32_t __epp_location;
+  /** The queue ID that this queue represents. */
+  unsigned int __queue_id;
+  /** Number of acknowledgements received. */
+  volatile uint32_t __acks_received;
+  /** Last completion number received for packet_sendv. */
+  volatile uint32_t __last_completion_rcv;
+  /** Number of packets allowed to be outstanding. */
+  uint32_t __max_outstanding;
+  /** First VA available for packets. */
+  void* __va_0;
+  /** First VA in second range available for packets. */
+  void* __va_1;
+  /** Padding to align the "__packets" field to the size of a netio_pkt_t. */
+  uint32_t __padding[3];
+  /** The packets themselves. */
+  netio_pkt_t __packets[0];
+}
+netio_queue_impl_t;
+/**
+ * An object for managing the user end of a NetIO queue.
+ */
+typedef struct __netio_queue_user_impl_t
+{
+  /** The next incoming packet to be read. */
+  uint32_t __packet_receive_read;
+  /** The next empty buffers to be read, one index per size. */
+  uint8_t __buffer_read[NETIO_NUM_SIZES];
+  /** Where the empty buffer we next request from the IPP will go, one index
+   * per size. */
+  uint8_t __buffer_requested_write[NETIO_NUM_SIZES];
+  /** PCIe interface flag. */
+  uint8_t __pcie;
+  /** Number of packets left to be received before we send a credit update. */
+  uint32_t __receive_credit_remaining;
+  /** Value placed in __receive_credit_remaining when it reaches zero. */
+  uint32_t __receive_credit_interval;
+  /** First fast I/O routine index. */
+  uint32_t __fastio_index;
+  /** Number of acknowledgements expected. */
+  uint32_t __acks_outstanding;
+  /** Last completion number requested. */
+  uint32_t __last_completion_req;
+  /** File descriptor for driver. */
+  int __fd;
+}
+netio_queue_user_impl_t;
+#define NETIO_GROUP_CHUNK_SIZE   64   /**< Max # groups in one IPP request */
+#define NETIO_BUCKET_CHUNK_SIZE  64   /**< Max # buckets in one IPP request */
+/** Internal structure used to convey packet send information to the
+ * hypervisor.  FIXME: Actually, it's not used for that anymore, but
+ * netio_packet_send() still uses it internally.
+ */
+typedef struct
+{
+  uint16_t flags;              /**< Packet flags (__NETIO_SEND_FLG_xxx) */
+  uint16_t transfer_size;      /**< Size of packet */
+  uint32_t va;                 /**< VA of start of packet */
+  __netio_pkt_handle_t handle; /**< Packet handle */
+  uint32_t csum0;              /**< First checksum word */
+  uint32_t csum1;              /**< Second checksum word */
+}
+__netio_send_cmd_t;
+/** Flags used in two contexts:
+ *  - As the "flags" member in the __netio_send_cmd_t, above; used only
+ *    for netio_pkt_send_{prepare,commit}.
+ *  - As part of the flags passed to the various send packet fast I/O calls.
+ */
+/** Need acknowledgement on this packet.  Note that some code in the
+ *  normal send_pkt fast I/O handler assumes that this is equal to 1. */
+#define __NETIO_SEND_FLG_ACK    0x1
+/** Do checksum on this packet.  (Only used with the __netio_send_cmd_t;
+ *  normal packet sends use a special fast I/O index to denote checksumming,
+ *  and multi-segment sends test the checksum descriptor.) */
+#define __NETIO_SEND_FLG_CSUM   0x2
+/** Get a completion on this packet.  Only used with multi-segment sends.  */
+#define __NETIO_SEND_FLG_COMPLETION 0x4
+/** Position of the number-of-extra-segments value in the flags word.
+    Only used with multi-segment sends. */
+#define __NETIO_SEND_FLG_XSEG_SHIFT 3
+/** Width of the number-of-extra-segments value in the flags word. */
+#define __NETIO_SEND_FLG_XSEG_WIDTH 2
+#endif /* __DRV_XGBE_IMPL_H__ */
diff --git a/arch/tile/include/hv/drv_xgbe_intf.h b/arch/tile/include/hv/drv_xgbe_intf.h
new file mode 100644
index 000000000000..146e47d5334b
--- /dev/null
+++ b/arch/tile/include/hv/drv_xgbe_intf.h
@@ -0,0 +1,615 @@
+/*
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+/**
+ * @file drv_xgbe_intf.h
+ * Interface to the hypervisor XGBE driver.
+ */
+#ifndef __DRV_XGBE_INTF_H__
+#define __DRV_XGBE_INTF_H__
+/**
+ * An object for forwarding VAs and PAs to the hypervisor.
+ * @ingroup types
+ *
+ * This allows the supervisor to specify a number of areas of memory to
+ * store packet buffers.
+ */
+typedef struct
+{
+  /** The physical address of the memory. */
+  HV_PhysAddr pa;
+  /** Page table entry for the memory.  This is only used to derive the
+   *  memory's caching mode; the PA bits are ignored. */
+  HV_PTE pte;
+  /** The virtual address of the memory. */
+  HV_VirtAddr va;
+  /** Size (in bytes) of the memory area. */
+  int size;
+}
+netio_ipp_address_t;
+/** The various pread/pwrite offsets into the hypervisor-level driver.
+ * @ingroup types
+ */
+typedef enum
+{
+  /** Inform the Linux driver of the address of the NetIO arena memory.
+   *  This offset is actually only used to convey information from netio
+   *  to the Linux driver; it never makes it from there to the hypervisor.
+   *  Write-only; takes a uint32_t specifying the VA address. */
+  NETIO_FIXED_ADDR               = 0x5000000000000000ULL,
+  /** Inform the Linux driver of the size of the NetIO arena memory.
+   *  This offset is actually only used to convey information from netio
+   *  to the Linux driver; it never makes it from there to the hypervisor.
+   *  Write-only; takes a uint32_t specifying the VA size. */
+  NETIO_FIXED_SIZE               = 0x5100000000000000ULL,
+  /** Register current tile with IPP.  Write then read: write, takes a
+   *  netio_input_config_t, read returns a pointer to a netio_queue_impl_t. */
+  NETIO_IPP_INPUT_REGISTER_OFF   = 0x6000000000000000ULL,
+  /** Unregister current tile from IPP.  Write-only, takes a dummy argument. */
+  NETIO_IPP_INPUT_UNREGISTER_OFF = 0x6100000000000000ULL,
+  /** Start packets flowing.  Write-only, takes a dummy argument. */
+  NETIO_IPP_INPUT_INIT_OFF       = 0x6200000000000000ULL,
+  /** Stop packets flowing.  Write-only, takes a dummy argument. */
+  NETIO_IPP_INPUT_UNINIT_OFF     = 0x6300000000000000ULL,
+  /** Configure group (typically we group on VLAN).  Write-only: takes an
+   *  array of netio_group_t's, low 24 bits of the offset is the base group
+   *  number times the size of a netio_group_t. */
+  NETIO_IPP_INPUT_GROUP_CFG_OFF  = 0x6400000000000000ULL,
+  /** Configure bucket.  Write-only: takes an array of netio_bucket_t's, low
+   *  24 bits of the offset is the base bucket number times the size of a
+   *  netio_bucket_t. */
+  NETIO_IPP_INPUT_BUCKET_CFG_OFF = 0x6500000000000000ULL,
+  /** Get/set a parameter.  Read or write: read or write data is the parameter
+   *  value, low 32 bits of the offset is a __netio_getset_offset_t. */
+  NETIO_IPP_PARAM_OFF            = 0x6600000000000000ULL,
+  /** Get fast I/O index.  Read-only; returns a 4-byte base index value. */
+  NETIO_IPP_GET_FASTIO_OFF       = 0x6700000000000000ULL,
+  /** Configure hijack IP address.  Packets with this IPv4 dest address
+   *  go to bucket NETIO_NUM_BUCKETS - 1.  Write-only: takes an IP address
+   *  in some standard form.  FIXME: Define the form! */
+  NETIO_IPP_INPUT_HIJACK_CFG_OFF  = 0x6800000000000000ULL,
+  /**
+   * Offsets beyond this point are reserved for the supervisor (although that
+   * enforcement must be done by the supervisor driver itself).
+   */
+  NETIO_IPP_USER_MAX_OFF         = 0x6FFFFFFFFFFFFFFFULL,
+  /** Register I/O memory.  Write-only, takes a netio_ipp_address_t. */
+  NETIO_IPP_IOMEM_REGISTER_OFF   = 0x7000000000000000ULL,
+  /** Unregister I/O memory.  Write-only, takes a netio_ipp_address_t. */
+  NETIO_IPP_IOMEM_UNREGISTER_OFF = 0x7100000000000000ULL,
+  /* Offsets greater than 0x7FFFFFFF can't be used directly from Linux
+   * userspace code due to limitations in the pread/pwrite syscalls. */
+  /** Drain LIPP buffers. */
+  NETIO_IPP_DRAIN_OFF              = 0xFA00000000000000ULL,
+  /** Supply a netio_ipp_address_t to be used as shared memory for the
+   *  LEPP command queue. */
+  NETIO_EPP_SHM_OFF              = 0xFB00000000000000ULL,
+  /* 0xFC... is currently unused. */
+  /** Stop IPP/EPP tiles.  Write-only, takes a dummy argument.  */
+  NETIO_IPP_STOP_SHIM_OFF        = 0xFD00000000000000ULL,
+  /** Start IPP/EPP tiles.  Write-only, takes a dummy argument.  */
+  NETIO_IPP_START_SHIM_OFF       = 0xFE00000000000000ULL,
+  /** Supply packet arena.  Write-only, takes an array of
+    * netio_ipp_address_t values. */
+  NETIO_IPP_ADDRESS_OFF          = 0xFF00000000000000ULL,
+} netio_hv_offset_t;
+/** Extract the base offset from an offset */
+#define NETIO_BASE_OFFSET(off)    ((off) & 0xFF00000000000000ULL)
+/** Extract the local offset from an offset */
+#define NETIO_LOCAL_OFFSET(off)   ((off) & 0x00FFFFFFFFFFFFFFULL)
+/**
+ * Get/set offset.
+ */
+typedef union
+{
+  struct
+  {
+    uint64_t addr:48;        /**< Class-specific address */
+    unsigned int class:8;    /**< Class (e.g., NETIO_PARAM) */
+    unsigned int opcode:8;   /**< High 8 bits of NETIO_IPP_PARAM_OFF */
+  }
+  bits;                      /**< Bitfields */
+  uint64_t word;             /**< Aggregated value to use as the offset */
+}
+__netio_getset_offset_t;
+/**
+ * Fast I/O index offsets (must be contiguous).
+ */
+typedef enum
+{
+  NETIO_FASTIO_ALLOCATE         = 0, /**< Get empty packet buffer */
+  NETIO_FASTIO_FREE_BUFFER      = 1, /**< Give buffer back to IPP */
+  NETIO_FASTIO_RETURN_CREDITS   = 2, /**< Give credits to IPP */
+  NETIO_FASTIO_SEND_PKT_NOCK    = 3, /**< Send a packet, no checksum */
+  NETIO_FASTIO_SEND_PKT_CK      = 4, /**< Send a packet, with checksum */
+  NETIO_FASTIO_SEND_PKT_VEC     = 5, /**< Send a vector of packets */
+  NETIO_FASTIO_SENDV_PKT        = 6, /**< Sendv one packet */
+  NETIO_FASTIO_NUM_INDEX        = 7, /**< Total number of fast I/O indices */
+} netio_fastio_index_t;
+/** 3-word return type for Fast I/O call. */
+typedef struct
+{
+  int err;            /**< Error code. */
+  uint32_t val0;      /**< Value.  Meaning depends upon the specific call. */
+  uint32_t val1;      /**< Value.  Meaning depends upon the specific call. */
+} netio_fastio_rv3_t;
+/** 0-argument fast I/O call */
+int __netio_fastio0(uint32_t fastio_index);
+/** 1-argument fast I/O call */
+int __netio_fastio1(uint32_t fastio_index, uint32_t arg0);
+/** 3-argument fast I/O call, 2-word return value */
+netio_fastio_rv3_t __netio_fastio3_rv3(uint32_t fastio_index, uint32_t arg0,
+                                       uint32_t arg1, uint32_t arg2);
+/** 4-argument fast I/O call */
+int __netio_fastio4(uint32_t fastio_index, uint32_t arg0, uint32_t arg1,
+                    uint32_t arg2, uint32_t arg3);
+/** 6-argument fast I/O call */
+int __netio_fastio6(uint32_t fastio_index, uint32_t arg0, uint32_t arg1,
+                    uint32_t arg2, uint32_t arg3, uint32_t arg4, uint32_t arg5);
+/** 9-argument fast I/O call */
+int __netio_fastio9(uint32_t fastio_index, uint32_t arg0, uint32_t arg1,
+                    uint32_t arg2, uint32_t arg3, uint32_t arg4, uint32_t arg5,
+                    uint32_t arg6, uint32_t arg7, uint32_t arg8);
+/** Allocate an empty packet.
+ * @param fastio_index Fast I/O index.
+ * @param size Size of the packet to allocate.
+ */
+#define __netio_fastio_allocate(fastio_index, size) \
+  __netio_fastio1((fastio_index) + NETIO_FASTIO_ALLOCATE, size)
+/** Free a buffer.
+ * @param fastio_index Fast I/O index.
+ * @param handle Handle for the packet to free.
+ */
+#define __netio_fastio_free_buffer(fastio_index, handle) \
+  __netio_fastio1((fastio_index) + NETIO_FASTIO_FREE_BUFFER, handle)
+/** Increment our receive credits.
+ * @param fastio_index Fast I/O index.
+ * @param credits Number of credits to add.
+ */
+#define __netio_fastio_return_credits(fastio_index, credits) \
+  __netio_fastio1((fastio_index) + NETIO_FASTIO_RETURN_CREDITS, credits)
+/** Send packet, no checksum.
+ * @param fastio_index Fast I/O index.
+ * @param ackflag Nonzero if we want an ack.
+ * @param size Size of the packet.
+ * @param va Virtual address of start of packet.
+ * @param handle Packet handle.
+ */
+#define __netio_fastio_send_pkt_nock(fastio_index, ackflag, size, va, handle) \
+  __netio_fastio4((fastio_index) + NETIO_FASTIO_SEND_PKT_NOCK, ackflag, \
+                  size, va, handle)
+/** Send packet, calculate checksum.
+ * @param fastio_index Fast I/O index.
+ * @param ackflag Nonzero if we want an ack.
+ * @param size Size of the packet.
+ * @param va Virtual address of start of packet.
+ * @param handle Packet handle.
+ * @param csum0 Shim checksum header.
+ * @param csum1 Checksum seed.
+ */
+#define __netio_fastio_send_pkt_ck(fastio_index, ackflag, size, va, handle, \
+                                   csum0, csum1) \
+  __netio_fastio6((fastio_index) + NETIO_FASTIO_SEND_PKT_CK, ackflag, \
+                  size, va, handle, csum0, csum1)
+/** Format for the "csum0" argument to the __netio_fastio_send routines
+ * and LEPP.  Note that this is currently exactly identical to the
+ * ShimProtocolOffloadHeader.
+ */
+typedef union
+{
+  struct
+  {
+    unsigned int start_byte:7;       /**< The first byte to be checksummed */
+    unsigned int count:14;           /**< Number of bytes to be checksummed. */
+    unsigned int destination_byte:7; /**< The byte to write the checksum to. */
+    unsigned int reserved:4;         /**< Reserved. */
+  } bits;                            /**< Decomposed method of access. */
+  unsigned int word;                 /**< To send out the IDN. */
+} __netio_checksum_header_t;
+/** Sendv packet with 1 or 2 segments.
+ * @param fastio_index Fast I/O index.
+ * @param flags Ack/csum/notify flags in low 3 bits; number of segments minus
+ *        1 in next 2 bits; expected checksum in high 16 bits.
+ * @param confno Confirmation number to request, if notify flag set.
+ * @param csum0 Checksum descriptor; if zero, no checksum.
+ * @param va_F Virtual address of first segment.
+ * @param va_L Virtual address of last segment, if 2 segments.
+ * @param len_F_L Length of first segment in low 16 bits; length of last
+ *        segment, if 2 segments, in high 16 bits.
+ */
+#define __netio_fastio_sendv_pkt_1_2(fastio_index, flags, confno, csum0, \
+                                     va_F, va_L, len_F_L) \
+  __netio_fastio6((fastio_index) + NETIO_FASTIO_SENDV_PKT, flags, confno, \
+                  csum0, va_F, va_L, len_F_L)
+/** Send packet on PCIe interface.
+ * @param fastio_index Fast I/O index.
+ * @param flags Ack/csum/notify flags in low 3 bits.
+ * @param confno Confirmation number to request, if notify flag set.
+ * @param csum0 Checksum descriptor; Hard wired 0, not needed for PCIe.
+ * @param va_F Virtual address of the packet buffer.
+ * @param va_L Virtual address of last segment, if 2 segments. Hard wired 0.
+ * @param len_F_L Length of the packet buffer in low 16 bits.
+ */
+#define __netio_fastio_send_pcie_pkt(fastio_index, flags, confno, csum0, \
+                                     va_F, va_L, len_F_L) \
+  __netio_fastio6((fastio_index) + PCIE_FASTIO_SENDV_PKT, flags, confno, \
+                  csum0, va_F, va_L, len_F_L)
+/** Sendv packet with 3 or 4 segments.
+ * @param fastio_index Fast I/O index.
+ * @param flags Ack/csum/notify flags in low 3 bits; number of segments minus
+ *        1 in next 2 bits; expected checksum in high 16 bits.
+ * @param confno Confirmation number to request, if notify flag set.
+ * @param csum0 Checksum descriptor; if zero, no checksum.
+ * @param va_F Virtual address of first segment.
+ * @param va_L Virtual address of last segment (third segment if 3 segments,
+ *        fourth segment if 4 segments).
+ * @param len_F_L Length of first segment in low 16 bits; length of last
+ *        segment in high 16 bits.
+ * @param va_M0 Virtual address of "middle 0" segment; this segment is sent
+ *        second when there are three segments, and third if there are four.
+ * @param va_M1 Virtual address of "middle 1" segment; this segment is sent
+ *        second when there are four segments.
+ * @param len_M0_M1 Length of middle 0 segment in low 16 bits; length of middle
+ *        1 segment, if 4 segments, in high 16 bits.
+ */
+#define __netio_fastio_sendv_pkt_3_4(fastio_index, flags, confno, csum0, va_F, \
+                                     va_L, len_F_L, va_M0, va_M1, len_M0_M1) \
+  __netio_fastio9((fastio_index) + NETIO_FASTIO_SENDV_PKT, flags, confno, \
+                  csum0, va_F, va_L, len_F_L, va_M0, va_M1, len_M0_M1)
+/** Send vector of packets.
+ * @param fastio_index Fast I/O index.
+ * @param seqno Number of packets transmitted so far on this interface;
+ *        used to decide which packets should be acknowledged.
+ * @param nentries Number of entries in vector.
+ * @param va Virtual address of start of vector entry array.
+ * @return 3-word netio_fastio_rv3_t structure.  The structure's err member
+ *         is an error code, or zero if no error.  The val0 member is the
+ *         updated value of seqno; it has been incremented by 1 for each
+ *         packet sent.  That increment may be less than nentries if an
+ *         error occured, or if some of the entries in the vector contain
+ *         handles equal to NETIO_PKT_HANDLE_NONE.  The val1 member is the
+ *         updated value of nentries; it has been decremented by 1 for each
+ *         vector entry processed.  Again, that decrement may be less than
+ *         nentries (leaving the returned value positive) if an error
+ *         occurred.
+ */
+#define __netio_fastio_send_pkt_vec(fastio_index, seqno, nentries, va) \
+  __netio_fastio3_rv3((fastio_index) + NETIO_FASTIO_SEND_PKT_VEC, seqno, \
+                      nentries, va)
+/** An egress DMA command for LEPP. */
+typedef struct
+{
+  /** Is this a TSO transfer?
+   *
+   * NOTE: This field is always 0, to distinguish it from
+   * lepp_tso_cmd_t.  It must come first!
+   */
+  uint8_t tso               : 1;
+  /** Unused padding bits. */
+  uint8_t _unused           : 3;
+  /** Should this packet be sent directly from caches instead of DRAM,
+   * using hash-for-home to locate the packet data?
+   */
+  uint8_t hash_for_home     : 1;
+  /** Should we compute a checksum? */
+  uint8_t compute_checksum  : 1;
+  /** Is this the final buffer for this packet?
+   *
+   * A single packet can be split over several input buffers (a "gather"
+   * operation).  This flag indicates that this is the last buffer
+   * in a packet.
+   */
+  uint8_t end_of_packet     : 1;
+  /** Should LEPP advance 'comp_busy' when this DMA is fully finished? */
+  uint8_t send_completion   : 1;
+  /** High bits of Client Physical Address of the start of the buffer
+   *  to be egressed.
+   *
+   *  NOTE: Only 6 bits are actually needed here, as CPAs are
+   *  currently 38 bits.  So two bits could be scavenged from this.
+   */
+  uint8_t cpa_hi;
+  /** The number of bytes to be egressed. */
+  uint16_t length;
+  /** Low 32 bits of Client Physical Address of the start of the buffer
+   *  to be egressed.
+   */
+  uint32_t cpa_lo;
+  /** Checksum information (only used if 'compute_checksum'). */
+  __netio_checksum_header_t checksum_data;
+} lepp_cmd_t;
+/** A chunk of physical memory for a TSO egress. */
+typedef struct
+{
+  /** The low bits of the CPA. */
+  uint32_t cpa_lo;
+  /** The high bits of the CPA. */
+  uint16_t cpa_hi               : 15;
+  /** Should this packet be sent directly from caches instead of DRAM,
+   *  using hash-for-home to locate the packet data?
+   */
+  uint16_t hash_for_home        : 1;
+  /** The length in bytes. */
+  uint16_t length;
+} lepp_frag_t;
+/** An LEPP command that handles TSO. */
+typedef struct
+{
+  /** Is this a TSO transfer?
+   *
+   *  NOTE: This field is always 1, to distinguish it from
+   *  lepp_cmd_t.  It must come first!
+   */
+  uint8_t tso             : 1;
+  /** Unused padding bits. */
+  uint8_t _unused         : 7;
+  /** Size of the header[] array in bytes.  It must be in the range
+   *  [40, 127], which are the smallest header for a TCP packet over
+   *  Ethernet and the maximum possible prepend size supported by
+   *  hardware, respectively.  Note that the array storage must be
+   *  padded out to a multiple of four bytes so that the following
+   *  LEPP command is aligned properly.
+   */
+  uint8_t header_size;
+  /** Byte offset of the IP header in header[]. */
+  uint8_t ip_offset;
+  /** Byte offset of the TCP header in header[]. */
+  uint8_t tcp_offset;
+  /** The number of bytes to use for the payload of each packet,
+   *  except of course the last one, which may not have enough bytes.
+   *  This means that each Ethernet packet except the last will have a
+   *  size of header_size + payload_size.
+   */
+  uint16_t payload_size;
+  /** The length of the 'frags' array that follows this struct. */
+  uint16_t num_frags;
+  /** The actual frags. */
+  lepp_frag_t frags[0 /* Variable-sized; num_frags entries. */];
+  /*
+   * The packet header template logically follows frags[],
+   * but you can't declare that in C.
+   *
+   * uint32_t header[header_size_in_words_rounded_up];
+   */
+} lepp_tso_cmd_t;
+/** An LEPP completion ring entry. */
+typedef void* lepp_comp_t;
+/** Maximum number of frags for one TSO command.  This is adapted from
+ *  linux's "MAX_SKB_FRAGS", and presumably over-estimates by one, for
+ *  our page size of exactly 65536.  We add one for a "body" fragment.
+ */
+#define LEPP_MAX_FRAGS (65536 / HV_PAGE_SIZE_SMALL + 2 + 1)
+/** Total number of bytes needed for an lepp_tso_cmd_t. */
+#define LEPP_TSO_CMD_SIZE(num_frags, header_size) \
+  (sizeof(lepp_tso_cmd_t) + \
+   (num_frags) * sizeof(lepp_frag_t) + \
+   (((header_size) + 3) & -4))
+/** The size of the lepp "cmd" queue. */
+#define LEPP_CMD_QUEUE_BYTES \
+ (((CHIP_L2_CACHE_SIZE() - 2 * CHIP_L2_LINE_SIZE()) / \
+  (sizeof(lepp_cmd_t) + sizeof(lepp_comp_t))) * sizeof(lepp_cmd_t))
+/** The largest possible command that can go in lepp_queue_t::cmds[]. */
+#define LEPP_MAX_CMD_SIZE LEPP_TSO_CMD_SIZE(LEPP_MAX_FRAGS, 128)
+/** The largest possible value of lepp_queue_t::cmd_{head, tail} (inclusive).
+ */
+#define LEPP_CMD_LIMIT \
+  (LEPP_CMD_QUEUE_BYTES - LEPP_MAX_CMD_SIZE)
+/** The maximum number of completions in an LEPP queue. */
+#define LEPP_COMP_QUEUE_SIZE \
+  ((LEPP_CMD_LIMIT + sizeof(lepp_cmd_t) - 1) / sizeof(lepp_cmd_t))
+/** Increment an index modulo the queue size. */
+#define LEPP_QINC(var) \
+  (var = __insn_mnz(var - (LEPP_COMP_QUEUE_SIZE - 1), var + 1))
+/** A queue used to convey egress commands from the client to LEPP. */
+typedef struct
+{
+  /** Index of first completion not yet processed by user code.
+   *  If this is equal to comp_busy, there are no such completions.
+   *
+   *  NOTE: This is only read/written by the user.
+   */
+  unsigned int comp_head;
+  /** Index of first completion record not yet completed.
+   *  If this is equal to comp_tail, there are no such completions.
+   *  This index gets advanced (modulo LEPP_QUEUE_SIZE) whenever
+   *  a command with the 'completion' bit set is finished.
+   *
+   *  NOTE: This is only written by LEPP, only read by the user.
+   */
+  volatile unsigned int comp_busy;
+  /** Index of the first empty slot in the completion ring.
+   *  Entries from this up to but not including comp_head (in ring order)
+   *  can be filled in with completion data.
+   *
+   *  NOTE: This is only read/written by the user.
+   */
+  unsigned int comp_tail;
+  /** Byte index of first command enqueued for LEPP but not yet processed.
+   *
+   *  This is always divisible by sizeof(void*) and always <= LEPP_CMD_LIMIT.
+   *
+   *  NOTE: LEPP advances this counter as soon as it no longer needs
+   *  the cmds[] storage for this entry, but the transfer is not actually
+   *  complete (i.e. the buffer pointed to by the command is no longer
+   *  needed) until comp_busy advances.
+   *
+   *  If this is equal to cmd_tail, the ring is empty.
+   *
+   *  NOTE: This is only written by LEPP, only read by the user.
+   */
+  volatile unsigned int cmd_head;
+  /** Byte index of first empty slot in the command ring.  This field can
+   *  be incremented up to but not equal to cmd_head (because that would
+   *  mean the ring is empty).
+   *
+   *  This is always divisible by sizeof(void*) and always <= LEPP_CMD_LIMIT.
+   *
+   *  NOTE: This is read/written by the user, only read by LEPP.
+   */
+  volatile unsigned int cmd_tail;
+  /** A ring of variable-sized egress DMA commands.
+   *
+   *  NOTE: Only written by the user, only read by LEPP.
+   */
+  char cmds[LEPP_CMD_QUEUE_BYTES]
+    __attribute__((aligned(CHIP_L2_LINE_SIZE())));
+  /** A ring of user completion data.
+   *  NOTE: Only read/written by the user.
+   */
+  lepp_comp_t comps[LEPP_COMP_QUEUE_SIZE]
+    __attribute__((aligned(CHIP_L2_LINE_SIZE())));
+} lepp_queue_t;
+/** An internal helper function for determining the number of entries
+ *  available in a ring buffer, given that there is one sentinel.
+ */
+static inline unsigned int
+_lepp_num_free_slots(unsigned int head, unsigned int tail)
+{
+  /*
+   * One entry is reserved for use as a sentinel, to distinguish
+   * "empty" from "full".  So we compute
+   * (head - tail - 1) % LEPP_QUEUE_SIZE, but without using a slow % operation.
+   */
+  return (head - tail - 1) + ((head <= tail) ? LEPP_COMP_QUEUE_SIZE : 0);
+}
+/** Returns how many new comp entries can be enqueued. */
+static inline unsigned int
+lepp_num_free_comp_slots(const lepp_queue_t* q)
+{
+  return _lepp_num_free_slots(q->comp_head, q->comp_tail);
+}
+static inline int
+lepp_qsub(int v1, int v2)
+{
+  int delta = v1 - v2;
+  return delta + ((delta >> 31) & LEPP_COMP_QUEUE_SIZE);
+}
+/** FIXME: Check this from linux, via a new "pwrite()" call. */
+#define LIPP_VERSION 1
+/** We use exactly two bytes of alignment padding. */
+#define LIPP_PACKET_PADDING 2
+/** The minimum size of a "small" buffer (including the padding). */
+#define LIPP_SMALL_PACKET_SIZE 128
+/*
+ * NOTE: The following two values should total to less than around
+ * 13582, to keep the total size used for "lipp_state_t" below 64K.
+ */
+/** The maximum number of "small" buffers.
+ *  This is enough for 53 network cpus with 128 credits.  Note that
+ *  if these are exhausted, we will fall back to using large buffers.
+ */
+#define LIPP_SMALL_BUFFERS 6785
+/** The maximum number of "large" buffers.
+ *  This is enough for 53 network cpus with 128 credits.
+ */
+#define LIPP_LARGE_BUFFERS 6785
+#endif /* __DRV_XGBE_INTF_H__ */
diff --git a/arch/tile/include/hv/netio_errors.h b/arch/tile/include/hv/netio_errors.h
new file mode 100644
index 000000000000..e1591bff61b5
--- /dev/null
+++ b/arch/tile/include/hv/netio_errors.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+/**
+ * Error codes returned from NetIO routines.
+ */
+#ifndef __NETIO_ERRORS_H__
+#define __NETIO_ERRORS_H__
+/**
+ * @addtogroup error
+ *
+ * @brief The error codes returned by NetIO functions.
+ *
+ * NetIO functions return 0 (defined as ::NETIO_NO_ERROR) on success, and
+ * a negative value if an error occurs.
+ *
+ * In cases where a NetIO function failed due to a error reported by
+ * system libraries, the error code will be the negation of the
+ * system errno at the time of failure.  The @ref netio_strerror()
+ * function will deliver error strings for both NetIO and system error
+ * codes.
+ *
+ * @{
+ */
+/** The set of all NetIO errors. */
+typedef enum
+{
+  /** Operation successfully completed. */
+  NETIO_NO_ERROR        = 0,
+  /** A packet was successfully retrieved from an input queue. */
+  NETIO_PKT             = 0,
+  /** Largest NetIO error number. */
+  NETIO_ERR_MAX         = -701,
+  /** The tile is not registered with the IPP. */
+  NETIO_NOT_REGISTERED  = -701,
+  /** No packet was available to retrieve from the input queue. */
+  NETIO_NOPKT           = -702,
+  /** The requested function is not implemented. */
+  NETIO_NOT_IMPLEMENTED = -703,
+  /** On a registration operation, the target queue already has the maximum
+   *  number of tiles registered for it, and no more may be added.  On a
+   *  packet send operation, the output queue is full and nothing more can
+   *  be queued until some of the queued packets are actually transmitted. */
+  NETIO_QUEUE_FULL      = -704,
+  /** The calling process or thread is not bound to exactly one CPU. */
+  NETIO_BAD_AFFINITY    = -705,
+  /** Cannot allocate memory on requested controllers. */
+  NETIO_CANNOT_HOME     = -706,
+  /** On a registration operation, the IPP specified is not configured
+   *  to support the options requested; for instance, the application
+   *  wants a specific type of tagged headers which the configured IPP
+   *  doesn't support.  Or, the supplied configuration information is
+   *  not self-consistent, or is out of range; for instance, specifying
+   *  both NETIO_RECV and NETIO_NO_RECV, or asking for more than
+   *  NETIO_MAX_SEND_BUFFERS to be preallocated.  On a VLAN or bucket
+   *  configure operation, the number of items, or the base item, was
+   *  out of range.
+   */
+  NETIO_BAD_CONFIG      = -707,
+  /** Too many tiles have registered to transmit packets. */
+  NETIO_TOOMANY_XMIT    = -708,
+  /** Packet transmission was attempted on a queue which was registered
+      with transmit disabled. */
+  NETIO_UNREG_XMIT      = -709,
+  /** This tile is already registered with the IPP. */
+  NETIO_ALREADY_REGISTERED = -710,
+  /** The Ethernet link is down. The application should try again later. */
+  NETIO_LINK_DOWN       = -711,
+  /** An invalid memory buffer has been specified.  This may be an unmapped
+   * virtual address, or one which does not meet alignment requirements.
+   * For netio_input_register(), this error may be returned when multiple
+   * processes specify different memory regions to be used for NetIO
+   * buffers.  That can happen if these processes specify explicit memory
+   * regions with the ::NETIO_FIXED_BUFFER_VA flag, or if tmc_cmem_init()
+   * has not been called by a common ancestor of the processes.
+   */
+  NETIO_FAULT           = -712,
+  /** Cannot combine user-managed shared memory and cache coherence. */
+  NETIO_BAD_CACHE_CONFIG = -713,
+  /** Smallest NetIO error number. */
+  NETIO_ERR_MIN         = -713,
+#ifndef __DOXYGEN__
+  /** Used internally to mean that no response is needed; never returned to
+   *  an application. */
+  NETIO_NO_RESPONSE     = 1
+#endif
+} netio_error_t;
+/** @} */
+#endif /* __NETIO_ERRORS_H__ */
diff --git a/arch/tile/include/hv/netio_intf.h b/arch/tile/include/hv/netio_intf.h
new file mode 100644
index 000000000000..8d20972aba2c
--- /dev/null
+++ b/arch/tile/include/hv/netio_intf.h
@@ -0,0 +1,2975 @@
+/*
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+/**
+ * NetIO interface structures and macros.
+ */
+#ifndef __NETIO_INTF_H__
+#define __NETIO_INTF_H__
+#include <hv/netio_errors.h>
+#ifdef __KERNEL__
+#include <linux/types.h>
+#else
+#include <stdint.h>
+#endif
+#if !defined(__HV__) && !defined(__BOGUX__) && !defined(__KERNEL__)
+#include <assert.h>
+#define netio_assert assert  /**< Enable assertions from macros */
+#else
+#define netio_assert(...) ((void)(0))  /**< Disable assertions from macros */
+#endif
+/*
+ * If none of these symbols are defined, we're building libnetio in an
+ * environment where we have pthreads, so we'll enable locking.
+ */
+#if !defined(__HV__) && !defined(__BOGUX__) && !defined(__KERNEL__) && \
+    !defined(__NEWLIB__)
+#define _NETIO_PTHREAD       /**< Include a mutex in netio_queue_t below */
+/*
+ * If NETIO_UNLOCKED is defined, we don't do use per-cpu locks on
+ * per-packet NetIO operations.  We still do pthread locking on things
+ * like netio_input_register, though.  This is used for building
+ * libnetio_unlocked.
+ */
+#ifndef NETIO_UNLOCKED
+/* Avoid PLT overhead by using our own inlined per-cpu lock. */
+#include <sched.h>
+typedef int _netio_percpu_mutex_t;
+static __inline int
+_netio_percpu_mutex_init(_netio_percpu_mutex_t* lock)
+{
+  *lock = 0;
+  return 0;
+}
+static __inline int
+_netio_percpu_mutex_lock(_netio_percpu_mutex_t* lock)
+{
+  while (__builtin_expect(__insn_tns(lock), 0))
+    sched_yield();
+  return 0;
+}
+static __inline int
+_netio_percpu_mutex_unlock(_netio_percpu_mutex_t* lock)
+{
+  *lock = 0;
+  return 0;
+}
+#else /* NETIO_UNLOCKED */
+/* Don't do any locking for per-packet NetIO operations. */
+typedef int _netio_percpu_mutex_t;
+#define _netio_percpu_mutex_init(L)
+#define _netio_percpu_mutex_lock(L)
+#define _netio_percpu_mutex_unlock(L)
+#endif /* NETIO_UNLOCKED */
+#endif /* !__HV__, !__BOGUX, !__KERNEL__, !__NEWLIB__ */
+/** How many tiles can register for a given queue.
+ *  @ingroup setup */
+#define NETIO_MAX_TILES_PER_QUEUE  64
+/** Largest permissible queue identifier.
+ *  @ingroup setup  */
+#define NETIO_MAX_QUEUE_ID        255
+#ifndef __DOXYGEN__
+/* Metadata packet checksum/ethertype flags. */
+/** The L4 checksum has not been calculated. */
+#define _NETIO_PKT_NO_L4_CSUM_SHIFT           0
+#define _NETIO_PKT_NO_L4_CSUM_RMASK           1
+#define _NETIO_PKT_NO_L4_CSUM_MASK \
+         (_NETIO_PKT_NO_L4_CSUM_RMASK << _NETIO_PKT_NO_L4_CSUM_SHIFT)
+/** The L3 checksum has not been calculated. */
+#define _NETIO_PKT_NO_L3_CSUM_SHIFT           1
+#define _NETIO_PKT_NO_L3_CSUM_RMASK           1
+#define _NETIO_PKT_NO_L3_CSUM_MASK \
+         (_NETIO_PKT_NO_L3_CSUM_RMASK << _NETIO_PKT_NO_L3_CSUM_SHIFT)
+/** The L3 checksum is incorrect (or perhaps has not been calculated). */
+#define _NETIO_PKT_BAD_L3_CSUM_SHIFT          2
+#define _NETIO_PKT_BAD_L3_CSUM_RMASK          1
+#define _NETIO_PKT_BAD_L3_CSUM_MASK \
+         (_NETIO_PKT_BAD_L3_CSUM_RMASK << _NETIO_PKT_BAD_L3_CSUM_SHIFT)
+/** The Ethernet packet type is unrecognized. */
+#define _NETIO_PKT_TYPE_UNRECOGNIZED_SHIFT    3
+#define _NETIO_PKT_TYPE_UNRECOGNIZED_RMASK    1
+#define _NETIO_PKT_TYPE_UNRECOGNIZED_MASK \
+         (_NETIO_PKT_TYPE_UNRECOGNIZED_RMASK << \
+          _NETIO_PKT_TYPE_UNRECOGNIZED_SHIFT)
+/* Metadata packet type flags. */
+/** Where the packet type bits are; this field is the index into
+ *  _netio_pkt_info. */
+#define _NETIO_PKT_TYPE_SHIFT        4
+#define _NETIO_PKT_TYPE_RMASK        0x3F
+/** How many VLAN tags the packet has, and, if we have two, which one we
+ *  actually grouped on.  A VLAN within a proprietary (Marvell or Broadcom)
+ *  tag is counted here. */
+#define _NETIO_PKT_VLAN_SHIFT        4
+#define _NETIO_PKT_VLAN_RMASK        0x3
+#define _NETIO_PKT_VLAN_MASK \
+         (_NETIO_PKT_VLAN_RMASK << _NETIO_PKT_VLAN_SHIFT)
+#define _NETIO_PKT_VLAN_NONE         0   /* No VLAN tag. */
+#define _NETIO_PKT_VLAN_ONE          1   /* One VLAN tag. */
+#define _NETIO_PKT_VLAN_TWO_OUTER    2   /* Two VLAN tags, outer one used. */
+#define _NETIO_PKT_VLAN_TWO_INNER    3   /* Two VLAN tags, inner one used. */
+/** Which proprietary tags the packet has. */
+#define _NETIO_PKT_TAG_SHIFT         6
+#define _NETIO_PKT_TAG_RMASK         0x3
+#define _NETIO_PKT_TAG_MASK \
+          (_NETIO_PKT_TAG_RMASK << _NETIO_PKT_TAG_SHIFT)
+#define _NETIO_PKT_TAG_NONE          0   /* No proprietary tags. */
+#define _NETIO_PKT_TAG_MRVL          1   /* Marvell HyperG.Stack tags. */
+#define _NETIO_PKT_TAG_MRVL_EXT      2   /* HyperG.Stack extended tags. */
+#define _NETIO_PKT_TAG_BRCM          3   /* Broadcom HiGig tags. */
+/** Whether a packet has an LLC + SNAP header. */
+#define _NETIO_PKT_SNAP_SHIFT        8
+#define _NETIO_PKT_SNAP_RMASK        0x1
+#define _NETIO_PKT_SNAP_MASK \
+          (_NETIO_PKT_SNAP_RMASK << _NETIO_PKT_SNAP_SHIFT)
+/* NOTE: Bits 9 and 10 are unused. */
+/** Length of any custom data before the L2 header, in words. */
+#define _NETIO_PKT_CUSTOM_LEN_SHIFT  11
+#define _NETIO_PKT_CUSTOM_LEN_RMASK  0x1F
+#define _NETIO_PKT_CUSTOM_LEN_MASK \
+          (_NETIO_PKT_CUSTOM_LEN_RMASK << _NETIO_PKT_CUSTOM_LEN_SHIFT)
+/** The L4 checksum is incorrect (or perhaps has not been calculated). */
+#define _NETIO_PKT_BAD_L4_CSUM_SHIFT 16
+#define _NETIO_PKT_BAD_L4_CSUM_RMASK 0x1
+#define _NETIO_PKT_BAD_L4_CSUM_MASK \
+          (_NETIO_PKT_BAD_L4_CSUM_RMASK << _NETIO_PKT_BAD_L4_CSUM_SHIFT)
+/** Length of the L2 header, in words. */
+#define _NETIO_PKT_L2_LEN_SHIFT  17
+#define _NETIO_PKT_L2_LEN_RMASK  0x1F
+#define _NETIO_PKT_L2_LEN_MASK \
+          (_NETIO_PKT_L2_LEN_RMASK << _NETIO_PKT_L2_LEN_SHIFT)
+/* Flags in minimal packet metadata. */
+/** We need an eDMA checksum on this packet. */
+#define _NETIO_PKT_NEED_EDMA_CSUM_SHIFT            0
+#define _NETIO_PKT_NEED_EDMA_CSUM_RMASK            1
+#define _NETIO_PKT_NEED_EDMA_CSUM_MASK \
+         (_NETIO_PKT_NEED_EDMA_CSUM_RMASK << _NETIO_PKT_NEED_EDMA_CSUM_SHIFT)
+/* Data within the packet information table. */
+/* Note that, for efficiency, code which uses these fields assumes that none
+ * of the shift values below are zero.  See uses below for an explanation. */
+/** Offset within the L2 header of the innermost ethertype (in halfwords). */
+#define _NETIO_PKT_INFO_ETYPE_SHIFT       6
+#define _NETIO_PKT_INFO_ETYPE_RMASK    0x1F
+/** Offset within the L2 header of the VLAN tag (in halfwords). */
+#define _NETIO_PKT_INFO_VLAN_SHIFT       11
+#define _NETIO_PKT_INFO_VLAN_RMASK     0x1F
+#endif
+/** The size of a memory buffer representing a small packet.
+ *  @ingroup egress */
+#define SMALL_PACKET_SIZE 256
+/** The size of a memory buffer representing a large packet.
+ *  @ingroup egress */
+#define LARGE_PACKET_SIZE 2048
+/** The size of a memory buffer representing a jumbo packet.
+ *  @ingroup egress */
+#define JUMBO_PACKET_SIZE (12 * 1024)
+/* Common ethertypes.
+ * @ingroup ingress */
+/** @{ */
+/** The ethertype of IPv4. */
+#define ETHERTYPE_IPv4 (0x0800)
+/** The ethertype of ARP. */
+#define ETHERTYPE_ARP (0x0806)
+/** The ethertype of VLANs. */
+#define ETHERTYPE_VLAN (0x8100)
+/** The ethertype of a Q-in-Q header. */
+#define ETHERTYPE_Q_IN_Q (0x9100)
+/** The ethertype of IPv6. */
+#define ETHERTYPE_IPv6 (0x86DD)
+/** The ethertype of MPLS. */
+#define ETHERTYPE_MPLS (0x8847)
+/** @} */
+/** The possible return values of NETIO_PKT_STATUS.
+ * @ingroup ingress
+ */
+typedef enum
+{
+  /** No problems were detected with this packet. */
+  NETIO_PKT_STATUS_OK,
+  /** The packet is undersized; this is expected behavior if the packet's
+    * ethertype is unrecognized, but otherwise the packet is likely corrupt. */
+  NETIO_PKT_STATUS_UNDERSIZE,
+  /** The packet is oversized and some trailing bytes have been discarded.
+      This is expected behavior for short packets, since it's impossible to
+      precisely determine the amount of padding which may have been added to
+      them to make them meet the minimum Ethernet packet size. */
+  NETIO_PKT_STATUS_OVERSIZE,
+  /** The packet was judged to be corrupt by hardware (for instance, it had
+      a bad CRC, or part of it was discarded due to lack of buffer space in
+      the I/O shim) and should be discarded. */
+  NETIO_PKT_STATUS_BAD
+} netio_pkt_status_t;
+/** Log2 of how many buckets we have. */
+#define NETIO_LOG2_NUM_BUCKETS (10)
+/** How many buckets we have.
+ * @ingroup ingress */
+#define NETIO_NUM_BUCKETS (1 << NETIO_LOG2_NUM_BUCKETS)
+/**
+ * @brief A group-to-bucket identifier.
+ *
+ * @ingroup setup
+ *
+ * This tells us what to do with a given group.
+ */
+typedef union {
+  /** The header broken down into bits. */
+  struct {
+    /** Whether we should balance on L4, if available */
+    unsigned int __balance_on_l4:1;
+    /** Whether we should balance on L3, if available */
+    unsigned int __balance_on_l3:1;
+    /** Whether we should balance on L2, if available */
+    unsigned int __balance_on_l2:1;
+    /** Reserved for future use */
+    unsigned int __reserved:1;
+    /** The base bucket to use to send traffic */
+    unsigned int __bucket_base:NETIO_LOG2_NUM_BUCKETS;
+    /** The mask to apply to the balancing value. This must be one less
+     * than a power of two, e.g. 0x3 or 0xFF.
+     */
+    unsigned int __bucket_mask:NETIO_LOG2_NUM_BUCKETS;
+    /** Pad to 32 bits */
+    unsigned int __padding:(32 - 4 - 2 * NETIO_LOG2_NUM_BUCKETS);
+  } bits;
+  /** To send out the IDN. */
+  unsigned int word;
+}
+netio_group_t;
+/**
+ * @brief A VLAN-to-bucket identifier.
+ *
+ * @ingroup setup
+ *
+ * This tells us what to do with a given VLAN.
+ */
+typedef netio_group_t netio_vlan_t;
+/**
+ * A bucket-to-queue mapping.
+ * @ingroup setup
+ */
+typedef unsigned char netio_bucket_t;
+/**
+ * A packet size can always fit in a netio_size_t.
+ * @ingroup setup
+ */
+typedef unsigned int netio_size_t;
+/**
+ * @brief Ethernet standard (ingress) packet metadata.
+ *
+ * @ingroup ingress
+ *
+ * This is additional data associated with each packet.
+ * This structure is opaque and accessed through the @ref ingress.
+ *
+ * Also, the buffer population operation currently assumes that standard
+ * metadata is at least as large as minimal metadata, and will need to be
+ * modified if that is no longer the case.
+ */
+typedef struct
+{
+#ifdef __DOXYGEN__
+  /** This structure is opaque. */
+  unsigned char opaque[24];
+#else
+  /** The overall ordinal of the packet */
+  unsigned int __packet_ordinal;
+  /** The ordinal of the packet within the group */
+  unsigned int __group_ordinal;
+  /** The best flow hash IPP could compute. */
+  unsigned int __flow_hash;
+  /** Flags pertaining to checksum calculation, packet type, etc. */
+  unsigned int __flags;
+  /** The first word of "user data". */
+  unsigned int __user_data_0;
+  /** The second word of "user data". */
+  unsigned int __user_data_1;
+#endif
+}
+netio_pkt_metadata_t;
+/** To ensure that the L3 header is aligned mod 4, the L2 header should be
+ * aligned mod 4 plus 2, since every supported L2 header is 4n + 2 bytes
+ * long.  The standard way to do this is to simply add 2 bytes of padding
+ * before the L2 header.
+ */
+#define NETIO_PACKET_PADDING 2
+/**
+ * @brief Ethernet minimal (egress) packet metadata.
+ *
+ * @ingroup egress
+ *
+ * This structure represents information about packets which have
+ * been processed by @ref netio_populate_buffer() or
+ * @ref netio_populate_prepend_buffer().  This structure is opaque
+ * and accessed through the @ref egress.
+ *
+ * @internal This structure is actually copied into the memory used by
+ * standard metadata, which is assumed to be large enough.
+ */
+typedef struct
+{
+#ifdef __DOXYGEN__
+  /** This structure is opaque. */
+  unsigned char opaque[14];
+#else
+  /** The offset of the L2 header from the start of the packet data. */
+  unsigned short l2_offset;
+  /** The offset of the L3 header from the start of the packet data. */
+  unsigned short l3_offset;
+  /** Where to write the checksum. */
+  unsigned char csum_location;
+  /** Where to start checksumming from. */
+  unsigned char csum_start;
+  /** Flags pertaining to checksum calculation etc. */
+  unsigned short flags;
+  /** The L2 length of the packet. */
+  unsigned short l2_length;
+  /** The checksum with which to seed the checksum generator. */
+  unsigned short csum_seed;
+  /** How much to checksum. */
+  unsigned short csum_length;
+#endif
+}
+netio_pkt_minimal_metadata_t;
+#ifndef __DOXYGEN__
+/**
+ * @brief An I/O notification header.
+ *
+ * This is the first word of data received from an I/O shim in a notification
+ * packet. It contains framing and status information.
+ */
+typedef union
+{
+  unsigned int word; /**< The whole word. */
+  /** The various fields. */
+  struct
+  {
+    unsigned int __channel:7;    /**< Resource channel. */
+    unsigned int __type:4;       /**< Type. */
+    unsigned int __ack:1;        /**< Whether an acknowledgement is needed. */
+    unsigned int __reserved:1;   /**< Reserved. */
+    unsigned int __protocol:1;   /**< A protocol-specific word is added. */
+    unsigned int __status:2;     /**< Status of the transfer. */
+    unsigned int __framing:2;    /**< Framing of the transfer. */
+    unsigned int __transfer_size:14; /**< Transfer size in bytes (total). */
+  } bits;
+}
+__netio_pkt_notif_t;
+/**
+ * Returns the base address of the packet.
+ */
+#define _NETIO_PKT_HANDLE_BASE(p) \
+  ((unsigned char*)((p).word & 0xFFFFFFC0))
+/**
+ * Returns the base address of the packet.
+ */
+#define _NETIO_PKT_BASE(p) \
+  _NETIO_PKT_HANDLE_BASE(p->__packet)
+/**
+ * @brief An I/O notification packet (second word)
+ *
+ * This is the second word of data received from an I/O shim in a notification
+ * packet.  This is the virtual address of the packet buffer, plus some flag
+ * bits.  (The virtual address of the packet is always 256-byte aligned so we
+ * have room for 8 bits' worth of flags in the low 8 bits.)
+ *
+ * @internal
+ * NOTE: The low two bits must contain "__queue", so the "packet size"
+ * (SIZE_SMALL, SIZE_LARGE, or SIZE_JUMBO) can be determined quickly.
+ *
+ * If __addr or __offset are moved, _NETIO_PKT_BASE
+ * (defined right below this) must be changed.
+ */
+typedef union
+{
+  unsigned int word; /**< The whole word. */
+  /** The various fields. */
+  struct
+  {
+    /** Which queue the packet will be returned to once it is sent back to
+        the IPP.  This is one of the SIZE_xxx values. */
+    unsigned int __queue:2;
+    /** The IPP handle of the sending IPP. */
+    unsigned int __ipp_handle:2;
+    /** Reserved for future use. */
+    unsigned int __reserved:1;
+    /** If 1, this packet has minimal (egress) metadata; otherwise, it
+        has standard (ingress) metadata. */
+    unsigned int __minimal:1;
+    /** Offset of the metadata within the packet.  This value is multiplied
+     *  by 64 and added to the base packet address to get the metadata
+     *  address.  Note that this field is aligned within the word such that
+     *  you can easily extract the metadata address with a 26-bit mask. */
+    unsigned int __offset:2;
+    /** The top 24 bits of the packet's virtual address. */
+    unsigned int __addr:24;
+  } bits;
+}
+__netio_pkt_handle_t;
+#endif /* !__DOXYGEN__ */
+/**
+ * @brief A handle for an I/O packet's storage.
+ * @ingroup ingress
+ *
+ * netio_pkt_handle_t encodes the concept of a ::netio_pkt_t with its
+ * packet metadata removed.  It is a much smaller type that exists to
+ * facilitate applications where the full ::netio_pkt_t type is too
+ * large, such as those that cache enormous numbers of packets or wish
+ * to transmit packet descriptors over the UDN.
+ *
+ * Because there is no metadata, most ::netio_pkt_t operations cannot be
+ * performed on a netio_pkt_handle_t.  It supports only
+ * netio_free_handle() (to free the buffer) and
+ * NETIO_PKT_CUSTOM_DATA_H() (to access a pointer to its contents).
+ * The application must acquire any additional metadata it wants from the
+ * original ::netio_pkt_t and record it separately.
+ *
+ * A netio_pkt_handle_t can be extracted from a ::netio_pkt_t by calling
+ * NETIO_PKT_HANDLE().  An invalid handle (analogous to NULL) can be
+ * created by assigning the value ::NETIO_PKT_HANDLE_NONE. A handle can
+ * be tested for validity with NETIO_PKT_HANDLE_IS_VALID().
+ */
+typedef struct
+{
+  unsigned int word; /**< Opaque bits. */
+} netio_pkt_handle_t;
+/**
+ * @brief A packet descriptor.
+ *
+ * @ingroup ingress
+ * @ingroup egress
+ *
+ * This data structure represents a packet.  The structure is manipulated
+ * through the @ref ingress and the @ref egress.
+ *
+ * While the contents of a netio_pkt_t are opaque, the structure itself is
+ * portable.  This means that it may be shared between all tiles which have
+ * done a netio_input_register() call for the interface on which the pkt_t
+ * was initially received (via netio_get_packet()) or retrieved (via
+ * netio_get_buffer()).  The contents of a netio_pkt_t can be transmitted to
+ * another tile via shared memory, or via a UDN message, or by other means.
+ * The destination tile may then use the pkt_t as if it had originally been
+ * received locally; it may read or write the packet's data, read its
+ * metadata, free the packet, send the packet, transfer the netio_pkt_t to
+ * yet another tile, and so forth.
+ *
+ * Once a netio_pkt_t has been transferred to a second tile, the first tile
+ * should not reference the original copy; in particular, if more than one
+ * tile frees or sends the same netio_pkt_t, the IPP's packet free lists will
+ * become corrupted.  Note also that each tile which reads or modifies
+ * packet data must obey the memory coherency rules outlined in @ref input.
+ */
+typedef struct
+{
+#ifdef __DOXYGEN__
+  /** This structure is opaque. */
+  unsigned char opaque[32];
+#else
+  /** For an ingress packet (one with standard metadata), this is the
+   *  notification header we got from the I/O shim.  For an egress packet
+   *  (one with minimal metadata), this word is zero if the packet has not
+   *  been populated, and nonzero if it has. */
+  __netio_pkt_notif_t __notif_header;
+  /** Virtual address of the packet buffer, plus state flags. */
+  __netio_pkt_handle_t __packet;
+  /** Metadata associated with the packet. */
+  netio_pkt_metadata_t __metadata;
+#endif
+}
+netio_pkt_t;
+#ifndef __DOXYGEN__
+#define __NETIO_PKT_NOTIF_HEADER(pkt) ((pkt)->__notif_header)
+#define __NETIO_PKT_IPP_HANDLE(pkt) ((pkt)->__packet.bits.__ipp_handle)
+#define __NETIO_PKT_QUEUE(pkt) ((pkt)->__packet.bits.__queue)
+#define __NETIO_PKT_NOTIF_HEADER_M(mda, pkt) ((pkt)->__notif_header)
+#define __NETIO_PKT_IPP_HANDLE_M(mda, pkt) ((pkt)->__packet.bits.__ipp_handle)
+#define __NETIO_PKT_MINIMAL(pkt) ((pkt)->__packet.bits.__minimal)
+#define __NETIO_PKT_QUEUE_M(mda, pkt) ((pkt)->__packet.bits.__queue)
+#define __NETIO_PKT_FLAGS_M(mda, pkt) ((mda)->__flags)
+/* Packet information table, used by the attribute access functions below. */
+extern const uint16_t _netio_pkt_info[];
+#endif /* __DOXYGEN__ */
+#ifndef __DOXYGEN__
+/* These macros are deprecated and will disappear in a future MDE release. */
+#define NETIO_PKT_GOOD_CHECKSUM(pkt) \
+  NETIO_PKT_L4_CSUM_CORRECT(pkt)
+#define NETIO_PKT_GOOD_CHECKSUM_M(mda, pkt) \
+  NETIO_PKT_L4_CSUM_CORRECT_M(mda, pkt)
+#endif /* __DOXYGEN__ */
+/* Packet attribute access functions. */
+/** Return a pointer to the metadata for a packet.
+ * @ingroup ingress
+ *
+ * Calling this function once and passing the result to other retrieval
+ * functions with a "_M" suffix usually improves performance.  This
+ * function must be called on an 'ingress' packet (i.e. one retrieved
+ * by @ref netio_get_packet(), on which @ref netio_populate_buffer() or
+ * @ref netio_populate_prepend_buffer have not been called). Use of this
+ * function on an 'egress' packet will cause an assertion failure.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to the packet's standard metadata.
+ */
+static __inline netio_pkt_metadata_t*
+NETIO_PKT_METADATA(netio_pkt_t* pkt)
+{
+  netio_assert(!pkt->__packet.bits.__minimal);
+  return &pkt->__metadata;
+}
+/** Return a pointer to the minimal metadata for a packet.
+ * @ingroup egress
+ *
+ * Calling this function once and passing the result to other retrieval
+ * functions with a "_MM" suffix usually improves performance.  This
+ * function must be called on an 'egress' packet (i.e. one on which
+ * @ref netio_populate_buffer() or @ref netio_populate_prepend_buffer()
+ * have been called, or one retrieved by @ref netio_get_buffer()). Use of
+ * this function on an 'ingress' packet will cause an assertion failure.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to the packet's standard metadata.
+ */
+static __inline netio_pkt_minimal_metadata_t*
+NETIO_PKT_MINIMAL_METADATA(netio_pkt_t* pkt)
+{
+  netio_assert(pkt->__packet.bits.__minimal);
+  return (netio_pkt_minimal_metadata_t*) &pkt->__metadata;
+}
+/** Determine whether a packet has 'minimal' metadata.
+ * @ingroup pktfuncs
+ *
+ * This function will return nonzero if the packet is an 'egress'
+ * packet (i.e. one on which @ref netio_populate_buffer() or
+ * @ref netio_populate_prepend_buffer() have been called, or one
+ * retrieved by @ref netio_get_buffer()), and zero if the packet
+ * is an 'ingress' packet (i.e. one retrieved by @ref netio_get_packet(),
+ * which has not been converted into an 'egress' packet).
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the packet has minimal metadata.
+ */
+static __inline unsigned int
+NETIO_PKT_IS_MINIMAL(netio_pkt_t* pkt)
+{
+  return pkt->__packet.bits.__minimal;
+}
+/** Return a handle for a packet's storage.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return A handle for the packet's storage.
+ */
+static __inline netio_pkt_handle_t
+NETIO_PKT_HANDLE(netio_pkt_t* pkt)
+{
+  netio_pkt_handle_t h;
+  h.word = pkt->__packet.word;
+  return h;
+}
+/** A special reserved value indicating the absence of a packet handle.
+ *
+ * @ingroup pktfuncs
+ */
+#define NETIO_PKT_HANDLE_NONE ((netio_pkt_handle_t) { 0 })
+/** Test whether a packet handle is valid.
+ *
+ * Applications may wish to use the reserved value NETIO_PKT_HANDLE_NONE
+ * to indicate no packet at all.  This function tests to see if a packet
+ * handle is a real handle, not this special reserved value.
+ *
+ * @ingroup pktfuncs
+ *
+ * @param[in] handle Handle on which to operate.
+ * @return One if the packet handle is valid, else zero.
+ */
+static __inline unsigned int
+NETIO_PKT_HANDLE_IS_VALID(netio_pkt_handle_t handle)
+{
+  return handle.word != 0;
+}
+/** Return a pointer to the start of the packet's custom header.
+ *  A custom header may or may not be present, depending upon the IPP; its
+ *  contents and alignment are also IPP-dependent.  Currently, none of the
+ *  standard IPPs supplied by Tilera produce a custom header.  If present,
+ *  the custom header precedes the L2 header in the packet buffer.
+ * @ingroup ingress
+ *
+ * @param[in] handle Handle on which to operate.
+ * @return A pointer to start of the packet.
+ */
+static __inline unsigned char*
+NETIO_PKT_CUSTOM_DATA_H(netio_pkt_handle_t handle)
+{
+  return _NETIO_PKT_HANDLE_BASE(handle) + NETIO_PACKET_PADDING;
+}
+/** Return the length of the packet's custom header.
+ *  A custom header may or may not be present, depending upon the IPP; its
+ *  contents and alignment are also IPP-dependent.  Currently, none of the
+ *  standard IPPs supplied by Tilera produce a custom header.  If present,
+ *  the custom header precedes the L2 header in the packet buffer.
+ *
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet's custom header, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_CUSTOM_HEADER_LENGTH_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  /*
+   * Note that we effectively need to extract a quantity from the flags word
+   * which is measured in words, and then turn it into bytes by shifting
+   * it left by 2.  We do this all at once by just shifting right two less
+   * bits, and shifting the mask up two bits.
+   */
+  return ((mda->__flags >> (_NETIO_PKT_CUSTOM_LEN_SHIFT - 2)) &
+          (_NETIO_PKT_CUSTOM_LEN_RMASK << 2));
+}
+/** Return the length of the packet, starting with the custom header.
+ *  A custom header may or may not be present, depending upon the IPP; its
+ *  contents and alignment are also IPP-dependent.  Currently, none of the
+ *  standard IPPs supplied by Tilera produce a custom header.  If present,
+ *  the custom header precedes the L2 header in the packet buffer.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_CUSTOM_LENGTH_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return (__NETIO_PKT_NOTIF_HEADER(pkt).bits.__transfer_size -
+          NETIO_PACKET_PADDING);
+}
+/** Return a pointer to the start of the packet's custom header.
+ *  A custom header may or may not be present, depending upon the IPP; its
+ *  contents and alignment are also IPP-dependent.  Currently, none of the
+ *  standard IPPs supplied by Tilera produce a custom header.  If present,
+ *  the custom header precedes the L2 header in the packet buffer.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to start of the packet.
+ */
+static __inline unsigned char*
+NETIO_PKT_CUSTOM_DATA_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return NETIO_PKT_CUSTOM_DATA_H(NETIO_PKT_HANDLE(pkt));
+}
+/** Return the length of the packet's L2 (Ethernet plus VLAN or SNAP) header.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet's L2 header, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L2_HEADER_LENGTH_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  /*
+   * Note that we effectively need to extract a quantity from the flags word
+   * which is measured in words, and then turn it into bytes by shifting
+   * it left by 2.  We do this all at once by just shifting right two less
+   * bits, and shifting the mask up two bits.  We then add two bytes.
+   */
+  return ((mda->__flags >> (_NETIO_PKT_L2_LEN_SHIFT - 2)) &
+          (_NETIO_PKT_L2_LEN_RMASK << 2)) + 2;
+}
+/** Return the length of the packet, starting with the L2 (Ethernet) header.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L2_LENGTH_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return (NETIO_PKT_CUSTOM_LENGTH_M(mda, pkt) -
+          NETIO_PKT_CUSTOM_HEADER_LENGTH_M(mda,pkt));
+}
+/** Return a pointer to the start of the packet's L2 (Ethernet) header.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to start of the packet.
+ */
+static __inline unsigned char*
+NETIO_PKT_L2_DATA_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return (NETIO_PKT_CUSTOM_DATA_M(mda, pkt) +
+          NETIO_PKT_CUSTOM_HEADER_LENGTH_M(mda, pkt));
+}
+/** Retrieve the length of the packet, starting with the L3 (generally,
+ *  the IP) header.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Length of the packet's L3 header and data, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L3_LENGTH_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return (NETIO_PKT_L2_LENGTH_M(mda, pkt) -
+          NETIO_PKT_L2_HEADER_LENGTH_M(mda,pkt));
+}
+/** Return a pointer to the packet's L3 (generally, the IP) header.
+ * @ingroup ingress
+ *
+ * Note that we guarantee word alignment of the L3 header.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to the packet's L3 header.
+ */
+static __inline unsigned char*
+NETIO_PKT_L3_DATA_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return (NETIO_PKT_L2_DATA_M(mda, pkt) +
+          NETIO_PKT_L2_HEADER_LENGTH_M(mda, pkt));
+}
+/** Return the ordinal of the packet.
+ * @ingroup ingress
+ *
+ * Each packet is given an ordinal number when it is delivered by the IPP.
+ * In the medium term, the ordinal is unique and monotonically increasing,
+ * being incremented by 1 for each packet; the ordinal of the first packet
+ * delivered after the IPP starts is zero.  (Since the ordinal is of finite
+ * size, given enough input packets, it will eventually wrap around to zero;
+ * in the long term, therefore, ordinals are not unique.)  The ordinals
+ * handed out by different IPPs are not disjoint, so two packets from
+ * different IPPs may have identical ordinals.  Packets dropped by the
+ * IPP or by the I/O shim are not assigned ordinals.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's per-IPP packet ordinal.
+ */
+static __inline unsigned int
+NETIO_PKT_ORDINAL_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return mda->__packet_ordinal;
+}
+/** Return the per-group ordinal of the packet.
+ * @ingroup ingress
+ *
+ * Each packet is given a per-group ordinal number when it is
+ * delivered by the IPP. By default, the group is the packet's VLAN,
+ * although IPP can be recompiled to use different values.  In
+ * the medium term, the ordinal is unique and monotonically
+ * increasing, being incremented by 1 for each packet; the ordinal of
+ * the first packet distributed to a particular group is zero.
+ * (Since the ordinal is of finite size, given enough input packets,
+ * it will eventually wrap around to zero; in the long term,
+ * therefore, ordinals are not unique.)  The ordinals handed out by
+ * different IPPs are not disjoint, so two packets from different IPPs
+ * may have identical ordinals; similarly, packets distributed to
+ * different groups may have identical ordinals.  Packets dropped by
+ * the IPP or by the I/O shim are not assigned ordinals.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's per-IPP, per-group ordinal.
+ */
+static __inline unsigned int
+NETIO_PKT_GROUP_ORDINAL_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return mda->__group_ordinal;
+}
+/** Return the VLAN ID assigned to the packet.
+ * @ingroup ingress
+ *
+ * This value is usually contained within the packet header.
+ *
+ * This value will be zero if the packet does not have a VLAN tag, or if
+ * this value was not extracted from the packet.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's VLAN ID.
+ */
+static __inline unsigned short
+NETIO_PKT_VLAN_ID_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  int vl = (mda->__flags >> _NETIO_PKT_VLAN_SHIFT) & _NETIO_PKT_VLAN_RMASK;
+  unsigned short* pkt_p;
+  int index;
+  unsigned short val;
+  if (vl == _NETIO_PKT_VLAN_NONE)
+    return 0;
+  pkt_p = (unsigned short*) NETIO_PKT_L2_DATA_M(mda, pkt);
+  index = (mda->__flags >> _NETIO_PKT_TYPE_SHIFT) & _NETIO_PKT_TYPE_RMASK;
+  val = pkt_p[(_netio_pkt_info[index] >> _NETIO_PKT_INFO_VLAN_SHIFT) &
+              _NETIO_PKT_INFO_VLAN_RMASK];
+#ifdef __TILECC__
+  return (__insn_bytex(val) >> 16) & 0xFFF;
+#else
+  return (__builtin_bswap32(val) >> 16) & 0xFFF;
+#endif
+}
+/** Return the ethertype of the packet.
+ * @ingroup ingress
+ *
+ * This value is usually contained within the packet header.
+ *
+ * This value is reliable if @ref NETIO_PKT_ETHERTYPE_RECOGNIZED_M()
+ * returns true, and otherwise, may not be well defined.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's ethertype.
+ */
+static __inline unsigned short
+NETIO_PKT_ETHERTYPE_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  unsigned short* pkt_p = (unsigned short*) NETIO_PKT_L2_DATA_M(mda, pkt);
+  int index = (mda->__flags >> _NETIO_PKT_TYPE_SHIFT) & _NETIO_PKT_TYPE_RMASK;
+  unsigned short val =
+    pkt_p[(_netio_pkt_info[index] >> _NETIO_PKT_INFO_ETYPE_SHIFT) &
+          _NETIO_PKT_INFO_ETYPE_RMASK];
+  return __builtin_bswap32(val) >> 16;
+}
+/** Return the flow hash computed on the packet.
+ * @ingroup ingress
+ *
+ * For TCP and UDP packets, this hash is calculated by hashing together
+ * the "5-tuple" values, specifically the source IP address, destination
+ * IP address, protocol type, source port and destination port.
+ * The hash value is intended to be helpful for millions of distinct
+ * flows.
+ *
+ * For IPv4 or IPv6 packets which are neither TCP nor UDP, the flow hash is
+ * derived by hashing together the source and destination IP addresses.
+ *
+ * For MPLS-encapsulated packets, the flow hash is derived by hashing
+ * the first MPLS label.
+ *
+ * For all other packets the flow hash is computed from the source
+ * and destination Ethernet addresses.
+ *
+ * The hash is symmetric, meaning it produces the same value if the
+ * source and destination are swapped. The only exceptions are
+ * tunneling protocols 0x04 (IP in IP Encapsulation), 0x29 (Simple
+ * Internet Protocol), 0x2F (General Routing Encapsulation) and 0x32
+ * (Encap Security Payload), which use only the destination address
+ * since the source address is not meaningful.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's 32-bit flow hash.
+ */
+static __inline unsigned int
+NETIO_PKT_FLOW_HASH_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return mda->__flow_hash;
+}
+/** Return the first word of "user data" for the packet.
+ *
+ * The contents of the user data words depend on the IPP.
+ *
+ * When using the standard ipp1, ipp2, or ipp4 sub-drivers, the first
+ * word of user data contains the least significant bits of the 64-bit
+ * arrival cycle count (see @c get_cycle_count_low()).
+ *
+ * See the <em>System Programmer's Guide</em> for details.
+ *
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's first word of "user data".
+ */
+static __inline unsigned int
+NETIO_PKT_USER_DATA_0_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return mda->__user_data_0;
+}
+/** Return the second word of "user data" for the packet.
+ *
+ * The contents of the user data words depend on the IPP.
+ *
+ * When using the standard ipp1, ipp2, or ipp4 sub-drivers, the second
+ * word of user data contains the most significant bits of the 64-bit
+ * arrival cycle count (see @c get_cycle_count_high()).
+ *
+ * See the <em>System Programmer's Guide</em> for details.
+ *
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's second word of "user data".
+ */
+static __inline unsigned int
+NETIO_PKT_USER_DATA_1_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return mda->__user_data_1;
+}
+/** Determine whether the L4 (TCP/UDP) checksum was calculated.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the L4 checksum was calculated.
+ */
+static __inline unsigned int
+NETIO_PKT_L4_CSUM_CALCULATED_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return !(mda->__flags & _NETIO_PKT_NO_L4_CSUM_MASK);
+}
+/** Determine whether the L4 (TCP/UDP) checksum was calculated and found to
+ *  be correct.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the checksum was calculated and is correct.
+ */
+static __inline unsigned int
+NETIO_PKT_L4_CSUM_CORRECT_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return !(mda->__flags &
+           (_NETIO_PKT_BAD_L4_CSUM_MASK | _NETIO_PKT_NO_L4_CSUM_MASK));
+}
+/** Determine whether the L3 (IP) checksum was calculated.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the L3 (IP) checksum was calculated.
+*/
+static __inline unsigned int
+NETIO_PKT_L3_CSUM_CALCULATED_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return !(mda->__flags & _NETIO_PKT_NO_L3_CSUM_MASK);
+}
+/** Determine whether the L3 (IP) checksum was calculated and found to be
+ *  correct.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the checksum was calculated and is correct.
+ */
+static __inline unsigned int
+NETIO_PKT_L3_CSUM_CORRECT_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return !(mda->__flags &
+           (_NETIO_PKT_BAD_L3_CSUM_MASK | _NETIO_PKT_NO_L3_CSUM_MASK));
+}
+/** Determine whether the ethertype was recognized and L3 packet data was
+ *  processed.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the ethertype was recognized and L3 packet data was
+ *   processed.
+ */
+static __inline unsigned int
+NETIO_PKT_ETHERTYPE_RECOGNIZED_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return !(mda->__flags & _NETIO_PKT_TYPE_UNRECOGNIZED_MASK);
+}
+/** Retrieve the status of a packet and any errors that may have occurred
+ * during ingress processing (length mismatches, CRC errors, etc.).
+ * @ingroup ingress
+ *
+ * Note that packets for which @ref NETIO_PKT_ETHERTYPE_RECOGNIZED()
+ * returns zero are always reported as underlength, as there is no a priori
+ * means to determine their length.  Normally, applications should use
+ * @ref NETIO_PKT_BAD_M() instead of explicitly checking status with this
+ * function.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's status.
+ */
+static __inline netio_pkt_status_t
+NETIO_PKT_STATUS_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return (netio_pkt_status_t) __NETIO_PKT_NOTIF_HEADER(pkt).bits.__status;
+}
+/** Report whether a packet is bad (i.e., was shorter than expected based on
+ *  its headers, or had a bad CRC).
+ * @ingroup ingress
+ *
+ * Note that this function does not verify L3 or L4 checksums.
+ *
+ * @param[in] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the packet is bad and should be discarded.
+ */
+static __inline unsigned int
+NETIO_PKT_BAD_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return ((NETIO_PKT_STATUS_M(mda, pkt) & 1) &&
+          (NETIO_PKT_ETHERTYPE_RECOGNIZED_M(mda, pkt) ||
+           NETIO_PKT_STATUS_M(mda, pkt) == NETIO_PKT_STATUS_BAD));
+}
+/** Return the length of the packet, starting with the L2 (Ethernet) header.
+ * @ingroup egress
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L2_LENGTH_MM(netio_pkt_minimal_metadata_t* mmd, netio_pkt_t* pkt)
+{
+  return mmd->l2_length;
+}
+/** Return the length of the L2 (Ethernet) header.
+ * @ingroup egress
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet's L2 header, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L2_HEADER_LENGTH_MM(netio_pkt_minimal_metadata_t* mmd,
+                              netio_pkt_t* pkt)
+{
+  return mmd->l3_offset - mmd->l2_offset;
+}
+/** Return the length of the packet, starting with the L3 (IP) header.
+ * @ingroup egress
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return Length of the packet's L3 header and data, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L3_LENGTH_MM(netio_pkt_minimal_metadata_t* mmd, netio_pkt_t* pkt)
+{
+  return (NETIO_PKT_L2_LENGTH_MM(mmd, pkt) -
+          NETIO_PKT_L2_HEADER_LENGTH_MM(mmd, pkt));
+}
+/** Return a pointer to the packet's L3 (generally, the IP) header.
+ * @ingroup egress
+ *
+ * Note that we guarantee word alignment of the L3 header.
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to the packet's L3 header.
+ */
+static __inline unsigned char*
+NETIO_PKT_L3_DATA_MM(netio_pkt_minimal_metadata_t* mmd, netio_pkt_t* pkt)
+{
+  return _NETIO_PKT_BASE(pkt) + mmd->l3_offset;
+}
+/** Return a pointer to the packet's L2 (Ethernet) header.
+ * @ingroup egress
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to start of the packet.
+ */
+static __inline unsigned char*
+NETIO_PKT_L2_DATA_MM(netio_pkt_minimal_metadata_t* mmd, netio_pkt_t* pkt)
+{
+  return _NETIO_PKT_BASE(pkt) + mmd->l2_offset;
+}
+/** Retrieve the status of a packet and any errors that may have occurred
+ * during ingress processing (length mismatches, CRC errors, etc.).
+ * @ingroup ingress
+ *
+ * Note that packets for which @ref NETIO_PKT_ETHERTYPE_RECOGNIZED()
+ * returns zero are always reported as underlength, as there is no a priori
+ * means to determine their length.  Normally, applications should use
+ * @ref NETIO_PKT_BAD() instead of explicitly checking status with this
+ * function.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's status.
+ */
+static __inline netio_pkt_status_t
+NETIO_PKT_STATUS(netio_pkt_t* pkt)
+{
+  netio_assert(!pkt->__packet.bits.__minimal);
+  return (netio_pkt_status_t) __NETIO_PKT_NOTIF_HEADER(pkt).bits.__status;
+}
+/** Report whether a packet is bad (i.e., was shorter than expected based on
+ *  its headers, or had a bad CRC).
+ * @ingroup ingress
+ *
+ * Note that this function does not verify L3 or L4 checksums.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the packet is bad and should be discarded.
+ */
+static __inline unsigned int
+NETIO_PKT_BAD(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_BAD_M(mda, pkt);
+}
+/** Return the length of the packet's custom header.
+ *  A custom header may or may not be present, depending upon the IPP; its
+ *  contents and alignment are also IPP-dependent.  Currently, none of the
+ *  standard IPPs supplied by Tilera produce a custom header.  If present,
+ *  the custom header precedes the L2 header in the packet buffer.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet's custom header, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_CUSTOM_HEADER_LENGTH(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_CUSTOM_HEADER_LENGTH_M(mda, pkt);
+}
+/** Return the length of the packet, starting with the custom header.
+ *  A custom header may or may not be present, depending upon the IPP; its
+ *  contents and alignment are also IPP-dependent.  Currently, none of the
+ *  standard IPPs supplied by Tilera produce a custom header.  If present,
+ *  the custom header precedes the L2 header in the packet buffer.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return  The length of the packet, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_CUSTOM_LENGTH(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_CUSTOM_LENGTH_M(mda, pkt);
+}
+/** Return a pointer to the packet's custom header.
+ *  A custom header may or may not be present, depending upon the IPP; its
+ *  contents and alignment are also IPP-dependent.  Currently, none of the
+ *  standard IPPs supplied by Tilera produce a custom header.  If present,
+ *  the custom header precedes the L2 header in the packet buffer.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to start of the packet.
+ */
+static __inline unsigned char*
+NETIO_PKT_CUSTOM_DATA(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_CUSTOM_DATA_M(mda, pkt);
+}
+/** Return the length of the packet's L2 (Ethernet plus VLAN or SNAP) header.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The length of the packet's L2 header, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L2_HEADER_LENGTH(netio_pkt_t* pkt)
+{
+  if (NETIO_PKT_IS_MINIMAL(pkt))
+  {
+    netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+    return NETIO_PKT_L2_HEADER_LENGTH_MM(mmd, pkt);
+  }
+  else
+  {
+    netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+    return NETIO_PKT_L2_HEADER_LENGTH_M(mda, pkt);
+  }
+}
+/** Return the length of the packet, starting with the L2 (Ethernet) header.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return  The length of the packet, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L2_LENGTH(netio_pkt_t* pkt)
+{
+  if (NETIO_PKT_IS_MINIMAL(pkt))
+  {
+    netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+    return NETIO_PKT_L2_LENGTH_MM(mmd, pkt);
+  }
+  else
+  {
+    netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+    return NETIO_PKT_L2_LENGTH_M(mda, pkt);
+  }
+}
+/** Return a pointer to the packet's L2 (Ethernet) header.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to start of the packet.
+ */
+static __inline unsigned char*
+NETIO_PKT_L2_DATA(netio_pkt_t* pkt)
+{
+  if (NETIO_PKT_IS_MINIMAL(pkt))
+  {
+    netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+    return NETIO_PKT_L2_DATA_MM(mmd, pkt);
+  }
+  else
+  {
+    netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+    return NETIO_PKT_L2_DATA_M(mda, pkt);
+  }
+}
+/** Retrieve the length of the packet, starting with the L3 (generally, the IP)
+ * header.
+ * @ingroup pktfuncs
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Length of the packet's L3 header and data, in bytes.
+ */
+static __inline netio_size_t
+NETIO_PKT_L3_LENGTH(netio_pkt_t* pkt)
+{
+  if (NETIO_PKT_IS_MINIMAL(pkt))
+  {
+    netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+    return NETIO_PKT_L3_LENGTH_MM(mmd, pkt);
+  }
+  else
+  {
+    netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+    return NETIO_PKT_L3_LENGTH_M(mda, pkt);
+  }
+}
+/** Return a pointer to the packet's L3 (generally, the IP) header.
+ * @ingroup pktfuncs
+ *
+ * Note that we guarantee word alignment of the L3 header.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return A pointer to the packet's L3 header.
+ */
+static __inline unsigned char*
+NETIO_PKT_L3_DATA(netio_pkt_t* pkt)
+{
+  if (NETIO_PKT_IS_MINIMAL(pkt))
+  {
+    netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+    return NETIO_PKT_L3_DATA_MM(mmd, pkt);
+  }
+  else
+  {
+    netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+    return NETIO_PKT_L3_DATA_M(mda, pkt);
+  }
+}
+/** Return the ordinal of the packet.
+ * @ingroup ingress
+ *
+ * Each packet is given an ordinal number when it is delivered by the IPP.
+ * In the medium term, the ordinal is unique and monotonically increasing,
+ * being incremented by 1 for each packet; the ordinal of the first packet
+ * delivered after the IPP starts is zero.  (Since the ordinal is of finite
+ * size, given enough input packets, it will eventually wrap around to zero;
+ * in the long term, therefore, ordinals are not unique.)  The ordinals
+ * handed out by different IPPs are not disjoint, so two packets from
+ * different IPPs may have identical ordinals.  Packets dropped by the
+ * IPP or by the I/O shim are not assigned ordinals.
+ *
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's per-IPP packet ordinal.
+ */
+static __inline unsigned int
+NETIO_PKT_ORDINAL(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_ORDINAL_M(mda, pkt);
+}
+/** Return the per-group ordinal of the packet.
+ * @ingroup ingress
+ *
+ * Each packet is given a per-group ordinal number when it is
+ * delivered by the IPP. By default, the group is the packet's VLAN,
+ * although IPP can be recompiled to use different values.  In
+ * the medium term, the ordinal is unique and monotonically
+ * increasing, being incremented by 1 for each packet; the ordinal of
+ * the first packet distributed to a particular group is zero.
+ * (Since the ordinal is of finite size, given enough input packets,
+ * it will eventually wrap around to zero; in the long term,
+ * therefore, ordinals are not unique.)  The ordinals handed out by
+ * different IPPs are not disjoint, so two packets from different IPPs
+ * may have identical ordinals; similarly, packets distributed to
+ * different groups may have identical ordinals.  Packets dropped by
+ * the IPP or by the I/O shim are not assigned ordinals.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's per-IPP, per-group ordinal.
+ */
+static __inline unsigned int
+NETIO_PKT_GROUP_ORDINAL(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_GROUP_ORDINAL_M(mda, pkt);
+}
+/** Return the VLAN ID assigned to the packet.
+ * @ingroup ingress
+ *
+ * This is usually also contained within the packet header.  If the packet
+ * does not have a VLAN tag, the VLAN ID returned by this function is zero.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's VLAN ID.
+ */
+static __inline unsigned short
+NETIO_PKT_VLAN_ID(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_VLAN_ID_M(mda, pkt);
+}
+/** Return the ethertype of the packet.
+ * @ingroup ingress
+ *
+ * This value is reliable if @ref NETIO_PKT_ETHERTYPE_RECOGNIZED()
+ * returns true, and otherwise, may not be well defined.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's ethertype.
+ */
+static __inline unsigned short
+NETIO_PKT_ETHERTYPE(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_ETHERTYPE_M(mda, pkt);
+}
+/** Return the flow hash computed on the packet.
+ * @ingroup ingress
+ *
+ * For TCP and UDP packets, this hash is calculated by hashing together
+ * the "5-tuple" values, specifically the source IP address, destination
+ * IP address, protocol type, source port and destination port.
+ * The hash value is intended to be helpful for millions of distinct
+ * flows.
+ *
+ * For IPv4 or IPv6 packets which are neither TCP nor UDP, the flow hash is
+ * derived by hashing together the source and destination IP addresses.
+ *
+ * For MPLS-encapsulated packets, the flow hash is derived by hashing
+ * the first MPLS label.
+ *
+ * For all other packets the flow hash is computed from the source
+ * and destination Ethernet addresses.
+ *
+ * The hash is symmetric, meaning it produces the same value if the
+ * source and destination are swapped. The only exceptions are
+ * tunneling protocols 0x04 (IP in IP Encapsulation), 0x29 (Simple
+ * Internet Protocol), 0x2F (General Routing Encapsulation) and 0x32
+ * (Encap Security Payload), which use only the destination address
+ * since the source address is not meaningful.
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's 32-bit flow hash.
+ */
+static __inline unsigned int
+NETIO_PKT_FLOW_HASH(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_FLOW_HASH_M(mda, pkt);
+}
+/** Return the first word of "user data" for the packet.
+ *
+ * The contents of the user data words depend on the IPP.
+ *
+ * When using the standard ipp1, ipp2, or ipp4 sub-drivers, the first
+ * word of user data contains the least significant bits of the 64-bit
+ * arrival cycle count (see @c get_cycle_count_low()).
+ *
+ * See the <em>System Programmer's Guide</em> for details.
+ *
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's first word of "user data".
+ */
+static __inline unsigned int
+NETIO_PKT_USER_DATA_0(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_USER_DATA_0_M(mda, pkt);
+}
+/** Return the second word of "user data" for the packet.
+ *
+ * The contents of the user data words depend on the IPP.
+ *
+ * When using the standard ipp1, ipp2, or ipp4 sub-drivers, the second
+ * word of user data contains the most significant bits of the 64-bit
+ * arrival cycle count (see @c get_cycle_count_high()).
+ *
+ * See the <em>System Programmer's Guide</em> for details.
+ *
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return The packet's second word of "user data".
+ */
+static __inline unsigned int
+NETIO_PKT_USER_DATA_1(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_USER_DATA_1_M(mda, pkt);
+}
+/** Determine whether the L4 (TCP/UDP) checksum was calculated.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the L4 checksum was calculated.
+ */
+static __inline unsigned int
+NETIO_PKT_L4_CSUM_CALCULATED(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_L4_CSUM_CALCULATED_M(mda, pkt);
+}
+/** Determine whether the L4 (TCP/UDP) checksum was calculated and found to
+ *  be correct.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the checksum was calculated and is correct.
+ */
+static __inline unsigned int
+NETIO_PKT_L4_CSUM_CORRECT(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_L4_CSUM_CORRECT_M(mda, pkt);
+}
+/** Determine whether the L3 (IP) checksum was calculated.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the L3 (IP) checksum was calculated.
+*/
+static __inline unsigned int
+NETIO_PKT_L3_CSUM_CALCULATED(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_L3_CSUM_CALCULATED_M(mda, pkt);
+}
+/** Determine whether the L3 (IP) checksum was calculated and found to be
+ *  correct.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the checksum was calculated and is correct.
+ */
+static __inline unsigned int
+NETIO_PKT_L3_CSUM_CORRECT(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_L3_CSUM_CORRECT_M(mda, pkt);
+}
+/** Determine whether the Ethertype was recognized and L3 packet data was
+ *  processed.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ * @return Nonzero if the Ethertype was recognized and L3 packet data was
+ *   processed.
+ */
+static __inline unsigned int
+NETIO_PKT_ETHERTYPE_RECOGNIZED(netio_pkt_t* pkt)
+{
+  netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+  return NETIO_PKT_ETHERTYPE_RECOGNIZED_M(mda, pkt);
+}
+/** Set an egress packet's L2 length, using a metadata pointer to speed the
+ * computation.
+ * @ingroup egress
+ *
+ * @param[in,out] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @param[in] len Packet L2 length, in bytes.
+ */
+static __inline void
+NETIO_PKT_SET_L2_LENGTH_MM(netio_pkt_minimal_metadata_t* mmd, netio_pkt_t* pkt,
+                           int len)
+{
+  mmd->l2_length = len;
+}
+/** Set an egress packet's L2 length.
+ * @ingroup egress
+ *
+ * @param[in,out] pkt Packet on which to operate.
+ * @param[in] len Packet L2 length, in bytes.
+ */
+static __inline void
+NETIO_PKT_SET_L2_LENGTH(netio_pkt_t* pkt, int len)
+{
+  netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+  NETIO_PKT_SET_L2_LENGTH_MM(mmd, pkt, len);
+}
+/** Set an egress packet's L2 header length, using a metadata pointer to
+ *  speed the computation.
+ * @ingroup egress
+ *
+ * It is not normally necessary to call this routine; only the L2 length,
+ * not the header length, is needed to transmit a packet.  It may be useful if
+ * the egress packet will later be processed by code which expects to use
+ * functions like @ref NETIO_PKT_L3_DATA() to get a pointer to the L3 payload.
+ *
+ * @param[in,out] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @param[in] len Packet L2 header length, in bytes.
+ */
+static __inline void
+NETIO_PKT_SET_L2_HEADER_LENGTH_MM(netio_pkt_minimal_metadata_t* mmd,
+                                  netio_pkt_t* pkt, int len)
+{
+  mmd->l3_offset = mmd->l2_offset + len;
+}
+/** Set an egress packet's L2 header length.
+ * @ingroup egress
+ *
+ * It is not normally necessary to call this routine; only the L2 length,
+ * not the header length, is needed to transmit a packet.  It may be useful if
+ * the egress packet will later be processed by code which expects to use
+ * functions like @ref NETIO_PKT_L3_DATA() to get a pointer to the L3 payload.
+ *
+ * @param[in,out] pkt Packet on which to operate.
+ * @param[in] len Packet L2 header length, in bytes.
+ */
+static __inline void
+NETIO_PKT_SET_L2_HEADER_LENGTH(netio_pkt_t* pkt, int len)
+{
+  netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+  NETIO_PKT_SET_L2_HEADER_LENGTH_MM(mmd, pkt, len);
+}
+/** Set up an egress packet for hardware checksum computation, using a
+ *  metadata pointer to speed the operation.
+ * @ingroup egress
+ *
+ *  NetIO provides the ability to automatically calculate a standard
+ *  16-bit Internet checksum on transmitted packets.  The application
+ *  may specify the point in the packet where the checksum starts, the
+ *  number of bytes to be checksummed, and the two bytes in the packet
+ *  which will be replaced with the completed checksum.  (If the range
+ *  of bytes to be checksummed includes the bytes to be replaced, the
+ *  initial values of those bytes will be included in the checksum.)
+ *
+ *  For some protocols, the packet checksum covers data which is not present
+ *  in the packet, or is at least not contiguous to the main data payload.
+ *  For instance, the TCP checksum includes a "pseudo-header" which includes
+ *  the source and destination IP addresses of the packet.  To accommodate
+ *  this, the checksum engine may be "seeded" with an initial value, which
+ *  the application would need to compute based on the specific protocol's
+ *  requirements.  Note that the seed is given in host byte order (little-
+ *  endian), not network byte order (big-endian); code written to compute a
+ *  pseudo-header checksum in network byte order will need to byte-swap it
+ *  before use as the seed.
+ *
+ *  Note that the checksum is computed as part of the transmission process,
+ *  so it will not be present in the packet upon completion of this routine.
+ *
+ * @param[in,out] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ * @param[in] start Offset within L2 packet of the first byte to include in
+ *   the checksum.
+ * @param[in] length Number of bytes to include in the checksum.
+ *   the checksum.
+ * @param[in] location Offset within L2 packet of the first of the two bytes
+ *   to be replaced with the calculated checksum.
+ * @param[in] seed Initial value of the running checksum before any of the
+ *   packet data is added.
+ */
+static __inline void
+NETIO_PKT_DO_EGRESS_CSUM_MM(netio_pkt_minimal_metadata_t* mmd,
+                            netio_pkt_t* pkt, int start, int length,
+                            int location, uint16_t seed)
+{
+  mmd->csum_start = start;
+  mmd->csum_length = length;
+  mmd->csum_location = location;
+  mmd->csum_seed = seed;
+  mmd->flags |= _NETIO_PKT_NEED_EDMA_CSUM_MASK;
+}
+/** Set up an egress packet for hardware checksum computation.
+ * @ingroup egress
+ *
+ *  NetIO provides the ability to automatically calculate a standard
+ *  16-bit Internet checksum on transmitted packets.  The application
+ *  may specify the point in the packet where the checksum starts, the
+ *  number of bytes to be checksummed, and the two bytes in the packet
+ *  which will be replaced with the completed checksum.  (If the range
+ *  of bytes to be checksummed includes the bytes to be replaced, the
+ *  initial values of those bytes will be included in the checksum.)
+ *
+ *  For some protocols, the packet checksum covers data which is not present
+ *  in the packet, or is at least not contiguous to the main data payload.
+ *  For instance, the TCP checksum includes a "pseudo-header" which includes
+ *  the source and destination IP addresses of the packet.  To accommodate
+ *  this, the checksum engine may be "seeded" with an initial value, which
+ *  the application would need to compute based on the specific protocol's
+ *  requirements.  Note that the seed is given in host byte order (little-
+ *  endian), not network byte order (big-endian); code written to compute a
+ *  pseudo-header checksum in network byte order will need to byte-swap it
+ *  before use as the seed.
+ *
+ *  Note that the checksum is computed as part of the transmission process,
+ *  so it will not be present in the packet upon completion of this routine.
+ *
+ * @param[in,out] pkt Packet on which to operate.
+ * @param[in] start Offset within L2 packet of the first byte to include in
+ *   the checksum.
+ * @param[in] length Number of bytes to include in the checksum.
+ *   the checksum.
+ * @param[in] location Offset within L2 packet of the first of the two bytes
+ *   to be replaced with the calculated checksum.
+ * @param[in] seed Initial value of the running checksum before any of the
+ *   packet data is added.
+ */
+static __inline void
+NETIO_PKT_DO_EGRESS_CSUM(netio_pkt_t* pkt, int start, int length,
+                         int location, uint16_t seed)
+{
+  netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+  NETIO_PKT_DO_EGRESS_CSUM_MM(mmd, pkt, start, length, location, seed);
+}
+/** Return the number of bytes which could be prepended to a packet, using a
+ *  metadata pointer to speed the operation.
+ *  See @ref netio_populate_prepend_buffer() to get a full description of
+ *  prepending.
+ *
+ * @param[in,out] mda Pointer to packet's standard metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline int
+NETIO_PKT_PREPEND_AVAIL_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+  return (pkt->__packet.bits.__offset << 6) +
+         NETIO_PKT_CUSTOM_HEADER_LENGTH_M(mda, pkt);
+}
+/** Return the number of bytes which could be prepended to a packet, using a
+ *  metadata pointer to speed the operation.
+ *  See @ref netio_populate_prepend_buffer() to get a full description of
+ *  prepending.
+ * @ingroup egress
+ *
+ * @param[in,out] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline int
+NETIO_PKT_PREPEND_AVAIL_MM(netio_pkt_minimal_metadata_t* mmd, netio_pkt_t* pkt)
+{
+  return (pkt->__packet.bits.__offset << 6) + mmd->l2_offset;
+}
+/** Return the number of bytes which could be prepended to a packet.
+ *  See @ref netio_populate_prepend_buffer() to get a full description of
+ *  prepending.
+ * @ingroup egress
+ *
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline int
+NETIO_PKT_PREPEND_AVAIL(netio_pkt_t* pkt)
+{
+  if (NETIO_PKT_IS_MINIMAL(pkt))
+  {
+    netio_pkt_minimal_metadata_t* mmd = NETIO_PKT_MINIMAL_METADATA(pkt);
+    return NETIO_PKT_PREPEND_AVAIL_MM(mmd, pkt);
+  }
+  else
+  {
+    netio_pkt_metadata_t* mda = NETIO_PKT_METADATA(pkt);
+    return NETIO_PKT_PREPEND_AVAIL_M(mda, pkt);
+  }
+}
+/** Flush a packet's minimal metadata from the cache, using a metadata pointer
+ *  to speed the operation.
+ * @ingroup egress
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_MINIMAL_METADATA_MM(netio_pkt_minimal_metadata_t* mmd,
+                                    netio_pkt_t* pkt)
+{
+}
+/** Invalidate a packet's minimal metadata from the cache, using a metadata
+ *  pointer to speed the operation.
+ * @ingroup egress
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_INV_MINIMAL_METADATA_MM(netio_pkt_minimal_metadata_t* mmd,
+                                  netio_pkt_t* pkt)
+{
+}
+/** Flush and then invalidate a packet's minimal metadata from the cache,
+ *  using a metadata pointer to speed the operation.
+ * @ingroup egress
+ *
+ * @param[in] mmd Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_INV_MINIMAL_METADATA_MM(netio_pkt_minimal_metadata_t* mmd,
+                                        netio_pkt_t* pkt)
+{
+}
+/** Flush a packet's metadata from the cache, using a metadata pointer
+ *  to speed the operation.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's minimal metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_METADATA_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+}
+/** Invalidate a packet's metadata from the cache, using a metadata
+ *  pointer to speed the operation.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_INV_METADATA_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+}
+/** Flush and then invalidate a packet's metadata from the cache,
+ *  using a metadata pointer to speed the operation.
+ * @ingroup ingress
+ *
+ * @param[in] mda Pointer to packet's metadata.
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_INV_METADATA_M(netio_pkt_metadata_t* mda, netio_pkt_t* pkt)
+{
+}
+/** Flush a packet's minimal metadata from the cache.
+ * @ingroup egress
+ *
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_MINIMAL_METADATA(netio_pkt_t* pkt)
+{
+}
+/** Invalidate a packet's minimal metadata from the cache.
+ * @ingroup egress
+ *
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_INV_MINIMAL_METADATA(netio_pkt_t* pkt)
+{
+}
+/** Flush and then invalidate a packet's minimal metadata from the cache.
+ * @ingroup egress
+ *
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_INV_MINIMAL_METADATA(netio_pkt_t* pkt)
+{
+}
+/** Flush a packet's metadata from the cache.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_METADATA(netio_pkt_t* pkt)
+{
+}
+/** Invalidate a packet's metadata from the cache.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_INV_METADATA(netio_pkt_t* pkt)
+{
+}
+/** Flush and then invalidate a packet's metadata from the cache.
+ * @ingroup ingress
+ *
+ * @param[in] pkt Packet on which to operate.
+ */
+static __inline void
+NETIO_PKT_FLUSH_INV_METADATA(netio_pkt_t* pkt)
+{
+}
+/** Number of NUMA nodes we can distribute buffers to.
+ * @ingroup setup */
+#define NETIO_NUM_NODE_WEIGHTS  16
+/**
+ * @brief An object for specifying the characteristics of NetIO communication
+ * endpoint.
+ *
+ * @ingroup setup
+ *
+ * The @ref netio_input_register() function uses this structure to define
+ * how an application tile will communicate with an IPP.
+ *
+ *
+ * Future updates to NetIO may add new members to this structure,
+ * which can affect the success of the registration operation.  Thus,
+ * if dynamically initializing the structure, applications are urged to
+ * zero it out first, for example:
+ *
+ * @code
+ * netio_input_config_t config;
+ * memset(&config, 0, sizeof (config));
+ * config.flags = NETIO_RECV | NETIO_XMIT_CSUM | NETIO_TAG_NONE;
+ * config.num_receive_packets = NETIO_MAX_RECEIVE_PKTS;
+ * config.queue_id = 0;
+ *     .
+ *     .
+ *     .
+ * @endcode
+ *
+ * since that guarantees that any unused structure members, including
+ * members which did not exist when the application was first developed,
+ * will not have unexpected values.
+ *
+ * If statically initializing the structure, we strongly recommend use of
+ * C99-style named initializers, for example:
+ *
+ * @code
+ * netio_input_config_t config = {
+ *    .flags = NETIO_RECV | NETIO_XMIT_CSUM | NETIO_TAG_NONE,
+ *    .num_receive_packets = NETIO_MAX_RECEIVE_PKTS,
+ *    .queue_id = 0,
+ * },
+ * @endcode
+ *
+ * instead of the old-style structure initialization:
+ *
+ * @code
+ * // Bad example! Currently equivalent to the above, but don't do this.
+ * netio_input_config_t config = {
+ *    NETIO_RECV | NETIO_XMIT_CSUM | NETIO_TAG_NONE, NETIO_MAX_RECEIVE_PKTS, 0
+ * },
+ * @endcode
+ *
+ * since the C99 style requires no changes to the code if elements of the
+ * config structure are rearranged.  (It also makes the initialization much
+ * easier to understand.)
+ *
+ * Except for items which address a particular tile's transmit or receive
+ * characteristics, such as the ::NETIO_RECV flag, applications are advised
+ * to specify the same set of configuration data on all registrations.
+ * This prevents differing results if multiple tiles happen to do their
+ * registration operations in a different order on different invocations of
+ * the application.  This is particularly important for things like link
+ * management flags, and buffer size and homing specifications.
+ *
+ * Unless the ::NETIO_FIXED_BUFFER_VA flag is specified in flags, the NetIO
+ * buffer pool is automatically created and mapped into the application's
+ * virtual address space at an address chosen by the operating system,
+ * using the common memory (cmem) facility in the Tilera Multicore
+ * Components library.  The cmem facility allows multiple processes to gain
+ * access to shared memory which is mapped into each process at an
+ * identical virtual address.  In order for this to work, the processes
+ * must have a common ancestor, which must create the common memory using
+ * tmc_cmem_init().
+ *
+ * In programs using the iLib process creation API, or in programs which use
+ * only one process (which include programs using the pthreads library),
+ * tmc_cmem_init() is called automatically.  All other applications
+ * must call it explicitly, before any child processes which might call
+ * netio_input_register() are created.
+ */
+typedef struct
+{
+  /** Registration characteristics.
+      This value determines several characteristics of the registration;
+      flags for different types of behavior are ORed together to make the
+      final flag value.  Generally applications should specify exactly
+      one flag from each of the following categories:
+      - Whether the application will be receiving packets on this queue
+        (::NETIO_RECV or ::NETIO_NO_RECV).
+      - Whether the application will be transmitting packets on this queue,
+        and if so, whether it will request egress checksum calculation
+        (::NETIO_XMIT, ::NETIO_XMIT_CSUM, or ::NETIO_NO_XMIT).  It is
+        legal to call netio_get_buffer() without one of the XMIT flags,
+        as long as ::NETIO_RECV is specified; in this case, the retrieved
+        buffers must be passed to another tile for transmission.
+      - Whether the application expects any vendor-specific tags in
+        its packets' L2 headers (::NETIO_TAG_NONE, ::NETIO_TAG_BRCM,
+        or ::NETIO_TAG_MRVL).  This must match the configuration of the
+        target IPP.
+      To accommodate applications written to previous versions of the NetIO
+      interface, none of the flags above are currently required; if omitted,
+      NetIO behaves more or less as if ::NETIO_RECV | ::NETIO_XMIT_CSUM |
+      ::NETIO_TAG_NONE were used.  However, explicit specification of
+      the relevant flags allows NetIO to do a better job of resource
+      allocation, allows earlier detection of certain configuration errors,
+      and may enable advanced features or higher performance in the future,
+      so their use is strongly recommended.
+      Note that specifying ::NETIO_NO_RECV along with ::NETIO_NO_XMIT
+      is a special case, intended primarily for use by programs which
+      retrieve network statistics or do link management operations.
+      When these flags are both specified, the resulting queue may not
+      be used with NetIO routines other than netio_get(), netio_set(),
+      and netio_input_unregister().  See @ref link for more information
+      on link management.
+      Other flags are optional; their use is described below.
+  */
+  int flags;
+  /** Interface name.  This is a string which identifies the specific
+      Ethernet controller hardware to be used.  The format of the string
+      is a device type and a device index, separated by a slash; so,
+      the first 10 Gigabit Ethernet controller is named "xgbe/0", while
+      the second 10/100/1000 Megabit Ethernet controller is named "gbe/1".
+   */
+  const char* interface;
+  /** Receive packet queue size.  This specifies the maximum number
+      of ingress packets that can be received on this queue without
+      being retrieved by @ref netio_get_packet().  If the IPP's distribution
+      algorithm calls for a packet to be sent to this queue, and this
+      number of packets are already pending there, the new packet
+      will either be discarded, or sent to another tile registered
+      for the same queue_id (see @ref drops).  This value must
+      be at least ::NETIO_MIN_RECEIVE_PKTS, can always be at least
+      ::NETIO_MAX_RECEIVE_PKTS, and may be larger than that on certain
+      interfaces.
+   */
+  int num_receive_packets;
+  /** The queue ID being requested.  Legal values for this range from 0
+      to ::NETIO_MAX_QUEUE_ID, inclusive.  ::NETIO_MAX_QUEUE_ID is always
+      greater than or equal to the number of tiles; this allows one queue
+      for each tile, plus at least one additional queue.  Some applications
+      may wish to use the additional queue as a destination for unwanted
+      packets, since packets delivered to queues for which no tiles have
+      registered are discarded.
+   */
+  unsigned int queue_id;
+  /** Maximum number of small send buffers to be held in the local empty
+      buffer cache.  This specifies the size of the area which holds
+      empty small egress buffers requested from the IPP but not yet
+      retrieved via @ref netio_get_buffer().  This value must be greater
+      than zero if the application will ever use @ref netio_get_buffer()
+      to allocate empty small egress buffers; it may be no larger than
+      ::NETIO_MAX_SEND_BUFFERS.  See @ref epp for more details on empty
+      buffer caching.
+   */
+  int num_send_buffers_small_total;
+  /** Number of small send buffers to be preallocated at registration.
+      If this value is nonzero, the specified number of empty small egress
+      buffers will be requested from the IPP during the netio_input_register
+      operation; this may speed the execution of @ref netio_get_buffer().
+      This may be no larger than @ref num_send_buffers_small_total.  See @ref
+      epp for more details on empty buffer caching.
+   */
+  int num_send_buffers_small_prealloc;
+  /** Maximum number of large send buffers to be held in the local empty
+      buffer cache.  This specifies the size of the area which holds empty
+      large egress buffers requested from the IPP but not yet retrieved via
+      @ref netio_get_buffer().  This value must be greater than zero if the
+      application will ever use @ref netio_get_buffer() to allocate empty
+      large egress buffers; it may be no larger than ::NETIO_MAX_SEND_BUFFERS.
+      See @ref epp for more details on empty buffer caching.
+   */
+  int num_send_buffers_large_total;
+  /** Number of large send buffers to be preallocated at registration.
+      If this value is nonzero, the specified number of empty large egress
+      buffers will be requested from the IPP during the netio_input_register
+      operation; this may speed the execution of @ref netio_get_buffer().
+      This may be no larger than @ref num_send_buffers_large_total.  See @ref
+      epp for more details on empty buffer caching.
+   */
+  int num_send_buffers_large_prealloc;
+  /** Maximum number of jumbo send buffers to be held in the local empty
+      buffer cache.  This specifies the size of the area which holds empty
+      jumbo egress buffers requested from the IPP but not yet retrieved via
+      @ref netio_get_buffer().  This value must be greater than zero if the
+      application will ever use @ref netio_get_buffer() to allocate empty
+      jumbo egress buffers; it may be no larger than ::NETIO_MAX_SEND_BUFFERS.
+      See @ref epp for more details on empty buffer caching.
+   */
+  int num_send_buffers_jumbo_total;
+  /** Number of jumbo send buffers to be preallocated at registration.
+      If this value is nonzero, the specified number of empty jumbo egress
+      buffers will be requested from the IPP during the netio_input_register
+      operation; this may speed the execution of @ref netio_get_buffer().
+      This may be no larger than @ref num_send_buffers_jumbo_total.  See @ref
+      epp for more details on empty buffer caching.
+   */
+  int num_send_buffers_jumbo_prealloc;
+  /** Total packet buffer size.  This determines the total size, in bytes,
+      of the NetIO buffer pool.  Note that the maximum number of available
+      buffers of each size is determined during hypervisor configuration
+      (see the <em>System Programmer's Guide</em> for details); this just
+      influences how much host memory is allocated for those buffers.
+      The buffer pool is allocated from common memory, which will be
+      automatically initialized if needed.  If your buffer pool is larger
+      than 240 MB, you might need to explicitly call @c tmc_cmem_init(),
+      as described in the Application Libraries Reference Manual (UG227).
+      Packet buffers are currently allocated in chunks of 16 MB; this
+      value will be rounded up to the next larger multiple of 16 MB.
+      If this value is zero, a default of 32 MB will be used; this was
+      the value used by previous versions of NetIO.  Note that taking this
+      default also affects the placement of buffers on Linux NUMA nodes.
+      See @ref buffer_node_weights for an explanation of buffer placement.
+      In order to successfully allocate packet buffers, Linux must have
+      available huge pages on the relevant Linux NUMA nodes.  See the
+      <em>System Programmer's Guide</em> for information on configuring
+      huge page support in Linux.
+   */
+  uint64_t total_buffer_size;
+  /** Buffer placement weighting factors.
+      This array specifies the relative amount of buffering to place
+      on each of the available Linux NUMA nodes.  This array is
+      indexed by the NUMA node, and the values in the array are
+      proportional to the amount of buffer space to allocate on that
+      node.
+      If memory striping is enabled in the Hypervisor, then there is
+      only one logical NUMA node (node 0). In that case, NetIO will by
+      default ignore the suggested buffer node weights, and buffers
+      will be striped across the physical memory controllers. See
+      UG209 System Programmer's Guide for a description of the
+      hypervisor option that controls memory striping.
+      If memory striping is disabled, then there are up to four NUMA
+      nodes, corresponding to the four DDRAM controllers in the TILE
+      processor architecture.  See UG100 Tile Processor Architecture
+      Overview for a diagram showing the location of each of the DDRAM
+      controllers relative to the tile array.
+      For instance, if memory striping is disabled, the following
+      configuration strucure:
+      @code
+      netio_input_config_t config = {
+            .
+            .
+            .
+        .total_buffer_size = 4 * 16 * 1024 * 1024;
+        .buffer_node_weights = { 1, 0, 1, 0 },
+      },
+      @endcode
+      would result in 32 MB of buffers being placed on controller 0, and
+      32 MB on controller 2.  (Since buffers are allocated in units of
+      16 MB, some sets of weights will not be able to be matched exactly.)
+      For the weights to be effective, @ref total_buffer_size must be
+      nonzero.  If @ref total_buffer_size is zero, causing the default
+      32 MB of buffer space to be used, then any specified weights will
+      be ignored, and buffers will positioned as they were in previous
+      versions of NetIO:
+      - For xgbe/0 and gbe/0, 16 MB of buffers will be placed on controller 1,
+        and the other 16 MB will be placed on controller 2.
+      - For xgbe/1 and gbe/1, 16 MB of buffers will be placed on controller 2,
+        and the other 16 MB will be placed on controller 3.
+      If @ref total_buffer_size is nonzero, but all weights are zero,
+      then all buffer space will be allocated on Linux NUMA node zero.
+      By default, the specified buffer placement is treated as a hint;
+      if sufficient free memory is not available on the specified
+      controllers, the buffers will be allocated elsewhere.  However,
+      if the ::NETIO_STRICT_HOMING flag is specified in @ref flags, then a
+      failure to allocate buffer space exactly as requested will cause the
+      registration operation to fail with an error of ::NETIO_CANNOT_HOME.
+      Note that maximal network performance cannot be achieved with
+      only one memory controller.
+   */
+  uint8_t buffer_node_weights[NETIO_NUM_NODE_WEIGHTS];
+  /** Fixed virtual address for packet buffers.  Only valid when
+      ::NETIO_FIXED_BUFFER_VA is specified in @ref flags; see the
+      description of that flag for details.
+   */
+  void* fixed_buffer_va;
+  /**
+      Maximum number of outstanding send packet requests.  This value is
+      only relevant when an EPP is in use; it determines the number of
+      slots in the EPP's outgoing packet queue which this tile is allowed
+      to consume, and thus the number of packets which may be sent before
+      the sending tile must wait for an acknowledgment from the EPP.
+      Modifying this value is generally only helpful when using @ref
+      netio_send_packet_vector(), where it can help improve performance by
+      allowing a single vector send operation to process more packets.
+      Typically it is not specified, and the default, which divides the
+      outgoing packet slots evenly between all tiles on the chip, is used.
+      If a registration asks for more outgoing packet queue slots than are
+      available, ::NETIO_TOOMANY_XMIT will be returned.  The total number
+      of packet queue slots which are available for all tiles for each EPP
+      is subject to change, but is currently ::NETIO_TOTAL_SENDS_OUTSTANDING.
+      This value is ignored if ::NETIO_XMIT is not specified in flags.
+      If you want to specify a large value here for a specific tile, you are
+      advised to specify NETIO_NO_XMIT on other, non-transmitting tiles so
+      that they do not consume a default number of packet slots.  Any tile
+      transmitting is required to have at least ::NETIO_MIN_SENDS_OUTSTANDING
+      slots allocated to it; values less than that will be silently
+      increased by the NetIO library.
+   */
+  int num_sends_outstanding;
+}
+netio_input_config_t;
+/** Registration flags; used in the @ref netio_input_config_t structure.
+ * @addtogroup setup
+ */
+/** @{ */
+/** Fail a registration request if we can't put packet buffers
+    on the specified memory controllers. */
+#define NETIO_STRICT_HOMING   0x00000002
+/** This application expects no tags on its L2 headers. */
+#define NETIO_TAG_NONE        0x00000004
+/** This application expects Marvell extended tags on its L2 headers. */
+#define NETIO_TAG_MRVL        0x00000008
+/** This application expects Broadcom tags on its L2 headers. */
+#define NETIO_TAG_BRCM        0x00000010
+/** This registration may call routines which receive packets. */
+#define NETIO_RECV            0x00000020
+/** This registration may not call routines which receive packets. */
+#define NETIO_NO_RECV         0x00000040
+/** This registration may call routines which transmit packets. */
+#define NETIO_XMIT            0x00000080
+/** This registration may call routines which transmit packets with
+    checksum acceleration. */
+#define NETIO_XMIT_CSUM       0x00000100
+/** This registration may not call routines which transmit packets. */
+#define NETIO_NO_XMIT         0x00000200
+/** This registration wants NetIO buffers mapped at an application-specified
+    virtual address.
+    NetIO buffers are by default created by the TMC common memory facility,
+    which must be configured by a common ancestor of all processes sharing
+    a network interface.  When this flag is specified, NetIO buffers are
+    instead mapped at an address chosen by the application (and specified
+    in @ref netio_input_config_t::fixed_buffer_va).  This allows multiple
+    unrelated but cooperating processes to share a NetIO interface.
+    All processes sharing the same interface must specify this flag,
+    and all must specify the same fixed virtual address.
+    @ref netio_input_config_t::fixed_buffer_va must be a
+    multiple of 16 MB, and the packet buffers will occupy @ref
+    netio_input_config_t::total_buffer_size bytes of virtual address
+    space, beginning at that address.  If any of those virtual addresses
+    are currently occupied by other memory objects, like application or
+    shared library code or data, @ref netio_input_register() will return
+    ::NETIO_FAULT.  While it is impossible to provide a fixed_buffer_va
+    which will work for all applications, a good first guess might be to
+    use 0xb0000000 minus @ref netio_input_config_t::total_buffer_size.
+    If that fails, it might be helpful to consult the running application's
+    virtual address description file (/proc/<em>pid</em>/maps) to see
+    which regions of virtual address space are available.
+ */
+#define NETIO_FIXED_BUFFER_VA 0x00000400
+/** This registration call will not complete unless the network link
+    is up.  The process will wait several seconds for this to happen (the
+    precise interval is link-dependent), but if the link does not come up,
+    ::NETIO_LINK_DOWN will be returned.  This flag is the default if
+    ::NETIO_NOREQUIRE_LINK_UP is not specified.  Note that this flag by
+    itself does not request that the link be brought up; that can be done
+    with the ::NETIO_AUTO_LINK_UPDN or ::NETIO_AUTO_LINK_UP flags (the
+    latter is the default if no NETIO_AUTO_LINK_xxx flags are specified),
+    or by explicitly setting the link's desired state via netio_set().
+    If the link is not brought up by one of those methods, and this flag
+    is specified, the registration operation will return ::NETIO_LINK_DOWN.
+    This flag is ignored if it is specified along with ::NETIO_NO_XMIT and
+    ::NETIO_NO_RECV.  See @ref link for more information on link
+    management.
+ */
+#define NETIO_REQUIRE_LINK_UP    0x00000800
+/** This registration call will complete even if the network link is not up.
+    Whenever the link is not up, packets will not be sent or received:
+    netio_get_packet() will return ::NETIO_NOPKT once all queued packets
+    have been drained, and netio_send_packet() and similar routines will
+    return NETIO_QUEUE_FULL once the outgoing packet queue in the EPP
+    or the I/O shim is full.  See @ref link for more information on link
+    management.
+ */
+#define NETIO_NOREQUIRE_LINK_UP  0x00001000
+#ifndef __DOXYGEN__
+/*
+ * These are part of the implementation of the NETIO_AUTO_LINK_xxx flags,
+ * but should not be used directly by applications, and are thus not
+ * documented.
+ */
+#define _NETIO_AUTO_UP        0x00002000
+#define _NETIO_AUTO_DN        0x00004000
+#define _NETIO_AUTO_PRESENT   0x00008000
+#endif
+/** Set the desired state of the link to up, allowing any speeds which are
+    supported by the link hardware, as part of this registration operation.
+    Do not take down the link automatically.  This is the default if
+    no other NETIO_AUTO_LINK_xxx flags are specified.  This flag is ignored
+    if it is specified along with ::NETIO_NO_XMIT and ::NETIO_NO_RECV.
+    See @ref link for more information on link management.
+ */
+#define NETIO_AUTO_LINK_UP     (_NETIO_AUTO_PRESENT | _NETIO_AUTO_UP)
+/** Set the desired state of the link to up, allowing any speeds which are
+    supported by the link hardware, as part of this registration operation.
+    Set the desired state of the link to down the next time no tiles are
+    registered for packet reception or transmission.  This flag is ignored
+    if it is specified along with ::NETIO_NO_XMIT and ::NETIO_NO_RECV.
+    See @ref link for more information on link management.
+ */
+#define NETIO_AUTO_LINK_UPDN   (_NETIO_AUTO_PRESENT | _NETIO_AUTO_UP | \
+                                _NETIO_AUTO_DN)
+/** Set the desired state of the link to down the next time no tiles are
+    registered for packet reception or transmission.  This flag is ignored
+    if it is specified along with ::NETIO_NO_XMIT and ::NETIO_NO_RECV.
+    See @ref link for more information on link management.
+ */
+#define NETIO_AUTO_LINK_DN     (_NETIO_AUTO_PRESENT | _NETIO_AUTO_DN)
+/** Do not bring up the link automatically as part of this registration
+    operation.  Do not take down the link automatically.  This flag
+    is ignored if it is specified along with ::NETIO_NO_XMIT and
+    ::NETIO_NO_RECV.  See @ref link for more information on link management.
+  */
+#define NETIO_AUTO_LINK_NONE   _NETIO_AUTO_PRESENT
+/** Minimum number of receive packets. */
+#define NETIO_MIN_RECEIVE_PKTS            16
+/** Lower bound on the maximum number of receive packets; may be higher
+    than this on some interfaces. */
+#define NETIO_MAX_RECEIVE_PKTS           128
+/** Maximum number of send buffers, per packet size. */
+#define NETIO_MAX_SEND_BUFFERS            16
+/** Number of EPP queue slots, and thus outstanding sends, per EPP. */
+#define NETIO_TOTAL_SENDS_OUTSTANDING   2015
+/** Minimum number of EPP queue slots, and thus outstanding sends, per
+ *  transmitting tile. */
+#define NETIO_MIN_SENDS_OUTSTANDING       16
+/**@}*/
+#ifndef __DOXYGEN__
+/**
+ * An object for providing Ethernet packets to a process.
+ */
+struct __netio_queue_impl_t;
+/**
+ * An object for managing the user end of a NetIO queue.
+ */
+struct __netio_queue_user_impl_t;
+#endif /* !__DOXYGEN__ */
+/** A netio_queue_t describes a NetIO communications endpoint.
+ * @ingroup setup
+ */
+typedef struct
+{
+#ifdef __DOXYGEN__
+  uint8_t opaque[8];                 /**< This is an opaque structure. */
+#else
+  struct __netio_queue_impl_t* __system_part;    /**< The system part. */
+  struct __netio_queue_user_impl_t* __user_part; /**< The user part. */
+#ifdef _NETIO_PTHREAD
+  _netio_percpu_mutex_t lock;                    /**< Queue lock. */
+#endif
+#endif
+}
+netio_queue_t;
+/**
+ * @brief Packet send context.
+ *
+ * @ingroup egress
+ *
+ * Packet send context for use with netio_send_packet_prepare and _commit.
+ */
+typedef struct
+{
+#ifdef __DOXYGEN__
+  uint8_t opaque[44];   /**< This is an opaque structure. */
+#else
+  uint8_t flags;        /**< Defined below */
+  uint8_t datalen;      /**< Number of valid words pointed to by data. */
+  uint32_t request[9];  /**< Request to be sent to the EPP or shim.  Note
+                             that this is smaller than the 11-word maximum
+                             request size, since some constant values are
+                             not saved in the context. */
+  uint32_t *data;       /**< Data to be sent to the EPP or shim via IDN. */
+#endif
+}
+netio_send_pkt_context_t;
+#ifndef __DOXYGEN__
+#define SEND_PKT_CTX_USE_EPP   1  /**< We're sending to an EPP. */
+#define SEND_PKT_CTX_SEND_CSUM 2  /**< Request includes a checksum. */
+#endif
+/**
+ * @brief Packet vector entry.
+ *
+ * @ingroup egress
+ *
+ * This data structure is used with netio_send_packet_vector() to send multiple
+ * packets with one NetIO call.  The structure should be initialized by
+ * calling netio_pkt_vector_set(), rather than by setting the fields
+ * directly.
+ *
+ * This structure is guaranteed to be a power of two in size, no
+ * bigger than one L2 cache line, and to be aligned modulo its size.
+ */
+typedef struct
+#ifndef __DOXYGEN__
+__attribute__((aligned(8)))
+#endif
+{
+  /** Reserved for use by the user application.  When initialized with
+   *  the netio_set_pkt_vector_entry() function, this field is guaranteed
+   *  to be visible to readers only after all other fields are already
+   *  visible.  This way it can be used as a valid flag or generation
+   *  counter. */
+  uint8_t user_data;
+  /* Structure members below this point should not be accessed directly by
+   * applications, as they may change in the future. */
+  /** Low 8 bits of the packet address to send.  The high bits are
+   *  acquired from the 'handle' field. */
+  uint8_t buffer_address_low;
+  /** Number of bytes to transmit. */
+  uint16_t size;
+  /** The raw handle from a netio_pkt_t.  If this is NETIO_PKT_HANDLE_NONE,
+   *  this vector entry will be skipped and no packet will be transmitted. */
+  netio_pkt_handle_t handle;
+}
+netio_pkt_vector_entry_t;
+/**
+ * @brief Initialize fields in a packet vector entry.
+ *
+ * @ingroup egress
+ *
+ * @param[out] v Pointer to the vector entry to be initialized.
+ * @param[in] pkt Packet to be transmitted when the vector entry is passed to
+ *        netio_send_packet_vector().  Note that the packet's attributes
+ *        (e.g., its L2 offset and length) are captured at the time this
+ *        routine is called; subsequent changes in those attributes will not
+ *        be reflected in the packet which is actually transmitted.
+ *        Changes in the packet's contents, however, will be so reflected.
+ *        If this is NULL, no packet will be transmitted.
+ * @param[in] user_data User data to be set in the vector entry.
+ *        This function guarantees that the "user_data" field will become
+ *        visible to a reader only after all other fields have become visible.
+ *        This allows a structure in a ring buffer to be written and read
+ *        by a polling reader without any locks or other synchronization.
+ */
+static __inline void
+netio_pkt_vector_set(volatile netio_pkt_vector_entry_t* v, netio_pkt_t* pkt,
+                     uint8_t user_data)
+{
+  if (pkt)
+  {
+    if (NETIO_PKT_IS_MINIMAL(pkt))
+    {
+      netio_pkt_minimal_metadata_t* mmd =
+        (netio_pkt_minimal_metadata_t*) &pkt->__metadata;
+      v->buffer_address_low = (uintptr_t) NETIO_PKT_L2_DATA_MM(mmd, pkt) & 0xFF;
+      v->size = NETIO_PKT_L2_LENGTH_MM(mmd, pkt);
+    }
+    else
+    {
+      netio_pkt_metadata_t* mda = &pkt->__metadata;
+      v->buffer_address_low = (uintptr_t) NETIO_PKT_L2_DATA_M(mda, pkt) & 0xFF;
+      v->size = NETIO_PKT_L2_LENGTH_M(mda, pkt);
+    }
+    v->handle.word = pkt->__packet.word;
+  }
+  else
+  {
+    v->handle.word = 0;   /* Set handle to NETIO_PKT_HANDLE_NONE. */
+  }
+  __asm__("" : : : "memory");
+  v->user_data = user_data;
+}
+/**
+ * Flags and structures for @ref netio_get() and @ref netio_set().
+ * @ingroup config
+ */
+/** @{ */
+/** Parameter class; addr is a NETIO_PARAM_xxx value. */
+#define NETIO_PARAM       0
+/** Interface MAC address. This address is only valid with @ref netio_get().
+ *  The value is a 6-byte MAC address.  Depending upon the overall system
+ *  design, a MAC address may or may not be available for each interface. */
+#define NETIO_PARAM_MAC        0
+/** Determine whether to suspend output on the receipt of pause frames.
+ *  If the value is nonzero, the I/O shim will suspend output when a pause
+ *  frame is received.  If the value is zero, pause frames will be ignored. */
+#define NETIO_PARAM_PAUSE_IN   1
+/** Determine whether to send pause frames if the I/O shim packet FIFOs are
+ *  nearly full.  If the value is zero, pause frames are not sent.  If
+ *  the value is nonzero, it is the delay value which will be sent in any
+ *  pause frames which are output, in units of 512 bit times. */
+#define NETIO_PARAM_PAUSE_OUT  2
+/** Jumbo frame support.  The value is a 4-byte integer.  If the value is
+ *  nonzero, the MAC will accept frames of up to 10240 bytes.  If the value
+ *  is zero, the MAC will only accept frames of up to 1544 bytes. */
+#define NETIO_PARAM_JUMBO      3
+/** I/O shim's overflow statistics register.  The value is two 16-bit integers.
+ *  The first 16-bit value (or the low 16 bits, if the value is treated as a
+ *  32-bit number) is the count of packets which were completely dropped and
+ *  not delivered by the shim.  The second 16-bit value (or the high 16 bits,
+ *  if the value is treated as a 32-bit number) is the count of packets
+ *  which were truncated and thus only partially delivered by the shim.  This
+ *  register is automatically reset to zero after it has been read.
+ */
+#define NETIO_PARAM_OVERFLOW   4
+/** IPP statistics.  This address is only valid with @ref netio_get().  The
+ *  value is a netio_stat_t structure.  Unlike the I/O shim statistics, the
+ *  IPP statistics are not all reset to zero on read; see the description
+ *  of the netio_stat_t for details. */
+#define NETIO_PARAM_STAT 5
+/** Possible link state.  The value is a combination of "NETIO_LINK_xxx"
+ *  flags.  With @ref netio_get(), this will indicate which flags are
+ *  actually supported by the hardware.
+ *
+ *  For historical reasons, specifying this value to netio_set() will have
+ *  the same behavior as using ::NETIO_PARAM_LINK_CONFIG, but this usage is
+ *  discouraged.
+ */
+#define NETIO_PARAM_LINK_POSSIBLE_STATE 6
+/** Link configuration. The value is a combination of "NETIO_LINK_xxx" flags.
+ *  With @ref netio_set(), this will attempt to immediately bring up the
+ *  link using whichever of the requested flags are supported by the
+ *  hardware, or take down the link if the flags are zero; if this is
+ *  not possible, an error will be returned.  Many programs will want
+ *  to use ::NETIO_PARAM_LINK_DESIRED_STATE instead.
+ *
+ *  For historical reasons, specifying this value to netio_get() will
+ *  have the same behavior as using ::NETIO_PARAM_LINK_POSSIBLE_STATE,
+ *  but this usage is discouraged.
+ */
+#define NETIO_PARAM_LINK_CONFIG NETIO_PARAM_LINK_POSSIBLE_STATE
+/** Current link state. This address is only valid with @ref netio_get().
+ *  The value is zero or more of the "NETIO_LINK_xxx" flags, ORed together.
+ *  If the link is down, the value ANDed with NETIO_LINK_SPEED will be
+ *  zero; if the link is up, the value ANDed with NETIO_LINK_SPEED will
+ *  result in exactly one of the NETIO_LINK_xxx values, indicating the
+ *  current speed. */
+#define NETIO_PARAM_LINK_CURRENT_STATE 7
+/** Variant symbol for current state, retained for compatibility with
+ *  pre-MDE-2.1 programs. */
+#define NETIO_PARAM_LINK_STATUS NETIO_PARAM_LINK_CURRENT_STATE
+/** Packet Coherence protocol. This address is only valid with @ref netio_get().
+ *  The value is nonzero if the interface is configured for cache-coherent DMA.
+ */
+#define NETIO_PARAM_COHERENT 8
+/** Desired link state. The value is a conbination of "NETIO_LINK_xxx"
+ *  flags, which specify the desired state for the link.  With @ref
+ *  netio_set(), this will, in the background, attempt to bring up the link
+ *  using whichever of the requested flags are reasonable, or take down the
+ *  link if the flags are zero.  The actual link up or down operation may
+ *  happen after this call completes.  If the link state changes in the
+ *  future, the system will continue to try to get back to the desired link
+ *  state; for instance, if the link is brought up successfully, and then
+ *  the network cable is disconnected, the link will go down.  However, the
+ *  desired state of the link is still up, so if the cable is reconnected,
+ *  the link will be brought up again.
+ *
+ *  With @ref netio_get(), this will indicate the desired state for the
+ *  link, as set with a previous netio_set() call, or implicitly by a
+ *  netio_input_register() or netio_input_unregister() operation.  This may
+ *  not reflect the current state of the link; to get that, use
+ *  ::NETIO_PARAM_LINK_CURRENT_STATE. */
+#define NETIO_PARAM_LINK_DESIRED_STATE 9
+/** NetIO statistics structure.  Retrieved using the ::NETIO_PARAM_STAT
+ *  address passed to @ref netio_get(). */
+typedef struct
+{
+  /** Number of packets which have been received by the IPP and forwarded
+   *  to a tile's receive queue for processing.  This value wraps at its
+   *  maximum, and is not cleared upon read. */
+  uint32_t packets_received;
+  /** Number of packets which have been dropped by the IPP, because they could
+   *  not be received, or could not be forwarded to a tile.  The former happens
+   *  when the IPP does not have a free packet buffer of suitable size for an
+   *  incoming frame.  The latter happens when all potential destination tiles
+   *  for a packet, as defined by the group, bucket, and queue configuration,
+   *  have full receive queues.   This value wraps at its maximum, and is not
+   *  cleared upon read. */
+  uint32_t packets_dropped;
+  /*
+   * Note: the #defines after each of the following four one-byte values
+   * denote their location within the third word of the netio_stat_t.  They
+   * are intended for use only by the IPP implementation and are thus omitted
+   * from the Doxygen output.
+   */
+  /** Number of packets dropped because no worker was able to accept a new
+   *  packet.  This value saturates at its maximum, and is cleared upon
+   *  read. */
+  uint8_t drops_no_worker;
+#ifndef __DOXYGEN__
+#define NETIO_STAT_DROPS_NO_WORKER   0
+#endif
+  /** Number of packets dropped because no small buffers were available.
+   *  This value saturates at its maximum, and is cleared upon read. */
+  uint8_t drops_no_smallbuf;
+#ifndef __DOXYGEN__
+#define NETIO_STAT_DROPS_NO_SMALLBUF 1
+#endif
+  /** Number of packets dropped because no large buffers were available.
+   *  This value saturates at its maximum, and is cleared upon read. */
+  uint8_t drops_no_largebuf;
+#ifndef __DOXYGEN__
+#define NETIO_STAT_DROPS_NO_LARGEBUF 2
+#endif
+  /** Number of packets dropped because no jumbo buffers were available.
+   *  This value saturates at its maximum, and is cleared upon read. */
+  uint8_t drops_no_jumbobuf;
+#ifndef __DOXYGEN__
+#define NETIO_STAT_DROPS_NO_JUMBOBUF 3
+#endif
+}
+netio_stat_t;
+/** Link can run, should run, or is running at 10 Mbps. */
+#define NETIO_LINK_10M         0x01
+/** Link can run, should run, or is running at 100 Mbps. */
+#define NETIO_LINK_100M        0x02
+/** Link can run, should run, or is running at 1 Gbps. */
+#define NETIO_LINK_1G          0x04
+/** Link can run, should run, or is running at 10 Gbps. */
+#define NETIO_LINK_10G         0x08
+/** Link should run at the highest speed supported by the link and by
+ *  the device connected to the link.  Only usable as a value for
+ *  the link's desired state; never returned as a value for the current
+ *  or possible states. */
+#define NETIO_LINK_ANYSPEED    0x10
+/** All legal link speeds. */
+#define NETIO_LINK_SPEED  (NETIO_LINK_10M  | \
+                           NETIO_LINK_100M | \
+                           NETIO_LINK_1G   | \
+                           NETIO_LINK_10G  | \
+                           NETIO_LINK_ANYSPEED)
+/** MAC register class.  Addr is a register offset within the MAC.
+ *  Registers within the XGbE and GbE MACs are documented in the Tile
+ *  Processor I/O Device Guide (UG104). MAC registers start at address
+ *  0x4000, and do not include the MAC_INTERFACE registers. */
+#define NETIO_MAC             1
+/** MDIO register class (IEEE 802.3 clause 22 format).  Addr is the "addr"
+ *  member of a netio_mdio_addr_t structure. */
+#define NETIO_MDIO            2
+/** MDIO register class (IEEE 802.3 clause 45 format).  Addr is the "addr"
+ *  member of a netio_mdio_addr_t structure. */
+#define NETIO_MDIO_CLAUSE45   3
+/** NetIO MDIO address type.  Retrieved or provided using the ::NETIO_MDIO
+ *  address passed to @ref netio_get() or @ref netio_set(). */
+typedef union
+{
+  struct
+  {
+    unsigned int reg:16;  /**< MDIO register offset.  For clause 22 access,
+                               must be less than 32. */
+    unsigned int phy:5;   /**< Which MDIO PHY to access. */
+    unsigned int dev:5;   /**< Which MDIO device to access within that PHY.
+                               Applicable for clause 45 access only; ignored
+                               for clause 22 access. */
+  }
+  bits;                   /**< Container for bitfields. */
+  uint64_t addr;          /**< Value to pass to @ref netio_get() or
+                           *   @ref netio_set(). */
+}
+netio_mdio_addr_t;
+/** @} */
+#endif /* __NETIO_INTF_H__ */
diff --git a/arch/tile/kernel/Makefile b/arch/tile/kernel/Makefile
index 112b1e248f05..b4c8e8ec45dc 100644
--- a/arch/tile/kernel/Makefile
+++ b/arch/tile/kernel/Makefile
@@ -15,3 +15,4 @@ obj-$(CONFIG_SMP)		+= smpboot.o smp.o tlb.o
 obj-$(CONFIG_MODULES)           += module.o
 obj-$(CONFIG_EARLY_PRINTK)      += early_printk.o
 obj-$(CONFIG_KEXEC)             += machine_kexec.o relocate_kernel.o
+obj-$(CONFIG_PCI)               += pci.o
diff --git a/arch/tile/kernel/pci.c b/arch/tile/kernel/pci.c
new file mode 100644
index 000000000000..a1ee25be9ad9
--- /dev/null
+++ b/arch/tile/kernel/pci.c
@@ -0,0 +1,621 @@
+/*
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/string.h>
+#include <linux/init.h>
+#include <linux/capability.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/bootmem.h>
+#include <linux/irq.h>
+#include <linux/io.h>
+#include <linux/uaccess.h>
+#include <asm/processor.h>
+#include <asm/sections.h>
+#include <asm/byteorder.h>
+#include <asm/hv_driver.h>
+#include <hv/drv_pcie_rc_intf.h>
+/*
+ * Initialization flow and process
+ * -------------------------------
+ *
+ * This files containes the routines to search for PCI buses,
+ * enumerate the buses, and configure any attached devices.
+ *
+ * There are two entry points here:
+ * 1) tile_pci_init
+ *    This sets up the pci_controller structs, and opens the
+ *    FDs to the hypervisor.  This is called from setup_arch() early
+ *    in the boot process.
+ * 2) pcibios_init
+ *    This probes the PCI bus(es) for any attached hardware.  It's
+ *    called by subsys_initcall.  All of the real work is done by the
+ *    generic Linux PCI layer.
+ *
+ */
+/*
+ * This flag tells if the platform is TILEmpower that needs
+ * special configuration for the PLX switch chip.
+ */
+int __write_once tile_plx_gen1;
+static struct pci_controller controllers[TILE_NUM_PCIE];
+static int num_controllers;
+static struct pci_ops tile_cfg_ops;
+/*
+ * We don't need to worry about the alignment of resources.
+ */
+resource_size_t pcibios_align_resource(void *data, const struct resource *res,
+                            resource_size_t size, resource_size_t align)
+{
+        return res->start;
+}
+EXPORT_SYMBOL(pcibios_align_resource);
+/*
+ * Open a FD to the hypervisor PCI device.
+ *
+ * controller_id is the controller number, config type is 0 or 1 for
+ * config0 or config1 operations.
+ */
+static int __init tile_pcie_open(int controller_id, int config_type)
+{
+        char filename[32];
+        int fd;
+        sprintf(filename, "pcie/%d/config%d", controller_id, config_type);
+        fd = hv_dev_open((HV_VirtAddr)filename, 0);
+        return fd;
+}
+/*
+ * Get the IRQ numbers from the HV and set up the handlers for them.
+ */
+static int __init tile_init_irqs(int controller_id,
+                                 struct pci_controller *controller)
+{
+        char filename[32];
+        int fd;
+        int ret;
+        int x;
+        struct pcie_rc_config rc_config;
+        sprintf(filename, "pcie/%d/ctl", controller_id);
+        fd = hv_dev_open((HV_VirtAddr)filename, 0);
+        if (fd < 0) {
+                pr_err("PCI: hv_dev_open(%s) failed\n", filename);
+                return -1;
+        }
+        ret = hv_dev_pread(fd, 0, (HV_VirtAddr)(&rc_config),
+                           sizeof(rc_config), PCIE_RC_CONFIG_MASK_OFF);
+        hv_dev_close(fd);
+        if (ret != sizeof(rc_config)) {
+                pr_err("PCI: wanted %zd bytes, got %d\n",
+                       sizeof(rc_config), ret);
+                return -1;
+        }
+        /* Record irq_base so that we can map INTx to IRQ # later. */
+        controller->irq_base = rc_config.intr;
+        for (x = 0; x < 4; x++)
+                tile_irq_activate(rc_config.intr + x,
+                                  TILE_IRQ_HW_CLEAR);
+        if (rc_config.plx_gen1)
+                controller->plx_gen1 = 1;
+        return 0;
+}
+/*
+ * First initialization entry point, called from setup_arch().
+ *
+ * Find valid controllers and fill in pci_controller structs for each
+ * of them.
+ *
+ * Returns the number of controllers discovered.
+ */
+int __init tile_pci_init(void)
+{
+        int i;
+        pr_info("PCI: Searching for controllers...\n");
+        /* Do any configuration we need before using the PCIe */
+        for (i = 0; i < TILE_NUM_PCIE; i++) {
+                int hv_cfg_fd0 = -1;
+                int hv_cfg_fd1 = -1;
+                int hv_mem_fd = -1;
+                char name[32];
+                struct pci_controller *controller;
+                /*
+                 * Open the fd to the HV.  If it fails then this
+                 * device doesn't exist.
+                 */
+                hv_cfg_fd0 = tile_pcie_open(i, 0);
+                if (hv_cfg_fd0 < 0)
+                        continue;
+                hv_cfg_fd1 = tile_pcie_open(i, 1);
+                if (hv_cfg_fd1 < 0) {
+                        pr_err("PCI: Couldn't open config fd to HV "
+                            "for controller %d\n", i);
+                        goto err_cont;
+                }
+                sprintf(name, "pcie/%d/mem", i);
+                hv_mem_fd = hv_dev_open((HV_VirtAddr)name, 0);
+                if (hv_mem_fd < 0) {
+                        pr_err("PCI: Could not open mem fd to HV!\n");
+                        goto err_cont;
+                }
+                pr_info("PCI: Found PCI controller #%d\n", i);
+                controller = &controllers[num_controllers];
+                if (tile_init_irqs(i, controller)) {
+                        pr_err("PCI: Could not initialize "
+                               "IRQs, aborting.\n");
+                        goto err_cont;
+                }
+                controller->index = num_controllers;
+                controller->hv_cfg_fd[0] = hv_cfg_fd0;
+                controller->hv_cfg_fd[1] = hv_cfg_fd1;
+                controller->hv_mem_fd = hv_mem_fd;
+                controller->first_busno = 0;
+                controller->last_busno = 0xff;
+                controller->ops = &tile_cfg_ops;
+                num_controllers++;
+                continue;
+err_cont:
+                if (hv_cfg_fd0 >= 0)
+                        hv_dev_close(hv_cfg_fd0);
+                if (hv_cfg_fd1 >= 0)
+                        hv_dev_close(hv_cfg_fd1);
+                if (hv_mem_fd >= 0)
+                        hv_dev_close(hv_mem_fd);
+                continue;
+        }
+        /*
+         * Before using the PCIe, see if we need to do any platform-specific
+         * configuration, such as the PLX switch Gen 1 issue on TILEmpower.
+         */
+        for (i = 0; i < num_controllers; i++) {
+                struct pci_controller *controller = &controllers[i];
+                if (controller->plx_gen1)
+                        tile_plx_gen1 = 1;
+        }
+        return num_controllers;
+}
+/*
+ * (pin - 1) converts from the PCI standard's [1:4] convention to
+ * a normal [0:3] range.
+ */
+static int tile_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
+{
+        struct pci_controller *controller =
+                (struct pci_controller *)dev->sysdata;
+        return (pin - 1) + controller->irq_base;
+}
+static void __init fixup_read_and_payload_sizes(void)
+{
+        struct pci_dev *dev = NULL;
+        int smallest_max_payload = 0x1; /* Tile maxes out at 256 bytes. */
+        int max_read_size = 0x2; /* Limit to 512 byte reads. */
+        u16 new_values;
+        /* Scan for the smallest maximum payload size. */
+        while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+                int pcie_caps_offset;
+                u32 devcap;
+                int max_payload;
+                pcie_caps_offset = pci_find_capability(dev, PCI_CAP_ID_EXP);
+                if (pcie_caps_offset == 0)
+                        continue;
+                pci_read_config_dword(dev, pcie_caps_offset + PCI_EXP_DEVCAP,
+                                      &devcap);
+                max_payload = devcap & PCI_EXP_DEVCAP_PAYLOAD;
+                if (max_payload < smallest_max_payload)
+                        smallest_max_payload = max_payload;
+        }
+        /* Now, set the max_payload_size for all devices to that value. */
+        new_values = (max_read_size << 12) | (smallest_max_payload << 5);
+        while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+                int pcie_caps_offset;
+                u16 devctl;
+                pcie_caps_offset = pci_find_capability(dev, PCI_CAP_ID_EXP);
+                if (pcie_caps_offset == 0)
+                        continue;
+                pci_read_config_word(dev, pcie_caps_offset + PCI_EXP_DEVCTL,
+                                     &devctl);
+                devctl &= ~(PCI_EXP_DEVCTL_PAYLOAD | PCI_EXP_DEVCTL_READRQ);
+                devctl |= new_values;
+                pci_write_config_word(dev, pcie_caps_offset + PCI_EXP_DEVCTL,
+                                      devctl);
+        }
+}
+/*
+ * Second PCI initialization entry point, called by subsys_initcall.
+ *
+ * The controllers have been set up by the time we get here, by a call to
+ * tile_pci_init.
+ */
+static int __init pcibios_init(void)
+{
+        int i;
+        pr_info("PCI: Probing PCI hardware\n");
+        /*
+         * Delay a bit in case devices aren't ready.  Some devices are
+         * known to require at least 20ms here, but we use a more
+         * conservative value.
+         */
+        mdelay(250);
+        /* Scan all of the recorded PCI controllers.  */
+        for (i = 0; i < num_controllers; i++) {
+                struct pci_controller *controller = &controllers[i];
+                struct pci_bus *bus;
+                pr_info("PCI: initializing controller #%d\n", i);
+                /*
+                 * This comes from the generic Linux PCI driver.
+                 *
+                 * It reads the PCI tree for this bus into the Linux
+                 * data structures.
+                 *
+                 * This is inlined in linux/pci.h and calls into
+                 * pci_scan_bus_parented() in probe.c.
+                 */
+                bus = pci_scan_bus(0, controller->ops, controller);
+                controller->root_bus = bus;
+                controller->last_busno = bus->subordinate;
+        }
+        /* Do machine dependent PCI interrupt routing */
+        pci_fixup_irqs(pci_common_swizzle, tile_map_irq);
+        /*
+         * This comes from the generic Linux PCI driver.
+         *
+         * It allocates all of the resources (I/O memory, etc)
+         * associated with the devices read in above.
+         */
+        pci_assign_unassigned_resources();
+        /* Configure the max_read_size and max_payload_size values. */
+        fixup_read_and_payload_sizes();
+        /* Record the I/O resources in the PCI controller structure. */
+        for (i = 0; i < num_controllers; i++) {
+                struct pci_bus *root_bus = controllers[i].root_bus;
+                struct pci_bus *next_bus;
+                struct pci_dev *dev;
+                list_for_each_entry(dev, &root_bus->devices, bus_list) {
+                        /* Find the PCI host controller, ie. the 1st bridge. */
+                        if ((dev->class >> 8) == PCI_CLASS_BRIDGE_PCI &&
+                                (PCI_SLOT(dev->devfn) == 0)) {
+                                next_bus = dev->subordinate;
+                                controllers[i].mem_resources[0] =
+                                        *next_bus->resource[0];
+                                controllers[i].mem_resources[1] =
+                                         *next_bus->resource[1];
+                                controllers[i].mem_resources[2] =
+                                         *next_bus->resource[2];
+                                break;
+                        }
+                }
+        }
+        return 0;
+}
+subsys_initcall(pcibios_init);
+/*
+ * No bus fixups needed.
+ */
+void __devinit pcibios_fixup_bus(struct pci_bus *bus)
+{
+        /* Nothing needs to be done. */
+}
+/*
+ * This can be called from the generic PCI layer, but doesn't need to
+ * do anything.
+ */
+char __devinit *pcibios_setup(char *str)
+{
+        /* Nothing needs to be done. */
+        return str;
+}
+/*
+ * This is called from the generic Linux layer.
+ */
+void __init pcibios_update_irq(struct pci_dev *dev, int irq)
+{
+        pci_write_config_byte(dev, PCI_INTERRUPT_LINE, irq);
+}
+/*
+ * Enable memory and/or address decoding, as appropriate, for the
+ * device described by the 'dev' struct.
+ *
+ * This is called from the generic PCI layer, and can be called
+ * for bridges or endpoints.
+ */
+int pcibios_enable_device(struct pci_dev *dev, int mask)
+{
+        u16 cmd, old_cmd;
+        u8 header_type;
+        int i;
+        struct resource *r;
+        pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
+        pci_read_config_word(dev, PCI_COMMAND, &cmd);
+        old_cmd = cmd;
+        if ((header_type & 0x7F) == PCI_HEADER_TYPE_BRIDGE) {
+                /*
+                 * For bridges, we enable both memory and I/O decoding
+                 * in call cases.
+                 */
+                cmd |= PCI_COMMAND_IO;
+                cmd |= PCI_COMMAND_MEMORY;
+        } else {
+                /*
+                 * For endpoints, we enable memory and/or I/O decoding
+                 * only if they have a memory resource of that type.
+                 */
+                for (i = 0; i < 6; i++) {
+                        r = &dev->resource[i];
+                        if (r->flags & IORESOURCE_UNSET) {
+                                pr_err("PCI: Device %s not available "
+                                       "because of resource collisions\n",
+                                       pci_name(dev));
+                                return -EINVAL;
+                        }
+                        if (r->flags & IORESOURCE_IO)
+                                cmd |= PCI_COMMAND_IO;
+                        if (r->flags & IORESOURCE_MEM)
+                                cmd |= PCI_COMMAND_MEMORY;
+                }
+        }
+        /*
+         * We only write the command if it changed.
+         */
+        if (cmd != old_cmd)
+                pci_write_config_word(dev, PCI_COMMAND, cmd);
+        return 0;
+}
+void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max)
+{
+        unsigned long start = pci_resource_start(dev, bar);
+        unsigned long len = pci_resource_len(dev, bar);
+        unsigned long flags = pci_resource_flags(dev, bar);
+        if (!len)
+                return NULL;
+        if (max && len > max)
+                len = max;
+        if (!(flags & IORESOURCE_MEM)) {
+                pr_info("PCI: Trying to map invalid resource %#lx\n", flags);
+                start = 0;
+        }
+        return (void __iomem *)start;
+}
+EXPORT_SYMBOL(pci_iomap);
+/****************************************************************
+ *
+ * Tile PCI config space read/write routines
+ *
+ ****************************************************************/
+/*
+ * These are the normal read and write ops
+ * These are expanded with macros from  pci_bus_read_config_byte() etc.
+ *
+ * devfn is the combined PCI slot & function.
+ *
+ * offset is in bytes, from the start of config space for the
+ * specified bus & slot.
+ */
+static int __devinit tile_cfg_read(struct pci_bus *bus,
+                                   unsigned int devfn,
+                                   int offset,
+                                   int size,
+                                   u32 *val)
+{
+        struct pci_controller *controller = bus->sysdata;
+        int busnum = bus->number & 0xff;
+        int slot = (devfn >> 3) & 0x1f;
+        int function = devfn & 0x7;
+        u32 addr;
+        int config_mode = 1;
+        /*
+         * There is no bridge between the Tile and bus 0, so we
+         * use config0 to talk to bus 0.
+         *
+         * If we're talking to a bus other than zero then we
+         * must have found a bridge.
+         */
+        if (busnum == 0) {
+                /*
+                 * We fake an empty slot for (busnum == 0) && (slot > 0),
+                 * since there is only one slot on bus 0.
+                 */
+                if (slot) {
+                        *val = 0xFFFFFFFF;
+                        return 0;
+                }
+                config_mode = 0;
+        }
+        addr = busnum << 20;            /* Bus in 27:20 */
+        addr |= slot << 15;             /* Slot (device) in 19:15 */
+        addr |= function << 12;         /* Function is in 14:12 */
+        addr |= (offset & 0xFFF);       /* byte address in 0:11 */
+        return hv_dev_pread(controller->hv_cfg_fd[config_mode], 0,
+                            (HV_VirtAddr)(val), size, addr);
+}
+/*
+ * See tile_cfg_read() for relevent comments.
+ * Note that "val" is the value to write, not a pointer to that value.
+ */
+static int __devinit tile_cfg_write(struct pci_bus *bus,
+                                    unsigned int devfn,
+                                    int offset,
+                                    int size,
+                                    u32 val)
+{
+        struct pci_controller *controller = bus->sysdata;
+        int busnum = bus->number & 0xff;
+        int slot = (devfn >> 3) & 0x1f;
+        int function = devfn & 0x7;
+        u32 addr;
+        int config_mode = 1;
+        HV_VirtAddr valp = (HV_VirtAddr)&val;
+        /*
+         * For bus 0 slot 0 we use config 0 accesses.
+         */
+        if (busnum == 0) {
+                /*
+                 * We fake an empty slot for (busnum == 0) && (slot > 0),
+                 * since there is only one slot on bus 0.
+                 */
+                if (slot)
+                        return 0;
+                config_mode = 0;
+        }
+        addr = busnum << 20;            /* Bus in 27:20 */
+        addr |= slot << 15;             /* Slot (device) in 19:15 */
+        addr |= function << 12;         /* Function is in 14:12 */
+        addr |= (offset & 0xFFF);       /* byte address in 0:11 */
+#ifdef __BIG_ENDIAN
+        /* Point to the correct part of the 32-bit "val". */
+        valp += 4 - size;
+#endif
+        return hv_dev_pwrite(controller->hv_cfg_fd[config_mode], 0,
+                             valp, size, addr);
+}
+static struct pci_ops tile_cfg_ops = {
+        .read =         tile_cfg_read,
+        .write =        tile_cfg_write,
+};
+/*
+ * In the following, each PCI controller's mem_resources[1]
+ * represents its (non-prefetchable) PCI memory resource.
+ * mem_resources[0] and mem_resources[2] refer to its PCI I/O and
+ * prefetchable PCI memory resources, respectively.
+ * For more details, see pci_setup_bridge() in setup-bus.c.
+ * By comparing the target PCI memory address against the
+ * end address of controller 0, we can determine the controller
+ * that should accept the PCI memory access.
+ */
+#define TILE_READ(size, type)                                           \
+type _tile_read##size(unsigned long addr)                               \
+{                                                                       \
+        type val;                                                       \
+        int idx = 0;                                                    \
+        if (addr > controllers[0].mem_resources[1].end &&               \
+            addr > controllers[0].mem_resources[2].end)                 \
+                idx = 1;                                                \
+        if (hv_dev_pread(controllers[idx].hv_mem_fd, 0,                 \
+                         (HV_VirtAddr)(&val), sizeof(type), addr))      \
+                pr_err("PCI: read %zd bytes at 0x%lX failed\n",         \
+                       sizeof(type), addr);                             \
+        return val;                                                     \
+}                                                                       \
+EXPORT_SYMBOL(_tile_read##size)
+TILE_READ(b, u8);
+TILE_READ(w, u16);
+TILE_READ(l, u32);
+TILE_READ(q, u64);
+#define TILE_WRITE(size, type)                                          \
+void _tile_write##size(type val, unsigned long addr)                    \
+{                                                                       \
+        int idx = 0;                                                    \
+        if (addr > controllers[0].mem_resources[1].end &&               \
+            addr > controllers[0].mem_resources[2].end)                 \
+                idx = 1;                                                \
+        if (hv_dev_pwrite(controllers[idx].hv_mem_fd, 0,                \
+                          (HV_VirtAddr)(&val), sizeof(type), addr))     \
+                pr_err("PCI: write %zd bytes at 0x%lX failed\n",        \
+                       sizeof(type), addr);                             \
+}                                                                       \
+EXPORT_SYMBOL(_tile_write##size)
+TILE_WRITE(b, u8);
+TILE_WRITE(w, u16);
+TILE_WRITE(l, u32);
+TILE_WRITE(q, u64);
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index fb0b3cbeae14..f18573643ed1 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -840,7 +840,7 @@ static int __init topology_init(void)
        for_each_online_node(i)
                register_one_node(i);
-        for_each_present_cpu(i)
+        for (i = 0; i < smp_height * smp_width; ++i)
                register_cpu(&cpu_devices[i], i);
        return 0;
diff --git a/arch/tile/lib/memchr_32.c b/arch/tile/lib/memchr_32.c
index 6235283b4859..cc3d9badf030 100644
--- a/arch/tile/lib/memchr_32.c
+++ b/arch/tile/lib/memchr_32.c
@@ -18,12 +18,24 @@
 void *memchr(const void *s, int c, size_t n)
 {
+        const uint32_t *last_word_ptr;
+        const uint32_t *p;
+        const char *last_byte_ptr;
+        uintptr_t s_int;
+        uint32_t goal, before_mask, v, bits;
+        char *ret;
+        if (__builtin_expect(n == 0, 0)) {
+                /* Don't dereference any memory if the array is empty. */
+                return NULL;
+        }
        /* Get an aligned pointer. */
-        const uintptr_t s_int = (uintptr_t) s;
+        s_int = (uintptr_t) s;
-        const uint32_t *p = (const uint32_t *)(s_int & -4);
+        p = (const uint32_t *)(s_int & -4);
        /* Create four copies of the byte for which we are looking. */
-        const uint32_t goal = 0x01010101 * (uint8_t) c;
+        goal = 0x01010101 * (uint8_t) c;
        /* Read the first word, but munge it so that bytes before the array
         * will not match goal.
@@ -31,23 +43,14 @@ void *memchr(const void *s, int c, size_t n)
         * Note that this shift count expression works because we know
         * shift counts are taken mod 32.
         */
-        const uint32_t before_mask = (1 << (s_int << 3)) - 1;
+        before_mask = (1 << (s_int << 3)) - 1;
-        uint32_t v = (*p | before_mask) ^ (goal & before_mask);
+        v = (*p | before_mask) ^ (goal & before_mask);
        /* Compute the address of the last byte. */
-        const char *const last_byte_ptr = (const char *)s + n - 1;
+        last_byte_ptr = (const char *)s + n - 1;
        /* Compute the address of the word containing the last byte. */
-        const uint32_t *const last_word_ptr =
+        last_word_ptr = (const uint32_t *)((uintptr_t) last_byte_ptr & -4);
-            (const uint32_t *)((uintptr_t) last_byte_ptr & -4);
-        uint32_t bits;
-        char *ret;
-        if (__builtin_expect(n == 0, 0)) {
-                /* Don't dereference any memory if the array is empty. */
-                return NULL;
-        }
        while ((bits = __insn_seqb(v, goal)) == 0) {
                if (__builtin_expect(p == last_word_ptr, 0)) {
diff --git a/arch/tile/lib/spinlock_32.c b/arch/tile/lib/spinlock_32.c
index 485e24d62c6b..5cd1c4004eca 100644
--- a/arch/tile/lib/spinlock_32.c
+++ b/arch/tile/lib/spinlock_32.c
@@ -167,23 +167,30 @@ void arch_write_lock_slow(arch_rwlock_t *rwlock, u32 val)
         * when we compare them.
         */
        u32 my_ticket_;
+        u32 iterations = 0;
-        /* Take out the next ticket; this will also stop would-be readers. */
+        /*
-        if (val & 1)
+         * Wait until there are no readers, then bump up the next
-                val = get_rwlock(rwlock);
+         * field and capture the ticket value.
-        rwlock->lock = __insn_addb(val, 1 << WR_NEXT_SHIFT);
+         */
+        for (;;) {
+                if (!(val & 1)) {
+                        if ((val >> RD_COUNT_SHIFT) == 0)
+                                break;
+                        rwlock->lock = val;
+                }
+                delay_backoff(iterations++);
+                val = __insn_tns((int *)&rwlock->lock);
+        }
-        /* Extract my ticket value from the original word. */
+        /* Take out the next ticket and extract my ticket value. */
+        rwlock->lock = __insn_addb(val, 1 << WR_NEXT_SHIFT);
        my_ticket_ = val >> WR_NEXT_SHIFT;
-        /*
+        /* Wait until the "current" field matches our ticket. */
-         * Wait until the "current" field matches our ticket, and
-         * there are no remaining readers.
-         */
        for (;;) {
                u32 curr_ = val >> WR_CURR_SHIFT;
-                u32 readers = val >> RD_COUNT_SHIFT;
+                u32 delta = ((my_ticket_ - curr_) & WR_MASK);
-                u32 delta = ((my_ticket_ - curr_) & WR_MASK) + !!readers;
                if (likely(delta == 0))
                        break;
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 7f7338c90784..1664cce7b0ac 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -727,6 +727,9 @@ struct winch {
 static void free_winch(struct winch *winch, int free_irq_ok)
 {
+        if (free_irq_ok)
+                free_irq(WINCH_IRQ, winch);
        list_del(&winch->list);
        if (winch->pid != -1)
@@ -735,8 +738,6 @@ static void free_winch(struct winch *winch, int free_irq_ok)
                os_close_file(winch->fd);
        if (winch->stack != 0)
                free_stack(winch->stack, 0);
-        if (free_irq_ok)
-                free_irq(WINCH_IRQ, winch);
        kfree(winch);
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index e8327686d3c5..e330da21b84f 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -21,7 +21,7 @@ config X86
        select HAVE_UNSTABLE_SCHED_CLOCK
        select HAVE_IDE
        select HAVE_OPROFILE
-        select HAVE_PERF_EVENTS if (!M386 && !M486)
+        select HAVE_PERF_EVENTS
        select HAVE_IRQ_WORK
        select HAVE_IOREMAP_PROT
        select HAVE_KPROBES
diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index 4d293dced62f..9479a037419f 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -216,8 +216,8 @@ static inline unsigned long virt_to_fix(const unsigned long vaddr)
 }
 /* Return an pointer with offset calculated */
-static inline unsigned long __set_fixmap_offset(enum fixed_addresses idx,
+static __always_inline unsigned long
-                                phys_addr_t phys, pgprot_t flags)
+__set_fixmap_offset(enum fixed_addresses idx, phys_addr_t phys, pgprot_t flags)
 {
        __set_fixmap(idx, phys, flags);
        return fix_to_virt(idx) + (phys & (PAGE_SIZE - 1));
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 3ea3dc487047..6b89f5e86021 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -128,7 +128,7 @@
 #define FAM10H_MMIO_CONF_ENABLE         (1<<0)
 #define FAM10H_MMIO_CONF_BUSRANGE_MASK  0xf
 #define FAM10H_MMIO_CONF_BUSRANGE_SHIFT 2
-#define FAM10H_MMIO_CONF_BASE_MASK      0xfffffff
+#define FAM10H_MMIO_CONF_BASE_MASK      0xfffffffULL
 #define FAM10H_MMIO_CONF_BASE_SHIFT     20
 #define MSR_FAM10H_NODE_ID              0xc001100c
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 18e3b8a8709f..ef9975812c77 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -824,27 +824,27 @@ static __always_inline void arch_spin_unlock(struct arch_spinlock *lock)
 #define __PV_IS_CALLEE_SAVE(func)                       \
        ((struct paravirt_callee_save) { func })
-static inline unsigned long arch_local_save_flags(void)
+static inline notrace unsigned long arch_local_save_flags(void)
 {
        return PVOP_CALLEE0(unsigned long, pv_irq_ops.save_fl);
 }
-static inline void arch_local_irq_restore(unsigned long f)
+static inline notrace void arch_local_irq_restore(unsigned long f)
 {
        PVOP_VCALLEE1(pv_irq_ops.restore_fl, f);
 }
-static inline void arch_local_irq_disable(void)
+static inline notrace void arch_local_irq_disable(void)
 {
        PVOP_VCALLEE0(pv_irq_ops.irq_disable);
 }
-static inline void arch_local_irq_enable(void)
+static inline notrace void arch_local_irq_enable(void)
 {
        PVOP_VCALLEE0(pv_irq_ops.irq_enable);
 }
-static inline unsigned long arch_local_irq_save(void)
+static inline notrace unsigned long arch_local_irq_save(void)
 {
        unsigned long f;
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index 7f7e577a0e39..31d84acc1512 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -11,6 +11,7 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src);
 void pvclock_read_wallclock(struct pvclock_wall_clock *wall,
                            struct pvclock_vcpu_time_info *vcpu,
                            struct timespec *ts);
+void pvclock_resume(void);
 /*
 * Scale a 64-bit delta by scaling and multiplying by a 32-bit fraction,
diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
index e969f691cbfd..a501741c2335 100644
--- a/arch/x86/include/asm/uv/uv_hub.h
+++ b/arch/x86/include/asm/uv/uv_hub.h
@@ -199,6 +199,8 @@ union uvh_apicid {
 #define UVH_APICID              0x002D0E00L
 #define UV_APIC_PNODE_SHIFT     6
+#define UV_APICID_HIBIT_MASK    0xffff0000
 /* Local Bus from cpu's perspective */
 #define LOCAL_BUS_BASE          0x1c00000
 #define LOCAL_BUS_SIZE          (4 * 1024 * 1024)
@@ -491,8 +493,10 @@ static inline void uv_set_cpu_scir_bits(int cpu, unsigned char value)
        }
 }
+extern unsigned int uv_apicid_hibits;
 static unsigned long uv_hub_ipi_value(int apicid, int vector, int mode)
 {
+        apicid |= uv_apicid_hibits;
        return (1UL << UVH_IPI_INT_SEND_SHFT) |
                        ((apicid) << UVH_IPI_INT_APIC_ID_SHFT) |
                        (mode << UVH_IPI_INT_DELIVERY_MODE_SHFT) |
diff --git a/arch/x86/include/asm/uv/uv_mmrs.h b/arch/x86/include/asm/uv/uv_mmrs.h
index 6d90adf4428a..20cafeac7455 100644
--- a/arch/x86/include/asm/uv/uv_mmrs.h
+++ b/arch/x86/include/asm/uv/uv_mmrs.h
@@ -5,7 +5,7 @@
 *
 * SGI UV MMR definitions
 *
- * Copyright (C) 2007-2008 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2007-2010 Silicon Graphics, Inc. All rights reserved.
 */
 #ifndef _ASM_X86_UV_UV_MMRS_H
@@ -754,6 +754,23 @@ union uvh_lb_bau_sb_descriptor_base_u {
 };
 /* ========================================================================= */
+/*                   UVH_LB_TARGET_PHYSICAL_APIC_ID_MASK                     */
+/* ========================================================================= */
+#define UVH_LB_TARGET_PHYSICAL_APIC_ID_MASK 0x320130UL
+#define UVH_LB_TARGET_PHYSICAL_APIC_ID_MASK_32 0x009f0
+#define UVH_LB_TARGET_PHYSICAL_APIC_ID_MASK_BIT_ENABLES_SHFT 0
+#define UVH_LB_TARGET_PHYSICAL_APIC_ID_MASK_BIT_ENABLES_MASK 0x00000000ffffffffUL
+union uvh_lb_target_physical_apic_id_mask_u {
+        unsigned long v;
+        struct uvh_lb_target_physical_apic_id_mask_s {
+                unsigned long bit_enables : 32;  /* RW */
+                unsigned long rsvd_32_63  : 32;  /*    */
+        } s;
+};
+/* ========================================================================= */
 /*                               UVH_NODE_ID                                 */
 /* ========================================================================= */
 #define UVH_NODE_ID 0x0UL
diff --git a/arch/x86/include/asm/xen/interface.h b/arch/x86/include/asm/xen/interface.h
index e8506c1f0c55..1c10c88ee4e1 100644
--- a/arch/x86/include/asm/xen/interface.h
+++ b/arch/x86/include/asm/xen/interface.h
@@ -61,9 +61,9 @@ DEFINE_GUEST_HANDLE(void);
 #define HYPERVISOR_VIRT_START mk_unsigned_long(__HYPERVISOR_VIRT_START)
 #endif
-#ifndef machine_to_phys_mapping
+#define MACH2PHYS_VIRT_START  mk_unsigned_long(__MACH2PHYS_VIRT_START)
-#define machine_to_phys_mapping ((unsigned long *)HYPERVISOR_VIRT_START)
+#define MACH2PHYS_VIRT_END    mk_unsigned_long(__MACH2PHYS_VIRT_END)
-#endif
+#define MACH2PHYS_NR_ENTRIES  ((MACH2PHYS_VIRT_END-MACH2PHYS_VIRT_START)>>__MACH2PHYS_SHIFT)
 /* Maximum number of virtual CPUs in multi-processor guests. */
 #define MAX_VIRT_CPUS 32
diff --git a/arch/x86/include/asm/xen/interface_32.h b/arch/x86/include/asm/xen/interface_32.h
index 42a7e004ae5c..8413688b2571 100644
--- a/arch/x86/include/asm/xen/interface_32.h
+++ b/arch/x86/include/asm/xen/interface_32.h
@@ -32,6 +32,11 @@
 /* And the trap vector is... */
 #define TRAP_INSTR "int $0x82"
+#define __MACH2PHYS_VIRT_START 0xF5800000
+#define __MACH2PHYS_VIRT_END   0xF6800000
+#define __MACH2PHYS_SHIFT      2
 /*
 * Virtual addresses beyond this are not modifiable by guest OSes. The
 * machine->physical mapping table starts at this address, read-only.
diff --git a/arch/x86/include/asm/xen/interface_64.h b/arch/x86/include/asm/xen/interface_64.h
index 100d2662b97c..839a4811cf98 100644
--- a/arch/x86/include/asm/xen/interface_64.h
+++ b/arch/x86/include/asm/xen/interface_64.h
@@ -39,18 +39,7 @@
 #define __HYPERVISOR_VIRT_END   0xFFFF880000000000
 #define __MACH2PHYS_VIRT_START  0xFFFF800000000000
 #define __MACH2PHYS_VIRT_END    0xFFFF804000000000
+#define __MACH2PHYS_SHIFT       3
-#ifndef HYPERVISOR_VIRT_START
-#define HYPERVISOR_VIRT_START mk_unsigned_long(__HYPERVISOR_VIRT_START)
-#define HYPERVISOR_VIRT_END   mk_unsigned_long(__HYPERVISOR_VIRT_END)
-#endif
-#define MACH2PHYS_VIRT_START  mk_unsigned_long(__MACH2PHYS_VIRT_START)
-#define MACH2PHYS_VIRT_END    mk_unsigned_long(__MACH2PHYS_VIRT_END)
-#define MACH2PHYS_NR_ENTRIES  ((MACH2PHYS_VIRT_END-MACH2PHYS_VIRT_START)>>3)
-#ifndef machine_to_phys_mapping
-#define machine_to_phys_mapping ((unsigned long *)HYPERVISOR_VIRT_START)
-#endif
 /*
 * int HYPERVISOR_set_segment_base(unsigned int which, unsigned long base)
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index dd8c1414b3d5..8760cc60a21c 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -5,6 +5,7 @@
 #include <linux/types.h>
 #include <linux/spinlock.h>
 #include <linux/pfn.h>
+#include <linux/mm.h>
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -35,6 +36,8 @@ typedef struct xpaddr {
 #define MAX_DOMAIN_PAGES                                                \
    ((unsigned long)((u64)CONFIG_XEN_MAX_DOMAIN_MEMORY * 1024 * 1024 * 1024 / PAGE_SIZE))
+extern unsigned long *machine_to_phys_mapping;
+extern unsigned int   machine_to_phys_order;
 extern unsigned long get_phys_to_machine(unsigned long pfn);
 extern bool set_phys_to_machine(unsigned long pfn, unsigned long mfn);
@@ -69,10 +72,8 @@ static inline unsigned long mfn_to_pfn(unsigned long mfn)
        if (xen_feature(XENFEAT_auto_translated_physmap))
                return mfn;
-#if 0
        if (unlikely((mfn >> machine_to_phys_order) != 0))
-                return max_mapnr;
+                return ~0;
-#endif
        pfn = 0;
        /*
diff --git a/arch/x86/kernel/apic/hw_nmi.c b/arch/x86/kernel/apic/hw_nmi.c
index cefd6942f0e9..62f6e1e55b90 100644
--- a/arch/x86/kernel/apic/hw_nmi.c
+++ b/arch/x86/kernel/apic/hw_nmi.c
@@ -17,15 +17,16 @@
 #include <linux/nmi.h>
 #include <linux/module.h>
-/* For reliability, we're prepared to waste bits here. */
-static DECLARE_BITMAP(backtrace_mask, NR_CPUS) __read_mostly;
 u64 hw_nmi_get_sample_period(void)
 {
        return (u64)(cpu_khz) * 1000 * 60;
 }
 #ifdef ARCH_HAS_NMI_WATCHDOG
+/* For reliability, we're prepared to waste bits here. */
+static DECLARE_BITMAP(backtrace_mask, NR_CPUS) __read_mostly;
 void arch_trigger_all_cpu_backtrace(void)
 {
        int i;
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 194539aea175..c1c52c341f40 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -44,6 +44,8 @@ static u64 gru_start_paddr, gru_end_paddr;
 static union uvh_apicid uvh_apicid;
 int uv_min_hub_revision_id;
 EXPORT_SYMBOL_GPL(uv_min_hub_revision_id);
+unsigned int uv_apicid_hibits;
+EXPORT_SYMBOL_GPL(uv_apicid_hibits);
 static DEFINE_SPINLOCK(uv_nmi_lock);
 static inline bool is_GRU_range(u64 start, u64 end)
@@ -85,6 +87,23 @@ static void __init early_get_apic_pnode_shift(void)
                uvh_apicid.s.pnode_shift = UV_APIC_PNODE_SHIFT;
 }
+/*
+ * Add an extra bit as dictated by bios to the destination apicid of
+ * interrupts potentially passing through the UV HUB.  This prevents
+ * a deadlock between interrupts and IO port operations.
+ */
+static void __init uv_set_apicid_hibit(void)
+{
+        union uvh_lb_target_physical_apic_id_mask_u apicid_mask;
+        unsigned long *mmr;
+        mmr = early_ioremap(UV_LOCAL_MMR_BASE |
+                UVH_LB_TARGET_PHYSICAL_APIC_ID_MASK, sizeof(*mmr));
+        apicid_mask.v = *mmr;
+        early_iounmap(mmr, sizeof(*mmr));
+        uv_apicid_hibits = apicid_mask.s.bit_enables & UV_APICID_HIBIT_MASK;
+}
 static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
        int nodeid;
@@ -102,6 +121,7 @@ static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
                        __get_cpu_var(x2apic_extra_bits) =
                                nodeid << (uvh_apicid.s.pnode_shift - 1);
                        uv_system_type = UV_NON_UNIQUE_APIC;
+                        uv_set_apicid_hibit();
                        return 1;
                }
        }
@@ -155,6 +175,7 @@ static int __cpuinit uv_wakeup_secondary(int phys_apicid, unsigned long start_ri
        int pnode;
        pnode = uv_apicid_to_pnode(phys_apicid);
+        phys_apicid |= uv_apicid_hibits;
        val = (1UL << UVH_IPI_INT_SEND_SHFT) |
            (phys_apicid << UVH_IPI_INT_APIC_ID_SHFT) |
            ((start_rip << UVH_IPI_INT_VECTOR_SHFT) >> 12) |
@@ -236,7 +257,7 @@ static unsigned int uv_cpu_mask_to_apicid(const struct cpumask *cpumask)
        int cpu = cpumask_first(cpumask);
        if ((unsigned)cpu < nr_cpu_ids)
-                return per_cpu(x86_cpu_to_apicid, cpu);
+                return per_cpu(x86_cpu_to_apicid, cpu) | uv_apicid_hibits;
        else
                return BAD_APICID;
 }
@@ -255,7 +276,7 @@ uv_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
                if (cpumask_test_cpu(cpu, cpu_online_mask))
                        break;
        }
-        return per_cpu(x86_cpu_to_apicid, cpu);
+        return per_cpu(x86_cpu_to_apicid, cpu) | uv_apicid_hibits;
 }
 static unsigned int x2apic_get_apic_id(unsigned long x)
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index ed6310183efb..6d75b9145b13 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -381,6 +381,20 @@ static void release_pmc_hardware(void) {}
 #endif
+static bool check_hw_exists(void)
+{
+        u64 val, val_new = 0;
+        int ret = 0;
+        val = 0xabcdUL;
+        ret |= checking_wrmsrl(x86_pmu.perfctr, val);
+        ret |= rdmsrl_safe(x86_pmu.perfctr, &val_new);
+        if (ret || val != val_new)
+                return false;
+        return true;
+}
 static void reserve_ds_buffers(void);
 static void release_ds_buffers(void);
@@ -1372,6 +1386,12 @@ void __init init_hw_perf_events(void)
        pmu_check_apic();
+        /* sanity check that the hardware exists or is emulated */
+        if (!check_hw_exists()) {
+                pr_cont("Broken PMU hardware detected, software events only.\n");
+                return;
+        }
        pr_cont("%s PMU driver.\n", x86_pmu.name);
        if (x86_pmu.quirks)
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 59e175e89599..591e60104278 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -395,7 +395,7 @@ sysenter_past_esp:
         * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
         * pushed above; +8 corresponds to copy_thread's esp0 setting.
         */
-        pushl_cfi (TI_sysenter_return-THREAD_SIZE_asm+8+4*4)(%esp)
+        pushl_cfi ((TI_sysenter_return)-THREAD_SIZE_asm+8+4*4)(%esp)
        CFI_REL_OFFSET eip, 0
        pushl_cfi %eax
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index fe2690d71c0c..e3ba417e8697 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -295,6 +295,7 @@ ENDPROC(native_usergs_sysret64)
        .endm
 /* save partial stack frame */
+        .pushsection .kprobes.text, "ax"
 ENTRY(save_args)
        XCPT_FRAME
        cld
@@ -334,6 +335,7 @@ ENTRY(save_args)
        ret
        CFI_ENDPROC
 END(save_args)
+        .popsection
 ENTRY(save_rest)
        PARTIAL_FRAME 1 REST_SKIP+8
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index ff15c9dcc25d..42c594254507 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -433,6 +433,10 @@ static int __kprobes hw_breakpoint_handler(struct die_args *args)
        dr6_p = (unsigned long *)ERR_PTR(args->err);
        dr6 = *dr6_p;
+        /* If it's a single step, TRAP bits are random */
+        if (dr6 & DR_STEP)
+                return NOTIFY_DONE;
        /* Do an early return if no trap bits are set in DR6 */
        if ((dr6 & DR_TRAP_BITS) == 0)
                return NOTIFY_DONE;
diff --git a/arch/x86/kernel/mmconf-fam10h_64.c b/arch/x86/kernel/mmconf-fam10h_64.c
index 6da143c2a6b8..ac861b8348e2 100644
--- a/arch/x86/kernel/mmconf-fam10h_64.c
+++ b/arch/x86/kernel/mmconf-fam10h_64.c
@@ -25,7 +25,6 @@ struct pci_hostbridge_probe {
 };
 static u64 __cpuinitdata fam10h_pci_mmconf_base;
-static int __cpuinitdata fam10h_pci_mmconf_base_status;
 static struct pci_hostbridge_probe pci_probes[] __cpuinitdata = {
        { 0, 0x18, PCI_VENDOR_ID_AMD, 0x1200 },
@@ -44,10 +43,12 @@ static int __cpuinit cmp_range(const void *x1, const void *x2)
        return start1 - start2;
 }
-/*[47:0] */
+#define MMCONF_UNIT (1ULL << FAM10H_MMIO_CONF_BASE_SHIFT)
-/* need to avoid (0xfd<<32) and (0xfe<<32), ht used space */
+#define MMCONF_MASK (~(MMCONF_UNIT - 1))
+#define MMCONF_SIZE (MMCONF_UNIT << 8)
+/* need to avoid (0xfd<<32), (0xfe<<32), and (0xff<<32), ht used space */
 #define FAM10H_PCI_MMCONF_BASE (0xfcULL<<32)
-#define BASE_VALID(b) ((b != (0xfdULL << 32)) && (b != (0xfeULL << 32)))
+#define BASE_VALID(b) ((b) + MMCONF_SIZE <= (0xfdULL<<32) || (b) >= (1ULL<<40))
 static void __cpuinit get_fam10h_pci_mmconf_base(void)
 {
        int i;
@@ -64,12 +65,11 @@ static void __cpuinit get_fam10h_pci_mmconf_base(void)
        struct range range[8];
        /* only try to get setting from BSP */
-        /* -1 or 1 */
+        if (fam10h_pci_mmconf_base)
-        if (fam10h_pci_mmconf_base_status)
                return;
        if (!early_pci_allowed())
-                goto fail;
+                return;
        found = 0;
        for (i = 0; i < ARRAY_SIZE(pci_probes); i++) {
@@ -91,7 +91,7 @@ static void __cpuinit get_fam10h_pci_mmconf_base(void)
        }
        if (!found)
-                goto fail;
+                return;
        /* SYS_CFG */
        address = MSR_K8_SYSCFG;
@@ -99,16 +99,16 @@ static void __cpuinit get_fam10h_pci_mmconf_base(void)
        /* TOP_MEM2 is not enabled? */
        if (!(val & (1<<21))) {
-                tom2 = 0;
+                tom2 = 1ULL << 32;
        } else {
                /* TOP_MEM2 */
                address = MSR_K8_TOP_MEM2;
                rdmsrl(address, val);
-                tom2 = val & (0xffffULL<<32);
+                tom2 = max(val & 0xffffff800000ULL, 1ULL << 32);
        }
        if (base <= tom2)
-                base = tom2 + (1ULL<<32);
+                base = (tom2 + 2 * MMCONF_UNIT - 1) & MMCONF_MASK;
        /*
         * need to check if the range is in the high mmio range that is
@@ -123,11 +123,11 @@ static void __cpuinit get_fam10h_pci_mmconf_base(void)
                if (!(reg & 3))
                        continue;
-                start = (((u64)reg) << 8) & (0xffULL << 32); /* 39:16 on 31:8*/
+                start = (u64)(reg & 0xffffff00) << 8; /* 39:16 on 31:8*/
                reg = read_pci_config(bus, slot, 1, 0x84 + (i << 3));
-                end = (((u64)reg) << 8) & (0xffULL << 32); /* 39:16 on 31:8*/
+                end = ((u64)(reg & 0xffffff00) << 8) | 0xffff; /* 39:16 on 31:8*/
-                if (!end)
+                if (end < tom2)
                        continue;
                range[hi_mmio_num].start = start;
@@ -143,32 +143,27 @@ static void __cpuinit get_fam10h_pci_mmconf_base(void)
        if (range[hi_mmio_num - 1].end < base)
                goto out;
-        if (range[0].start > base)
+        if (range[0].start > base + MMCONF_SIZE)
                goto out;
        /* need to find one window */
-        base = range[0].start - (1ULL << 32);
+        base = (range[0].start & MMCONF_MASK) - MMCONF_UNIT;
        if ((base > tom2) && BASE_VALID(base))
                goto out;
-        base = range[hi_mmio_num - 1].end + (1ULL << 32);
+        base = (range[hi_mmio_num - 1].end + MMCONF_UNIT) & MMCONF_MASK;
-        if ((base > tom2) && BASE_VALID(base))
+        if (BASE_VALID(base))
                goto out;
        /* need to find window between ranges */
-        if (hi_mmio_num > 1)
+        for (i = 1; i < hi_mmio_num; i++) {
-        for (i = 0; i < hi_mmio_num - 1; i++) {
+                base = (range[i - 1].end + MMCONF_UNIT) & MMCONF_MASK;
-                if (range[i + 1].start > (range[i].end + (1ULL << 32))) {
+                val = range[i].start & MMCONF_MASK;
-                        base = range[i].end + (1ULL << 32);
+                if (val >= base + MMCONF_SIZE && BASE_VALID(base))
-                        if ((base > tom2) && BASE_VALID(base))
+                        goto out;
-                                goto out;
-                }
        }
-fail:
-        fam10h_pci_mmconf_base_status = -1;
        return;
 out:
        fam10h_pci_mmconf_base = base;
-        fam10h_pci_mmconf_base_status = 1;
 }
 void __cpuinit fam10h_check_enable_mmcfg(void)
@@ -190,11 +185,10 @@ void __cpuinit fam10h_check_enable_mmcfg(void)
                /* only trust the one handle 256 buses, if acpi=off */
                if (!acpi_pci_disabled || busnbits >= 8) {
-                        u64 base;
+                        u64 base = val & MMCONF_MASK;
-                        base = val & (0xffffULL << 32);
-                        if (fam10h_pci_mmconf_base_status <= 0) {
+                        if (!fam10h_pci_mmconf_base) {
                                fam10h_pci_mmconf_base = base;
-                                fam10h_pci_mmconf_base_status = 1;
                                return;
                        } else if (fam10h_pci_mmconf_base ==  base)
                                return;
@@ -206,8 +200,10 @@ void __cpuinit fam10h_check_enable_mmcfg(void)
         * with 256 buses
         */
        get_fam10h_pci_mmconf_base();
-        if (fam10h_pci_mmconf_base_status <= 0)
+        if (!fam10h_pci_mmconf_base) {
+                pci_probe &= ~PCI_CHECK_ENABLE_AMD_MMCONF;
                return;
+        }
        printk(KERN_INFO "Enable MMCONFIG on AMD Family 10h\n");
        val &= ~((FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT) |
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index 008b91eefa18..42eb3300dfc6 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -83,6 +83,11 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
 static atomic64_t last_value = ATOMIC64_INIT(0);
+void pvclock_resume(void)
+{
+        atomic64_set(&last_value, 0);
+}
 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
 {
        struct pvclock_shadow_time shadow;
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 12cdbb17ad18..6acc724d5d8f 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -223,7 +223,7 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
 static void __cpuinit calculate_tlb_offset(void)
 {
-        int cpu, node, nr_node_vecs;
+        int cpu, node, nr_node_vecs, idx = 0;
        /*
         * we are changing tlb_vector_offset for each CPU in runtime, but this
         * will not cause inconsistency, as the write is atomic under X86. we
@@ -239,7 +239,7 @@ static void __cpuinit calculate_tlb_offset(void)
                nr_node_vecs = NUM_INVALIDATE_TLB_VECTORS/nr_online_nodes;
        for_each_online_node(node) {
-                int node_offset = (node % NUM_INVALIDATE_TLB_VECTORS) *
+                int node_offset = (idx % NUM_INVALIDATE_TLB_VECTORS) *
                        nr_node_vecs;
                int cpu_offset = 0;
                for_each_cpu(cpu, cpumask_of_node(node)) {
@@ -248,6 +248,7 @@ static void __cpuinit calculate_tlb_offset(void)
                        cpu_offset++;
                        cpu_offset = cpu_offset % nr_node_vecs;
                }
+                idx++;
        }
 }
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index d7b5109f7a9c..25cd4a07d09f 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -70,6 +70,9 @@ static int acpi_register_gsi_xen_hvm(struct device *dev, u32 gsi,
 struct xen_pci_frontend_ops *xen_pci_frontend;
 EXPORT_SYMBOL_GPL(xen_pci_frontend);
+#define XEN_PIRQ_MSI_DATA  (MSI_DATA_TRIGGER_EDGE | \
+                MSI_DATA_LEVEL_ASSERT | (3 << 8) | MSI_DATA_VECTOR(0))
 static void xen_msi_compose_msg(struct pci_dev *pdev, unsigned int pirq,
                struct msi_msg *msg)
 {
@@ -83,12 +86,7 @@ static void xen_msi_compose_msg(struct pci_dev *pdev, unsigned int pirq,
                MSI_ADDR_REDIRECTION_CPU |
                MSI_ADDR_DEST_ID(pirq);
-        msg->data =
+        msg->data = XEN_PIRQ_MSI_DATA;
-                MSI_DATA_TRIGGER_EDGE |
-                MSI_DATA_LEVEL_ASSERT |
-                /* delivery mode reserved */
-                (3 << 8) |
-                MSI_DATA_VECTOR(0);
 }
 static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
@@ -98,8 +96,23 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
        struct msi_msg msg;
        list_for_each_entry(msidesc, &dev->msi_list, list) {
+                __read_msi_msg(msidesc, &msg);
+                pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
+                        ((msg.address_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xff);
+                if (xen_irq_from_pirq(pirq) >= 0 && msg.data == XEN_PIRQ_MSI_DATA) {
+                        xen_allocate_pirq_msi((type == PCI_CAP_ID_MSIX) ?
+                                        "msi-x" : "msi", &irq, &pirq, XEN_ALLOC_IRQ);
+                        if (irq < 0)
+                                goto error;
+                        ret = set_irq_msi(irq, msidesc);
+                        if (ret < 0)
+                                goto error_while;
+                        printk(KERN_DEBUG "xen: msi already setup: msi --> irq=%d"
+                                        " pirq=%d\n", irq, pirq);
+                        return 0;
+                }
                xen_allocate_pirq_msi((type == PCI_CAP_ID_MSIX) ?
-                                "msi-x" : "msi", &irq, &pirq);
+                                "msi-x" : "msi", &irq, &pirq, (XEN_ALLOC_IRQ | XEN_ALLOC_PIRQ));
                if (irq < 0 || pirq < 0)
                        goto error;
                printk(KERN_DEBUG "xen: msi --> irq=%d, pirq=%d\n", irq, pirq);
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index a318194002b5..ba9caa808a9c 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1455,7 +1455,7 @@ static void __init uv_init_uvhub(int uvhub, int vector)
         * the below initialization can't be in firmware because the
         * messaging IRQ will be determined by the OS
         */
-        apicid = uvhub_to_first_apicid(uvhub);
+        apicid = uvhub_to_first_apicid(uvhub) | uv_apicid_hibits;
        uv_write_global_mmr64(pnode, UVH_BAU_DATA_CONFIG,
                                      ((apicid << 32) | vector));
 }
diff --git a/arch/x86/platform/uv/uv_time.c b/arch/x86/platform/uv/uv_time.c
index 56e421bc379b..9daf5d1af9f1 100644
--- a/arch/x86/platform/uv/uv_time.c
+++ b/arch/x86/platform/uv/uv_time.c
@@ -89,6 +89,7 @@ static void uv_rtc_send_IPI(int cpu)
        apicid = cpu_physical_id(cpu);
        pnode = uv_apicid_to_pnode(apicid);
+        apicid |= uv_apicid_hibits;
        val = (1UL << UVH_IPI_INT_SEND_SHFT) |
              (apicid << UVH_IPI_INT_APIC_ID_SHFT) |
              (X86_PLATFORM_IPI_VECTOR << UVH_IPI_INT_VECTOR_SHFT);
@@ -107,6 +108,7 @@ static int uv_intr_pending(int pnode)
 static int uv_setup_intr(int cpu, u64 expires)
 {
        u64 val;
+        unsigned long apicid = cpu_physical_id(cpu) | uv_apicid_hibits;
        int pnode = uv_cpu_to_pnode(cpu);
        uv_write_global_mmr64(pnode, UVH_RTC1_INT_CONFIG,
@@ -117,7 +119,7 @@ static int uv_setup_intr(int cpu, u64 expires)
                UVH_EVENT_OCCURRED0_RTC1_MASK);
        val = (X86_PLATFORM_IPI_VECTOR << UVH_RTC1_INT_CONFIG_VECTOR_SHFT) |
-                ((u64)cpu_physical_id(cpu) << UVH_RTC1_INT_CONFIG_APIC_ID_SHFT);
+                ((u64)apicid << UVH_RTC1_INT_CONFIG_APIC_ID_SHFT);
        /* Set configuration */
        uv_write_global_mmr64(pnode, UVH_RTC1_INT_CONFIG, val);
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 235c0f4d3861..44dcad43989d 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -75,6 +75,11 @@ DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 enum xen_domain_type xen_domain_type = XEN_NATIVE;
 EXPORT_SYMBOL_GPL(xen_domain_type);
+unsigned long *machine_to_phys_mapping = (void *)MACH2PHYS_VIRT_START;
+EXPORT_SYMBOL(machine_to_phys_mapping);
+unsigned int   machine_to_phys_order;
+EXPORT_SYMBOL(machine_to_phys_order);
 struct start_info *xen_start_info;
 EXPORT_SYMBOL_GPL(xen_start_info);
@@ -1016,10 +1021,6 @@ static void xen_reboot(int reason)
 {
        struct sched_shutdown r = { .reason = reason };
-#ifdef CONFIG_SMP
-        stop_other_cpus();
-#endif
        if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
                BUG();
 }
@@ -1090,6 +1091,8 @@ static void __init xen_setup_stackprotector(void)
 /* First C function to be called on Xen boot */
 asmlinkage void __init xen_start_kernel(void)
 {
+        struct physdev_set_iopl set_iopl;
+        int rc;
        pgd_t *pgd;
        if (!xen_start_info)
@@ -1097,6 +1100,8 @@ asmlinkage void __init xen_start_kernel(void)
        xen_domain_type = XEN_PV_DOMAIN;
+        xen_setup_machphys_mapping();
        /* Install Xen paravirt ops */
        pv_info = xen_info;
        pv_init_ops = xen_init_ops;
@@ -1191,8 +1196,6 @@ asmlinkage void __init xen_start_kernel(void)
        /* Allocate and initialize top and mid mfn levels for p2m structure */
        xen_build_mfn_list_list();
-        init_mm.pgd = pgd;
        /* keep using Xen gdt for now; no urgent need to change it */
 #ifdef CONFIG_X86_32
@@ -1202,10 +1205,18 @@ asmlinkage void __init xen_start_kernel(void)
 #else
        pv_info.kernel_rpl = 0;
 #endif
        /* set the limit of our address space */
        xen_reserve_top();
+        /* We used to do this in xen_arch_setup, but that is too late on AMD
+         * were early_cpu_init (run before ->arch_setup()) calls early_amd_init
+         * which pokes 0xcf8 port.
+         */
+        set_iopl.iopl = 1;
+        rc = HYPERVISOR_physdev_op(PHYSDEVOP_set_iopl, &set_iopl);
+        if (rc != 0)
+                xen_raw_printk("physdev_op failed %d\n", rc);
 #ifdef CONFIG_X86_32
        /* set up basic CPUID stuff */
        cpu_detect(&new_cpu_data);
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 21ed8d7f75a5..44924e551fde 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2034,6 +2034,20 @@ static __init void xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
        set_page_prot(pmd, PAGE_KERNEL_RO);
 }
+void __init xen_setup_machphys_mapping(void)
+{
+        struct xen_machphys_mapping mapping;
+        unsigned long machine_to_phys_nr_ents;
+        if (HYPERVISOR_memory_op(XENMEM_machphys_mapping, &mapping) == 0) {
+                machine_to_phys_mapping = (unsigned long *)mapping.v_start;
+                machine_to_phys_nr_ents = mapping.max_mfn + 1;
+        } else {
+                machine_to_phys_nr_ents = MACH2PHYS_NR_ENTRIES;
+        }
+        machine_to_phys_order = fls(machine_to_phys_nr_ents - 1);
+}
 #ifdef CONFIG_X86_64
 static void convert_pfn_mfn(void *v)
 {
@@ -2119,44 +2133,83 @@ __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
        return pgd;
 }
 #else   /* !CONFIG_X86_64 */
-static RESERVE_BRK_ARRAY(pmd_t, level2_kernel_pgt, PTRS_PER_PMD);
+static RESERVE_BRK_ARRAY(pmd_t, initial_kernel_pmd, PTRS_PER_PMD);
+static RESERVE_BRK_ARRAY(pmd_t, swapper_kernel_pmd, PTRS_PER_PMD);
+static __init void xen_write_cr3_init(unsigned long cr3)
+{
+        unsigned long pfn = PFN_DOWN(__pa(swapper_pg_dir));
+        BUG_ON(read_cr3() != __pa(initial_page_table));
+        BUG_ON(cr3 != __pa(swapper_pg_dir));
+        /*
+         * We are switching to swapper_pg_dir for the first time (from
+         * initial_page_table) and therefore need to mark that page
+         * read-only and then pin it.
+         *
+         * Xen disallows sharing of kernel PMDs for PAE
+         * guests. Therefore we must copy the kernel PMD from
+         * initial_page_table into a new kernel PMD to be used in
+         * swapper_pg_dir.
+         */
+        swapper_kernel_pmd =
+                extend_brk(sizeof(pmd_t) * PTRS_PER_PMD, PAGE_SIZE);
+        memcpy(swapper_kernel_pmd, initial_kernel_pmd,
+               sizeof(pmd_t) * PTRS_PER_PMD);
+        swapper_pg_dir[KERNEL_PGD_BOUNDARY] =
+                __pgd(__pa(swapper_kernel_pmd) | _PAGE_PRESENT);
+        set_page_prot(swapper_kernel_pmd, PAGE_KERNEL_RO);
+        set_page_prot(swapper_pg_dir, PAGE_KERNEL_RO);
+        xen_write_cr3(cr3);
+        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, pfn);
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE,
+                          PFN_DOWN(__pa(initial_page_table)));
+        set_page_prot(initial_page_table, PAGE_KERNEL);
+        set_page_prot(initial_kernel_pmd, PAGE_KERNEL);
+        pv_mmu_ops.write_cr3 = &xen_write_cr3;
+}
 __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
                                         unsigned long max_pfn)
 {
        pmd_t *kernel_pmd;
-        level2_kernel_pgt = extend_brk(sizeof(pmd_t) * PTRS_PER_PMD, PAGE_SIZE);
+        initial_kernel_pmd =
+                extend_brk(sizeof(pmd_t) * PTRS_PER_PMD, PAGE_SIZE);
        max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->pt_base) +
                                  xen_start_info->nr_pt_frames * PAGE_SIZE +
                                  512*1024);
        kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
-        memcpy(level2_kernel_pgt, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
+        memcpy(initial_kernel_pmd, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
-        xen_map_identity_early(level2_kernel_pgt, max_pfn);
+        xen_map_identity_early(initial_kernel_pmd, max_pfn);
-        memcpy(swapper_pg_dir, pgd, sizeof(pgd_t) * PTRS_PER_PGD);
+        memcpy(initial_page_table, pgd, sizeof(pgd_t) * PTRS_PER_PGD);
-        set_pgd(&swapper_pg_dir[KERNEL_PGD_BOUNDARY],
+        initial_page_table[KERNEL_PGD_BOUNDARY] =
-                        __pgd(__pa(level2_kernel_pgt) | _PAGE_PRESENT));
+                __pgd(__pa(initial_kernel_pmd) | _PAGE_PRESENT);
-        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(initial_kernel_pmd, PAGE_KERNEL_RO);
-        set_page_prot(swapper_pg_dir, PAGE_KERNEL_RO);
+        set_page_prot(initial_page_table, PAGE_KERNEL_RO);
        set_page_prot(empty_zero_page, PAGE_KERNEL_RO);
        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
-        xen_write_cr3(__pa(swapper_pg_dir));
+        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE,
+                          PFN_DOWN(__pa(initial_page_table)));
-        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(swapper_pg_dir)));
+        xen_write_cr3(__pa(initial_page_table));
        memblock_x86_reserve_range(__pa(xen_start_info->pt_base),
                      __pa(xen_start_info->pt_base +
                           xen_start_info->nr_pt_frames * PAGE_SIZE),
                      "XEN PAGETABLES");
-        return swapper_pg_dir;
+        return initial_page_table;
 }
 #endif  /* CONFIG_X86_64 */
@@ -2290,7 +2343,11 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
        .write_cr2 = xen_write_cr2,
        .read_cr3 = xen_read_cr3,
+#ifdef CONFIG_X86_32
+        .write_cr3 = xen_write_cr3_init,
+#else
        .write_cr3 = xen_write_cr3,
+#endif
        .flush_tlb_user = xen_flush_tlb,
        .flush_tlb_kernel = xen_flush_tlb,
@@ -2358,8 +2415,6 @@ void __init xen_init_mmu_ops(void)
        x86_init.paging.pagetable_setup_done = xen_pagetable_setup_done;
        pv_mmu_ops = xen_mmu_ops;
-        vmap_lazy_unmap = false;
        memset(dummy_mapping, 0xff, PAGE_SIZE);
 }
@@ -2627,7 +2682,8 @@ int xen_remap_domain_mfn_range(struct vm_area_struct *vma,
        prot = __pgprot(pgprot_val(prot) | _PAGE_IOMAP);
-        vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP;
+        BUG_ON(!((vma->vm_flags & (VM_PFNMAP | VM_RESERVED | VM_IO)) ==
+                                (VM_PFNMAP | VM_RESERVED | VM_IO)));
        rmd.mfn = mfn;
        rmd.prot = prot;
diff --git a/arch/x86/xen/platform-pci-unplug.c b/arch/x86/xen/platform-pci-unplug.c
index 0f456386cce5..25c52f94a27c 100644
--- a/arch/x86/xen/platform-pci-unplug.c
+++ b/arch/x86/xen/platform-pci-unplug.c
@@ -68,7 +68,7 @@ static int __init check_platform_magic(void)
        return 0;
 }
-void __init xen_unplug_emulated_devices(void)
+void xen_unplug_emulated_devices(void)
 {
        int r;
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 769c4b01fa32..b5a7f928234b 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -23,7 +23,6 @@
 #include <xen/interface/callback.h>
 #include <xen/interface/memory.h>
 #include <xen/interface/physdev.h>
-#include <xen/interface/memory.h>
 #include <xen/features.h>
 #include "xen-ops.h"
@@ -182,24 +181,21 @@ char * __init xen_memory_setup(void)
        for (i = 0; i < memmap.nr_entries; i++) {
                unsigned long long end = map[i].addr + map[i].size;
-                if (map[i].type == E820_RAM) {
+                if (map[i].type == E820_RAM && end > mem_end) {
-                        if (map[i].addr < mem_end && end > mem_end) {
+                        /* RAM off the end - may be partially included */
-                                /* Truncate region to max_mem. */
+                        u64 delta = min(map[i].size, end - mem_end);
-                                u64 delta = end - mem_end;
-                                map[i].size -= delta;
+                        map[i].size -= delta;
-                                extra_pages += PFN_DOWN(delta);
+                        end -= delta;
-                                end = mem_end;
+                        extra_pages += PFN_DOWN(delta);
-                        }
                }
-                if (end > xen_extra_mem_start)
+                if (map[i].size > 0 && end > xen_extra_mem_start)
                        xen_extra_mem_start = end;
-                /* If region is non-RAM or below mem_end, add what remains */
+                /* Add region if any remains */
-                if ((map[i].type != E820_RAM || map[i].addr < mem_end) &&
+                if (map[i].size > 0)
-                    map[i].size > 0)
                        e820_add_region(map[i].addr, map[i].size, map[i].type);
        }
@@ -248,26 +244,11 @@ char * __init xen_memory_setup(void)
        else
                extra_pages = 0;
-        if (!xen_initial_domain())
+        xen_add_extra_mem(extra_pages);
-                xen_add_extra_mem(extra_pages);
        return "Xen";
 }
-static void xen_idle(void)
-{
-        local_irq_disable();
-        if (need_resched())
-                local_irq_enable();
-        else {
-                current_thread_info()->status &= ~TS_POLLING;
-                smp_mb__after_clear_bit();
-                safe_halt();
-                current_thread_info()->status |= TS_POLLING;
-        }
-}
 /*
 * Set the bit indicating "nosegneg" library variants should be used.
 * We only need to bother in pure 32-bit mode; compat 32-bit processes
@@ -337,9 +318,6 @@ void __cpuinit xen_enable_syscall(void)
 void __init xen_arch_setup(void)
 {
-        struct physdev_set_iopl set_iopl;
-        int rc;
        xen_panic_handler_init();
        HYPERVISOR_vm_assist(VMASST_CMD_enable, VMASST_TYPE_4gb_segments);
@@ -356,11 +334,6 @@ void __init xen_arch_setup(void)
        xen_enable_sysenter();
        xen_enable_syscall();
-        set_iopl.iopl = 1;
-        rc = HYPERVISOR_physdev_op(PHYSDEVOP_set_iopl, &set_iopl);
-        if (rc != 0)
-                printk(KERN_INFO "physdev_op failed %d\n", rc);
 #ifdef CONFIG_ACPI
        if (!(xen_start_info->flags & SIF_INITDOMAIN)) {
                printk(KERN_INFO "ACPI in unprivileged domain disabled\n");
@@ -372,7 +345,11 @@ void __init xen_arch_setup(void)
               MAX_GUEST_CMDLINE > COMMAND_LINE_SIZE ?
               COMMAND_LINE_SIZE : MAX_GUEST_CMDLINE);
-        pm_idle = xen_idle;
+        /* Set up idle, making sure it calls safe_halt() pvop */
+#ifdef CONFIG_X86_32
+        boot_cpu_data.hlt_works_ok = 1;
+#endif
+        pm_idle = default_idle;
        fiddle_vdso();
 }
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
index 1d789d56877c..9bbd63a129b5 100644
--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -31,6 +31,7 @@ void xen_hvm_post_suspend(int suspend_cancelled)
        int cpu;
        xen_hvm_init_shared_info();
        xen_callback_vector();
+        xen_unplug_emulated_devices();
        if (xen_feature(XENFEAT_hvm_safe_pvclock)) {
                for_each_online_cpu(cpu) {
                        xen_setup_runstate_info(cpu);
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index b2bb5aa3b054..5da5e53fb94c 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -426,6 +426,8 @@ void xen_timer_resume(void)
 {
        int cpu;
+        pvclock_resume();
        if (xen_clockevent != &xen_vcpuop_clockevent)
                return;
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index 64044747348e..9d41bf985757 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -43,7 +43,7 @@ void xen_vcpu_restore(void);
 void xen_callback_vector(void);
 void xen_hvm_init_shared_info(void);
-void __init xen_unplug_emulated_devices(void);
+void xen_unplug_emulated_devices(void);
 void __init xen_build_dynamic_phys_to_machine(void);
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 56ad4531b412..004be80fd894 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -645,7 +645,7 @@ static int throtl_dispatch_tg(struct throtl_data *td, struct throtl_grp *tg,
 {
        unsigned int nr_reads = 0, nr_writes = 0;
        unsigned int max_nr_reads = throtl_grp_quantum*3/4;
-        unsigned int max_nr_writes = throtl_grp_quantum - nr_reads;
+        unsigned int max_nr_writes = throtl_grp_quantum - max_nr_reads;
        struct bio *bio;
        /* Try to dispatch 75% READS and 25% WRITES */
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index a1725e6488d3..7888501ad9ee 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1341,7 +1341,7 @@ static struct request *set_next_request(void)
 {
        struct request_queue *q;
        int cnt = FD_MAX_UNITS;
-        struct request *rq;
+        struct request *rq = NULL;
        /* Find next queue we can dispatch from */
        fdc_queue = fdc_queue + 1;
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 4e4cc6c828cb..605a67e40bbf 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1399,7 +1399,7 @@ static struct request *set_next_request(void)
 {
        struct request_queue *q;
        int old_pos = fdc_queue;
-        struct request *rq;
+        struct request *rq = NULL;
        do {
                q = unit[fdc_queue].disk->queue;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index a67d0a611a8a..f291587d753e 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -66,6 +66,7 @@ MODULE_VERSION("3.6.26");
 MODULE_LICENSE("GPL");
 static DEFINE_MUTEX(cciss_mutex);
+static struct proc_dir_entry *proc_cciss;
 #include "cciss_cmd.h"
 #include "cciss.h"
@@ -363,8 +364,6 @@ static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
 #define ENG_GIG_FACTOR (ENG_GIG/512)
 #define ENGAGE_SCSI     "engage scsi"
-static struct proc_dir_entry *proc_cciss;
 static void cciss_seq_show_header(struct seq_file *seq)
 {
        ctlr_info_t *h = seq->private;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 6ec9d53806c5..008d4a00b50d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -21,80 +21,9 @@
-   Instructions for use
+   For usage instructions, please refer to:
-   --------------------
-   1) Map a Linux block device to an existing rbd image.
+                 Documentation/ABI/testing/sysfs-bus-rbd
-      Usage: <mon ip addr> <options> <pool name> <rbd image name> [snap name]
-      $ echo "192.168.0.1 name=admin rbd foo" > /sys/class/rbd/add
-      The snapshot name can be "-" or omitted to map the image read/write.
-   2) List all active blkdev<->object mappings.
-      In this example, we have performed step #1 twice, creating two blkdevs,
-      mapped to two separate rados objects in the rados rbd pool
-      $ cat /sys/class/rbd/list
-      #id     major   client_name     pool    name    snap    KB
-      0       254     client4143      rbd     foo     -      1024000
-      The columns, in order, are:
-      - blkdev unique id
-      - blkdev assigned major
-      - rados client id
-      - rados pool name
-      - rados block device name
-      - mapped snapshot ("-" if none)
-      - device size in KB
-   3) Create a snapshot.
-      Usage: <blkdev id> <snapname>
-      $ echo "0 mysnap" > /sys/class/rbd/snap_create
-   4) Listing a snapshot.
-      $ cat /sys/class/rbd/snaps_list
-      #id     snap    KB
-      0       -       1024000 (*)
-      0       foo     1024000
-      The columns, in order, are:
-      - blkdev unique id
-      - snapshot name, '-' means none (active read/write version)
-      - size of device at time of snapshot
-      - the (*) indicates this is the active version
-   5) Rollback to snapshot.
-      Usage: <blkdev id> <snapname>
-      $ echo "0 mysnap" > /sys/class/rbd/snap_rollback
-   6) Mapping an image using snapshot.
-      A snapshot mapping is read-only. This is being done by passing
-      snap=<snapname> to the options when adding a device.
-      $ echo "192.168.0.1 name=admin,snap=mysnap rbd foo" > /sys/class/rbd/add
-   7) Remove an active blkdev<->rbd image mapping.
-      In this example, we remove the mapping with blkdev unique id 1.
-      $ echo 1 > /sys/class/rbd/remove
-   NOTE:  The actual creation and deletion of rados objects is outside the scope
-   of this driver.
 */
@@ -163,6 +92,14 @@ struct rbd_request {
        u64                     len;
 };
+struct rbd_snap {
+        struct  device          dev;
+        const char              *name;
+        size_t                  size;
+        struct list_head        node;
+        u64                     id;
+};
 /*
 * a single device
 */
@@ -193,21 +130,60 @@ struct rbd_device {
        int read_only;
        struct list_head        node;
+        /* list of snapshots */
+        struct list_head        snaps;
+        /* sysfs related */
+        struct device           dev;
+};
+static struct bus_type rbd_bus_type = {
+        .name           = "rbd",
 };
 static spinlock_t node_lock;      /* protects client get/put */
-static struct class *class_rbd;   /* /sys/class/rbd */
 static DEFINE_MUTEX(ctl_mutex);   /* Serialize open/close/setup/teardown */
 static LIST_HEAD(rbd_dev_list);    /* devices */
 static LIST_HEAD(rbd_client_list);      /* clients */
+static int __rbd_init_snaps_header(struct rbd_device *rbd_dev);
+static void rbd_dev_release(struct device *dev);
+static ssize_t rbd_snap_rollback(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf,
+                                 size_t size);
+static ssize_t rbd_snap_add(struct device *dev,
+                            struct device_attribute *attr,
+                            const char *buf,
+                            size_t count);
+static void __rbd_remove_snap_dev(struct rbd_device *rbd_dev,
+                                  struct rbd_snap *snap);;
+static struct rbd_device *dev_to_rbd(struct device *dev)
+{
+        return container_of(dev, struct rbd_device, dev);
+}
+static struct device *rbd_get_dev(struct rbd_device *rbd_dev)
+{
+        return get_device(&rbd_dev->dev);
+}
+static void rbd_put_dev(struct rbd_device *rbd_dev)
+{
+        put_device(&rbd_dev->dev);
+}
 static int rbd_open(struct block_device *bdev, fmode_t mode)
 {
        struct gendisk *disk = bdev->bd_disk;
        struct rbd_device *rbd_dev = disk->private_data;
+        rbd_get_dev(rbd_dev);
        set_device_ro(bdev, rbd_dev->read_only);
        if ((mode & FMODE_WRITE) && rbd_dev->read_only)
@@ -216,9 +192,19 @@ static int rbd_open(struct block_device *bdev, fmode_t mode)
        return 0;
 }
+static int rbd_release(struct gendisk *disk, fmode_t mode)
+{
+        struct rbd_device *rbd_dev = disk->private_data;
+        rbd_put_dev(rbd_dev);
+        return 0;
+}
 static const struct block_device_operations rbd_bd_ops = {
        .owner                  = THIS_MODULE,
        .open                   = rbd_open,
+        .release                = rbd_release,
 };
 /*
@@ -361,7 +347,6 @@ static int rbd_header_from_disk(struct rbd_image_header *header,
        int ret = -ENOMEM;
        init_rwsem(&header->snap_rwsem);
        header->snap_names_len = le64_to_cpu(ondisk->snap_names_len);
        header->snapc = kmalloc(sizeof(struct ceph_snap_context) +
                                snap_count *
@@ -1256,10 +1241,20 @@ bad:
        return -ERANGE;
 }
+static void __rbd_remove_all_snaps(struct rbd_device *rbd_dev)
+{
+        struct rbd_snap *snap;
+        while (!list_empty(&rbd_dev->snaps)) {
+                snap = list_first_entry(&rbd_dev->snaps, struct rbd_snap, node);
+                __rbd_remove_snap_dev(rbd_dev, snap);
+        }
+}
 /*
 * only read the first part of the ondisk header, without the snaps info
 */
-static int rbd_update_snaps(struct rbd_device *rbd_dev)
+static int __rbd_update_snaps(struct rbd_device *rbd_dev)
 {
        int ret;
        struct rbd_image_header h;
@@ -1280,12 +1275,15 @@ static int rbd_update_snaps(struct rbd_device *rbd_dev)
        rbd_dev->header.total_snaps = h.total_snaps;
        rbd_dev->header.snapc = h.snapc;
        rbd_dev->header.snap_names = h.snap_names;
+        rbd_dev->header.snap_names_len = h.snap_names_len;
        rbd_dev->header.snap_sizes = h.snap_sizes;
        rbd_dev->header.snapc->seq = snap_seq;
+        ret = __rbd_init_snaps_header(rbd_dev);
        up_write(&rbd_dev->header.snap_rwsem);
-        return 0;
+        return ret;
 }
 static int rbd_init_disk(struct rbd_device *rbd_dev)
@@ -1300,6 +1298,11 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
        if (rc)
                return rc;
+        /* no need to lock here, as rbd_dev is not registered yet */
+        rc = __rbd_init_snaps_header(rbd_dev);
+        if (rc)
+                return rc;
        rc = rbd_header_set_snap(rbd_dev, rbd_dev->snap_name, &total_size);
        if (rc)
                return rc;
@@ -1343,54 +1346,360 @@ out:
        return rc;
 }
-/********************************************************************
+/*
- * /sys/class/rbd/
+  sysfs
- *                   add        map rados objects to blkdev
+*/
- *                   remove     unmap rados objects
- *                   list       show mappings
+static ssize_t rbd_size_show(struct device *dev,
- *******************************************************************/
+                             struct device_attribute *attr, char *buf)
+{
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
+        return sprintf(buf, "%llu\n", (unsigned long long)rbd_dev->header.image_size);
+}
+static ssize_t rbd_major_show(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
-static void class_rbd_release(struct class *cls)
+        return sprintf(buf, "%d\n", rbd_dev->major);
+}
+static ssize_t rbd_client_id_show(struct device *dev,
+                                  struct device_attribute *attr, char *buf)
 {
-        kfree(cls);
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
+        return sprintf(buf, "client%lld\n", ceph_client_id(rbd_dev->client));
 }
-static ssize_t class_rbd_list(struct class *c,
+static ssize_t rbd_pool_show(struct device *dev,
-                              struct class_attribute *attr,
+                             struct device_attribute *attr, char *buf)
-                              char *data)
 {
-        int n = 0;
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
-        struct list_head *tmp;
-        int max = PAGE_SIZE;
+        return sprintf(buf, "%s\n", rbd_dev->pool_name);
+}
+static ssize_t rbd_name_show(struct device *dev,
+                             struct device_attribute *attr, char *buf)
+{
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
+        return sprintf(buf, "%s\n", rbd_dev->obj);
+}
+static ssize_t rbd_snap_show(struct device *dev,
+                             struct device_attribute *attr,
+                             char *buf)
+{
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
+        return sprintf(buf, "%s\n", rbd_dev->snap_name);
+}
+static ssize_t rbd_image_refresh(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf,
+                                 size_t size)
+{
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
+        int rc;
+        int ret = size;
        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
-        n += snprintf(data, max,
+        rc = __rbd_update_snaps(rbd_dev);
-                      "#id\tmajor\tclient_name\tpool\tname\tsnap\tKB\n");
+        if (rc < 0)
+                ret = rc;
-        list_for_each(tmp, &rbd_dev_list) {
+        mutex_unlock(&ctl_mutex);
-                struct rbd_device *rbd_dev;
+        return ret;
+}
-                rbd_dev = list_entry(tmp, struct rbd_device, node);
+static DEVICE_ATTR(size, S_IRUGO, rbd_size_show, NULL);
-                n += snprintf(data+n, max-n,
+static DEVICE_ATTR(major, S_IRUGO, rbd_major_show, NULL);
-                              "%d\t%d\tclient%lld\t%s\t%s\t%s\t%lld\n",
+static DEVICE_ATTR(client_id, S_IRUGO, rbd_client_id_show, NULL);
-                              rbd_dev->id,
+static DEVICE_ATTR(pool, S_IRUGO, rbd_pool_show, NULL);
-                              rbd_dev->major,
+static DEVICE_ATTR(name, S_IRUGO, rbd_name_show, NULL);
-                              ceph_client_id(rbd_dev->client),
+static DEVICE_ATTR(refresh, S_IWUSR, NULL, rbd_image_refresh);
-                              rbd_dev->pool_name,
+static DEVICE_ATTR(current_snap, S_IRUGO, rbd_snap_show, NULL);
-                              rbd_dev->obj, rbd_dev->snap_name,
+static DEVICE_ATTR(create_snap, S_IWUSR, NULL, rbd_snap_add);
-                              rbd_dev->header.image_size >> 10);
+static DEVICE_ATTR(rollback_snap, S_IWUSR, NULL, rbd_snap_rollback);
-                if (n == max)
+static struct attribute *rbd_attrs[] = {
+        &dev_attr_size.attr,
+        &dev_attr_major.attr,
+        &dev_attr_client_id.attr,
+        &dev_attr_pool.attr,
+        &dev_attr_name.attr,
+        &dev_attr_current_snap.attr,
+        &dev_attr_refresh.attr,
+        &dev_attr_create_snap.attr,
+        &dev_attr_rollback_snap.attr,
+        NULL
+};
+static struct attribute_group rbd_attr_group = {
+        .attrs = rbd_attrs,
+};
+static const struct attribute_group *rbd_attr_groups[] = {
+        &rbd_attr_group,
+        NULL
+};
+static void rbd_sysfs_dev_release(struct device *dev)
+{
+}
+static struct device_type rbd_device_type = {
+        .name           = "rbd",
+        .groups         = rbd_attr_groups,
+        .release        = rbd_sysfs_dev_release,
+};
+/*
+  sysfs - snapshots
+*/
+static ssize_t rbd_snap_size_show(struct device *dev,
+                                  struct device_attribute *attr,
+                                  char *buf)
+{
+        struct rbd_snap *snap = container_of(dev, struct rbd_snap, dev);
+        return sprintf(buf, "%lld\n", (long long)snap->size);
+}
+static ssize_t rbd_snap_id_show(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        struct rbd_snap *snap = container_of(dev, struct rbd_snap, dev);
+        return sprintf(buf, "%lld\n", (long long)snap->id);
+}
+static DEVICE_ATTR(snap_size, S_IRUGO, rbd_snap_size_show, NULL);
+static DEVICE_ATTR(snap_id, S_IRUGO, rbd_snap_id_show, NULL);
+static struct attribute *rbd_snap_attrs[] = {
+        &dev_attr_snap_size.attr,
+        &dev_attr_snap_id.attr,
+        NULL,
+};
+static struct attribute_group rbd_snap_attr_group = {
+        .attrs = rbd_snap_attrs,
+};
+static void rbd_snap_dev_release(struct device *dev)
+{
+        struct rbd_snap *snap = container_of(dev, struct rbd_snap, dev);
+        kfree(snap->name);
+        kfree(snap);
+}
+static const struct attribute_group *rbd_snap_attr_groups[] = {
+        &rbd_snap_attr_group,
+        NULL
+};
+static struct device_type rbd_snap_device_type = {
+        .groups         = rbd_snap_attr_groups,
+        .release        = rbd_snap_dev_release,
+};
+static void __rbd_remove_snap_dev(struct rbd_device *rbd_dev,
+                                  struct rbd_snap *snap)
+{
+        list_del(&snap->node);
+        device_unregister(&snap->dev);
+}
+static int rbd_register_snap_dev(struct rbd_device *rbd_dev,
+                                  struct rbd_snap *snap,
+                                  struct device *parent)
+{
+        struct device *dev = &snap->dev;
+        int ret;
+        dev->type = &rbd_snap_device_type;
+        dev->parent = parent;
+        dev->release = rbd_snap_dev_release;
+        dev_set_name(dev, "snap_%s", snap->name);
+        ret = device_register(dev);
+        return ret;
+}
+static int __rbd_add_snap_dev(struct rbd_device *rbd_dev,
+                              int i, const char *name,
+                              struct rbd_snap **snapp)
+{
+        int ret;
+        struct rbd_snap *snap = kzalloc(sizeof(*snap), GFP_KERNEL);
+        if (!snap)
+                return -ENOMEM;
+        snap->name = kstrdup(name, GFP_KERNEL);
+        snap->size = rbd_dev->header.snap_sizes[i];
+        snap->id = rbd_dev->header.snapc->snaps[i];
+        if (device_is_registered(&rbd_dev->dev)) {
+                ret = rbd_register_snap_dev(rbd_dev, snap,
+                                             &rbd_dev->dev);
+                if (ret < 0)
+                        goto err;
+        }
+        *snapp = snap;
+        return 0;
+err:
+        kfree(snap->name);
+        kfree(snap);
+        return ret;
+}
+/*
+ * search for the previous snap in a null delimited string list
+ */
+const char *rbd_prev_snap_name(const char *name, const char *start)
+{
+        if (name < start + 2)
+                return NULL;
+        name -= 2;
+        while (*name) {
+                if (name == start)
+                        return start;
+                name--;
+        }
+        return name + 1;
+}
+/*
+ * compare the old list of snapshots that we have to what's in the header
+ * and update it accordingly. Note that the header holds the snapshots
+ * in a reverse order (from newest to oldest) and we need to go from
+ * older to new so that we don't get a duplicate snap name when
+ * doing the process (e.g., removed snapshot and recreated a new
+ * one with the same name.
+ */
+static int __rbd_init_snaps_header(struct rbd_device *rbd_dev)
+{
+        const char *name, *first_name;
+        int i = rbd_dev->header.total_snaps;
+        struct rbd_snap *snap, *old_snap = NULL;
+        int ret;
+        struct list_head *p, *n;
+        first_name = rbd_dev->header.snap_names;
+        name = first_name + rbd_dev->header.snap_names_len;
+        list_for_each_prev_safe(p, n, &rbd_dev->snaps) {
+                u64 cur_id;
+                old_snap = list_entry(p, struct rbd_snap, node);
+                if (i)
+                        cur_id = rbd_dev->header.snapc->snaps[i - 1];
+                if (!i || old_snap->id < cur_id) {
+                        /* old_snap->id was skipped, thus was removed */
+                        __rbd_remove_snap_dev(rbd_dev, old_snap);
+                        continue;
+                }
+                if (old_snap->id == cur_id) {
+                        /* we have this snapshot already */
+                        i--;
+                        name = rbd_prev_snap_name(name, first_name);
+                        continue;
+                }
+                for (; i > 0;
+                     i--, name = rbd_prev_snap_name(name, first_name)) {
+                        if (!name) {
+                                WARN_ON(1);
+                                return -EINVAL;
+                        }
+                        cur_id = rbd_dev->header.snapc->snaps[i];
+                        /* snapshot removal? handle it above */
+                        if (cur_id >= old_snap->id)
+                                break;
+                        /* a new snapshot */
+                        ret = __rbd_add_snap_dev(rbd_dev, i - 1, name, &snap);
+                        if (ret < 0)
+                                return ret;
+                        /* note that we add it backward so using n and not p */
+                        list_add(&snap->node, n);
+                        p = &snap->node;
+                }
+        }
+        /* we're done going over the old snap list, just add what's left */
+        for (; i > 0; i--) {
+                name = rbd_prev_snap_name(name, first_name);
+                if (!name) {
+                        WARN_ON(1);
+                        return -EINVAL;
+                }
+                ret = __rbd_add_snap_dev(rbd_dev, i - 1, name, &snap);
+                if (ret < 0)
+                        return ret;
+                list_add(&snap->node, &rbd_dev->snaps);
+        }
+        return 0;
+}
+static void rbd_root_dev_release(struct device *dev)
+{
+}
+static struct device rbd_root_dev = {
+        .init_name =    "rbd",
+        .release =      rbd_root_dev_release,
+};
+static int rbd_bus_add_dev(struct rbd_device *rbd_dev)
+{
+        int ret = -ENOMEM;
+        struct device *dev;
+        struct rbd_snap *snap;
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+        dev = &rbd_dev->dev;
+        dev->bus = &rbd_bus_type;
+        dev->type = &rbd_device_type;
+        dev->parent = &rbd_root_dev;
+        dev->release = rbd_dev_release;
+        dev_set_name(dev, "%d", rbd_dev->id);
+        ret = device_register(dev);
+        if (ret < 0)
+                goto done_free;
+        list_for_each_entry(snap, &rbd_dev->snaps, node) {
+                ret = rbd_register_snap_dev(rbd_dev, snap,
+                                             &rbd_dev->dev);
+                if (ret < 0)
                        break;
        }
        mutex_unlock(&ctl_mutex);
-        return n;
+        return 0;
+done_free:
+        mutex_unlock(&ctl_mutex);
+        return ret;
 }
-static ssize_t class_rbd_add(struct class *c,
+static void rbd_bus_del_dev(struct rbd_device *rbd_dev)
-                             struct class_attribute *attr,
+{
-                             const char *buf, size_t count)
+        device_unregister(&rbd_dev->dev);
+}
+static ssize_t rbd_add(struct bus_type *bus, const char *buf, size_t count)
 {
        struct ceph_osd_client *osdc;
        struct rbd_device *rbd_dev;
@@ -1419,6 +1728,7 @@ static ssize_t class_rbd_add(struct class *c,
        /* static rbd_device initialization */
        spin_lock_init(&rbd_dev->lock);
        INIT_LIST_HEAD(&rbd_dev->node);
+        INIT_LIST_HEAD(&rbd_dev->snaps);
        /* generate unique id: find highest unique id, add one */
        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
@@ -1478,6 +1788,9 @@ static ssize_t class_rbd_add(struct class *c,
        }
        rbd_dev->major = irc;
+        rc = rbd_bus_add_dev(rbd_dev);
+        if (rc)
+                goto err_out_disk;
        /* set up and announce blkdev mapping */
        rc = rbd_init_disk(rbd_dev);
        if (rc)
@@ -1487,6 +1800,8 @@ static ssize_t class_rbd_add(struct class *c,
 err_out_blkdev:
        unregister_blkdev(rbd_dev->major, rbd_dev->name);
+err_out_disk:
+        rbd_free_disk(rbd_dev);
 err_out_client:
        rbd_put_client(rbd_dev);
        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
@@ -1518,35 +1833,10 @@ static struct rbd_device *__rbd_get_dev(unsigned long id)
        return NULL;
 }
-static ssize_t class_rbd_remove(struct class *c,
+static void rbd_dev_release(struct device *dev)
-                                struct class_attribute *attr,
-                                const char *buf,
-                                size_t count)
 {
-        struct rbd_device *rbd_dev = NULL;
+        struct rbd_device *rbd_dev =
-        int target_id, rc;
+                        container_of(dev, struct rbd_device, dev);
-        unsigned long ul;
-        rc = strict_strtoul(buf, 10, &ul);
-        if (rc)
-                return rc;
-        /* convert to int; abort if we lost anything in the conversion */
-        target_id = (int) ul;
-        if (target_id != ul)
-                return -EINVAL;
-        /* remove object from list immediately */
-        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
-        rbd_dev = __rbd_get_dev(target_id);
-        if (rbd_dev)
-                list_del_init(&rbd_dev->node);
-        mutex_unlock(&ctl_mutex);
-        if (!rbd_dev)
-                return -ENOENT;
        rbd_put_client(rbd_dev);
@@ -1557,67 +1847,11 @@ static ssize_t class_rbd_remove(struct class *c,
        /* release module ref */
        module_put(THIS_MODULE);
-        return count;
 }
-static ssize_t class_rbd_snaps_list(struct class *c,
+static ssize_t rbd_remove(struct bus_type *bus,
-                              struct class_attribute *attr,
+                          const char *buf,
-                              char *data)
+                          size_t count)
-{
-        struct rbd_device *rbd_dev = NULL;
-        struct list_head *tmp;
-        struct rbd_image_header *header;
-        int i, n = 0, max = PAGE_SIZE;
-        int ret;
-        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
-        n += snprintf(data, max, "#id\tsnap\tKB\n");
-        list_for_each(tmp, &rbd_dev_list) {
-                char *names, *p;
-                struct ceph_snap_context *snapc;
-                rbd_dev = list_entry(tmp, struct rbd_device, node);
-                header = &rbd_dev->header;
-                down_read(&header->snap_rwsem);
-                names = header->snap_names;
-                snapc = header->snapc;
-                n += snprintf(data + n, max - n, "%d\t%s\t%lld%s\n",
-                              rbd_dev->id, RBD_SNAP_HEAD_NAME,
-                              header->image_size >> 10,
-                              (!rbd_dev->cur_snap ? " (*)" : ""));
-                if (n == max)
-                        break;
-                p = names;
-                for (i = 0; i < header->total_snaps; i++, p += strlen(p) + 1) {
-                        n += snprintf(data + n, max - n, "%d\t%s\t%lld%s\n",
-                              rbd_dev->id, p, header->snap_sizes[i] >> 10,
-                              (rbd_dev->cur_snap &&
-                               (snap_index(header, i) == rbd_dev->cur_snap) ?
-                               " (*)" : ""));
-                        if (n == max)
-                                break;
-                }
-                up_read(&header->snap_rwsem);
-        }
-        ret = n;
-        mutex_unlock(&ctl_mutex);
-        return ret;
-}
-static ssize_t class_rbd_snaps_refresh(struct class *c,
-                                struct class_attribute *attr,
-                                const char *buf,
-                                size_t count)
 {
        struct rbd_device *rbd_dev = NULL;
        int target_id, rc;
@@ -1641,95 +1875,70 @@ static ssize_t class_rbd_snaps_refresh(struct class *c,
                goto done;
        }
-        rc = rbd_update_snaps(rbd_dev);
+        list_del_init(&rbd_dev->node);
-        if (rc < 0)
-                ret = rc;
+        __rbd_remove_all_snaps(rbd_dev);
+        rbd_bus_del_dev(rbd_dev);
 done:
        mutex_unlock(&ctl_mutex);
        return ret;
 }
-static ssize_t class_rbd_snap_create(struct class *c,
+static ssize_t rbd_snap_add(struct device *dev,
-                                struct class_attribute *attr,
+                            struct device_attribute *attr,
-                                const char *buf,
+                            const char *buf,
-                                size_t count)
+                            size_t count)
 {
-        struct rbd_device *rbd_dev = NULL;
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
-        int target_id, ret;
+        int ret;
-        char *name;
+        char *name = kmalloc(count + 1, GFP_KERNEL);
-        name = kmalloc(RBD_MAX_SNAP_NAME_LEN + 1, GFP_KERNEL);
        if (!name)
                return -ENOMEM;
-        /* parse snaps add command */
+        snprintf(name, count, "%s", buf);
-        if (sscanf(buf, "%d "
-                   "%" __stringify(RBD_MAX_SNAP_NAME_LEN) "s",
-                   &target_id,
-                   name) != 2) {
-                ret = -EINVAL;
-                goto done;
-        }
        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
-        rbd_dev = __rbd_get_dev(target_id);
-        if (!rbd_dev) {
-                ret = -ENOENT;
-                goto done_unlock;
-        }
        ret = rbd_header_add_snap(rbd_dev,
                                  name, GFP_KERNEL);
        if (ret < 0)
                goto done_unlock;
-        ret = rbd_update_snaps(rbd_dev);
+        ret = __rbd_update_snaps(rbd_dev);
        if (ret < 0)
                goto done_unlock;
        ret = count;
 done_unlock:
        mutex_unlock(&ctl_mutex);
-done:
        kfree(name);
        return ret;
 }
-static ssize_t class_rbd_rollback(struct class *c,
+static ssize_t rbd_snap_rollback(struct device *dev,
-                                struct class_attribute *attr,
+                                 struct device_attribute *attr,
-                                const char *buf,
+                                 const char *buf,
-                                size_t count)
+                                 size_t count)
 {
-        struct rbd_device *rbd_dev = NULL;
+        struct rbd_device *rbd_dev = dev_to_rbd(dev);
-        int target_id, ret;
+        int ret;
        u64 snapid;
-        char snap_name[RBD_MAX_SNAP_NAME_LEN];
        u64 cur_ofs;
-        char *seg_name;
+        char *seg_name = NULL;
+        char *snap_name = kmalloc(count + 1, GFP_KERNEL);
+        ret = -ENOMEM;
+        if (!snap_name)
+                return ret;
        /* parse snaps add command */
-        if (sscanf(buf, "%d "
+        snprintf(snap_name, count, "%s", buf);
-                   "%" __stringify(RBD_MAX_SNAP_NAME_LEN) "s",
-                   &target_id,
-                   snap_name) != 2) {
-                return -EINVAL;
-        }
-        ret = -ENOMEM;
        seg_name = kmalloc(RBD_MAX_SEG_NAME_LEN + 1, GFP_NOIO);
        if (!seg_name)
-                return ret;
+                goto done;
        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
-        rbd_dev = __rbd_get_dev(target_id);
-        if (!rbd_dev) {
-                ret = -ENOENT;
-                goto done_unlock;
-        }
        ret = snap_by_name(&rbd_dev->header, snap_name, &snapid, NULL);
        if (ret < 0)
                goto done_unlock;
@@ -1750,7 +1959,7 @@ static ssize_t class_rbd_rollback(struct class *c,
                                   seg_name, ret);
        }
-        ret = rbd_update_snaps(rbd_dev);
+        ret = __rbd_update_snaps(rbd_dev);
        if (ret < 0)
                goto done_unlock;
@@ -1758,57 +1967,42 @@ static ssize_t class_rbd_rollback(struct class *c,
 done_unlock:
        mutex_unlock(&ctl_mutex);
+done:
        kfree(seg_name);
+        kfree(snap_name);
        return ret;
 }
-static struct class_attribute class_rbd_attrs[] = {
+static struct bus_attribute rbd_bus_attrs[] = {
-        __ATTR(add,             0200, NULL, class_rbd_add),
+        __ATTR(add, S_IWUSR, NULL, rbd_add),
-        __ATTR(remove,          0200, NULL, class_rbd_remove),
+        __ATTR(remove, S_IWUSR, NULL, rbd_remove),
-        __ATTR(list,            0444, class_rbd_list, NULL),
-        __ATTR(snaps_refresh,   0200, NULL, class_rbd_snaps_refresh),
-        __ATTR(snap_create,     0200, NULL, class_rbd_snap_create),
-        __ATTR(snaps_list,      0444, class_rbd_snaps_list, NULL),
-        __ATTR(snap_rollback,   0200, NULL, class_rbd_rollback),
        __ATTR_NULL
 };
 /*
 * create control files in sysfs
- * /sys/class/rbd/...
+ * /sys/bus/rbd/...
 */
 static int rbd_sysfs_init(void)
 {
-        int ret = -ENOMEM;
+        int ret;
-        class_rbd = kzalloc(sizeof(*class_rbd), GFP_KERNEL);
+        rbd_bus_type.bus_attrs = rbd_bus_attrs;
-        if (!class_rbd)
-                goto out;
-        class_rbd->name = DRV_NAME;
+        ret = bus_register(&rbd_bus_type);
-        class_rbd->owner = THIS_MODULE;
+         if (ret < 0)
-        class_rbd->class_release = class_rbd_release;
+                return ret;
-        class_rbd->class_attrs = class_rbd_attrs;
-        ret = class_register(class_rbd);
+        ret = device_register(&rbd_root_dev);
-        if (ret)
-                goto out_class;
-        return 0;
-out_class:
-        kfree(class_rbd);
-        class_rbd = NULL;
-        pr_err(DRV_NAME ": failed to create class rbd\n");
-out:
        return ret;
 }
 static void rbd_sysfs_cleanup(void)
 {
-        if (class_rbd)
+        device_unregister(&rbd_root_dev);
-                class_destroy(class_rbd);
+        bus_unregister(&rbd_bus_type);
-        class_rbd = NULL;
 }
 int __init rbd_init(void)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 255035cfc88a..4f9e22f29138 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -65,7 +65,7 @@ enum blkif_state {
 struct blk_shadow {
        struct blkif_request req;
-        unsigned long request;
+        struct request *request;
        unsigned long frame[BLKIF_MAX_SEGMENTS_PER_REQUEST];
 };
@@ -136,7 +136,7 @@ static void add_id_to_freelist(struct blkfront_info *info,
                               unsigned long id)
 {
        info->shadow[id].req.id  = info->shadow_free;
-        info->shadow[id].request = 0;
+        info->shadow[id].request = NULL;
        info->shadow_free = id;
 }
@@ -245,14 +245,11 @@ static int blkif_ioctl(struct block_device *bdev, fmode_t mode,
 }
 /*
- * blkif_queue_request
+ * Generate a Xen blkfront IO request from a blk layer request.  Reads
+ * and writes are handled as expected.  Since we lack a loose flush
+ * request, we map flushes into a full ordered barrier.
 *
- * request block io
+ * @req: a request struct
- *
- * id: for guest use only.
- * operation: BLKIF_OP_{READ,WRITE,PROBE}
- * buffer: buffer to read/write into. this should be a
- *   virtual address in the guest os.
 */
 static int blkif_queue_request(struct request *req)
 {
@@ -281,7 +278,7 @@ static int blkif_queue_request(struct request *req)
        /* Fill out a communications ring structure. */
        ring_req = RING_GET_REQUEST(&info->ring, info->ring.req_prod_pvt);
        id = get_id_from_freelist(info);
-        info->shadow[id].request = (unsigned long)req;
+        info->shadow[id].request = req;
        ring_req->id = id;
        ring_req->sector_number = (blkif_sector_t)blk_rq_pos(req);
@@ -290,6 +287,18 @@ static int blkif_queue_request(struct request *req)
        ring_req->operation = rq_data_dir(req) ?
                BLKIF_OP_WRITE : BLKIF_OP_READ;
+        if (req->cmd_flags & (REQ_FLUSH | REQ_FUA)) {
+                /*
+                 * Ideally we could just do an unordered
+                 * flush-to-disk, but all we have is a full write
+                 * barrier at the moment.  However, a barrier write is
+                 * a superset of FUA, so we can implement it the same
+                 * way.  (It's also a FLUSH+FUA, since it is
+                 * guaranteed ordered WRT previous writes.)
+                 */
+                ring_req->operation = BLKIF_OP_WRITE_BARRIER;
+        }
        ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg);
        BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST);
@@ -634,7 +643,7 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                bret = RING_GET_RESPONSE(&info->ring, i);
                id   = bret->id;
-                req  = (struct request *)info->shadow[id].request;
+                req  = info->shadow[id].request;
                blkif_completion(&info->shadow[id]);
@@ -647,6 +656,16 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                                printk(KERN_WARNING "blkfront: %s: write barrier op failed\n",
                                       info->gd->disk_name);
                                error = -EOPNOTSUPP;
+                        }
+                        if (unlikely(bret->status == BLKIF_RSP_ERROR &&
+                                     info->shadow[id].req.nr_segments == 0)) {
+                                printk(KERN_WARNING "blkfront: %s: empty write barrier op failed\n",
+                                       info->gd->disk_name);
+                                error = -EOPNOTSUPP;
+                        }
+                        if (unlikely(error)) {
+                                if (error == -EOPNOTSUPP)
+                                        error = 0;
                                info->feature_flush = 0;
                                xlvbd_flush(info);
                        }
@@ -899,7 +918,7 @@ static int blkif_recover(struct blkfront_info *info)
        /* Stage 3: Find pending requests and requeue them. */
        for (i = 0; i < BLK_RING_SIZE; i++) {
                /* Not in use? */
-                if (copy[i].request == 0)
+                if (!copy[i].request)
                        continue;
                /* Grab a request slot and copy shadow state into it. */
@@ -916,9 +935,7 @@ static int blkif_recover(struct blkfront_info *info)
                                req->seg[j].gref,
                                info->xbdev->otherend_id,
                                pfn_to_mfn(info->shadow[req->id].frame[j]),
-                                rq_data_dir(
+                                rq_data_dir(info->shadow[req->id].request));
-                                        (struct request *)
-                                        info->shadow[req->id].request));
                info->shadow[req->id].req = *req;
                info->ring.req_prod_pvt++;
@@ -1067,14 +1084,8 @@ static void blkfront_connect(struct blkfront_info *info)
         */
        info->feature_flush = 0;
-        /*
-         * The driver doesn't properly handled empty flushes, so
-         * lets disable barrier support for now.
-         */
-#if 0
        if (!err && barrier)
-                info->feature_flush = REQ_FLUSH;
+                info->feature_flush = REQ_FLUSH | REQ_FUA;
-#endif
        err = xlvbd_alloc_gendisk(sectors, info, binfo, sector_size);
        if (err) {
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 5259065f3c79..3e67ddde9e16 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -120,7 +120,6 @@ struct agp_bridge_driver {
        void (*agp_destroy_page)(struct page *, int flags);
        void (*agp_destroy_pages)(struct agp_memory *);
        int (*agp_type_to_mask_type) (struct agp_bridge_data *, int);
-        void (*chipset_flush)(struct agp_bridge_data *);
 };
 struct agp_bridge_data {
diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
index 9d2c97a69cdd..a48e05b31593 100644
--- a/drivers/char/agp/compat_ioctl.c
+++ b/drivers/char/agp/compat_ioctl.c
@@ -276,7 +276,6 @@ long compat_agp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                break;
        case AGPIOC_CHIPSET_FLUSH32:
-                ret_val = agpioc_chipset_flush_wrap(curr_priv);
                break;
        }
diff --git a/drivers/char/agp/compat_ioctl.h b/drivers/char/agp/compat_ioctl.h
index 0c9678ac0371..f30e0fd97963 100644
--- a/drivers/char/agp/compat_ioctl.h
+++ b/drivers/char/agp/compat_ioctl.h
@@ -102,6 +102,5 @@ void agp_free_memory_wrap(struct agp_memory *memory);
 struct agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type);
 struct agp_memory *agp_find_mem_by_key(int key);
 struct agp_client *agp_find_client_by_pid(pid_t id);
-int agpioc_chipset_flush_wrap(struct agp_file_private *priv);
 #endif /* _AGP_COMPAT_H */
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index 3cb4539a98b2..2e044338753c 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -957,13 +957,6 @@ static int agpioc_unbind_wrap(struct agp_file_private *priv, void __user *arg)
        return agp_unbind_memory(memory);
 }
-int agpioc_chipset_flush_wrap(struct agp_file_private *priv)
-{
-        DBG("");
-        agp_flush_chipset(agp_bridge);
-        return 0;
-}
 static long agp_ioctl(struct file *file,
                     unsigned int cmd, unsigned long arg)
 {
@@ -1039,7 +1032,6 @@ static long agp_ioctl(struct file *file,
                break;
               
        case AGPIOC_CHIPSET_FLUSH:
-                ret_val = agpioc_chipset_flush_wrap(curr_priv);
                break;
        }
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 4956f1c8f9d5..012cba0d6d96 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -81,13 +81,6 @@ static int agp_get_key(void)
        return -1;
 }
-void agp_flush_chipset(struct agp_bridge_data *bridge)
-{
-        if (bridge->driver->chipset_flush)
-                bridge->driver->chipset_flush(bridge);
-}
-EXPORT_SYMBOL(agp_flush_chipset);
 /*
 * Use kmalloc if possible for the page list. Otherwise fall back to
 * vmalloc. This speeds things up and also saves memory for small AGP
@@ -487,26 +480,6 @@ int agp_unbind_memory(struct agp_memory *curr)
 }
 EXPORT_SYMBOL(agp_unbind_memory);
-/**
- *      agp_rebind_emmory  -  Rewrite the entire GATT, useful on resume
- */
-int agp_rebind_memory(void)
-{
-        struct agp_memory *curr;
-        int ret_val = 0;
-        spin_lock(&agp_bridge->mapped_lock);
-        list_for_each_entry(curr, &agp_bridge->mapped_list, mapped_list) {
-                ret_val = curr->bridge->driver->insert_memory(curr,
-                                                              curr->pg_start,
-                                                              curr->type);
-                if (ret_val != 0)
-                        break;
-        }
-        spin_unlock(&agp_bridge->mapped_lock);
-        return ret_val;
-}
-EXPORT_SYMBOL(agp_rebind_memory);
 /* End - Routines for handling swapping of agp_memory into the GATT */
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index e72f49d52202..07e9796fead7 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -828,14 +828,9 @@ static void __devexit agp_intel_remove(struct pci_dev *pdev)
 static int agp_intel_resume(struct pci_dev *pdev)
 {
        struct agp_bridge_data *bridge = pci_get_drvdata(pdev);
-        int ret_val;
        bridge->driver->configure();
-        ret_val = agp_rebind_memory();
-        if (ret_val != 0)
-                return ret_val;
        return 0;
 }
 #endif
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index 90539df02504..010e3defd6c3 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -75,6 +75,8 @@
 #define I810_GMS_DISABLE        0x00000000
 #define I810_PGETBL_CTL         0x2020
 #define I810_PGETBL_ENABLED     0x00000001
+/* Note: PGETBL_CTL2 has a different offset on G33. */
+#define I965_PGETBL_CTL2        0x20c4
 #define I965_PGETBL_SIZE_MASK   0x0000000e
 #define I965_PGETBL_SIZE_512KB  (0 << 1)
 #define I965_PGETBL_SIZE_256KB  (1 << 1)
@@ -82,9 +84,15 @@
 #define I965_PGETBL_SIZE_1MB    (3 << 1)
 #define I965_PGETBL_SIZE_2MB    (4 << 1)
 #define I965_PGETBL_SIZE_1_5MB  (5 << 1)
-#define G33_PGETBL_SIZE_MASK    (3 << 8)
+#define G33_GMCH_SIZE_MASK      (3 << 8)
-#define G33_PGETBL_SIZE_1M      (1 << 8)
+#define G33_GMCH_SIZE_1M        (1 << 8)
-#define G33_PGETBL_SIZE_2M      (2 << 8)
+#define G33_GMCH_SIZE_2M        (2 << 8)
+#define G4x_GMCH_SIZE_MASK      (0xf << 8)
+#define G4x_GMCH_SIZE_1M        (0x1 << 8)
+#define G4x_GMCH_SIZE_2M        (0x3 << 8)
+#define G4x_GMCH_SIZE_VT_1M     (0x9 << 8)
+#define G4x_GMCH_SIZE_VT_1_5M   (0xa << 8)
+#define G4x_GMCH_SIZE_VT_2M     (0xc << 8)
 #define I810_DRAM_CTL           0x3000
 #define I810_DRAM_ROW_0         0x00000001
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 9272c38dd3c6..356f73e0d17e 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -24,7 +24,6 @@
 #include <asm/smp.h>
 #include "agp.h"
 #include "intel-agp.h"
-#include <linux/intel-gtt.h>
 #include <drm/intel-gtt.h>
 /*
@@ -39,40 +38,12 @@
 #define USE_PCI_DMA_API 0
 #endif
-/* Max amount of stolen space, anything above will be returned to Linux */
-int intel_max_stolen = 32 * 1024 * 1024;
-static const struct aper_size_info_fixed intel_i810_sizes[] =
-{
-        {64, 16384, 4},
-        /* The 32M mode still requires a 64k gatt */
-        {32, 8192, 4}
-};
-#define AGP_DCACHE_MEMORY       1
-#define AGP_PHYS_MEMORY         2
-#define INTEL_AGP_CACHED_MEMORY 3
-static struct gatt_mask intel_i810_masks[] =
-{
-        {.mask = I810_PTE_VALID, .type = 0},
-        {.mask = (I810_PTE_VALID | I810_PTE_LOCAL), .type = AGP_DCACHE_MEMORY},
-        {.mask = I810_PTE_VALID, .type = 0},
-        {.mask = I810_PTE_VALID | I830_PTE_SYSTEM_CACHED,
-         .type = INTEL_AGP_CACHED_MEMORY}
-};
-#define INTEL_AGP_UNCACHED_MEMORY              0
-#define INTEL_AGP_CACHED_MEMORY_LLC            1
-#define INTEL_AGP_CACHED_MEMORY_LLC_GFDT       2
-#define INTEL_AGP_CACHED_MEMORY_LLC_MLC        3
-#define INTEL_AGP_CACHED_MEMORY_LLC_MLC_GFDT   4
 struct intel_gtt_driver {
        unsigned int gen : 8;
        unsigned int is_g33 : 1;
        unsigned int is_pineview : 1;
        unsigned int is_ironlake : 1;
+        unsigned int has_pgtbl_enable : 1;
        unsigned int dma_mask_size : 8;
        /* Chipset specific GTT setup */
        int (*setup)(void);
@@ -95,13 +66,14 @@ static struct _intel_private {
        u8 __iomem *registers;
        phys_addr_t gtt_bus_addr;
        phys_addr_t gma_bus_addr;
-        phys_addr_t pte_bus_addr;
+        u32 PGETBL_save;
        u32 __iomem *gtt;               /* I915G */
        int num_dcache_entries;
        union {
                void __iomem *i9xx_flush_page;
                void *i8xx_flush_page;
        };
+        char *i81x_gtt_table;
        struct page *i8xx_page;
        struct resource ifp_resource;
        int resource_valid;
@@ -113,42 +85,31 @@ static struct _intel_private {
 #define IS_G33          intel_private.driver->is_g33
 #define IS_PINEVIEW     intel_private.driver->is_pineview
 #define IS_IRONLAKE     intel_private.driver->is_ironlake
+#define HAS_PGTBL_EN    intel_private.driver->has_pgtbl_enable
-static void intel_agp_free_sglist(struct agp_memory *mem)
+int intel_gtt_map_memory(struct page **pages, unsigned int num_entries,
-{
+                         struct scatterlist **sg_list, int *num_sg)
-        struct sg_table st;
-        st.sgl = mem->sg_list;
-        st.orig_nents = st.nents = mem->page_count;
-        sg_free_table(&st);
-        mem->sg_list = NULL;
-        mem->num_sg = 0;
-}
-static int intel_agp_map_memory(struct agp_memory *mem)
 {
        struct sg_table st;
        struct scatterlist *sg;
        int i;
-        if (mem->sg_list)
+        if (*sg_list)
                return 0; /* already mapped (for e.g. resume */
-        DBG("try mapping %lu pages\n", (unsigned long)mem->page_count);
+        DBG("try mapping %lu pages\n", (unsigned long)num_entries);
-        if (sg_alloc_table(&st, mem->page_count, GFP_KERNEL))
+        if (sg_alloc_table(&st, num_entries, GFP_KERNEL))
                goto err;
-        mem->sg_list = sg = st.sgl;
+        *sg_list = sg = st.sgl;
-        for (i = 0 ; i < mem->page_count; i++, sg = sg_next(sg))
+        for (i = 0 ; i < num_entries; i++, sg = sg_next(sg))
-                sg_set_page(sg, mem->pages[i], PAGE_SIZE, 0);
+                sg_set_page(sg, pages[i], PAGE_SIZE, 0);
-        mem->num_sg = pci_map_sg(intel_private.pcidev, mem->sg_list,
+        *num_sg = pci_map_sg(intel_private.pcidev, *sg_list,
-                                 mem->page_count, PCI_DMA_BIDIRECTIONAL);
+                                 num_entries, PCI_DMA_BIDIRECTIONAL);
-        if (unlikely(!mem->num_sg))
+        if (unlikely(!*num_sg))
                goto err;
        return 0;
@@ -157,90 +118,22 @@ err:
        sg_free_table(&st);
        return -ENOMEM;
 }
+EXPORT_SYMBOL(intel_gtt_map_memory);
-static void intel_agp_unmap_memory(struct agp_memory *mem)
+void intel_gtt_unmap_memory(struct scatterlist *sg_list, int num_sg)
 {
+        struct sg_table st;
        DBG("try unmapping %lu pages\n", (unsigned long)mem->page_count);
-        pci_unmap_sg(intel_private.pcidev, mem->sg_list,
+        pci_unmap_sg(intel_private.pcidev, sg_list,
-                     mem->page_count, PCI_DMA_BIDIRECTIONAL);
+                     num_sg, PCI_DMA_BIDIRECTIONAL);
-        intel_agp_free_sglist(mem);
-}
-static int intel_i810_fetch_size(void)
-{
-        u32 smram_miscc;
-        struct aper_size_info_fixed *values;
-        pci_read_config_dword(intel_private.bridge_dev,
-                              I810_SMRAM_MISCC, &smram_miscc);
-        values = A_SIZE_FIX(agp_bridge->driver->aperture_sizes);
-        if ((smram_miscc & I810_GMS) == I810_GMS_DISABLE) {
-                dev_warn(&intel_private.bridge_dev->dev, "i810 is disabled\n");
-                return 0;
-        }
-        if ((smram_miscc & I810_GFX_MEM_WIN_SIZE) == I810_GFX_MEM_WIN_32M) {
-                agp_bridge->current_size = (void *) (values + 1);
-                agp_bridge->aperture_size_idx = 1;
-                return values[1].size;
-        } else {
-                agp_bridge->current_size = (void *) (values);
-                agp_bridge->aperture_size_idx = 0;
-                return values[0].size;
-        }
-        return 0;
-}
-static int intel_i810_configure(void)
-{
-        struct aper_size_info_fixed *current_size;
-        u32 temp;
-        int i;
-        current_size = A_SIZE_FIX(agp_bridge->current_size);
-        if (!intel_private.registers) {
-                pci_read_config_dword(intel_private.pcidev, I810_MMADDR, &temp);
-                temp &= 0xfff80000;
-                intel_private.registers = ioremap(temp, 128 * 4096);
+        st.sgl = sg_list;
-                if (!intel_private.registers) {
+        st.orig_nents = st.nents = num_sg;
-                        dev_err(&intel_private.pcidev->dev,
-                                "can't remap memory\n");
-                        return -ENOMEM;
-                }
-        }
-        if ((readl(intel_private.registers+I810_DRAM_CTL)
+        sg_free_table(&st);
-                & I810_DRAM_ROW_0) == I810_DRAM_ROW_0_SDRAM) {
-                /* This will need to be dynamically assigned */
-                dev_info(&intel_private.pcidev->dev,
-                         "detected 4MB dedicated video ram\n");
-                intel_private.num_dcache_entries = 1024;
-        }
-        pci_read_config_dword(intel_private.pcidev, I810_GMADDR, &temp);
-        agp_bridge->gart_bus_addr = (temp & PCI_BASE_ADDRESS_MEM_MASK);
-        writel(agp_bridge->gatt_bus_addr | I810_PGETBL_ENABLED, intel_private.registers+I810_PGETBL_CTL);
-        readl(intel_private.registers+I810_PGETBL_CTL); /* PCI Posting. */
-        if (agp_bridge->driver->needs_scratch_page) {
-                for (i = 0; i < current_size->num_entries; i++) {
-                        writel(agp_bridge->scratch_page, intel_private.registers+I810_PTE_BASE+(i*4));
-                }
-                readl(intel_private.registers+I810_PTE_BASE+((i-1)*4)); /* PCI posting. */
-        }
-        global_cache_flush();
-        return 0;
-}
-static void intel_i810_cleanup(void)
-{
-        writel(0, intel_private.registers+I810_PGETBL_CTL);
-        readl(intel_private.registers); /* PCI Posting. */
-        iounmap(intel_private.registers);
 }
+EXPORT_SYMBOL(intel_gtt_unmap_memory);
 static void intel_fake_agp_enable(struct agp_bridge_data *bridge, u32 mode)
 {
@@ -277,80 +170,64 @@ static void i8xx_destroy_pages(struct page *page)
        atomic_dec(&agp_bridge->current_memory_agp);
 }
-static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
+#define I810_GTT_ORDER 4
-                                int type)
+static int i810_setup(void)
 {
-        int i, j, num_entries;
+        u32 reg_addr;
-        void *temp;
+        char *gtt_table;
-        int ret = -EINVAL;
-        int mask_type;
-        if (mem->page_count == 0)
-                goto out;
-        temp = agp_bridge->current_size;
-        num_entries = A_SIZE_FIX(temp)->num_entries;
-        if ((pg_start + mem->page_count) > num_entries)
+        /* i81x does not preallocate the gtt. It's always 64kb in size. */
-                goto out_err;
+        gtt_table = alloc_gatt_pages(I810_GTT_ORDER);
+        if (gtt_table == NULL)
+                return -ENOMEM;
+        intel_private.i81x_gtt_table = gtt_table;
+        pci_read_config_dword(intel_private.pcidev, I810_MMADDR, &reg_addr);
+        reg_addr &= 0xfff80000;
-        for (j = pg_start; j < (pg_start + mem->page_count); j++) {
+        intel_private.registers = ioremap(reg_addr, KB(64));
-                if (!PGE_EMPTY(agp_bridge, readl(agp_bridge->gatt_table+j))) {
+        if (!intel_private.registers)
-                        ret = -EBUSY;
+                return -ENOMEM;
-                        goto out_err;
-                }
-        }
-        if (type != mem->type)
+        writel(virt_to_phys(gtt_table) | I810_PGETBL_ENABLED,
-                goto out_err;
+               intel_private.registers+I810_PGETBL_CTL);
-        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
+        intel_private.gtt_bus_addr = reg_addr + I810_PTE_BASE;
-        switch (mask_type) {
+        if ((readl(intel_private.registers+I810_DRAM_CTL)
-        case AGP_DCACHE_MEMORY:
+                & I810_DRAM_ROW_0) == I810_DRAM_ROW_0_SDRAM) {
-                if (!mem->is_flushed)
+                dev_info(&intel_private.pcidev->dev,
-                        global_cache_flush();
+                         "detected 4MB dedicated video ram\n");
-                for (i = pg_start; i < (pg_start + mem->page_count); i++) {
+                intel_private.num_dcache_entries = 1024;
-                        writel((i*4096)|I810_PTE_LOCAL|I810_PTE_VALID,
-                               intel_private.registers+I810_PTE_BASE+(i*4));
-                }
-                readl(intel_private.registers+I810_PTE_BASE+((i-1)*4));
-                break;
-        case AGP_PHYS_MEMORY:
-        case AGP_NORMAL_MEMORY:
-                if (!mem->is_flushed)
-                        global_cache_flush();
-                for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                        writel(agp_bridge->driver->mask_memory(agp_bridge,
-                                        page_to_phys(mem->pages[i]), mask_type),
-                               intel_private.registers+I810_PTE_BASE+(j*4));
-                }
-                readl(intel_private.registers+I810_PTE_BASE+((j-1)*4));
-                break;
-        default:
-                goto out_err;
        }
-out:
+        return 0;
-        ret = 0;
+}
-out_err:
-        mem->is_flushed = true;
+static void i810_cleanup(void)
-        return ret;
+{
+        writel(0, intel_private.registers+I810_PGETBL_CTL);
+        free_gatt_pages(intel_private.i81x_gtt_table, I810_GTT_ORDER);
 }
-static int intel_i810_remove_entries(struct agp_memory *mem, off_t pg_start,
+static int i810_insert_dcache_entries(struct agp_memory *mem, off_t pg_start,
-                                int type)
+                                      int type)
 {
        int i;
-        if (mem->page_count == 0)
+        if ((pg_start + mem->page_count)
-                return 0;
+                        > intel_private.num_dcache_entries)
+                return -EINVAL;
+        if (!mem->is_flushed)
+                global_cache_flush();
-        for (i = pg_start; i < (mem->page_count + pg_start); i++) {
+        for (i = pg_start; i < (pg_start + mem->page_count); i++) {
-                writel(agp_bridge->scratch_page, intel_private.registers+I810_PTE_BASE+(i*4));
+                dma_addr_t addr = i << PAGE_SHIFT;
+                intel_private.driver->write_entry(addr,
+                                                  i, type);
        }
-        readl(intel_private.registers+I810_PTE_BASE+((i-1)*4));
+        readl(intel_private.gtt+i-1);
        return 0;
 }
@@ -397,29 +274,6 @@ static struct agp_memory *alloc_agpphysmem_i8xx(size_t pg_count, int type)
        return new;
 }
-static struct agp_memory *intel_i810_alloc_by_type(size_t pg_count, int type)
-{
-        struct agp_memory *new;
-        if (type == AGP_DCACHE_MEMORY) {
-                if (pg_count != intel_private.num_dcache_entries)
-                        return NULL;
-                new = agp_create_memory(1);
-                if (new == NULL)
-                        return NULL;
-                new->type = AGP_DCACHE_MEMORY;
-                new->page_count = pg_count;
-                new->num_scratch_pages = 0;
-                agp_free_page_array(new);
-                return new;
-        }
-        if (type == AGP_PHYS_MEMORY)
-                return alloc_agpphysmem_i8xx(pg_count, type);
-        return NULL;
-}
 static void intel_i810_free_by_type(struct agp_memory *curr)
 {
        agp_free_key(curr->key);
@@ -437,13 +291,6 @@ static void intel_i810_free_by_type(struct agp_memory *curr)
        kfree(curr);
 }
-static unsigned long intel_i810_mask_memory(struct agp_bridge_data *bridge,
-                                            dma_addr_t addr, int type)
-{
-        /* Type checking must be done elsewhere */
-        return addr | bridge->driver->masks[type].mask;
-}
 static int intel_gtt_setup_scratch_page(void)
 {
        struct page *page;
@@ -455,7 +302,7 @@ static int intel_gtt_setup_scratch_page(void)
        get_page(page);
        set_pages_uc(page, 1);
-        if (USE_PCI_DMA_API && INTEL_GTT_GEN > 2) {
+        if (intel_private.base.needs_dmar) {
                dma_addr = pci_map_page(intel_private.pcidev, page, 0,
                                    PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
                if (pci_dma_mapping_error(intel_private.pcidev, dma_addr))
@@ -470,34 +317,45 @@ static int intel_gtt_setup_scratch_page(void)
        return 0;
 }
-static const struct aper_size_info_fixed const intel_fake_agp_sizes[] = {
+static void i810_write_entry(dma_addr_t addr, unsigned int entry,
+                             unsigned int flags)
+{
+        u32 pte_flags = I810_PTE_VALID;
+        switch (flags) {
+        case AGP_DCACHE_MEMORY:
+                pte_flags |= I810_PTE_LOCAL;
+                break;
+        case AGP_USER_CACHED_MEMORY:
+                pte_flags |= I830_PTE_SYSTEM_CACHED;
+                break;
+        }
+        writel(addr | pte_flags, intel_private.gtt + entry);
+}
+static const struct aper_size_info_fixed intel_fake_agp_sizes[] = {
+        {32, 8192, 3},
+        {64, 16384, 4},
        {128, 32768, 5},
-        /* The 64M mode still requires a 128k gatt */
-        {64, 16384, 5},
        {256, 65536, 6},
        {512, 131072, 7},
 };
-static unsigned int intel_gtt_stolen_entries(void)
+static unsigned int intel_gtt_stolen_size(void)
 {
        u16 gmch_ctrl;
        u8 rdct;
        int local = 0;
        static const int ddt[4] = { 0, 16, 32, 64 };
-        unsigned int overhead_entries, stolen_entries;
        unsigned int stolen_size = 0;
+        if (INTEL_GTT_GEN == 1)
+                return 0; /* no stolen mem on i81x */
        pci_read_config_word(intel_private.bridge_dev,
                             I830_GMCH_CTRL, &gmch_ctrl);
-        if (INTEL_GTT_GEN > 4 || IS_PINEVIEW)
-                overhead_entries = 0;
-        else
-                overhead_entries = intel_private.base.gtt_mappable_entries
-                        / 1024;
-        overhead_entries += 1; /* BIOS popup */
        if (intel_private.bridge_dev->device == PCI_DEVICE_ID_INTEL_82830_HB ||
            intel_private.bridge_dev->device == PCI_DEVICE_ID_INTEL_82845G_HB) {
                switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
@@ -623,12 +481,7 @@ static unsigned int intel_gtt_stolen_entries(void)
                }
        }
-        if (!local && stolen_size > intel_max_stolen) {
+        if (stolen_size > 0) {
-                dev_info(&intel_private.bridge_dev->dev,
-                         "detected %dK stolen memory, trimming to %dK\n",
-                         stolen_size / KB(1), intel_max_stolen / KB(1));
-                stolen_size = intel_max_stolen;
-        } else if (stolen_size > 0) {
                dev_info(&intel_private.bridge_dev->dev, "detected %dK %s memory\n",
                       stolen_size / KB(1), local ? "local" : "stolen");
        } else {
@@ -637,46 +490,88 @@ static unsigned int intel_gtt_stolen_entries(void)
                stolen_size = 0;
        }
-        stolen_entries = stolen_size/KB(4) - overhead_entries;
+        return stolen_size;
+}
-        return stolen_entries;
+static void i965_adjust_pgetbl_size(unsigned int size_flag)
+{
+        u32 pgetbl_ctl, pgetbl_ctl2;
+        /* ensure that ppgtt is disabled */
+        pgetbl_ctl2 = readl(intel_private.registers+I965_PGETBL_CTL2);
+        pgetbl_ctl2 &= ~I810_PGETBL_ENABLED;
+        writel(pgetbl_ctl2, intel_private.registers+I965_PGETBL_CTL2);
+        /* write the new ggtt size */
+        pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
+        pgetbl_ctl &= ~I965_PGETBL_SIZE_MASK;
+        pgetbl_ctl |= size_flag;
+        writel(pgetbl_ctl, intel_private.registers+I810_PGETBL_CTL);
 }
-static unsigned int intel_gtt_total_entries(void)
+static unsigned int i965_gtt_total_entries(void)
 {
        int size;
+        u32 pgetbl_ctl;
+        u16 gmch_ctl;
-        if (IS_G33 || INTEL_GTT_GEN == 4 || INTEL_GTT_GEN == 5) {
+        pci_read_config_word(intel_private.bridge_dev,
-                u32 pgetbl_ctl;
+                             I830_GMCH_CTRL, &gmch_ctl);
-                pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
-                switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
+        if (INTEL_GTT_GEN == 5) {
-                case I965_PGETBL_SIZE_128KB:
+                switch (gmch_ctl & G4x_GMCH_SIZE_MASK) {
-                        size = KB(128);
+                case G4x_GMCH_SIZE_1M:
-                        break;
+                case G4x_GMCH_SIZE_VT_1M:
-                case I965_PGETBL_SIZE_256KB:
+                        i965_adjust_pgetbl_size(I965_PGETBL_SIZE_1MB);
-                        size = KB(256);
-                        break;
-                case I965_PGETBL_SIZE_512KB:
-                        size = KB(512);
                        break;
-                case I965_PGETBL_SIZE_1MB:
+                case G4x_GMCH_SIZE_VT_1_5M:
-                        size = KB(1024);
+                        i965_adjust_pgetbl_size(I965_PGETBL_SIZE_1_5MB);
                        break;
-                case I965_PGETBL_SIZE_2MB:
+                case G4x_GMCH_SIZE_2M:
-                        size = KB(2048);
+                case G4x_GMCH_SIZE_VT_2M:
+                        i965_adjust_pgetbl_size(I965_PGETBL_SIZE_2MB);
                        break;
-                case I965_PGETBL_SIZE_1_5MB:
-                        size = KB(1024 + 512);
-                        break;
-                default:
-                        dev_info(&intel_private.pcidev->dev,
-                                 "unknown page table size, assuming 512KB\n");
-                        size = KB(512);
                }
+        }
-                return size/4;
+        pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
-        } else if (INTEL_GTT_GEN == 6) {
+        switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
+        case I965_PGETBL_SIZE_128KB:
+                size = KB(128);
+                break;
+        case I965_PGETBL_SIZE_256KB:
+                size = KB(256);
+                break;
+        case I965_PGETBL_SIZE_512KB:
+                size = KB(512);
+                break;
+        /* GTT pagetable sizes bigger than 512KB are not possible on G33! */
+        case I965_PGETBL_SIZE_1MB:
+                size = KB(1024);
+                break;
+        case I965_PGETBL_SIZE_2MB:
+                size = KB(2048);
+                break;
+        case I965_PGETBL_SIZE_1_5MB:
+                size = KB(1024 + 512);
+                break;
+        default:
+                dev_info(&intel_private.pcidev->dev,
+                         "unknown page table size, assuming 512KB\n");
+                size = KB(512);
+        }
+        return size/4;
+}
+static unsigned int intel_gtt_total_entries(void)
+{
+        int size;
+        if (IS_G33 || INTEL_GTT_GEN == 4 || INTEL_GTT_GEN == 5)
+                return i965_gtt_total_entries();
+        else if (INTEL_GTT_GEN == 6) {
                u16 snb_gmch_ctl;
                pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
@@ -706,7 +601,18 @@ static unsigned int intel_gtt_mappable_entries(void)
 {
        unsigned int aperture_size;
-        if (INTEL_GTT_GEN == 2) {
+        if (INTEL_GTT_GEN == 1) {
+                u32 smram_miscc;
+                pci_read_config_dword(intel_private.bridge_dev,
+                                      I810_SMRAM_MISCC, &smram_miscc);
+                if ((smram_miscc & I810_GFX_MEM_WIN_SIZE)
+                                == I810_GFX_MEM_WIN_32M)
+                        aperture_size = MB(32);
+                else
+                        aperture_size = MB(64);
+        } else if (INTEL_GTT_GEN == 2) {
                u16 gmch_ctrl;
                pci_read_config_word(intel_private.bridge_dev,
@@ -739,7 +645,7 @@ static void intel_gtt_cleanup(void)
        iounmap(intel_private.gtt);
        iounmap(intel_private.registers);
-        
        intel_gtt_teardown_scratch_page();
 }
@@ -755,6 +661,14 @@ static int intel_gtt_init(void)
        intel_private.base.gtt_mappable_entries = intel_gtt_mappable_entries();
        intel_private.base.gtt_total_entries = intel_gtt_total_entries();
+        /* save the PGETBL reg for resume */
+        intel_private.PGETBL_save =
+                readl(intel_private.registers+I810_PGETBL_CTL)
+                        & ~I810_PGETBL_ENABLED;
+        /* we only ever restore the register when enabling the PGTBL... */
+        if (HAS_PGTBL_EN)
+                intel_private.PGETBL_save |= I810_PGETBL_ENABLED;
        dev_info(&intel_private.bridge_dev->dev,
                        "detected gtt size: %dK total, %dK mappable\n",
                        intel_private.base.gtt_total_entries * 4,
@@ -772,14 +686,7 @@ static int intel_gtt_init(void)
        global_cache_flush();   /* FIXME: ? */
-        /* we have to call this as early as possible after the MMIO base address is known */
+        intel_private.base.stolen_size = intel_gtt_stolen_size();
-        intel_private.base.gtt_stolen_entries = intel_gtt_stolen_entries();
-        if (intel_private.base.gtt_stolen_entries == 0) {
-                intel_private.driver->cleanup();
-                iounmap(intel_private.registers);
-                iounmap(intel_private.gtt);
-                return -ENOMEM;
-        }
        ret = intel_gtt_setup_scratch_page();
        if (ret != 0) {
@@ -787,6 +694,8 @@ static int intel_gtt_init(void)
                return ret;
        }
+        intel_private.base.needs_dmar = USE_PCI_DMA_API && INTEL_GTT_GEN > 2;
        return 0;
 }
@@ -812,8 +721,10 @@ static int intel_fake_agp_fetch_size(void)
 static void i830_cleanup(void)
 {
-        kunmap(intel_private.i8xx_page);
+        if (intel_private.i8xx_flush_page) {
-        intel_private.i8xx_flush_page = NULL;
+                kunmap(intel_private.i8xx_flush_page);
+                intel_private.i8xx_flush_page = NULL;
+        }
        __free_page(intel_private.i8xx_page);
        intel_private.i8xx_page = NULL;
@@ -860,25 +771,19 @@ static void i830_write_entry(dma_addr_t addr, unsigned int entry,
                             unsigned int flags)
 {
        u32 pte_flags = I810_PTE_VALID;
-        
-        switch (flags) {
+        if (flags ==  AGP_USER_CACHED_MEMORY)
-        case AGP_DCACHE_MEMORY:
-                pte_flags |= I810_PTE_LOCAL;
-                break;
-        case AGP_USER_CACHED_MEMORY:
                pte_flags |= I830_PTE_SYSTEM_CACHED;
-                break;
-        }
        writel(addr | pte_flags, intel_private.gtt + entry);
 }
-static void intel_enable_gtt(void)
+static bool intel_enable_gtt(void)
 {
        u32 gma_addr;
-        u16 gmch_ctrl;
+        u8 __iomem *reg;
-        if (INTEL_GTT_GEN == 2)
+        if (INTEL_GTT_GEN <= 2)
                pci_read_config_dword(intel_private.pcidev, I810_GMADDR,
                                      &gma_addr);
        else
@@ -887,13 +792,38 @@ static void intel_enable_gtt(void)
        intel_private.gma_bus_addr = (gma_addr & PCI_BASE_ADDRESS_MEM_MASK);
-        pci_read_config_word(intel_private.bridge_dev, I830_GMCH_CTRL, &gmch_ctrl);
+        if (INTEL_GTT_GEN >= 6)
-        gmch_ctrl |= I830_GMCH_ENABLED;
+            return true;
-        pci_write_config_word(intel_private.bridge_dev, I830_GMCH_CTRL, gmch_ctrl);
-        writel(intel_private.pte_bus_addr|I810_PGETBL_ENABLED,
+        if (INTEL_GTT_GEN == 2) {
-               intel_private.registers+I810_PGETBL_CTL);
+                u16 gmch_ctrl;
-        readl(intel_private.registers+I810_PGETBL_CTL); /* PCI Posting. */
+                pci_read_config_word(intel_private.bridge_dev,
+                                     I830_GMCH_CTRL, &gmch_ctrl);
+                gmch_ctrl |= I830_GMCH_ENABLED;
+                pci_write_config_word(intel_private.bridge_dev,
+                                      I830_GMCH_CTRL, gmch_ctrl);
+                pci_read_config_word(intel_private.bridge_dev,
+                                     I830_GMCH_CTRL, &gmch_ctrl);
+                if ((gmch_ctrl & I830_GMCH_ENABLED) == 0) {
+                        dev_err(&intel_private.pcidev->dev,
+                                "failed to enable the GTT: GMCH_CTRL=%x\n",
+                                gmch_ctrl);
+                        return false;
+                }
+        }
+        reg = intel_private.registers+I810_PGETBL_CTL;
+        writel(intel_private.PGETBL_save, reg);
+        if (HAS_PGTBL_EN && (readl(reg) & I810_PGETBL_ENABLED) == 0) {
+                dev_err(&intel_private.pcidev->dev,
+                        "failed to enable the GTT: PGETBL=%x [expected %x]\n",
+                        readl(reg), intel_private.PGETBL_save);
+                return false;
+        }
+        return true;
 }
 static int i830_setup(void)
@@ -908,8 +838,6 @@ static int i830_setup(void)
                return -ENOMEM;
        intel_private.gtt_bus_addr = reg_addr + I810_PTE_BASE;
-        intel_private.pte_bus_addr =
-                readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
        intel_i830_setup_flush();
@@ -934,12 +862,12 @@ static int intel_fake_agp_configure(void)
 {
        int i;
-        intel_enable_gtt();
+        if (!intel_enable_gtt())
+            return -EIO;
        agp_bridge->gart_bus_addr = intel_private.gma_bus_addr;
-        for (i = intel_private.base.gtt_stolen_entries;
+        for (i = 0; i < intel_private.base.gtt_total_entries; i++) {
-                        i < intel_private.base.gtt_total_entries; i++) {
                intel_private.driver->write_entry(intel_private.scratch_page_dma,
                                                  i, 0);
        }
@@ -963,10 +891,10 @@ static bool i830_check_flags(unsigned int flags)
        return false;
 }
-static void intel_gtt_insert_sg_entries(struct scatterlist *sg_list,
+void intel_gtt_insert_sg_entries(struct scatterlist *sg_list,
-                                        unsigned int sg_len,
+                                 unsigned int sg_len,
-                                        unsigned int pg_start,
+                                 unsigned int pg_start,
-                                        unsigned int flags)
+                                 unsigned int flags)
 {
        struct scatterlist *sg;
        unsigned int len, m;
@@ -987,27 +915,34 @@ static void intel_gtt_insert_sg_entries(struct scatterlist *sg_list,
        }
        readl(intel_private.gtt+j-1);
 }
+EXPORT_SYMBOL(intel_gtt_insert_sg_entries);
+void intel_gtt_insert_pages(unsigned int first_entry, unsigned int num_entries,
+                            struct page **pages, unsigned int flags)
+{
+        int i, j;
+        for (i = 0, j = first_entry; i < num_entries; i++, j++) {
+                dma_addr_t addr = page_to_phys(pages[i]);
+                intel_private.driver->write_entry(addr,
+                                                  j, flags);
+        }
+        readl(intel_private.gtt+j-1);
+}
+EXPORT_SYMBOL(intel_gtt_insert_pages);
 static int intel_fake_agp_insert_entries(struct agp_memory *mem,
                                         off_t pg_start, int type)
 {
-        int i, j;
        int ret = -EINVAL;
+        if (INTEL_GTT_GEN == 1 && type == AGP_DCACHE_MEMORY)
+                return i810_insert_dcache_entries(mem, pg_start, type);
        if (mem->page_count == 0)
                goto out;
-        if (pg_start < intel_private.base.gtt_stolen_entries) {
+        if (pg_start + mem->page_count > intel_private.base.gtt_total_entries)
-                dev_printk(KERN_DEBUG, &intel_private.pcidev->dev,
-                           "pg_start == 0x%.8lx, gtt_stolen_entries == 0x%.8x\n",
-                           pg_start, intel_private.base.gtt_stolen_entries);
-                dev_info(&intel_private.pcidev->dev,
-                         "trying to insert into local/stolen memory\n");
-                goto out_err;
-        }
-        if ((pg_start + mem->page_count) > intel_private.base.gtt_total_entries)
                goto out_err;
        if (type != mem->type)
@@ -1019,21 +954,17 @@ static int intel_fake_agp_insert_entries(struct agp_memory *mem,
        if (!mem->is_flushed)
                global_cache_flush();
-        if (USE_PCI_DMA_API && INTEL_GTT_GEN > 2) {
+        if (intel_private.base.needs_dmar) {
-                ret = intel_agp_map_memory(mem);
+                ret = intel_gtt_map_memory(mem->pages, mem->page_count,
+                                           &mem->sg_list, &mem->num_sg);
                if (ret != 0)
                        return ret;
                intel_gtt_insert_sg_entries(mem->sg_list, mem->num_sg,
                                            pg_start, type);
-        } else {
+        } else
-                for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
+                intel_gtt_insert_pages(pg_start, mem->page_count, mem->pages,
-                        dma_addr_t addr = page_to_phys(mem->pages[i]);
+                                       type);
-                        intel_private.driver->write_entry(addr,
-                                                          j, type);
-                }
-                readl(intel_private.gtt+j-1);
-        }
 out:
        ret = 0;
@@ -1042,40 +973,54 @@ out_err:
        return ret;
 }
+void intel_gtt_clear_range(unsigned int first_entry, unsigned int num_entries)
+{
+        unsigned int i;
+        for (i = first_entry; i < (first_entry + num_entries); i++) {
+                intel_private.driver->write_entry(intel_private.scratch_page_dma,
+                                                  i, 0);
+        }
+        readl(intel_private.gtt+i-1);
+}
+EXPORT_SYMBOL(intel_gtt_clear_range);
 static int intel_fake_agp_remove_entries(struct agp_memory *mem,
                                         off_t pg_start, int type)
 {
-        int i;
        if (mem->page_count == 0)
                return 0;
-        if (pg_start < intel_private.base.gtt_stolen_entries) {
+        if (intel_private.base.needs_dmar) {
-                dev_info(&intel_private.pcidev->dev,
+                intel_gtt_unmap_memory(mem->sg_list, mem->num_sg);
-                         "trying to disable local/stolen memory\n");
+                mem->sg_list = NULL;
-                return -EINVAL;
+                mem->num_sg = 0;
        }
-        if (USE_PCI_DMA_API && INTEL_GTT_GEN > 2)
+        intel_gtt_clear_range(pg_start, mem->page_count);
-                intel_agp_unmap_memory(mem);
-        for (i = pg_start; i < (mem->page_count + pg_start); i++) {
-                intel_private.driver->write_entry(intel_private.scratch_page_dma,
-                                                  i, 0);
-        }
-        readl(intel_private.gtt+i-1);
        return 0;
 }
-static void intel_fake_agp_chipset_flush(struct agp_bridge_data *bridge)
-{
-        intel_private.driver->chipset_flush();
-}
 static struct agp_memory *intel_fake_agp_alloc_by_type(size_t pg_count,
                                                       int type)
 {
+        struct agp_memory *new;
+        if (type == AGP_DCACHE_MEMORY && INTEL_GTT_GEN == 1) {
+                if (pg_count != intel_private.num_dcache_entries)
+                        return NULL;
+                new = agp_create_memory(1);
+                if (new == NULL)
+                        return NULL;
+                new->type = AGP_DCACHE_MEMORY;
+                new->page_count = pg_count;
+                new->num_scratch_pages = 0;
+                agp_free_page_array(new);
+                return new;
+        }
        if (type == AGP_PHYS_MEMORY)
                return alloc_agpphysmem_i8xx(pg_count, type);
        /* always return NULL for other allocation types for now */
@@ -1190,12 +1135,19 @@ static void i9xx_chipset_flush(void)
                writel(1, intel_private.i9xx_flush_page);
 }
-static void i965_write_entry(dma_addr_t addr, unsigned int entry,
+static void i965_write_entry(dma_addr_t addr,
+                             unsigned int entry,
                             unsigned int flags)
 {
+        u32 pte_flags;
+        pte_flags = I810_PTE_VALID;
+        if (flags == AGP_USER_CACHED_MEMORY)
+                pte_flags |= I830_PTE_SYSTEM_CACHED;
        /* Shift high bits down */
        addr |= (addr >> 28) & 0xf0;
-        writel(addr | I810_PTE_VALID, intel_private.gtt + entry);
+        writel(addr | pte_flags, intel_private.gtt + entry);
 }
 static bool gen6_check_flags(unsigned int flags)
@@ -1265,40 +1217,11 @@ static int i9xx_setup(void)
                intel_private.gtt_bus_addr = reg_addr + gtt_offset;
        }
-        intel_private.pte_bus_addr =
-                readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
        intel_i9xx_setup_flush();
        return 0;
 }
-static const struct agp_bridge_driver intel_810_driver = {
-        .owner                  = THIS_MODULE,
-        .aperture_sizes         = intel_i810_sizes,
-        .size_type              = FIXED_APER_SIZE,
-        .num_aperture_sizes     = 2,
-        .needs_scratch_page     = true,
-        .configure              = intel_i810_configure,
-        .fetch_size             = intel_i810_fetch_size,
-        .cleanup                = intel_i810_cleanup,
-        .mask_memory            = intel_i810_mask_memory,
-        .masks                  = intel_i810_masks,
-        .agp_enable             = intel_fake_agp_enable,
-        .cache_flush            = global_cache_flush,
-        .create_gatt_table      = agp_generic_create_gatt_table,
-        .free_gatt_table        = agp_generic_free_gatt_table,
-        .insert_memory          = intel_i810_insert_entries,
-        .remove_memory          = intel_i810_remove_entries,
-        .alloc_by_type          = intel_i810_alloc_by_type,
-        .free_by_type           = intel_i810_free_by_type,
-        .agp_alloc_page         = agp_generic_alloc_page,
-        .agp_alloc_pages        = agp_generic_alloc_pages,
-        .agp_destroy_page       = agp_generic_destroy_page,
-        .agp_destroy_pages      = agp_generic_destroy_pages,
-        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
-};
 static const struct agp_bridge_driver intel_fake_agp_driver = {
        .owner                  = THIS_MODULE,
        .size_type              = FIXED_APER_SIZE,
@@ -1319,15 +1242,20 @@ static const struct agp_bridge_driver intel_fake_agp_driver = {
        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
        .agp_destroy_pages      = agp_generic_destroy_pages,
-        .chipset_flush          = intel_fake_agp_chipset_flush,
 };
 static const struct intel_gtt_driver i81x_gtt_driver = {
        .gen = 1,
+        .has_pgtbl_enable = 1,
        .dma_mask_size = 32,
+        .setup = i810_setup,
+        .cleanup = i810_cleanup,
+        .check_flags = i830_check_flags,
+        .write_entry = i810_write_entry,
 };
 static const struct intel_gtt_driver i8xx_gtt_driver = {
        .gen = 2,
+        .has_pgtbl_enable = 1,
        .setup = i830_setup,
        .cleanup = i830_cleanup,
        .write_entry = i830_write_entry,
@@ -1337,10 +1265,11 @@ static const struct intel_gtt_driver i8xx_gtt_driver = {
 };
 static const struct intel_gtt_driver i915_gtt_driver = {
        .gen = 3,
+        .has_pgtbl_enable = 1,
        .setup = i9xx_setup,
        .cleanup = i9xx_cleanup,
        /* i945 is the last gpu to need phys mem (for overlay and cursors). */
-        .write_entry = i830_write_entry, 
+        .write_entry = i830_write_entry,
        .dma_mask_size = 32,
        .check_flags = i830_check_flags,
        .chipset_flush = i9xx_chipset_flush,
@@ -1367,6 +1296,7 @@ static const struct intel_gtt_driver pineview_gtt_driver = {
 };
 static const struct intel_gtt_driver i965_gtt_driver = {
        .gen = 4,
+        .has_pgtbl_enable = 1,
        .setup = i9xx_setup,
        .cleanup = i9xx_cleanup,
        .write_entry = i965_write_entry,
@@ -1410,93 +1340,92 @@ static const struct intel_gtt_driver sandybridge_gtt_driver = {
 static const struct intel_gtt_driver_description {
        unsigned int gmch_chip_id;
        char *name;
-        const struct agp_bridge_driver *gmch_driver;
        const struct intel_gtt_driver *gtt_driver;
 } intel_gtt_chipsets[] = {
-        { PCI_DEVICE_ID_INTEL_82810_IG1, "i810", &intel_810_driver,
+        { PCI_DEVICE_ID_INTEL_82810_IG1, "i810",
                &i81x_gtt_driver},
-        { PCI_DEVICE_ID_INTEL_82810_IG3, "i810", &intel_810_driver,
+        { PCI_DEVICE_ID_INTEL_82810_IG3, "i810",
                &i81x_gtt_driver},
-        { PCI_DEVICE_ID_INTEL_82810E_IG, "i810", &intel_810_driver,
+        { PCI_DEVICE_ID_INTEL_82810E_IG, "i810",
                &i81x_gtt_driver},
-        { PCI_DEVICE_ID_INTEL_82815_CGC, "i815", &intel_810_driver,
+        { PCI_DEVICE_ID_INTEL_82815_CGC, "i815",
                &i81x_gtt_driver},
        { PCI_DEVICE_ID_INTEL_82830_CGC, "830M",
-                &intel_fake_agp_driver, &i8xx_gtt_driver},
+                &i8xx_gtt_driver},
        { PCI_DEVICE_ID_INTEL_82845G_IG, "830M",
-                &intel_fake_agp_driver, &i8xx_gtt_driver},
+                &i8xx_gtt_driver},
        { PCI_DEVICE_ID_INTEL_82854_IG, "854",
-                &intel_fake_agp_driver, &i8xx_gtt_driver},
+                &i8xx_gtt_driver},
        { PCI_DEVICE_ID_INTEL_82855GM_IG, "855GM",
-                &intel_fake_agp_driver, &i8xx_gtt_driver},
+                &i8xx_gtt_driver},
        { PCI_DEVICE_ID_INTEL_82865_IG, "865",
-                &intel_fake_agp_driver, &i8xx_gtt_driver},
+                &i8xx_gtt_driver},
        { PCI_DEVICE_ID_INTEL_E7221_IG, "E7221 (i915)",
-                &intel_fake_agp_driver, &i915_gtt_driver },
+                &i915_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82915G_IG, "915G",
-                &intel_fake_agp_driver, &i915_gtt_driver },
+                &i915_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82915GM_IG, "915GM",
-                &intel_fake_agp_driver, &i915_gtt_driver },
+                &i915_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82945G_IG, "945G",
-                &intel_fake_agp_driver, &i915_gtt_driver },
+                &i915_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82945GM_IG, "945GM",
-                &intel_fake_agp_driver, &i915_gtt_driver },
+                &i915_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82945GME_IG, "945GME",
-                &intel_fake_agp_driver, &i915_gtt_driver },
+                &i915_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82946GZ_IG, "946GZ",
-                &intel_fake_agp_driver, &i965_gtt_driver },
+                &i965_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82G35_IG, "G35",
-                &intel_fake_agp_driver, &i965_gtt_driver },
+                &i965_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82965Q_IG, "965Q",
-                &intel_fake_agp_driver, &i965_gtt_driver },
+                &i965_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82965G_IG, "965G",
-                &intel_fake_agp_driver, &i965_gtt_driver },
+                &i965_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82965GM_IG, "965GM",
-                &intel_fake_agp_driver, &i965_gtt_driver },
+                &i965_gtt_driver },
        { PCI_DEVICE_ID_INTEL_82965GME_IG, "965GME/GLE",
-                &intel_fake_agp_driver, &i965_gtt_driver },
+                &i965_gtt_driver },
        { PCI_DEVICE_ID_INTEL_G33_IG, "G33",
-                &intel_fake_agp_driver, &g33_gtt_driver },
+                &g33_gtt_driver },
        { PCI_DEVICE_ID_INTEL_Q35_IG, "Q35",
-                &intel_fake_agp_driver, &g33_gtt_driver },
+                &g33_gtt_driver },
        { PCI_DEVICE_ID_INTEL_Q33_IG, "Q33",
-                &intel_fake_agp_driver, &g33_gtt_driver },
+                &g33_gtt_driver },
        { PCI_DEVICE_ID_INTEL_PINEVIEW_M_IG, "GMA3150",
-                &intel_fake_agp_driver, &pineview_gtt_driver },
+                &pineview_gtt_driver },
        { PCI_DEVICE_ID_INTEL_PINEVIEW_IG, "GMA3150",
-                &intel_fake_agp_driver, &pineview_gtt_driver },
+                &pineview_gtt_driver },
        { PCI_DEVICE_ID_INTEL_GM45_IG, "GM45",
-                &intel_fake_agp_driver, &g4x_gtt_driver },
+                &g4x_gtt_driver },
        { PCI_DEVICE_ID_INTEL_EAGLELAKE_IG, "Eaglelake",
-                &intel_fake_agp_driver, &g4x_gtt_driver },
+                &g4x_gtt_driver },
        { PCI_DEVICE_ID_INTEL_Q45_IG, "Q45/Q43",
-                &intel_fake_agp_driver, &g4x_gtt_driver },
+                &g4x_gtt_driver },
        { PCI_DEVICE_ID_INTEL_G45_IG, "G45/G43",
-                &intel_fake_agp_driver, &g4x_gtt_driver },
+                &g4x_gtt_driver },
        { PCI_DEVICE_ID_INTEL_B43_IG, "B43",
-                &intel_fake_agp_driver, &g4x_gtt_driver },
+                &g4x_gtt_driver },
        { PCI_DEVICE_ID_INTEL_B43_1_IG, "B43",
-                &intel_fake_agp_driver, &g4x_gtt_driver },
+                &g4x_gtt_driver },
        { PCI_DEVICE_ID_INTEL_G41_IG, "G41",
-                &intel_fake_agp_driver, &g4x_gtt_driver },
+                &g4x_gtt_driver },
        { PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
-            "HD Graphics", &intel_fake_agp_driver, &ironlake_gtt_driver },
+            "HD Graphics", &ironlake_gtt_driver },
        { PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG,
-            "HD Graphics", &intel_fake_agp_driver, &ironlake_gtt_driver },
+            "HD Graphics", &ironlake_gtt_driver },
        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT1_IG,
-            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+            "Sandybridge", &sandybridge_gtt_driver },
        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_IG,
-            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+            "Sandybridge", &sandybridge_gtt_driver },
        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_GT2_PLUS_IG,
-            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+            "Sandybridge", &sandybridge_gtt_driver },
        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT1_IG,
-            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+            "Sandybridge", &sandybridge_gtt_driver },
        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_IG,
-            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+            "Sandybridge", &sandybridge_gtt_driver },
        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_GT2_PLUS_IG,
-            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+            "Sandybridge", &sandybridge_gtt_driver },
        { PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_IG,
-            "Sandybridge", &intel_fake_agp_driver, &sandybridge_gtt_driver },
+            "Sandybridge", &sandybridge_gtt_driver },
        { 0, NULL, NULL }
 };
@@ -1521,21 +1450,20 @@ int intel_gmch_probe(struct pci_dev *pdev,
                                      struct agp_bridge_data *bridge)
 {
        int i, mask;
-        bridge->driver = NULL;
+        intel_private.driver = NULL;
        for (i = 0; intel_gtt_chipsets[i].name != NULL; i++) {
                if (find_gmch(intel_gtt_chipsets[i].gmch_chip_id)) {
-                        bridge->driver =
+                        intel_private.driver =
-                                intel_gtt_chipsets[i].gmch_driver;
-                        intel_private.driver = 
                                intel_gtt_chipsets[i].gtt_driver;
                        break;
                }
        }
-        if (!bridge->driver)
+        if (!intel_private.driver)
                return 0;
+        bridge->driver = &intel_fake_agp_driver;
        bridge->dev_private_data = &intel_private;
        bridge->dev = pdev;
@@ -1551,8 +1479,8 @@ int intel_gmch_probe(struct pci_dev *pdev,
                pci_set_consistent_dma_mask(intel_private.pcidev,
                                            DMA_BIT_MASK(mask));
-        if (bridge->driver == &intel_810_driver)
+        /*if (bridge->driver == &intel_810_driver)
-                return 1;
+                return 1;*/
        if (intel_gtt_init() != 0)
                return 0;
@@ -1561,12 +1489,19 @@ int intel_gmch_probe(struct pci_dev *pdev,
 }
 EXPORT_SYMBOL(intel_gmch_probe);
-struct intel_gtt *intel_gtt_get(void)
+const struct intel_gtt *intel_gtt_get(void)
 {
        return &intel_private.base;
 }
 EXPORT_SYMBOL(intel_gtt_get);
+void intel_gtt_chipset_flush(void)
+{
+        if (intel_private.driver->chipset_flush)
+                intel_private.driver->chipset_flush();
+}
+EXPORT_SYMBOL(intel_gtt_chipset_flush);
 void intel_gmch_remove(struct pci_dev *pdev)
 {
        if (intel_private.pcidev)
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 1030f8420137..c17a305ecb28 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/wait.h>
+#include <linux/acpi.h>
 #include "tpm.h"
 #define TPM_HEADER_SIZE 10
@@ -78,6 +79,26 @@ enum tis_defaults {
 static LIST_HEAD(tis_chips);
 static DEFINE_SPINLOCK(tis_lock);
+#ifdef CONFIG_ACPI
+static int is_itpm(struct pnp_dev *dev)
+{
+        struct acpi_device *acpi = pnp_acpi_device(dev);
+        struct acpi_hardware_id *id;
+        list_for_each_entry(id, &acpi->pnp.ids, list) {
+                if (!strcmp("INTC0102", id->id))
+                        return 1;
+        }
+        return 0;
+}
+#else
+static int is_itpm(struct pnp_dev *dev)
+{
+        return 0;
+}
+#endif
 static int check_locality(struct tpm_chip *chip, int l)
 {
        if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
@@ -472,6 +493,9 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
                 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
                 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+        if (is_itpm(to_pnp_dev(dev)))
+                itpm = 1;
        if (itpm)
                dev_info(dev, "Intel iTPM workaround enabled\n");
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 6c1b676643a9..896a2ced1d27 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1547,31 +1547,16 @@ static int init_vqs(struct ports_device *portdev)
        nr_queues = use_multiport(portdev) ? (nr_ports + 1) * 2 : 2;
        vqs = kmalloc(nr_queues * sizeof(struct virtqueue *), GFP_KERNEL);
-        if (!vqs) {
-                err = -ENOMEM;
-                goto fail;
-        }
        io_callbacks = kmalloc(nr_queues * sizeof(vq_callback_t *), GFP_KERNEL);
-        if (!io_callbacks) {
-                err = -ENOMEM;
-                goto free_vqs;
-        }
        io_names = kmalloc(nr_queues * sizeof(char *), GFP_KERNEL);
-        if (!io_names) {
-                err = -ENOMEM;
-                goto free_callbacks;
-        }
        portdev->in_vqs = kmalloc(nr_ports * sizeof(struct virtqueue *),
                                  GFP_KERNEL);
-        if (!portdev->in_vqs) {
-                err = -ENOMEM;
-                goto free_names;
-        }
        portdev->out_vqs = kmalloc(nr_ports * sizeof(struct virtqueue *),
                                   GFP_KERNEL);
-        if (!portdev->out_vqs) {
+        if (!vqs || !io_callbacks || !io_names || !portdev->in_vqs ||
+                        !portdev->out_vqs) {
                err = -ENOMEM;
-                goto free_invqs;
+                goto free;
        }
        /*
@@ -1605,7 +1590,7 @@ static int init_vqs(struct ports_device *portdev)
                                              io_callbacks,
                                              (const char **)io_names);
        if (err)
-                goto free_outvqs;
+                goto free;
        j = 0;
        portdev->in_vqs[0] = vqs[0];
@@ -1621,23 +1606,19 @@ static int init_vqs(struct ports_device *portdev)
                        portdev->out_vqs[i] = vqs[j + 1];
                }
        }
-        kfree(io_callbacks);
        kfree(io_names);
+        kfree(io_callbacks);
        kfree(vqs);
        return 0;
-free_names:
+free:
-        kfree(io_names);
-free_callbacks:
-        kfree(io_callbacks);
-free_outvqs:
        kfree(portdev->out_vqs);
-free_invqs:
        kfree(portdev->in_vqs);
-free_vqs:
+        kfree(io_names);
+        kfree(io_callbacks);
        kfree(vqs);
-fail:
        return err;
 }
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index eb6b54dbb806..85ffd5e38c50 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -1213,3 +1213,4 @@ module_exit(sh_dmae_exit);
 MODULE_AUTHOR("Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>");
 MODULE_DESCRIPTION("Renesas SH DMA Engine driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:sh-dma-engine");
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index b3781399b38a..ba2898b3639b 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -10,16 +10,16 @@ obj-$(CONFIG_EDAC)			:= edac_stub.o
 obj-$(CONFIG_EDAC_MM_EDAC)              += edac_core.o
 obj-$(CONFIG_EDAC_MCE)                  += edac_mce.o
-edac_core-objs  := edac_mc.o edac_device.o edac_mc_sysfs.o edac_pci_sysfs.o
+edac_core-y     := edac_mc.o edac_device.o edac_mc_sysfs.o edac_pci_sysfs.o
-edac_core-objs  += edac_module.o edac_device_sysfs.o
+edac_core-y     += edac_module.o edac_device_sysfs.o
 ifdef CONFIG_PCI
-edac_core-objs  += edac_pci.o edac_pci_sysfs.o
+edac_core-y     += edac_pci.o edac_pci_sysfs.o
 endif
 obj-$(CONFIG_EDAC_MCE_INJ)              += mce_amd_inj.o
-edac_mce_amd-objs                       := mce_amd.o
+edac_mce_amd-y                          := mce_amd.o
 obj-$(CONFIG_EDAC_DECODE_MCE)           += edac_mce_amd.o
 obj-$(CONFIG_EDAC_AMD76X)               += amd76x_edac.o
diff --git a/drivers/edac/mce_amd_inj.c b/drivers/edac/mce_amd_inj.c
index 8d0688f36d4c..39faded3cadd 100644
--- a/drivers/edac/mce_amd_inj.c
+++ b/drivers/edac/mce_amd_inj.c
@@ -139,7 +139,7 @@ static int __init edac_init_mce_inject(void)
        return 0;
 err_sysfs_create:
-        while (i-- >= 0)
+        while (--i >= 0)
                sysfs_remove_file(mce_kobj, &sysfs_attrs[i]->attr);
        kobject_del(mce_kobj);
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 18fdd9703b48..1a467a91fb0b 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -7,6 +7,7 @@
 */
 #include <linux/bug.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/firewire.h>
 #include <linux/firewire-constants.h>
@@ -26,8 +27,14 @@
 #include <asm/unaligned.h>
 #include <net/arp.h>
-#define FWNET_MAX_FRAGMENTS     25      /* arbitrary limit */
+/* rx limits */
-#define FWNET_ISO_PAGE_COUNT    (PAGE_SIZE < 16 * 1024 ? 4 : 2)
+#define FWNET_MAX_FRAGMENTS             30 /* arbitrary, > TX queue depth */
+#define FWNET_ISO_PAGE_COUNT            (PAGE_SIZE < 16*1024 ? 4 : 2)
+/* tx limits */
+#define FWNET_MAX_QUEUED_DATAGRAMS      20 /* < 64 = number of tlabels */
+#define FWNET_MIN_QUEUED_DATAGRAMS      10 /* should keep AT DMA busy enough */
+#define FWNET_TX_QUEUE_LEN              FWNET_MAX_QUEUED_DATAGRAMS /* ? */
 #define IEEE1394_BROADCAST_CHANNEL      31
 #define IEEE1394_ALL_NODES              (0xffc0 | 0x003f)
@@ -169,15 +176,8 @@ struct fwnet_device {
        struct fw_address_handler handler;
        u64 local_fifo;
-        /* List of packets to be sent */
+        /* Number of tx datagrams that have been queued but not yet acked */
-        struct list_head packet_list;
+        int queued_datagrams;
-        /*
-         * List of packets that were broadcasted.  When we get an ISO interrupt
-         * one of them has been sent
-         */
-        struct list_head broadcasted_list;
-        /* List of packets that have been sent but not yet acked */
-        struct list_head sent_list;
        struct list_head peer_list;
        struct fw_card *card;
@@ -195,7 +195,7 @@ struct fwnet_peer {
        unsigned pdg_size;        /* pd_list size */
        u16 datagram_label;       /* outgoing datagram label */
-        unsigned max_payload;     /* includes RFC2374_FRAG_HDR_SIZE overhead */
+        u16 max_payload;          /* includes RFC2374_FRAG_HDR_SIZE overhead */
        int node_id;
        int generation;
        unsigned speed;
@@ -203,22 +203,18 @@ struct fwnet_peer {
 /* This is our task struct. It's used for the packet complete callback.  */
 struct fwnet_packet_task {
-        /*
-         * ptask can actually be on dev->packet_list, dev->broadcasted_list,
-         * or dev->sent_list depending on its current state.
-         */
-        struct list_head pt_link;
        struct fw_transaction transaction;
        struct rfc2734_header hdr;
        struct sk_buff *skb;
        struct fwnet_device *dev;
        int outstanding_pkts;
-        unsigned max_payload;
        u64 fifo_addr;
        u16 dest_node;
+        u16 max_payload;
        u8 generation;
        u8 speed;
+        u8 enqueued;
 };
 /*
@@ -650,8 +646,6 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
                net->stats.rx_packets++;
                net->stats.rx_bytes += skb->len;
        }
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
        return 0;
@@ -660,8 +654,6 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
        net->stats.rx_dropped++;
        dev_kfree_skb_any(skb);
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
        return -ENOENT;
 }
@@ -793,15 +785,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
         * Datagram is not complete, we're done for the
         * moment.
         */
-        spin_unlock_irqrestore(&dev->lock, flags);
+        retval = 0;
-        return 0;
 fail:
        spin_unlock_irqrestore(&dev->lock, flags);
-        if (netif_queue_stopped(net))
-                netif_wake_queue(net);
        return retval;
 }
@@ -901,11 +888,19 @@ static void fwnet_free_ptask(struct fwnet_packet_task *ptask)
        kmem_cache_free(fwnet_packet_task_cache, ptask);
 }
+/* Caller must hold dev->lock. */
+static void dec_queued_datagrams(struct fwnet_device *dev)
+{
+        if (--dev->queued_datagrams == FWNET_MIN_QUEUED_DATAGRAMS)
+                netif_wake_queue(dev->netdev);
+}
 static int fwnet_send_packet(struct fwnet_packet_task *ptask);
 static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
 {
        struct fwnet_device *dev = ptask->dev;
+        struct sk_buff *skb = ptask->skb;
        unsigned long flags;
        bool free;
@@ -914,10 +909,14 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
        ptask->outstanding_pkts--;
        /* Check whether we or the networking TX soft-IRQ is last user. */
-        free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));
+        free = (ptask->outstanding_pkts == 0 && ptask->enqueued);
+        if (free)
+                dec_queued_datagrams(dev);
-        if (ptask->outstanding_pkts == 0)
+        if (ptask->outstanding_pkts == 0) {
-                list_del(&ptask->pt_link);
+                dev->netdev->stats.tx_packets++;
+                dev->netdev->stats.tx_bytes += skb->len;
+        }
        spin_unlock_irqrestore(&dev->lock, flags);
@@ -926,7 +925,6 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                u16 fg_off;
                u16 datagram_label;
                u16 lf;
-                struct sk_buff *skb;
                /* Update the ptask to point to the next fragment and send it */
                lf = fwnet_get_hdr_lf(&ptask->hdr);
@@ -953,7 +951,7 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                        datagram_label = fwnet_get_hdr_dgl(&ptask->hdr);
                        break;
                }
-                skb = ptask->skb;
                skb_pull(skb, ptask->max_payload);
                if (ptask->outstanding_pkts > 1) {
                        fwnet_make_sf_hdr(&ptask->hdr, RFC2374_HDR_INTFRAG,
@@ -970,6 +968,31 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                fwnet_free_ptask(ptask);
 }
+static void fwnet_transmit_packet_failed(struct fwnet_packet_task *ptask)
+{
+        struct fwnet_device *dev = ptask->dev;
+        unsigned long flags;
+        bool free;
+        spin_lock_irqsave(&dev->lock, flags);
+        /* One fragment failed; don't try to send remaining fragments. */
+        ptask->outstanding_pkts = 0;
+        /* Check whether we or the networking TX soft-IRQ is last user. */
+        free = ptask->enqueued;
+        if (free)
+                dec_queued_datagrams(dev);
+        dev->netdev->stats.tx_dropped++;
+        dev->netdev->stats.tx_errors++;
+        spin_unlock_irqrestore(&dev->lock, flags);
+        if (free)
+                fwnet_free_ptask(ptask);
+}
 static void fwnet_write_complete(struct fw_card *card, int rcode,
                                 void *payload, size_t length, void *data)
 {
@@ -977,11 +1000,12 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
        ptask = data;
-        if (rcode == RCODE_COMPLETE)
+        if (rcode == RCODE_COMPLETE) {
                fwnet_transmit_packet_done(ptask);
-        else
+        } else {
                fw_error("fwnet_write_complete: failed: %x\n", rcode);
-                /* ??? error recovery */
+                fwnet_transmit_packet_failed(ptask);
+        }
 }
 static int fwnet_send_packet(struct fwnet_packet_task *ptask)
@@ -1039,9 +1063,11 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
                spin_lock_irqsave(&dev->lock, flags);
                /* If the AT tasklet already ran, we may be last user. */
-                free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+                free = (ptask->outstanding_pkts == 0 && !ptask->enqueued);
                if (!free)
-                        list_add_tail(&ptask->pt_link, &dev->broadcasted_list);
+                        ptask->enqueued = true;
+                else
+                        dec_queued_datagrams(dev);
                spin_unlock_irqrestore(&dev->lock, flags);
@@ -1056,9 +1082,11 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
        spin_lock_irqsave(&dev->lock, flags);
        /* If the AT tasklet already ran, we may be last user. */
-        free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+        free = (ptask->outstanding_pkts == 0 && !ptask->enqueued);
        if (!free)
-                list_add_tail(&ptask->pt_link, &dev->sent_list);
+                ptask->enqueued = true;
+        else
+                dec_queued_datagrams(dev);
        spin_unlock_irqrestore(&dev->lock, flags);
@@ -1224,6 +1252,15 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
        struct fwnet_peer *peer;
        unsigned long flags;
+        spin_lock_irqsave(&dev->lock, flags);
+        /* Can this happen? */
+        if (netif_queue_stopped(dev->netdev)) {
+                spin_unlock_irqrestore(&dev->lock, flags);
+                return NETDEV_TX_BUSY;
+        }
        ptask = kmem_cache_alloc(fwnet_packet_task_cache, GFP_ATOMIC);
        if (ptask == NULL)
                goto fail;
@@ -1242,9 +1279,6 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
        proto = hdr_buf.h_proto;
        dg_size = skb->len;
-        /* serialize access to peer, including peer->datagram_label */
-        spin_lock_irqsave(&dev->lock, flags);
        /*
         * Set the transmission type for the packet.  ARP packets and IP
         * broadcast packets are sent via GASP.
@@ -1266,7 +1300,7 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
                peer = fwnet_peer_find_by_guid(dev, be64_to_cpu(guid));
                if (!peer || peer->fifo == FWNET_NO_FIFO_ADDR)
-                        goto fail_unlock;
+                        goto fail;
                generation         = peer->generation;
                dest_node          = peer->node_id;
@@ -1320,18 +1354,21 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
                max_payload += RFC2374_FRAG_HDR_SIZE;
        }
+        if (++dev->queued_datagrams == FWNET_MAX_QUEUED_DATAGRAMS)
+                netif_stop_queue(dev->netdev);
        spin_unlock_irqrestore(&dev->lock, flags);
        ptask->max_payload = max_payload;
-        INIT_LIST_HEAD(&ptask->pt_link);
+        ptask->enqueued    = 0;
        fwnet_send_packet(ptask);
        return NETDEV_TX_OK;
- fail_unlock:
-        spin_unlock_irqrestore(&dev->lock, flags);
 fail:
+        spin_unlock_irqrestore(&dev->lock, flags);
        if (ptask)
                kmem_cache_free(fwnet_packet_task_cache, ptask);
@@ -1377,7 +1414,7 @@ static void fwnet_init_dev(struct net_device *net)
        net->addr_len           = FWNET_ALEN;
        net->hard_header_len    = FWNET_HLEN;
        net->type               = ARPHRD_IEEE1394;
-        net->tx_queue_len       = 10;
+        net->tx_queue_len       = FWNET_TX_QUEUE_LEN;
 }
 /* caller must hold fwnet_device_mutex */
@@ -1457,14 +1494,9 @@ static int fwnet_probe(struct device *_dev)
        dev->broadcast_rcv_context = NULL;
        dev->broadcast_xmt_max_payload = 0;
        dev->broadcast_xmt_datagramlabel = 0;
        dev->local_fifo = FWNET_NO_FIFO_ADDR;
+        dev->queued_datagrams = 0;
-        INIT_LIST_HEAD(&dev->packet_list);
-        INIT_LIST_HEAD(&dev->broadcasted_list);
-        INIT_LIST_HEAD(&dev->sent_list);
        INIT_LIST_HEAD(&dev->peer_list);
        dev->card = card;
        dev->netdev = net;
@@ -1522,7 +1554,7 @@ static int fwnet_remove(struct device *_dev)
        struct fwnet_peer *peer = dev_get_drvdata(_dev);
        struct fwnet_device *dev = peer->dev;
        struct net_device *net;
-        struct fwnet_packet_task *ptask, *pt_next;
+        int i;
        mutex_lock(&fwnet_device_mutex);
@@ -1540,21 +1572,9 @@ static int fwnet_remove(struct device *_dev)
                                              dev->card);
                        fw_iso_context_destroy(dev->broadcast_rcv_context);
                }
-                list_for_each_entry_safe(ptask, pt_next,
+                for (i = 0; dev->queued_datagrams && i < 5; i++)
-                                         &dev->packet_list, pt_link) {
+                        ssleep(1);
-                        dev_kfree_skb_any(ptask->skb);
+                WARN_ON(dev->queued_datagrams);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->broadcasted_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
-                list_for_each_entry_safe(ptask, pt_next,
-                                         &dev->sent_list, pt_link) {
-                        dev_kfree_skb_any(ptask->skb);
-                        kmem_cache_free(fwnet_packet_task_cache, ptask);
-                }
                list_del(&dev->dev_link);
                free_netdev(net);
diff --git a/drivers/gpio/cs5535-gpio.c b/drivers/gpio/cs5535-gpio.c
index e23c06893d19..599f6c9e0fbf 100644
--- a/drivers/gpio/cs5535-gpio.c
+++ b/drivers/gpio/cs5535-gpio.c
@@ -56,6 +56,18 @@ static struct cs5535_gpio_chip {
 * registers, see include/linux/cs5535.h.
 */
+static void errata_outl(u32 val, unsigned long addr)
+{
+        /*
+         * According to the CS5536 errata (#36), after suspend
+         * a write to the high bank GPIO register will clear all
+         * non-selected bits; the recommended workaround is a
+         * read-modify-write operation.
+         */
+        val |= inl(addr);
+        outl(val, addr);
+}
 static void __cs5535_gpio_set(struct cs5535_gpio_chip *chip, unsigned offset,
                unsigned int reg)
 {
@@ -64,7 +76,7 @@ static void __cs5535_gpio_set(struct cs5535_gpio_chip *chip, unsigned offset,
                outl(1 << offset, chip->base + reg);
        else
                /* high bank register */
-                outl(1 << (offset - 16), chip->base + 0x80 + reg);
+                errata_outl(1 << (offset - 16), chip->base + 0x80 + reg);
 }
 void cs5535_gpio_set(unsigned offset, unsigned int reg)
@@ -86,7 +98,7 @@ static void __cs5535_gpio_clear(struct cs5535_gpio_chip *chip, unsigned offset,
                outl(1 << (offset + 16), chip->base + reg);
        else
                /* high bank register */
-                outl(1 << offset, chip->base + 0x80 + reg);
+                errata_outl(1 << offset, chip->base + 0x80 + reg);
 }
 void cs5535_gpio_clear(unsigned offset, unsigned int reg)
diff --git a/drivers/gpu/drm/drm_agpsupport.c b/drivers/gpu/drm/drm_agpsupport.c
index 252fdb98b73a..0cb2ba50af53 100644
--- a/drivers/gpu/drm/drm_agpsupport.c
+++ b/drivers/gpu/drm/drm_agpsupport.c
@@ -466,10 +466,4 @@ drm_agp_bind_pages(struct drm_device *dev,
 }
 EXPORT_SYMBOL(drm_agp_bind_pages);
-void drm_agp_chipset_flush(struct drm_device *dev)
-{
-        agp_flush_chipset(dev->agp->bridge);
-}
-EXPORT_SYMBOL(drm_agp_chipset_flush);
 #endif /* __OS_HAS_AGP */
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 4c200931a6bc..c6b2e27a446a 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -241,7 +241,7 @@ void drm_helper_disable_unused_functions(struct drm_device *dev)
        }
        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
-                if (!drm_helper_encoder_in_use(encoder)) {
+                if (encoder->crtc && !drm_helper_encoder_in_use(encoder)) {
                        drm_encoder_disable(encoder);
                        /* disconnector encoder from any connector */
                        encoder->crtc = NULL;
@@ -482,6 +482,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
        int count = 0, ro, fail = 0;
        struct drm_crtc_helper_funcs *crtc_funcs;
        int ret = 0;
+        int i;
        DRM_DEBUG_KMS("\n");
@@ -677,6 +678,12 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                if (ret != 0)
                        goto fail;
        }
+        DRM_DEBUG_KMS("Setting connector DPMS state to on\n");
+        for (i = 0; i < set->num_connectors; i++) {
+                DRM_DEBUG_KMS("\t[CONNECTOR:%d:%s] set DPMS on\n", set->connectors[i]->base.id,
+                              drm_get_connector_name(set->connectors[i]));
+                set->connectors[i]->dpms = DRM_MODE_DPMS_ON;
+        }
        kfree(save_connectors);
        kfree(save_encoders);
@@ -852,7 +859,7 @@ static void output_poll_execute(struct work_struct *work)
        struct delayed_work *delayed_work = to_delayed_work(work);
        struct drm_device *dev = container_of(delayed_work, struct drm_device, mode_config.output_poll_work);
        struct drm_connector *connector;
-        enum drm_connector_status old_status, status;
+        enum drm_connector_status old_status;
        bool repoll = false, changed = false;
        if (!drm_kms_helper_poll)
@@ -877,8 +884,9 @@ static void output_poll_execute(struct work_struct *work)
                    !(connector->polled & DRM_CONNECTOR_POLL_HPD))
                        continue;
-                status = connector->funcs->detect(connector, false);
+                connector->status = connector->funcs->detect(connector, false);
-                if (old_status != status)
+                DRM_DEBUG_KMS("connector status updated to %d\n", connector->status);
+                if (old_status != connector->status)
                        changed = true;
        }
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 55160d7c38b6..8304c42195fc 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -1047,10 +1047,13 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe,
        struct timeval now;
        unsigned long flags;
        unsigned int seq;
+        int ret;
        e = kzalloc(sizeof *e, GFP_KERNEL);
-        if (e == NULL)
+        if (e == NULL) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_put;
+        }
        e->pipe = pipe;
        e->base.pid = current->pid;
@@ -1064,9 +1067,8 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe,
        spin_lock_irqsave(&dev->event_lock, flags);
        if (file_priv->event_space < sizeof e->event) {
-                spin_unlock_irqrestore(&dev->event_lock, flags);
+                ret = -EBUSY;
-                kfree(e);
+                goto err_unlock;
-                return -ENOMEM;
        }
        file_priv->event_space -= sizeof e->event;
@@ -1103,6 +1105,13 @@ static int drm_queue_vblank_event(struct drm_device *dev, int pipe,
        spin_unlock_irqrestore(&dev->event_lock, flags);
        return 0;
+err_unlock:
+        spin_unlock_irqrestore(&dev->event_lock, flags);
+        kfree(e);
+err_put:
+        drm_vblank_put(dev, e->pipe);
+        return ret;
 }
 /**
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index a6bfc302ed90..c59515ba7e69 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -392,10 +392,36 @@ void drm_mm_init_scan(struct drm_mm *mm, unsigned long size,
        mm->scanned_blocks = 0;
        mm->scan_hit_start = 0;
        mm->scan_hit_size = 0;
+        mm->scan_check_range = 0;
 }
 EXPORT_SYMBOL(drm_mm_init_scan);
 /**
+ * Initializa lru scanning.
+ *
+ * This simply sets up the scanning routines with the parameters for the desired
+ * hole. This version is for range-restricted scans.
+ *
+ * Warning: As long as the scan list is non-empty, no other operations than
+ * adding/removing nodes to/from the scan list are allowed.
+ */
+void drm_mm_init_scan_with_range(struct drm_mm *mm, unsigned long size,
+                                 unsigned alignment,
+                                 unsigned long start,
+                                 unsigned long end)
+{
+        mm->scan_alignment = alignment;
+        mm->scan_size = size;
+        mm->scanned_blocks = 0;
+        mm->scan_hit_start = 0;
+        mm->scan_hit_size = 0;
+        mm->scan_start = start;
+        mm->scan_end = end;
+        mm->scan_check_range = 1;
+}
+EXPORT_SYMBOL(drm_mm_init_scan_with_range);
+/**
 * Add a node to the scan list that might be freed to make space for the desired
 * hole.
 *
@@ -406,6 +432,8 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
        struct drm_mm *mm = node->mm;
        struct list_head *prev_free, *next_free;
        struct drm_mm_node *prev_node, *next_node;
+        unsigned long adj_start;
+        unsigned long adj_end;
        mm->scanned_blocks++;
@@ -452,7 +480,17 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
        node->free_stack.prev = prev_free;
        node->free_stack.next = next_free;
-        if (check_free_hole(node->start, node->start + node->size,
+        if (mm->scan_check_range) {
+                adj_start = node->start < mm->scan_start ?
+                        mm->scan_start : node->start;
+                adj_end = node->start + node->size > mm->scan_end ?
+                        mm->scan_end : node->start + node->size;
+        } else {
+                adj_start = node->start;
+                adj_end = node->start + node->size;
+        }
+        if (check_free_hole(adj_start , adj_end,
                            mm->scan_size, mm->scan_alignment)) {
                mm->scan_hit_start = node->start;
                mm->scan_hit_size = node->size;
diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
index fdc833d5cc7b..0ae6a7c5020f 100644
--- a/drivers/gpu/drm/i915/Makefile
+++ b/drivers/gpu/drm/i915/Makefile
@@ -9,6 +9,8 @@ i915-y := i915_drv.o i915_dma.o i915_irq.o i915_mem.o \
          i915_gem.o \
          i915_gem_debug.o \
          i915_gem_evict.o \
+          i915_gem_execbuffer.o \
+          i915_gem_gtt.o \
          i915_gem_tiling.o \
          i915_trace_points.o \
          intel_display.o \
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 1f4f3ceb63c7..92f75782c332 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -32,6 +32,7 @@
 #include "drmP.h"
 #include "drm.h"
 #include "intel_drv.h"
+#include "intel_ringbuffer.h"
 #include "i915_drm.h"
 #include "i915_drv.h"
@@ -72,7 +73,6 @@ static int i915_capabilities(struct seq_file *m, void *data)
        B(is_broadwater);
        B(is_crestline);
        B(has_fbc);
-        B(has_rc6);
        B(has_pipe_cxsr);
        B(has_hotplug);
        B(cursor_needs_physical);
@@ -86,19 +86,19 @@ static int i915_capabilities(struct seq_file *m, void *data)
        return 0;
 }
-static const char *get_pin_flag(struct drm_i915_gem_object *obj_priv)
+static const char *get_pin_flag(struct drm_i915_gem_object *obj)
 {
-        if (obj_priv->user_pin_count > 0)
+        if (obj->user_pin_count > 0)
                return "P";
-        else if (obj_priv->pin_count > 0)
+        else if (obj->pin_count > 0)
                return "p";
        else
                return " ";
 }
-static const char *get_tiling_flag(struct drm_i915_gem_object *obj_priv)
+static const char *get_tiling_flag(struct drm_i915_gem_object *obj)
 {
-    switch (obj_priv->tiling_mode) {
+    switch (obj->tiling_mode) {
    default:
    case I915_TILING_NONE: return " ";
    case I915_TILING_X: return "X";
@@ -109,7 +109,7 @@ static const char *get_tiling_flag(struct drm_i915_gem_object *obj_priv)
 static void
 describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
 {
-        seq_printf(m, "%p: %s%s %8zd %08x %08x %d%s%s",
+        seq_printf(m, "%p: %s%s %8zd %04x %04x %d %d%s%s",
                   &obj->base,
                   get_pin_flag(obj),
                   get_tiling_flag(obj),
@@ -117,6 +117,7 @@ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
                   obj->base.read_domains,
                   obj->base.write_domain,
                   obj->last_rendering_seqno,
+                   obj->last_fenced_seqno,
                   obj->dirty ? " dirty" : "",
                   obj->madv == I915_MADV_DONTNEED ? " purgeable" : "");
        if (obj->base.name)
@@ -124,7 +125,17 @@ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
        if (obj->fence_reg != I915_FENCE_REG_NONE)
                seq_printf(m, " (fence: %d)", obj->fence_reg);
        if (obj->gtt_space != NULL)
-                seq_printf(m, " (gtt_offset: %08x)", obj->gtt_offset);
+                seq_printf(m, " (gtt offset: %08x, size: %08x)",
+                           obj->gtt_offset, (unsigned int)obj->gtt_space->size);
+        if (obj->pin_mappable || obj->fault_mappable) {
+                char s[3], *t = s;
+                if (obj->pin_mappable)
+                        *t++ = 'p';
+                if (obj->fault_mappable)
+                        *t++ = 'f';
+                *t = '\0';
+                seq_printf(m, " (%s mappable)", s);
+        }
        if (obj->ring != NULL)
                seq_printf(m, " (%s)", obj->ring->name);
 }
@@ -136,7 +147,7 @@ static int i915_gem_object_list_info(struct seq_file *m, void *data)
        struct list_head *head;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        size_t total_obj_size, total_gtt_size;
        int count, ret;
@@ -171,12 +182,12 @@ static int i915_gem_object_list_info(struct seq_file *m, void *data)
        }
        total_obj_size = total_gtt_size = count = 0;
-        list_for_each_entry(obj_priv, head, mm_list) {
+        list_for_each_entry(obj, head, mm_list) {
                seq_printf(m, "   ");
-                describe_obj(m, obj_priv);
+                describe_obj(m, obj);
                seq_printf(m, "\n");
-                total_obj_size += obj_priv->base.size;
+                total_obj_size += obj->base.size;
-                total_gtt_size += obj_priv->gtt_space->size;
+                total_gtt_size += obj->gtt_space->size;
                count++;
        }
        mutex_unlock(&dev->struct_mutex);
@@ -186,24 +197,79 @@ static int i915_gem_object_list_info(struct seq_file *m, void *data)
        return 0;
 }
+#define count_objects(list, member) do { \
+        list_for_each_entry(obj, list, member) { \
+                size += obj->gtt_space->size; \
+                ++count; \
+                if (obj->map_and_fenceable) { \
+                        mappable_size += obj->gtt_space->size; \
+                        ++mappable_count; \
+                } \
+        } \
+} while(0)
 static int i915_gem_object_info(struct seq_file *m, void* data)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 count, mappable_count;
+        size_t size, mappable_size;
+        struct drm_i915_gem_object *obj;
        int ret;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
        if (ret)
                return ret;
-        seq_printf(m, "%u objects\n", dev_priv->mm.object_count);
+        seq_printf(m, "%u objects, %zu bytes\n",
-        seq_printf(m, "%zu object bytes\n", dev_priv->mm.object_memory);
+                   dev_priv->mm.object_count,
-        seq_printf(m, "%u pinned\n", dev_priv->mm.pin_count);
+                   dev_priv->mm.object_memory);
-        seq_printf(m, "%zu pin bytes\n", dev_priv->mm.pin_memory);
-        seq_printf(m, "%u objects in gtt\n", dev_priv->mm.gtt_count);
+        size = count = mappable_size = mappable_count = 0;
-        seq_printf(m, "%zu gtt bytes\n", dev_priv->mm.gtt_memory);
+        count_objects(&dev_priv->mm.gtt_list, gtt_list);
-        seq_printf(m, "%zu gtt total\n", dev_priv->mm.gtt_total);
+        seq_printf(m, "%u [%u] objects, %zu [%zu] bytes in gtt\n",
+                   count, mappable_count, size, mappable_size);
+        size = count = mappable_size = mappable_count = 0;
+        count_objects(&dev_priv->mm.active_list, mm_list);
+        count_objects(&dev_priv->mm.flushing_list, mm_list);
+        seq_printf(m, "  %u [%u] active objects, %zu [%zu] bytes\n",
+                   count, mappable_count, size, mappable_size);
+        size = count = mappable_size = mappable_count = 0;
+        count_objects(&dev_priv->mm.pinned_list, mm_list);
+        seq_printf(m, "  %u [%u] pinned objects, %zu [%zu] bytes\n",
+                   count, mappable_count, size, mappable_size);
+        size = count = mappable_size = mappable_count = 0;
+        count_objects(&dev_priv->mm.inactive_list, mm_list);
+        seq_printf(m, "  %u [%u] inactive objects, %zu [%zu] bytes\n",
+                   count, mappable_count, size, mappable_size);
+        size = count = mappable_size = mappable_count = 0;
+        count_objects(&dev_priv->mm.deferred_free_list, mm_list);
+        seq_printf(m, "  %u [%u] freed objects, %zu [%zu] bytes\n",
+                   count, mappable_count, size, mappable_size);
+        size = count = mappable_size = mappable_count = 0;
+        list_for_each_entry(obj, &dev_priv->mm.gtt_list, gtt_list) {
+                if (obj->fault_mappable) {
+                        size += obj->gtt_space->size;
+                        ++count;
+                }
+                if (obj->pin_mappable) {
+                        mappable_size += obj->gtt_space->size;
+                        ++mappable_count;
+                }
+        }
+        seq_printf(m, "%u pinned mappable objects, %zu bytes\n",
+                   mappable_count, mappable_size);
+        seq_printf(m, "%u fault mappable objects, %zu bytes\n",
+                   count, size);
+        seq_printf(m, "%zu [%zu] gtt total\n",
+                   dev_priv->mm.gtt_total, dev_priv->mm.mappable_gtt_total);
        mutex_unlock(&dev->struct_mutex);
@@ -243,14 +309,14 @@ static int i915_gem_pageflip_info(struct seq_file *m, void *data)
                        seq_printf(m, "%d prepares\n", work->pending);
                        if (work->old_fb_obj) {
-                                struct drm_i915_gem_object *obj_priv = to_intel_bo(work->old_fb_obj);
+                                struct drm_i915_gem_object *obj = work->old_fb_obj;
-                                if(obj_priv)
+                                if (obj)
-                                        seq_printf(m, "Old framebuffer gtt_offset 0x%08x\n", obj_priv->gtt_offset );
+                                        seq_printf(m, "Old framebuffer gtt_offset 0x%08x\n", obj->gtt_offset);
                        }
                        if (work->pending_flip_obj) {
-                                struct drm_i915_gem_object *obj_priv = to_intel_bo(work->pending_flip_obj);
+                                struct drm_i915_gem_object *obj = work->pending_flip_obj;
-                                if(obj_priv)
+                                if (obj)
-                                        seq_printf(m, "New framebuffer gtt_offset 0x%08x\n", obj_priv->gtt_offset );
+                                        seq_printf(m, "New framebuffer gtt_offset 0x%08x\n", obj->gtt_offset);
                        }
                }
                spin_unlock_irqrestore(&dev->event_lock, flags);
@@ -265,44 +331,80 @@ static int i915_gem_request_info(struct seq_file *m, void *data)
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_gem_request *gem_request;
-        int ret;
+        int ret, count;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
        if (ret)
                return ret;
-        seq_printf(m, "Request:\n");
+        count = 0;
-        list_for_each_entry(gem_request, &dev_priv->render_ring.request_list,
+        if (!list_empty(&dev_priv->ring[RCS].request_list)) {
-                        list) {
+                seq_printf(m, "Render requests:\n");
-                seq_printf(m, "    %d @ %d\n",
+                list_for_each_entry(gem_request,
-                           gem_request->seqno,
+                                    &dev_priv->ring[RCS].request_list,
-                           (int) (jiffies - gem_request->emitted_jiffies));
+                                    list) {
+                        seq_printf(m, "    %d @ %d\n",
+                                   gem_request->seqno,
+                                   (int) (jiffies - gem_request->emitted_jiffies));
+                }
+                count++;
+        }
+        if (!list_empty(&dev_priv->ring[VCS].request_list)) {
+                seq_printf(m, "BSD requests:\n");
+                list_for_each_entry(gem_request,
+                                    &dev_priv->ring[VCS].request_list,
+                                    list) {
+                        seq_printf(m, "    %d @ %d\n",
+                                   gem_request->seqno,
+                                   (int) (jiffies - gem_request->emitted_jiffies));
+                }
+                count++;
+        }
+        if (!list_empty(&dev_priv->ring[BCS].request_list)) {
+                seq_printf(m, "BLT requests:\n");
+                list_for_each_entry(gem_request,
+                                    &dev_priv->ring[BCS].request_list,
+                                    list) {
+                        seq_printf(m, "    %d @ %d\n",
+                                   gem_request->seqno,
+                                   (int) (jiffies - gem_request->emitted_jiffies));
+                }
+                count++;
        }
        mutex_unlock(&dev->struct_mutex);
+        if (count == 0)
+                seq_printf(m, "No requests\n");
        return 0;
 }
+static void i915_ring_seqno_info(struct seq_file *m,
+                                 struct intel_ring_buffer *ring)
+{
+        if (ring->get_seqno) {
+                seq_printf(m, "Current sequence (%s): %d\n",
+                           ring->name, ring->get_seqno(ring));
+                seq_printf(m, "Waiter sequence (%s):  %d\n",
+                           ring->name, ring->waiting_seqno);
+                seq_printf(m, "IRQ sequence (%s):     %d\n",
+                           ring->name, ring->irq_seqno);
+        }
+}
 static int i915_gem_seqno_info(struct seq_file *m, void *data)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        int ret;
+        int ret, i;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
        if (ret)
                return ret;
-        if (dev_priv->render_ring.status_page.page_addr != NULL) {
+        for (i = 0; i < I915_NUM_RINGS; i++)
-                seq_printf(m, "Current sequence: %d\n",
+                i915_ring_seqno_info(m, &dev_priv->ring[i]);
-                           dev_priv->render_ring.get_seqno(dev, &dev_priv->render_ring));
-        } else {
-                seq_printf(m, "Current sequence: hws uninitialized\n");
-        }
-        seq_printf(m, "Waiter sequence:  %d\n",
-                        dev_priv->mm.waiting_gem_seqno);
-        seq_printf(m, "IRQ sequence:     %d\n", dev_priv->mm.irq_gem_seqno);
        mutex_unlock(&dev->struct_mutex);
@@ -315,7 +417,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        int ret;
+        int ret, i;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
        if (ret)
@@ -354,16 +456,8 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
        }
        seq_printf(m, "Interrupts received: %d\n",
                   atomic_read(&dev_priv->irq_received));
-        if (dev_priv->render_ring.status_page.page_addr != NULL) {
+        for (i = 0; i < I915_NUM_RINGS; i++)
-                seq_printf(m, "Current sequence:    %d\n",
+                i915_ring_seqno_info(m, &dev_priv->ring[i]);
-                           dev_priv->render_ring.get_seqno(dev, &dev_priv->render_ring));
-        } else {
-                seq_printf(m, "Current sequence:    hws uninitialized\n");
-        }
-        seq_printf(m, "Waiter sequence:     %d\n",
-                   dev_priv->mm.waiting_gem_seqno);
-        seq_printf(m, "IRQ sequence:        %d\n",
-                   dev_priv->mm.irq_gem_seqno);
        mutex_unlock(&dev->struct_mutex);
        return 0;
@@ -383,29 +477,17 @@ static int i915_gem_fence_regs_info(struct seq_file *m, void *data)
        seq_printf(m, "Reserved fences = %d\n", dev_priv->fence_reg_start);
        seq_printf(m, "Total fences = %d\n", dev_priv->num_fence_regs);
        for (i = 0; i < dev_priv->num_fence_regs; i++) {
-                struct drm_gem_object *obj = dev_priv->fence_regs[i].obj;
+                struct drm_i915_gem_object *obj = dev_priv->fence_regs[i].obj;
-                if (obj == NULL) {
+                seq_printf(m, "Fenced object[%2d] = ", i);
-                        seq_printf(m, "Fenced object[%2d] = unused\n", i);
+                if (obj == NULL)
-                } else {
+                        seq_printf(m, "unused");
-                        struct drm_i915_gem_object *obj_priv;
+                else
+                        describe_obj(m, obj);
-                        obj_priv = to_intel_bo(obj);
+                seq_printf(m, "\n");
-                        seq_printf(m, "Fenced object[%2d] = %p: %s "
-                                   "%08x %08zx %08x %s %08x %08x %d",
-                                   i, obj, get_pin_flag(obj_priv),
-                                   obj_priv->gtt_offset,
-                                   obj->size, obj_priv->stride,
-                                   get_tiling_flag(obj_priv),
-                                   obj->read_domains, obj->write_domain,
-                                   obj_priv->last_rendering_seqno);
-                        if (obj->name)
-                                seq_printf(m, " (name: %d)", obj->name);
-                        seq_printf(m, "\n");
-                }
        }
-        mutex_unlock(&dev->struct_mutex);
+        mutex_unlock(&dev->struct_mutex);
        return 0;
 }
@@ -414,10 +496,12 @@ static int i915_hws_info(struct seq_file *m, void *data)
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        int i;
+        struct intel_ring_buffer *ring;
        volatile u32 *hws;
+        int i;
-        hws = (volatile u32 *)dev_priv->render_ring.status_page.page_addr;
+        ring = &dev_priv->ring[(uintptr_t)node->info_ent->data];
+        hws = (volatile u32 *)ring->status_page.page_addr;
        if (hws == NULL)
                return 0;
@@ -431,14 +515,14 @@ static int i915_hws_info(struct seq_file *m, void *data)
 static void i915_dump_object(struct seq_file *m,
                             struct io_mapping *mapping,
-                             struct drm_i915_gem_object *obj_priv)
+                             struct drm_i915_gem_object *obj)
 {
        int page, page_count, i;
-        page_count = obj_priv->base.size / PAGE_SIZE;
+        page_count = obj->base.size / PAGE_SIZE;
        for (page = 0; page < page_count; page++) {
                u32 *mem = io_mapping_map_wc(mapping,
-                                             obj_priv->gtt_offset + page * PAGE_SIZE);
+                                             obj->gtt_offset + page * PAGE_SIZE);
                for (i = 0; i < PAGE_SIZE; i += 4)
                        seq_printf(m, "%08x :  %08x\n", i, mem[i / 4]);
                io_mapping_unmap(mem);
@@ -450,25 +534,21 @@ static int i915_batchbuffer_info(struct seq_file *m, void *data)
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
        if (ret)
                return ret;
-        list_for_each_entry(obj_priv, &dev_priv->mm.active_list, mm_list) {
+        list_for_each_entry(obj, &dev_priv->mm.active_list, mm_list) {
-                obj = &obj_priv->base;
+                if (obj->base.read_domains & I915_GEM_DOMAIN_COMMAND) {
-                if (obj->read_domains & I915_GEM_DOMAIN_COMMAND) {
+                    seq_printf(m, "--- gtt_offset = 0x%08x\n", obj->gtt_offset);
-                    seq_printf(m, "--- gtt_offset = 0x%08x\n",
+                    i915_dump_object(m, dev_priv->mm.gtt_mapping, obj);
-                               obj_priv->gtt_offset);
-                    i915_dump_object(m, dev_priv->mm.gtt_mapping, obj_priv);
                }
        }
        mutex_unlock(&dev->struct_mutex);
        return 0;
 }
@@ -477,19 +557,21 @@ static int i915_ringbuffer_data(struct seq_file *m, void *data)
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring;
        int ret;
        ret = mutex_lock_interruptible(&dev->struct_mutex);
        if (ret)
                return ret;
-        if (!dev_priv->render_ring.gem_object) {
+        ring = &dev_priv->ring[(uintptr_t)node->info_ent->data];
+        if (!ring->obj) {
                seq_printf(m, "No ringbuffer setup\n");
        } else {
-                u8 *virt = dev_priv->render_ring.virtual_start;
+                u8 *virt = ring->virtual_start;
                uint32_t off;
-                for (off = 0; off < dev_priv->render_ring.size; off += 4) {
+                for (off = 0; off < ring->size; off += 4) {
                        uint32_t *ptr = (uint32_t *)(virt + off);
                        seq_printf(m, "%08x :  %08x\n", off, *ptr);
                }
@@ -504,19 +586,38 @@ static int i915_ringbuffer_info(struct seq_file *m, void *data)
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        unsigned int head, tail;
+        struct intel_ring_buffer *ring;
-        head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
+        ring = &dev_priv->ring[(uintptr_t)node->info_ent->data];
-        tail = I915_READ(PRB0_TAIL) & TAIL_ADDR;
+        if (ring->size == 0)
+                return 0;
-        seq_printf(m, "RingHead :  %08x\n", head);
+        seq_printf(m, "Ring %s:\n", ring->name);
-        seq_printf(m, "RingTail :  %08x\n", tail);
+        seq_printf(m, "  Head :    %08x\n", I915_READ_HEAD(ring) & HEAD_ADDR);
-        seq_printf(m, "RingSize :  %08lx\n", dev_priv->render_ring.size);
+        seq_printf(m, "  Tail :    %08x\n", I915_READ_TAIL(ring) & TAIL_ADDR);
-        seq_printf(m, "Acthd :     %08x\n", I915_READ(INTEL_INFO(dev)->gen >= 4 ? ACTHD_I965 : ACTHD));
+        seq_printf(m, "  Size :    %08x\n", ring->size);
+        seq_printf(m, "  Active :  %08x\n", intel_ring_get_active_head(ring));
+        seq_printf(m, "  NOPID :   %08x\n", I915_READ_NOPID(ring));
+        if (IS_GEN6(dev)) {
+                seq_printf(m, "  Sync 0 :   %08x\n", I915_READ_SYNC_0(ring));
+                seq_printf(m, "  Sync 1 :   %08x\n", I915_READ_SYNC_1(ring));
+        }
+        seq_printf(m, "  Control : %08x\n", I915_READ_CTL(ring));
+        seq_printf(m, "  Start :   %08x\n", I915_READ_START(ring));
        return 0;
 }
+static const char *ring_str(int ring)
+{
+        switch (ring) {
+        case RING_RENDER: return " render";
+        case RING_BSD: return " bsd";
+        case RING_BLT: return " blt";
+        default: return "";
+        }
+}
 static const char *pin_flag(int pinned)
 {
        if (pinned > 0)
@@ -547,6 +648,36 @@ static const char *purgeable_flag(int purgeable)
        return purgeable ? " purgeable" : "";
 }
+static void print_error_buffers(struct seq_file *m,
+                                const char *name,
+                                struct drm_i915_error_buffer *err,
+                                int count)
+{
+        seq_printf(m, "%s [%d]:\n", name, count);
+        while (count--) {
+                seq_printf(m, "  %08x %8zd %04x %04x %08x%s%s%s%s%s",
+                           err->gtt_offset,
+                           err->size,
+                           err->read_domains,
+                           err->write_domain,
+                           err->seqno,
+                           pin_flag(err->pinned),
+                           tiling_flag(err->tiling),
+                           dirty_flag(err->dirty),
+                           purgeable_flag(err->purgeable),
+                           ring_str(err->ring));
+                if (err->name)
+                        seq_printf(m, " (name: %d)", err->name);
+                if (err->fence_reg != I915_FENCE_REG_NONE)
+                        seq_printf(m, " (fence: %d)", err->fence_reg);
+                seq_printf(m, "\n");
+                err++;
+        }
+}
 static int i915_error_state(struct seq_file *m, void *unused)
 {
        struct drm_info_node *node = (struct drm_info_node *) m->private;
@@ -568,41 +699,46 @@ static int i915_error_state(struct seq_file *m, void *unused)
                   error->time.tv_usec);
        seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device);
        seq_printf(m, "EIR: 0x%08x\n", error->eir);
-        seq_printf(m, "  PGTBL_ER: 0x%08x\n", error->pgtbl_er);
+        seq_printf(m, "PGTBL_ER: 0x%08x\n", error->pgtbl_er);
-        seq_printf(m, "  INSTPM: 0x%08x\n", error->instpm);
+        if (INTEL_INFO(dev)->gen >= 6) {
+                seq_printf(m, "ERROR: 0x%08x\n", error->error);
+                seq_printf(m, "Blitter command stream:\n");
+                seq_printf(m, "  ACTHD:    0x%08x\n", error->bcs_acthd);
+                seq_printf(m, "  IPEIR:    0x%08x\n", error->bcs_ipeir);
+                seq_printf(m, "  IPEHR:    0x%08x\n", error->bcs_ipehr);
+                seq_printf(m, "  INSTDONE: 0x%08x\n", error->bcs_instdone);
+                seq_printf(m, "  seqno:    0x%08x\n", error->bcs_seqno);
+                seq_printf(m, "Video (BSD) command stream:\n");
+                seq_printf(m, "  ACTHD:    0x%08x\n", error->vcs_acthd);
+                seq_printf(m, "  IPEIR:    0x%08x\n", error->vcs_ipeir);
+                seq_printf(m, "  IPEHR:    0x%08x\n", error->vcs_ipehr);
+                seq_printf(m, "  INSTDONE: 0x%08x\n", error->vcs_instdone);
+                seq_printf(m, "  seqno:    0x%08x\n", error->vcs_seqno);
+        }
+        seq_printf(m, "Render command stream:\n");
+        seq_printf(m, "  ACTHD: 0x%08x\n", error->acthd);
        seq_printf(m, "  IPEIR: 0x%08x\n", error->ipeir);
        seq_printf(m, "  IPEHR: 0x%08x\n", error->ipehr);
        seq_printf(m, "  INSTDONE: 0x%08x\n", error->instdone);
-        seq_printf(m, "  ACTHD: 0x%08x\n", error->acthd);
        if (INTEL_INFO(dev)->gen >= 4) {
-                seq_printf(m, "  INSTPS: 0x%08x\n", error->instps);
                seq_printf(m, "  INSTDONE1: 0x%08x\n", error->instdone1);
+                seq_printf(m, "  INSTPS: 0x%08x\n", error->instps);
        }
-        seq_printf(m, "seqno: 0x%08x\n", error->seqno);
+        seq_printf(m, "  INSTPM: 0x%08x\n", error->instpm);
+        seq_printf(m, "  seqno: 0x%08x\n", error->seqno);
-        if (error->active_bo_count) {
-                seq_printf(m, "Buffers [%d]:\n", error->active_bo_count);
+        for (i = 0; i < 16; i++)
+                seq_printf(m, "  fence[%d] = %08llx\n", i, error->fence[i]);
-                for (i = 0; i < error->active_bo_count; i++) {
-                        seq_printf(m, "  %08x %8zd %08x %08x %08x%s%s%s%s",
+        if (error->active_bo)
-                                   error->active_bo[i].gtt_offset,
+                print_error_buffers(m, "Active",
-                                   error->active_bo[i].size,
+                                    error->active_bo,
-                                   error->active_bo[i].read_domains,
+                                    error->active_bo_count);
-                                   error->active_bo[i].write_domain,
-                                   error->active_bo[i].seqno,
+        if (error->pinned_bo)
-                                   pin_flag(error->active_bo[i].pinned),
+                print_error_buffers(m, "Pinned",
-                                   tiling_flag(error->active_bo[i].tiling),
+                                    error->pinned_bo,
-                                   dirty_flag(error->active_bo[i].dirty),
+                                    error->pinned_bo_count);
-                                   purgeable_flag(error->active_bo[i].purgeable));
-                        if (error->active_bo[i].name)
-                                seq_printf(m, " (name: %d)", error->active_bo[i].name);
-                        if (error->active_bo[i].fence_reg != I915_FENCE_REG_NONE)
-                                seq_printf(m, " (fence: %d)", error->active_bo[i].fence_reg);
-                        seq_printf(m, "\n");
-                }
-        }
        for (i = 0; i < ARRAY_SIZE(error->batchbuffer); i++) {
                if (error->batchbuffer[i]) {
@@ -635,6 +771,9 @@ static int i915_error_state(struct seq_file *m, void *unused)
        if (error->overlay)
                intel_overlay_print_error_state(m, error->overlay);
+        if (error->display)
+                intel_display_print_error_state(m, dev, error->display);
 out:
        spin_unlock_irqrestore(&dev_priv->error_lock, flags);
@@ -658,15 +797,51 @@ static int i915_cur_delayinfo(struct seq_file *m, void *unused)
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        u16 rgvswctl = I915_READ16(MEMSWCTL);
-        u16 rgvstat = I915_READ16(MEMSTAT_ILK);
-        seq_printf(m, "Requested P-state: %d\n", (rgvswctl >> 8) & 0xf);
+        if (IS_GEN5(dev)) {
-        seq_printf(m, "Requested VID: %d\n", rgvswctl & 0x3f);
+                u16 rgvswctl = I915_READ16(MEMSWCTL);
-        seq_printf(m, "Current VID: %d\n", (rgvstat & MEMSTAT_VID_MASK) >>
+                u16 rgvstat = I915_READ16(MEMSTAT_ILK);
-                   MEMSTAT_VID_SHIFT);
-        seq_printf(m, "Current P-state: %d\n",
+                seq_printf(m, "Requested P-state: %d\n", (rgvswctl >> 8) & 0xf);
-                   (rgvstat & MEMSTAT_PSTATE_MASK) >> MEMSTAT_PSTATE_SHIFT);
+                seq_printf(m, "Requested VID: %d\n", rgvswctl & 0x3f);
+                seq_printf(m, "Current VID: %d\n", (rgvstat & MEMSTAT_VID_MASK) >>
+                           MEMSTAT_VID_SHIFT);
+                seq_printf(m, "Current P-state: %d\n",
+                           (rgvstat & MEMSTAT_PSTATE_MASK) >> MEMSTAT_PSTATE_SHIFT);
+        } else if (IS_GEN6(dev)) {
+                u32 gt_perf_status = I915_READ(GEN6_GT_PERF_STATUS);
+                u32 rp_state_limits = I915_READ(GEN6_RP_STATE_LIMITS);
+                u32 rp_state_cap = I915_READ(GEN6_RP_STATE_CAP);
+                int max_freq;
+                /* RPSTAT1 is in the GT power well */
+                __gen6_force_wake_get(dev_priv);
+                seq_printf(m, "GT_PERF_STATUS: 0x%08x\n", gt_perf_status);
+                seq_printf(m, "RPSTAT1: 0x%08x\n", I915_READ(GEN6_RPSTAT1));
+                seq_printf(m, "Render p-state ratio: %d\n",
+                           (gt_perf_status & 0xff00) >> 8);
+                seq_printf(m, "Render p-state VID: %d\n",
+                           gt_perf_status & 0xff);
+                seq_printf(m, "Render p-state limit: %d\n",
+                           rp_state_limits & 0xff);
+                max_freq = (rp_state_cap & 0xff0000) >> 16;
+                seq_printf(m, "Lowest (RPN) frequency: %dMHz\n",
+                           max_freq * 100);
+                max_freq = (rp_state_cap & 0xff00) >> 8;
+                seq_printf(m, "Nominal (RP1) frequency: %dMHz\n",
+                           max_freq * 100);
+                max_freq = rp_state_cap & 0xff;
+                seq_printf(m, "Max non-overclocked (RP0) frequency: %dMHz\n",
+                           max_freq * 100);
+                __gen6_force_wake_put(dev_priv);
+        } else {
+                seq_printf(m, "no P-state info available\n");
+        }
        return 0;
 }
@@ -794,7 +969,7 @@ static int i915_sr_status(struct seq_file *m, void *unused)
        drm_i915_private_t *dev_priv = dev->dev_private;
        bool sr_enabled = false;
-        if (IS_GEN5(dev))
+        if (HAS_PCH_SPLIT(dev))
                sr_enabled = I915_READ(WM1_LP_ILK) & WM1_LP_SR_EN;
        else if (IS_CRESTLINE(dev) || IS_I945G(dev) || IS_I945GM(dev))
                sr_enabled = I915_READ(FW_BLC_SELF) & FW_BLC_SELF_EN;
@@ -886,7 +1061,7 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
                   fb->base.height,
                   fb->base.depth,
                   fb->base.bits_per_pixel);
-        describe_obj(m, to_intel_bo(fb->obj));
+        describe_obj(m, fb->obj);
        seq_printf(m, "\n");
        list_for_each_entry(fb, &dev->mode_config.fb_list, base.head) {
@@ -898,7 +1073,7 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
                           fb->base.height,
                           fb->base.depth,
                           fb->base.bits_per_pixel);
-                describe_obj(m, to_intel_bo(fb->obj));
+                describe_obj(m, fb->obj);
                seq_printf(m, "\n");
        }
@@ -943,7 +1118,6 @@ i915_wedged_write(struct file *filp,
                  loff_t *ppos)
 {
        struct drm_device *dev = filp->private_data;
-        drm_i915_private_t *dev_priv = dev->dev_private;
        char buf[20];
        int val = 1;
@@ -959,12 +1133,7 @@ i915_wedged_write(struct file *filp,
        }
        DRM_INFO("Manually setting wedged to %d\n", val);
+        i915_handle_error(dev, val);
-        atomic_set(&dev_priv->mm.wedged, val);
-        if (val) {
-                wake_up_all(&dev_priv->irq_queue);
-                queue_work(dev_priv->wq, &dev_priv->error_work);
-        }
        return cnt;
 }
@@ -1028,9 +1197,15 @@ static struct drm_info_list i915_debugfs_list[] = {
        {"i915_gem_seqno", i915_gem_seqno_info, 0},
        {"i915_gem_fence_regs", i915_gem_fence_regs_info, 0},
        {"i915_gem_interrupt", i915_interrupt_info, 0},
-        {"i915_gem_hws", i915_hws_info, 0},
+        {"i915_gem_hws", i915_hws_info, 0, (void *)RCS},
-        {"i915_ringbuffer_data", i915_ringbuffer_data, 0},
+        {"i915_gem_hws_blt", i915_hws_info, 0, (void *)BCS},
-        {"i915_ringbuffer_info", i915_ringbuffer_info, 0},
+        {"i915_gem_hws_bsd", i915_hws_info, 0, (void *)VCS},
+        {"i915_ringbuffer_data", i915_ringbuffer_data, 0, (void *)RCS},
+        {"i915_ringbuffer_info", i915_ringbuffer_info, 0, (void *)RCS},
+        {"i915_bsd_ringbuffer_data", i915_ringbuffer_data, 0, (void *)VCS},
+        {"i915_bsd_ringbuffer_info", i915_ringbuffer_info, 0, (void *)VCS},
+        {"i915_blt_ringbuffer_data", i915_ringbuffer_data, 0, (void *)BCS},
+        {"i915_blt_ringbuffer_info", i915_ringbuffer_info, 0, (void *)BCS},
        {"i915_batchbuffers", i915_batchbuffer_info, 0},
        {"i915_error_state", i915_error_state, 0},
        {"i915_rstdby_delays", i915_rstdby_delays, 0},
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 7a26f4dd21ae..18746e6cb129 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -49,6 +49,8 @@
 static int i915_init_phys_hws(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        /* Program Hardware Status Page */
        dev_priv->status_page_dmah =
                drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE);
@@ -57,11 +59,10 @@ static int i915_init_phys_hws(struct drm_device *dev)
                DRM_ERROR("Can not allocate hardware status page\n");
                return -ENOMEM;
        }
-        dev_priv->render_ring.status_page.page_addr
+        ring->status_page.page_addr = dev_priv->status_page_dmah->vaddr;
-                = dev_priv->status_page_dmah->vaddr;
        dev_priv->dma_status_page = dev_priv->status_page_dmah->busaddr;
-        memset(dev_priv->render_ring.status_page.page_addr, 0, PAGE_SIZE);
+        memset(ring->status_page.page_addr, 0, PAGE_SIZE);
        if (INTEL_INFO(dev)->gen >= 4)
                dev_priv->dma_status_page |= (dev_priv->dma_status_page >> 28) &
@@ -79,13 +80,15 @@ static int i915_init_phys_hws(struct drm_device *dev)
 static void i915_free_hws(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        if (dev_priv->status_page_dmah) {
                drm_pci_free(dev, dev_priv->status_page_dmah);
                dev_priv->status_page_dmah = NULL;
        }
-        if (dev_priv->render_ring.status_page.gfx_addr) {
+        if (ring->status_page.gfx_addr) {
-                dev_priv->render_ring.status_page.gfx_addr = 0;
+                ring->status_page.gfx_addr = 0;
                drm_core_ioremapfree(&dev_priv->hws_map, dev);
        }
@@ -97,7 +100,7 @@ void i915_kernel_lost_context(struct drm_device * dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv;
-        struct intel_ring_buffer *ring = &dev_priv->render_ring;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        /*
         * We should never lose context on the ring with modesetting
@@ -106,8 +109,8 @@ void i915_kernel_lost_context(struct drm_device * dev)
        if (drm_core_check_feature(dev, DRIVER_MODESET))
                return;
-        ring->head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
+        ring->head = I915_READ_HEAD(ring) & HEAD_ADDR;
-        ring->tail = I915_READ(PRB0_TAIL) & TAIL_ADDR;
+        ring->tail = I915_READ_TAIL(ring) & TAIL_ADDR;
        ring->space = ring->head - (ring->tail + 8);
        if (ring->space < 0)
                ring->space += ring->size;
@@ -123,6 +126,8 @@ void i915_kernel_lost_context(struct drm_device * dev)
 static int i915_dma_cleanup(struct drm_device * dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        int i;
        /* Make sure interrupts are disabled here because the uninstall ioctl
         * may not have been called from userspace and after dev_private
         * is freed, it's too late.
@@ -131,9 +136,8 @@ static int i915_dma_cleanup(struct drm_device * dev)
                drm_irq_uninstall(dev);
        mutex_lock(&dev->struct_mutex);
-        intel_cleanup_ring_buffer(dev, &dev_priv->render_ring);
+        for (i = 0; i < I915_NUM_RINGS; i++)
-        intel_cleanup_ring_buffer(dev, &dev_priv->bsd_ring);
+                intel_cleanup_ring_buffer(&dev_priv->ring[i]);
-        intel_cleanup_ring_buffer(dev, &dev_priv->blt_ring);
        mutex_unlock(&dev->struct_mutex);
        /* Clear the HWS virtual address at teardown */
@@ -147,6 +151,7 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        master_priv->sarea = drm_getsarea(dev);
        if (master_priv->sarea) {
@@ -157,24 +162,24 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
        }
        if (init->ring_size != 0) {
-                if (dev_priv->render_ring.gem_object != NULL) {
+                if (ring->obj != NULL) {
                        i915_dma_cleanup(dev);
                        DRM_ERROR("Client tried to initialize ringbuffer in "
                                  "GEM mode\n");
                        return -EINVAL;
                }
-                dev_priv->render_ring.size = init->ring_size;
+                ring->size = init->ring_size;
-                dev_priv->render_ring.map.offset = init->ring_start;
+                ring->map.offset = init->ring_start;
-                dev_priv->render_ring.map.size = init->ring_size;
+                ring->map.size = init->ring_size;
-                dev_priv->render_ring.map.type = 0;
+                ring->map.type = 0;
-                dev_priv->render_ring.map.flags = 0;
+                ring->map.flags = 0;
-                dev_priv->render_ring.map.mtrr = 0;
+                ring->map.mtrr = 0;
-                drm_core_ioremap_wc(&dev_priv->render_ring.map, dev);
+                drm_core_ioremap_wc(&ring->map, dev);
-                if (dev_priv->render_ring.map.handle == NULL) {
+                if (ring->map.handle == NULL) {
                        i915_dma_cleanup(dev);
                        DRM_ERROR("can not ioremap virtual address for"
                                  " ring buffer\n");
@@ -182,7 +187,7 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
                }
        }
-        dev_priv->render_ring.virtual_start = dev_priv->render_ring.map.handle;
+        ring->virtual_start = ring->map.handle;
        dev_priv->cpp = init->cpp;
        dev_priv->back_offset = init->back_offset;
@@ -201,12 +206,10 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
 static int i915_dma_resume(struct drm_device * dev)
 {
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
-        struct intel_ring_buffer *ring;
        DRM_DEBUG_DRIVER("%s\n", __func__);
-        ring = &dev_priv->render_ring;
        if (ring->map.handle == NULL) {
                DRM_ERROR("can not ioremap virtual address for"
                          " ring buffer\n");
@@ -221,7 +224,7 @@ static int i915_dma_resume(struct drm_device * dev)
        DRM_DEBUG_DRIVER("hw status page @ %p\n",
                                ring->status_page.page_addr);
        if (ring->status_page.gfx_addr != 0)
-                intel_ring_setup_status_page(dev, ring);
+                intel_ring_setup_status_page(ring);
        else
                I915_WRITE(HWS_PGA, dev_priv->dma_status_page);
@@ -263,7 +266,7 @@ static int i915_dma_init(struct drm_device *dev, void *data,
 * instruction detected will be given a size of zero, which is a
 * signal to abort the rest of the buffer.
 */
-static int do_validate_cmd(int cmd)
+static int validate_cmd(int cmd)
 {
        switch (((cmd >> 29) & 0x7)) {
        case 0x0:
@@ -321,40 +324,27 @@ static int do_validate_cmd(int cmd)
        return 0;
 }
-static int validate_cmd(int cmd)
-{
-        int ret = do_validate_cmd(cmd);
-/*      printk("validate_cmd( %x ): %d\n", cmd, ret); */
-        return ret;
-}
 static int i915_emit_cmds(struct drm_device * dev, int *buffer, int dwords)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
-        int i;
+        int i, ret;
-        if ((dwords+1) * sizeof(int) >= dev_priv->render_ring.size - 8)
+        if ((dwords+1) * sizeof(int) >= LP_RING(dev_priv)->size - 8)
                return -EINVAL;
-        BEGIN_LP_RING((dwords+1)&~1);
        for (i = 0; i < dwords;) {
-                int cmd, sz;
+                int sz = validate_cmd(buffer[i]);
+                if (sz == 0 || i + sz > dwords)
-                cmd = buffer[i];
-                if ((sz = validate_cmd(cmd)) == 0 || i + sz > dwords)
                        return -EINVAL;
+                i += sz;
-                OUT_RING(cmd);
-                while (++i, --sz) {
-                        OUT_RING(buffer[i]);
-                }
        }
+        ret = BEGIN_LP_RING((dwords+1)&~1);
+        if (ret)
+                return ret;
+        for (i = 0; i < dwords; i++)
+                OUT_RING(buffer[i]);
        if (dwords & 1)
                OUT_RING(0);
@@ -365,34 +355,41 @@ static int i915_emit_cmds(struct drm_device * dev, int *buffer, int dwords)
 int
 i915_emit_box(struct drm_device *dev,
-              struct drm_clip_rect *boxes,
+              struct drm_clip_rect *box,
-              int i, int DR1, int DR4)
+              int DR1, int DR4)
 {
-        struct drm_clip_rect box = boxes[i];
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int ret;
-        if (box.y2 <= box.y1 || box.x2 <= box.x1 || box.y2 <= 0 || box.x2 <= 0) {
+        if (box->y2 <= box->y1 || box->x2 <= box->x1 ||
+            box->y2 <= 0 || box->x2 <= 0) {
                DRM_ERROR("Bad box %d,%d..%d,%d\n",
-                          box.x1, box.y1, box.x2, box.y2);
+                          box->x1, box->y1, box->x2, box->y2);
                return -EINVAL;
        }
        if (INTEL_INFO(dev)->gen >= 4) {
-                BEGIN_LP_RING(4);
+                ret = BEGIN_LP_RING(4);
+                if (ret)
+                        return ret;
                OUT_RING(GFX_OP_DRAWRECT_INFO_I965);
-                OUT_RING((box.x1 & 0xffff) | (box.y1 << 16));
+                OUT_RING((box->x1 & 0xffff) | (box->y1 << 16));
-                OUT_RING(((box.x2 - 1) & 0xffff) | ((box.y2 - 1) << 16));
+                OUT_RING(((box->x2 - 1) & 0xffff) | ((box->y2 - 1) << 16));
                OUT_RING(DR4);
-                ADVANCE_LP_RING();
        } else {
-                BEGIN_LP_RING(6);
+                ret = BEGIN_LP_RING(6);
+                if (ret)
+                        return ret;
                OUT_RING(GFX_OP_DRAWRECT_INFO);
                OUT_RING(DR1);
-                OUT_RING((box.x1 & 0xffff) | (box.y1 << 16));
+                OUT_RING((box->x1 & 0xffff) | (box->y1 << 16));
-                OUT_RING(((box.x2 - 1) & 0xffff) | ((box.y2 - 1) << 16));
+                OUT_RING(((box->x2 - 1) & 0xffff) | ((box->y2 - 1) << 16));
                OUT_RING(DR4);
                OUT_RING(0);
-                ADVANCE_LP_RING();
        }
+        ADVANCE_LP_RING();
        return 0;
 }
@@ -412,12 +409,13 @@ static void i915_emit_breadcrumb(struct drm_device *dev)
        if (master_priv->sarea_priv)
                master_priv->sarea_priv->last_enqueue = dev_priv->counter;
-        BEGIN_LP_RING(4);
+        if (BEGIN_LP_RING(4) == 0) {
-        OUT_RING(MI_STORE_DWORD_INDEX);
+                OUT_RING(MI_STORE_DWORD_INDEX);
-        OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+                OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-        OUT_RING(dev_priv->counter);
+                OUT_RING(dev_priv->counter);
-        OUT_RING(0);
+                OUT_RING(0);
-        ADVANCE_LP_RING();
+                ADVANCE_LP_RING();
+        }
 }
 static int i915_dispatch_cmdbuffer(struct drm_device * dev,
@@ -439,7 +437,7 @@ static int i915_dispatch_cmdbuffer(struct drm_device * dev,
        for (i = 0; i < count; i++) {
                if (i < nbox) {
-                        ret = i915_emit_box(dev, cliprects, i,
+                        ret = i915_emit_box(dev, &cliprects[i],
                                            cmd->DR1, cmd->DR4);
                        if (ret)
                                return ret;
@@ -458,8 +456,9 @@ static int i915_dispatch_batchbuffer(struct drm_device * dev,
                                     drm_i915_batchbuffer_t * batch,
                                     struct drm_clip_rect *cliprects)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        int nbox = batch->num_cliprects;
-        int i = 0, count;
+        int i, count, ret;
        if ((batch->start | batch->used) & 0x7) {
                DRM_ERROR("alignment");
@@ -469,17 +468,19 @@ static int i915_dispatch_batchbuffer(struct drm_device * dev,
        i915_kernel_lost_context(dev);
        count = nbox ? nbox : 1;
        for (i = 0; i < count; i++) {
                if (i < nbox) {
-                        int ret = i915_emit_box(dev, cliprects, i,
+                        ret = i915_emit_box(dev, &cliprects[i],
-                                                batch->DR1, batch->DR4);
+                                            batch->DR1, batch->DR4);
                        if (ret)
                                return ret;
                }
                if (!IS_I830(dev) && !IS_845G(dev)) {
-                        BEGIN_LP_RING(2);
+                        ret = BEGIN_LP_RING(2);
+                        if (ret)
+                                return ret;
                        if (INTEL_INFO(dev)->gen >= 4) {
                                OUT_RING(MI_BATCH_BUFFER_START | (2 << 6) | MI_BATCH_NON_SECURE_I965);
                                OUT_RING(batch->start);
@@ -487,26 +488,29 @@ static int i915_dispatch_batchbuffer(struct drm_device * dev,
                                OUT_RING(MI_BATCH_BUFFER_START | (2 << 6));
                                OUT_RING(batch->start | MI_BATCH_NON_SECURE);
                        }
-                        ADVANCE_LP_RING();
                } else {
-                        BEGIN_LP_RING(4);
+                        ret = BEGIN_LP_RING(4);
+                        if (ret)
+                                return ret;
                        OUT_RING(MI_BATCH_BUFFER);
                        OUT_RING(batch->start | MI_BATCH_NON_SECURE);
                        OUT_RING(batch->start + batch->used - 4);
                        OUT_RING(0);
-                        ADVANCE_LP_RING();
                }
+                ADVANCE_LP_RING();
        }
        if (IS_G4X(dev) || IS_GEN5(dev)) {
-                BEGIN_LP_RING(2);
+                if (BEGIN_LP_RING(2) == 0) {
-                OUT_RING(MI_FLUSH | MI_NO_WRITE_FLUSH | MI_INVALIDATE_ISP);
+                        OUT_RING(MI_FLUSH | MI_NO_WRITE_FLUSH | MI_INVALIDATE_ISP);
-                OUT_RING(MI_NOOP);
+                        OUT_RING(MI_NOOP);
-                ADVANCE_LP_RING();
+                        ADVANCE_LP_RING();
+                }
        }
-        i915_emit_breadcrumb(dev);
+        i915_emit_breadcrumb(dev);
        return 0;
 }
@@ -515,6 +519,7 @@ static int i915_dispatch_flip(struct drm_device * dev)
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv =
                dev->primary->master->driver_priv;
+        int ret;
        if (!master_priv->sarea_priv)
                return -EINVAL;
@@ -526,12 +531,13 @@ static int i915_dispatch_flip(struct drm_device * dev)
        i915_kernel_lost_context(dev);
-        BEGIN_LP_RING(2);
+        ret = BEGIN_LP_RING(10);
+        if (ret)
+                return ret;
        OUT_RING(MI_FLUSH | MI_READ_FLUSH);
        OUT_RING(0);
-        ADVANCE_LP_RING();
-        BEGIN_LP_RING(6);
        OUT_RING(CMD_OP_DISPLAYBUFFER_INFO | ASYNC_FLIP);
        OUT_RING(0);
        if (dev_priv->current_page == 0) {
@@ -542,33 +548,32 @@ static int i915_dispatch_flip(struct drm_device * dev)
                dev_priv->current_page = 0;
        }
        OUT_RING(0);
-        ADVANCE_LP_RING();
-        BEGIN_LP_RING(2);
        OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_PLANE_A_FLIP);
        OUT_RING(0);
        ADVANCE_LP_RING();
        master_priv->sarea_priv->last_enqueue = dev_priv->counter++;
-        BEGIN_LP_RING(4);
+        if (BEGIN_LP_RING(4) == 0) {
-        OUT_RING(MI_STORE_DWORD_INDEX);
+                OUT_RING(MI_STORE_DWORD_INDEX);
-        OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+                OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-        OUT_RING(dev_priv->counter);
+                OUT_RING(dev_priv->counter);
-        OUT_RING(0);
+                OUT_RING(0);
-        ADVANCE_LP_RING();
+                ADVANCE_LP_RING();
+        }
        master_priv->sarea_priv->pf_current_page = dev_priv->current_page;
        return 0;
 }
-static int i915_quiescent(struct drm_device * dev)
+static int i915_quiescent(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring = LP_RING(dev->dev_private);
        i915_kernel_lost_context(dev);
-        return intel_wait_ring_buffer(dev, &dev_priv->render_ring,
+        return intel_wait_ring_buffer(ring, ring->size - 8);
-                                      dev_priv->render_ring.size - 8);
 }
 static int i915_flush_ioctl(struct drm_device *dev, void *data,
@@ -767,6 +772,15 @@ static int i915_getparam(struct drm_device *dev, void *data,
        case I915_PARAM_HAS_BLT:
                value = HAS_BLT(dev);
                break;
+        case I915_PARAM_HAS_RELAXED_FENCING:
+                value = 1;
+                break;
+        case I915_PARAM_HAS_COHERENT_RINGS:
+                value = 1;
+                break;
+        case I915_PARAM_HAS_EXEC_CONSTANTS:
+                value = INTEL_INFO(dev)->gen >= 4;
+                break;
        default:
                DRM_DEBUG_DRIVER("Unknown parameter %d\n",
                                 param->param);
@@ -822,7 +836,7 @@ static int i915_set_status_page(struct drm_device *dev, void *data,
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        drm_i915_hws_addr_t *hws = data;
-        struct intel_ring_buffer *ring = &dev_priv->render_ring;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        if (!I915_NEED_GFX_HWS(dev))
                return -EINVAL;
@@ -1001,73 +1015,47 @@ intel_teardown_mchbar(struct drm_device *dev)
 #define PTE_VALID                       (1 << 0)
 /**
- * i915_gtt_to_phys - take a GTT address and turn it into a physical one
+ * i915_stolen_to_phys - take an offset into stolen memory and turn it into
+ *                       a physical one
 * @dev: drm device
- * @gtt_addr: address to translate
+ * @offset: address to translate
 *
- * Some chip functions require allocations from stolen space but need the
+ * Some chip functions require allocations from stolen space and need the
- * physical address of the memory in question.  We use this routine
+ * physical address of the memory in question.
- * to get a physical address suitable for register programming from a given
- * GTT address.
 */
-static unsigned long i915_gtt_to_phys(struct drm_device *dev,
+static unsigned long i915_stolen_to_phys(struct drm_device *dev, u32 offset)
-                                      unsigned long gtt_addr)
 {
-        unsigned long *gtt;
+        struct drm_i915_private *dev_priv = dev->dev_private;
-        unsigned long entry, phys;
+        struct pci_dev *pdev = dev_priv->bridge_dev;
-        int gtt_bar = IS_GEN2(dev) ? 1 : 0;
+        u32 base;
-        int gtt_offset, gtt_size;
+#if 0
-        if (INTEL_INFO(dev)->gen >= 4) {
+        /* On the machines I have tested the Graphics Base of Stolen Memory
-                if (IS_G4X(dev) || INTEL_INFO(dev)->gen > 4) {
+         * is unreliable, so compute the base by subtracting the stolen memory
-                        gtt_offset = 2*1024*1024;
+         * from the Top of Low Usable DRAM which is where the BIOS places
-                        gtt_size = 2*1024*1024;
+         * the graphics stolen memory.
-                } else {
+         */
-                        gtt_offset = 512*1024;
+        if (INTEL_INFO(dev)->gen > 3 || IS_G33(dev)) {
-                        gtt_size = 512*1024;
+                /* top 32bits are reserved = 0 */
-                }
+                pci_read_config_dword(pdev, 0xA4, &base);
        } else {
-                gtt_bar = 3;
+                /* XXX presume 8xx is the same as i915 */
-                gtt_offset = 0;
+                pci_bus_read_config_dword(pdev->bus, 2, 0x5C, &base);
-                gtt_size = pci_resource_len(dev->pdev, gtt_bar);
+        }
-        }
+#else
+        if (INTEL_INFO(dev)->gen > 3 || IS_G33(dev)) {
-        gtt = ioremap_wc(pci_resource_start(dev->pdev, gtt_bar) + gtt_offset,
+                u16 val;
-                         gtt_size);
+                pci_read_config_word(pdev, 0xb0, &val);
-        if (!gtt) {
+                base = val >> 4 << 20;
-                DRM_ERROR("ioremap of GTT failed\n");
+        } else {
-                return 0;
+                u8 val;
-        }
+                pci_read_config_byte(pdev, 0x9c, &val);
+                base = val >> 3 << 27;
-        entry = *(volatile u32 *)(gtt + (gtt_addr / 1024));
-        DRM_DEBUG_DRIVER("GTT addr: 0x%08lx, PTE: 0x%08lx\n", gtt_addr, entry);
-        /* Mask out these reserved bits on this hardware. */
-        if (INTEL_INFO(dev)->gen < 4 && !IS_G33(dev))
-                entry &= ~PTE_ADDRESS_MASK_HIGH;
-        /* If it's not a mapping type we know, then bail. */
-        if ((entry & PTE_MAPPING_TYPE_MASK) != PTE_MAPPING_TYPE_UNCACHED &&
-            (entry & PTE_MAPPING_TYPE_MASK) != PTE_MAPPING_TYPE_CACHED) {
-                iounmap(gtt);
-                return 0;
-        }
-        if (!(entry & PTE_VALID)) {
-                DRM_ERROR("bad GTT entry in stolen space\n");
-                iounmap(gtt);
-                return 0;
        }
+        base -= dev_priv->mm.gtt->stolen_size;
+#endif
-        iounmap(gtt);
+        return base + offset;
-        phys =(entry & PTE_ADDRESS_MASK) |
-                ((uint64_t)(entry & PTE_ADDRESS_MASK_HIGH) << (32 - 4));
-        DRM_DEBUG_DRIVER("GTT addr: 0x%08lx, phys addr: 0x%08lx\n", gtt_addr, phys);
-        return phys;
 }
 static void i915_warn_stolen(struct drm_device *dev)
@@ -1083,54 +1071,35 @@ static void i915_setup_compression(struct drm_device *dev, int size)
        unsigned long cfb_base;
        unsigned long ll_base = 0;
-        /* Leave 1M for line length buffer & misc. */
+        compressed_fb = drm_mm_search_free(&dev_priv->mm.stolen, size, 4096, 0);
-        compressed_fb = drm_mm_search_free(&dev_priv->mm.vram, size, 4096, 0);
+        if (compressed_fb)
-        if (!compressed_fb) {
+                compressed_fb = drm_mm_get_block(compressed_fb, size, 4096);
-                dev_priv->no_fbc_reason = FBC_STOLEN_TOO_SMALL;
+        if (!compressed_fb)
-                i915_warn_stolen(dev);
+                goto err;
-                return;
-        }
-        compressed_fb = drm_mm_get_block(compressed_fb, size, 4096);
+        cfb_base = i915_stolen_to_phys(dev, compressed_fb->start);
-        if (!compressed_fb) {
+        if (!cfb_base)
-                i915_warn_stolen(dev);
+                goto err_fb;
-                dev_priv->no_fbc_reason = FBC_STOLEN_TOO_SMALL;
-                return;
-        }
-        cfb_base = i915_gtt_to_phys(dev, compressed_fb->start);
+        if (!(IS_GM45(dev) || HAS_PCH_SPLIT(dev))) {
-        if (!cfb_base) {
+                compressed_llb = drm_mm_search_free(&dev_priv->mm.stolen,
-                DRM_ERROR("failed to get stolen phys addr, disabling FBC\n");
+                                                    4096, 4096, 0);
-                drm_mm_put_block(compressed_fb);
+                if (compressed_llb)
-        }
+                        compressed_llb = drm_mm_get_block(compressed_llb,
+                                                          4096, 4096);
+                if (!compressed_llb)
+                        goto err_fb;
-        if (!(IS_GM45(dev) || IS_IRONLAKE_M(dev))) {
+                ll_base = i915_stolen_to_phys(dev, compressed_llb->start);
-                compressed_llb = drm_mm_search_free(&dev_priv->mm.vram, 4096,
+                if (!ll_base)
-                                                    4096, 0);
+                        goto err_llb;
-                if (!compressed_llb) {
-                        i915_warn_stolen(dev);
-                        return;
-                }
-                compressed_llb = drm_mm_get_block(compressed_llb, 4096, 4096);
-                if (!compressed_llb) {
-                        i915_warn_stolen(dev);
-                        return;
-                }
-                ll_base = i915_gtt_to_phys(dev, compressed_llb->start);
-                if (!ll_base) {
-                        DRM_ERROR("failed to get stolen phys addr, disabling FBC\n");
-                        drm_mm_put_block(compressed_fb);
-                        drm_mm_put_block(compressed_llb);
-                }
        }
        dev_priv->cfb_size = size;
        intel_disable_fbc(dev);
        dev_priv->compressed_fb = compressed_fb;
-        if (IS_IRONLAKE_M(dev))
+        if (HAS_PCH_SPLIT(dev))
                I915_WRITE(ILK_DPFC_CB_BASE, compressed_fb->start);
        else if (IS_GM45(dev)) {
                I915_WRITE(DPFC_CB_BASE, compressed_fb->start);
@@ -1140,8 +1109,17 @@ static void i915_setup_compression(struct drm_device *dev, int size)
                dev_priv->compressed_llb = compressed_llb;
        }
-        DRM_DEBUG_KMS("FBC base 0x%08lx, ll base 0x%08lx, size %dM\n", cfb_base,
+        DRM_DEBUG_KMS("FBC base 0x%08lx, ll base 0x%08lx, size %dM\n",
-                  ll_base, size >> 20);
+                      cfb_base, ll_base, size >> 20);
+        return;
+err_llb:
+        drm_mm_put_block(compressed_llb);
+err_fb:
+        drm_mm_put_block(compressed_fb);
+err:
+        dev_priv->no_fbc_reason = FBC_STOLEN_TOO_SMALL;
+        i915_warn_stolen(dev);
 }
 static void i915_cleanup_compression(struct drm_device *dev)
@@ -1192,17 +1170,20 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
        return can_switch;
 }
-static int i915_load_modeset_init(struct drm_device *dev,
+static int i915_load_modeset_init(struct drm_device *dev)
-                                  unsigned long prealloc_size,
-                                  unsigned long agp_size)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        unsigned long prealloc_size, gtt_size, mappable_size;
        int ret = 0;
-        /* Basic memrange allocator for stolen space (aka mm.vram) */
+        prealloc_size = dev_priv->mm.gtt->stolen_size;
-        drm_mm_init(&dev_priv->mm.vram, 0, prealloc_size);
+        gtt_size = dev_priv->mm.gtt->gtt_total_entries << PAGE_SHIFT;
+        mappable_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
+        /* Basic memrange allocator for stolen space */
+        drm_mm_init(&dev_priv->mm.stolen, 0, prealloc_size);
-        /* Let GEM Manage from end of prealloc space to end of aperture.
+        /* Let GEM Manage all of the aperture.
         *
         * However, leave one page at the end still bound to the scratch page.
         * There are a number of places where the hardware apparently
@@ -1211,7 +1192,7 @@ static int i915_load_modeset_init(struct drm_device *dev,
         * at the last page of the aperture.  One page should be enough to
         * keep any prefetching inside of the aperture.
         */
-        i915_gem_do_init(dev, prealloc_size, agp_size - 4096);
+        i915_gem_do_init(dev, 0, mappable_size, gtt_size - PAGE_SIZE);
        mutex_lock(&dev->struct_mutex);
        ret = i915_gem_init_ringbuffer(dev);
@@ -1223,16 +1204,17 @@ static int i915_load_modeset_init(struct drm_device *dev,
        if (I915_HAS_FBC(dev) && i915_powersave) {
                int cfb_size;
-                /* Try to get an 8M buffer... */
+                /* Leave 1M for line length buffer & misc. */
-                if (prealloc_size > (9*1024*1024))
-                        cfb_size = 8*1024*1024;
+                /* Try to get a 32M buffer... */
+                if (prealloc_size > (36*1024*1024))
+                        cfb_size = 32*1024*1024;
                else /* fall back to 7/8 of the stolen space */
                        cfb_size = prealloc_size * 7 / 8;
                i915_setup_compression(dev, cfb_size);
        }
-        /* Allow hardware batchbuffers unless told otherwise.
+        /* Allow hardware batchbuffers unless told otherwise. */
-         */
        dev_priv->allow_batchbuffer = 1;
        ret = intel_parse_bios(dev);
@@ -1422,152 +1404,12 @@ static void i915_ironlake_get_mem_freq(struct drm_device *dev)
        }
 }
-struct v_table {
+static const struct cparams {
-        u8 vid;
+        u16 i;
-        unsigned long vd; /* in .1 mil */
+        u16 t;
-        unsigned long vm; /* in .1 mil */
+        u16 m;
-        u8 pvid;
+        u16 c;
-};
+} cparams[] = {
-static struct v_table v_table[] = {
-        { 0, 16125, 15000, 0x7f, },
-        { 1, 16000, 14875, 0x7e, },
-        { 2, 15875, 14750, 0x7d, },
-        { 3, 15750, 14625, 0x7c, },
-        { 4, 15625, 14500, 0x7b, },
-        { 5, 15500, 14375, 0x7a, },
-        { 6, 15375, 14250, 0x79, },
-        { 7, 15250, 14125, 0x78, },
-        { 8, 15125, 14000, 0x77, },
-        { 9, 15000, 13875, 0x76, },
-        { 10, 14875, 13750, 0x75, },
-        { 11, 14750, 13625, 0x74, },
-        { 12, 14625, 13500, 0x73, },
-        { 13, 14500, 13375, 0x72, },
-        { 14, 14375, 13250, 0x71, },
-        { 15, 14250, 13125, 0x70, },
-        { 16, 14125, 13000, 0x6f, },
-        { 17, 14000, 12875, 0x6e, },
-        { 18, 13875, 12750, 0x6d, },
-        { 19, 13750, 12625, 0x6c, },
-        { 20, 13625, 12500, 0x6b, },
-        { 21, 13500, 12375, 0x6a, },
-        { 22, 13375, 12250, 0x69, },
-        { 23, 13250, 12125, 0x68, },
-        { 24, 13125, 12000, 0x67, },
-        { 25, 13000, 11875, 0x66, },
-        { 26, 12875, 11750, 0x65, },
-        { 27, 12750, 11625, 0x64, },
-        { 28, 12625, 11500, 0x63, },
-        { 29, 12500, 11375, 0x62, },
-        { 30, 12375, 11250, 0x61, },
-        { 31, 12250, 11125, 0x60, },
-        { 32, 12125, 11000, 0x5f, },
-        { 33, 12000, 10875, 0x5e, },
-        { 34, 11875, 10750, 0x5d, },
-        { 35, 11750, 10625, 0x5c, },
-        { 36, 11625, 10500, 0x5b, },
-        { 37, 11500, 10375, 0x5a, },
-        { 38, 11375, 10250, 0x59, },
-        { 39, 11250, 10125, 0x58, },
-        { 40, 11125, 10000, 0x57, },
-        { 41, 11000, 9875, 0x56, },
-        { 42, 10875, 9750, 0x55, },
-        { 43, 10750, 9625, 0x54, },
-        { 44, 10625, 9500, 0x53, },
-        { 45, 10500, 9375, 0x52, },
-        { 46, 10375, 9250, 0x51, },
-        { 47, 10250, 9125, 0x50, },
-        { 48, 10125, 9000, 0x4f, },
-        { 49, 10000, 8875, 0x4e, },
-        { 50, 9875, 8750, 0x4d, },
-        { 51, 9750, 8625, 0x4c, },
-        { 52, 9625, 8500, 0x4b, },
-        { 53, 9500, 8375, 0x4a, },
-        { 54, 9375, 8250, 0x49, },
-        { 55, 9250, 8125, 0x48, },
-        { 56, 9125, 8000, 0x47, },
-        { 57, 9000, 7875, 0x46, },
-        { 58, 8875, 7750, 0x45, },
-        { 59, 8750, 7625, 0x44, },
-        { 60, 8625, 7500, 0x43, },
-        { 61, 8500, 7375, 0x42, },
-        { 62, 8375, 7250, 0x41, },
-        { 63, 8250, 7125, 0x40, },
-        { 64, 8125, 7000, 0x3f, },
-        { 65, 8000, 6875, 0x3e, },
-        { 66, 7875, 6750, 0x3d, },
-        { 67, 7750, 6625, 0x3c, },
-        { 68, 7625, 6500, 0x3b, },
-        { 69, 7500, 6375, 0x3a, },
-        { 70, 7375, 6250, 0x39, },
-        { 71, 7250, 6125, 0x38, },
-        { 72, 7125, 6000, 0x37, },
-        { 73, 7000, 5875, 0x36, },
-        { 74, 6875, 5750, 0x35, },
-        { 75, 6750, 5625, 0x34, },
-        { 76, 6625, 5500, 0x33, },
-        { 77, 6500, 5375, 0x32, },
-        { 78, 6375, 5250, 0x31, },
-        { 79, 6250, 5125, 0x30, },
-        { 80, 6125, 5000, 0x2f, },
-        { 81, 6000, 4875, 0x2e, },
-        { 82, 5875, 4750, 0x2d, },
-        { 83, 5750, 4625, 0x2c, },
-        { 84, 5625, 4500, 0x2b, },
-        { 85, 5500, 4375, 0x2a, },
-        { 86, 5375, 4250, 0x29, },
-        { 87, 5250, 4125, 0x28, },
-        { 88, 5125, 4000, 0x27, },
-        { 89, 5000, 3875, 0x26, },
-        { 90, 4875, 3750, 0x25, },
-        { 91, 4750, 3625, 0x24, },
-        { 92, 4625, 3500, 0x23, },
-        { 93, 4500, 3375, 0x22, },
-        { 94, 4375, 3250, 0x21, },
-        { 95, 4250, 3125, 0x20, },
-        { 96, 4125, 3000, 0x1f, },
-        { 97, 4125, 3000, 0x1e, },
-        { 98, 4125, 3000, 0x1d, },
-        { 99, 4125, 3000, 0x1c, },
-        { 100, 4125, 3000, 0x1b, },
-        { 101, 4125, 3000, 0x1a, },
-        { 102, 4125, 3000, 0x19, },
-        { 103, 4125, 3000, 0x18, },
-        { 104, 4125, 3000, 0x17, },
-        { 105, 4125, 3000, 0x16, },
-        { 106, 4125, 3000, 0x15, },
-        { 107, 4125, 3000, 0x14, },
-        { 108, 4125, 3000, 0x13, },
-        { 109, 4125, 3000, 0x12, },
-        { 110, 4125, 3000, 0x11, },
-        { 111, 4125, 3000, 0x10, },
-        { 112, 4125, 3000, 0x0f, },
-        { 113, 4125, 3000, 0x0e, },
-        { 114, 4125, 3000, 0x0d, },
-        { 115, 4125, 3000, 0x0c, },
-        { 116, 4125, 3000, 0x0b, },
-        { 117, 4125, 3000, 0x0a, },
-        { 118, 4125, 3000, 0x09, },
-        { 119, 4125, 3000, 0x08, },
-        { 120, 1125, 0, 0x07, },
-        { 121, 1000, 0, 0x06, },
-        { 122, 875, 0, 0x05, },
-        { 123, 750, 0, 0x04, },
-        { 124, 625, 0, 0x03, },
-        { 125, 500, 0, 0x02, },
-        { 126, 375, 0, 0x01, },
-        { 127, 0, 0, 0x00, },
-};
-struct cparams {
-        int i;
-        int t;
-        int m;
-        int c;
-};
-static struct cparams cparams[] = {
        { 1, 1333, 301, 28664 },
        { 1, 1066, 294, 24460 },
        { 1, 800, 294, 25192 },
@@ -1633,21 +1475,145 @@ unsigned long i915_mch_val(struct drm_i915_private *dev_priv)
        return ((m * x) / 127) - b;
 }
-static unsigned long pvid_to_extvid(struct drm_i915_private *dev_priv, u8 pxvid)
+static u16 pvid_to_extvid(struct drm_i915_private *dev_priv, u8 pxvid)
 {
-        unsigned long val = 0;
+        static const struct v_table {
-        int i;
+                u16 vd; /* in .1 mil */
+                u16 vm; /* in .1 mil */
-        for (i = 0; i < ARRAY_SIZE(v_table); i++) {
+        } v_table[] = {
-                if (v_table[i].pvid == pxvid) {
+                { 0, 0, },
-                        if (IS_MOBILE(dev_priv->dev))
+                { 375, 0, },
-                                val = v_table[i].vm;
+                { 500, 0, },
-                        else
+                { 625, 0, },
-                                val = v_table[i].vd;
+                { 750, 0, },
-                }
+                { 875, 0, },
-        }
+                { 1000, 0, },
+                { 1125, 0, },
-        return val;
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4125, 3000, },
+                { 4250, 3125, },
+                { 4375, 3250, },
+                { 4500, 3375, },
+                { 4625, 3500, },
+                { 4750, 3625, },
+                { 4875, 3750, },
+                { 5000, 3875, },
+                { 5125, 4000, },
+                { 5250, 4125, },
+                { 5375, 4250, },
+                { 5500, 4375, },
+                { 5625, 4500, },
+                { 5750, 4625, },
+                { 5875, 4750, },
+                { 6000, 4875, },
+                { 6125, 5000, },
+                { 6250, 5125, },
+                { 6375, 5250, },
+                { 6500, 5375, },
+                { 6625, 5500, },
+                { 6750, 5625, },
+                { 6875, 5750, },
+                { 7000, 5875, },
+                { 7125, 6000, },
+                { 7250, 6125, },
+                { 7375, 6250, },
+                { 7500, 6375, },
+                { 7625, 6500, },
+                { 7750, 6625, },
+                { 7875, 6750, },
+                { 8000, 6875, },
+                { 8125, 7000, },
+                { 8250, 7125, },
+                { 8375, 7250, },
+                { 8500, 7375, },
+                { 8625, 7500, },
+                { 8750, 7625, },
+                { 8875, 7750, },
+                { 9000, 7875, },
+                { 9125, 8000, },
+                { 9250, 8125, },
+                { 9375, 8250, },
+                { 9500, 8375, },
+                { 9625, 8500, },
+                { 9750, 8625, },
+                { 9875, 8750, },
+                { 10000, 8875, },
+                { 10125, 9000, },
+                { 10250, 9125, },
+                { 10375, 9250, },
+                { 10500, 9375, },
+                { 10625, 9500, },
+                { 10750, 9625, },
+                { 10875, 9750, },
+                { 11000, 9875, },
+                { 11125, 10000, },
+                { 11250, 10125, },
+                { 11375, 10250, },
+                { 11500, 10375, },
+                { 11625, 10500, },
+                { 11750, 10625, },
+                { 11875, 10750, },
+                { 12000, 10875, },
+                { 12125, 11000, },
+                { 12250, 11125, },
+                { 12375, 11250, },
+                { 12500, 11375, },
+                { 12625, 11500, },
+                { 12750, 11625, },
+                { 12875, 11750, },
+                { 13000, 11875, },
+                { 13125, 12000, },
+                { 13250, 12125, },
+                { 13375, 12250, },
+                { 13500, 12375, },
+                { 13625, 12500, },
+                { 13750, 12625, },
+                { 13875, 12750, },
+                { 14000, 12875, },
+                { 14125, 13000, },
+                { 14250, 13125, },
+                { 14375, 13250, },
+                { 14500, 13375, },
+                { 14625, 13500, },
+                { 14750, 13625, },
+                { 14875, 13750, },
+                { 15000, 13875, },
+                { 15125, 14000, },
+                { 15250, 14125, },
+                { 15375, 14250, },
+                { 15500, 14375, },
+                { 15625, 14500, },
+                { 15750, 14625, },
+                { 15875, 14750, },
+                { 16000, 14875, },
+                { 16125, 15000, },
+        };
+        if (dev_priv->info->is_mobile)
+                return v_table[pxvid].vm;
+        else
+                return v_table[pxvid].vd;
 }
 void i915_update_gfx_val(struct drm_i915_private *dev_priv)
@@ -1881,9 +1847,9 @@ EXPORT_SYMBOL_GPL(i915_gpu_turbo_disable);
 int i915_driver_load(struct drm_device *dev, unsigned long flags)
 {
        struct drm_i915_private *dev_priv;
-        resource_size_t base, size;
        int ret = 0, mmio_bar;
-        uint32_t agp_size, prealloc_size;
+        uint32_t agp_size;
        /* i915 has 4 more counters */
        dev->counters += 4;
        dev->types[6] = _DRM_STAT_IRQ;
@@ -1899,11 +1865,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        dev_priv->dev = dev;
        dev_priv->info = (struct intel_device_info *) flags;
-        /* Add register map (needed for suspend/resume) */
-        mmio_bar = IS_GEN2(dev) ? 1 : 0;
-        base = pci_resource_start(dev->pdev, mmio_bar);
-        size = pci_resource_len(dev->pdev, mmio_bar);
        if (i915_get_bridge_dev(dev)) {
                ret = -EIO;
                goto free_priv;
@@ -1913,16 +1874,25 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (IS_GEN2(dev))
                dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(30));
-        dev_priv->regs = ioremap(base, size);
+        mmio_bar = IS_GEN2(dev) ? 1 : 0;
+        dev_priv->regs = pci_iomap(dev->pdev, mmio_bar, 0);
        if (!dev_priv->regs) {
                DRM_ERROR("failed to map registers\n");
                ret = -EIO;
                goto put_bridge;
        }
+        dev_priv->mm.gtt = intel_gtt_get();
+        if (!dev_priv->mm.gtt) {
+                DRM_ERROR("Failed to initialize GTT\n");
+                ret = -ENODEV;
+                goto out_iomapfree;
+        }
+        agp_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
        dev_priv->mm.gtt_mapping =
-                io_mapping_create_wc(dev->agp->base,
+                io_mapping_create_wc(dev->agp->base, agp_size);
-                                     dev->agp->agp_info.aper_size * 1024*1024);
        if (dev_priv->mm.gtt_mapping == NULL) {
                ret = -EIO;
                goto out_rmmap;
@@ -1934,24 +1904,13 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         * MTRR if present.  Even if a UC MTRR isn't present.
         */
        dev_priv->mm.gtt_mtrr = mtrr_add(dev->agp->base,
-                                         dev->agp->agp_info.aper_size *
+                                         agp_size,
-                                         1024 * 1024,
                                         MTRR_TYPE_WRCOMB, 1);
        if (dev_priv->mm.gtt_mtrr < 0) {
                DRM_INFO("MTRR allocation failed.  Graphics "
                         "performance may suffer.\n");
        }
-        dev_priv->mm.gtt = intel_gtt_get();
-        if (!dev_priv->mm.gtt) {
-                DRM_ERROR("Failed to initialize GTT\n");
-                ret = -ENODEV;
-                goto out_iomapfree;
-        }
-        prealloc_size = dev_priv->mm.gtt->gtt_stolen_entries << PAGE_SHIFT;
-        agp_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
        /* The i915 workqueue is primarily used for batched retirement of
         * requests (and thus managing bo) once the task has been completed
         * by the GPU. i915_gem_retire_requests() is called directly when we
@@ -1959,7 +1918,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         * bo.
         *
         * It is also used for periodic low-priority events, such as
-         * idle-timers and hangcheck.
+         * idle-timers and recording error state.
         *
         * All tasks on the workqueue are expected to acquire the dev mutex
         * so there is no point in running more than one instance of the
@@ -1977,20 +1936,11 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        /* enable GEM by default */
        dev_priv->has_gem = 1;
-        if (prealloc_size > agp_size * 3 / 4) {
-                DRM_ERROR("Detected broken video BIOS with %d/%dkB of video "
-                          "memory stolen.\n",
-                          prealloc_size / 1024, agp_size / 1024);
-                DRM_ERROR("Disabling GEM. (try reducing stolen memory or "
-                          "updating the BIOS to fix).\n");
-                dev_priv->has_gem = 0;
-        }
        if (dev_priv->has_gem == 0 &&
            drm_core_check_feature(dev, DRIVER_MODESET)) {
                DRM_ERROR("kernel modesetting requires GEM, disabling driver.\n");
                ret = -ENODEV;
-                goto out_iomapfree;
+                goto out_workqueue_free;
        }
        dev->driver->get_vblank_counter = i915_get_vblank_counter;
@@ -2013,8 +1963,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        /* Init HWS */
        if (!I915_NEED_GFX_HWS(dev)) {
                ret = i915_init_phys_hws(dev);
-                if (ret != 0)
+                if (ret)
-                        goto out_workqueue_free;
+                        goto out_gem_unload;
        }
        if (IS_PINEVIEW(dev))
@@ -2036,16 +1986,13 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (!IS_I945G(dev) && !IS_I945GM(dev))
                pci_enable_msi(dev->pdev);
-        spin_lock_init(&dev_priv->user_irq_lock);
+        spin_lock_init(&dev_priv->irq_lock);
        spin_lock_init(&dev_priv->error_lock);
        dev_priv->trace_irq_seqno = 0;
        ret = drm_vblank_init(dev, I915_NUM_PIPE);
+        if (ret)
-        if (ret) {
+                goto out_gem_unload;
-                (void) i915_driver_unload(dev);
-                return ret;
-        }
        /* Start out suspended */
        dev_priv->mm.suspended = 1;
@@ -2053,10 +2000,10 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        intel_detect_pch(dev);
        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                ret = i915_load_modeset_init(dev, prealloc_size, agp_size);
+                ret = i915_load_modeset_init(dev);
                if (ret < 0) {
                        DRM_ERROR("failed to init modeset\n");
-                        goto out_workqueue_free;
+                        goto out_gem_unload;
                }
        }
@@ -2074,12 +2021,18 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        return 0;
+out_gem_unload:
+        if (dev->pdev->msi_enabled)
+                pci_disable_msi(dev->pdev);
+        intel_teardown_gmbus(dev);
+        intel_teardown_mchbar(dev);
 out_workqueue_free:
        destroy_workqueue(dev_priv->wq);
 out_iomapfree:
        io_mapping_free(dev_priv->mm.gtt_mapping);
 out_rmmap:
-        iounmap(dev_priv->regs);
+        pci_iounmap(dev->pdev, dev_priv->regs);
 put_bridge:
        pci_dev_put(dev_priv->bridge_dev);
 free_priv:
@@ -2096,6 +2049,9 @@ int i915_driver_unload(struct drm_device *dev)
        i915_mch_dev = NULL;
        spin_unlock(&mchdev_lock);
+        if (dev_priv->mm.inactive_shrinker.shrink)
+                unregister_shrinker(&dev_priv->mm.inactive_shrinker);
        mutex_lock(&dev->struct_mutex);
        ret = i915_gpu_idle(dev);
        if (ret)
@@ -2153,7 +2109,7 @@ int i915_driver_unload(struct drm_device *dev)
                mutex_unlock(&dev->struct_mutex);
                if (I915_HAS_FBC(dev) && i915_powersave)
                        i915_cleanup_compression(dev);
-                drm_mm_takedown(&dev_priv->mm.vram);
+                drm_mm_takedown(&dev_priv->mm.stolen);
                intel_cleanup_overlay(dev);
@@ -2162,7 +2118,7 @@ int i915_driver_unload(struct drm_device *dev)
        }
        if (dev_priv->regs != NULL)
-                iounmap(dev_priv->regs);
+                pci_iounmap(dev->pdev, dev_priv->regs);
        intel_teardown_gmbus(dev);
        intel_teardown_mchbar(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f737960712e6..9eee6cf7901e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -111,7 +111,7 @@ static const struct intel_device_info intel_i965g_info = {
 static const struct intel_device_info intel_i965gm_info = {
        .gen = 4, .is_crestline = 1,
-        .is_mobile = 1, .has_fbc = 1, .has_rc6 = 1, .has_hotplug = 1,
+        .is_mobile = 1, .has_fbc = 1, .has_hotplug = 1,
        .has_overlay = 1,
        .supports_tv = 1,
 };
@@ -130,7 +130,7 @@ static const struct intel_device_info intel_g45_info = {
 static const struct intel_device_info intel_gm45_info = {
        .gen = 4, .is_g4x = 1,
-        .is_mobile = 1, .need_gfx_hws = 1, .has_fbc = 1, .has_rc6 = 1,
+        .is_mobile = 1, .need_gfx_hws = 1, .has_fbc = 1,
        .has_pipe_cxsr = 1, .has_hotplug = 1,
        .supports_tv = 1,
        .has_bsd_ring = 1,
@@ -150,7 +150,7 @@ static const struct intel_device_info intel_ironlake_d_info = {
 static const struct intel_device_info intel_ironlake_m_info = {
        .gen = 5, .is_mobile = 1,
-        .need_gfx_hws = 1, .has_rc6 = 1, .has_hotplug = 1,
+        .need_gfx_hws = 1, .has_hotplug = 1,
        .has_fbc = 0, /* disabled due to buggy hardware */
        .has_bsd_ring = 1,
 };
@@ -165,6 +165,7 @@ static const struct intel_device_info intel_sandybridge_d_info = {
 static const struct intel_device_info intel_sandybridge_m_info = {
        .gen = 6, .is_mobile = 1,
        .need_gfx_hws = 1, .has_hotplug = 1,
+        .has_fbc = 1,
        .has_bsd_ring = 1,
        .has_blt_ring = 1,
 };
@@ -244,6 +245,28 @@ void intel_detect_pch (struct drm_device *dev)
        }
 }
+void __gen6_force_wake_get(struct drm_i915_private *dev_priv)
+{
+        int count;
+        count = 0;
+        while (count++ < 50 && (I915_READ_NOTRACE(FORCEWAKE_ACK) & 1))
+                udelay(10);
+        I915_WRITE_NOTRACE(FORCEWAKE, 1);
+        POSTING_READ(FORCEWAKE);
+        count = 0;
+        while (count++ < 50 && (I915_READ_NOTRACE(FORCEWAKE_ACK) & 1) == 0)
+                udelay(10);
+}
+void __gen6_force_wake_put(struct drm_i915_private *dev_priv)
+{
+        I915_WRITE_NOTRACE(FORCEWAKE, 0);
+        POSTING_READ(FORCEWAKE);
+}
 static int i915_drm_freeze(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -304,6 +327,12 @@ static int i915_drm_thaw(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        int error = 0;
+        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+                mutex_lock(&dev->struct_mutex);
+                i915_gem_restore_gtt_mappings(dev);
+                mutex_unlock(&dev->struct_mutex);
+        }
        i915_restore_state(dev);
        intel_opregion_setup(dev);
@@ -405,6 +434,14 @@ static int ironlake_do_reset(struct drm_device *dev, u8 flags)
        return wait_for(I915_READ(MCHBAR_MIRROR_BASE + ILK_GDSR) & 0x1, 500);
 }
+static int gen6_do_reset(struct drm_device *dev, u8 flags)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        I915_WRITE(GEN6_GDRST, GEN6_GRDOM_FULL);
+        return wait_for((I915_READ(GEN6_GDRST) & GEN6_GRDOM_FULL) == 0, 500);
+}
 /**
 * i965_reset - reset chip after a hang
 * @dev: drm device to reset
@@ -431,7 +468,8 @@ int i915_reset(struct drm_device *dev, u8 flags)
        bool need_display = true;
        int ret;
-        mutex_lock(&dev->struct_mutex);
+        if (!mutex_trylock(&dev->struct_mutex))
+                return -EBUSY;
        i915_gem_reset(dev);
@@ -439,6 +477,9 @@ int i915_reset(struct drm_device *dev, u8 flags)
        if (get_seconds() - dev_priv->last_gpu_reset < 5) {
                DRM_ERROR("GPU hanging too fast, declaring wedged!\n");
        } else switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                ret = gen6_do_reset(dev, flags);
+                break;
        case 5:
                ret = ironlake_do_reset(dev, flags);
                break;
@@ -472,9 +513,14 @@ int i915_reset(struct drm_device *dev, u8 flags)
         */
        if (drm_core_check_feature(dev, DRIVER_MODESET) ||
                        !dev_priv->mm.suspended) {
-                struct intel_ring_buffer *ring = &dev_priv->render_ring;
                dev_priv->mm.suspended = 0;
-                ring->init(dev, ring);
+                dev_priv->ring[RCS].init(&dev_priv->ring[RCS]);
+                if (HAS_BSD(dev))
+                    dev_priv->ring[VCS].init(&dev_priv->ring[VCS]);
+                if (HAS_BLT(dev))
+                    dev_priv->ring[BCS].init(&dev_priv->ring[BCS]);
                mutex_unlock(&dev->struct_mutex);
                drm_irq_uninstall(dev);
                drm_irq_install(dev);
@@ -606,6 +652,8 @@ static struct drm_driver driver = {
        .device_is_agp = i915_driver_device_is_agp,
        .enable_vblank = i915_enable_vblank,
        .disable_vblank = i915_disable_vblank,
+        .get_vblank_timestamp = i915_get_vblank_timestamp,
+        .get_scanout_position = i915_get_crtc_scanoutpos,
        .irq_preinstall = i915_driver_irq_preinstall,
        .irq_postinstall = i915_driver_irq_postinstall,
        .irq_uninstall = i915_driver_irq_uninstall,
@@ -661,8 +709,6 @@ static int __init i915_init(void)
        driver.num_ioctls = i915_max_ioctl;
-        i915_gem_shrinker_init();
        /*
         * If CONFIG_DRM_I915_KMS is set, default to KMS unless
         * explicitly disabled with the module pararmeter.
@@ -684,17 +730,11 @@ static int __init i915_init(void)
                driver.driver_features &= ~DRIVER_MODESET;
 #endif
-        if (!(driver.driver_features & DRIVER_MODESET)) {
-                driver.suspend = i915_suspend;
-                driver.resume = i915_resume;
-        }
        return drm_init(&driver);
 }
 static void __exit i915_exit(void)
 {
-        i915_gem_shrinker_exit();
        drm_exit(&driver);
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 409826da3099..aac1bf332f75 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -89,7 +89,7 @@ struct drm_i915_gem_phys_object {
        int id;
        struct page **page_list;
        drm_dma_handle_t *handle;
-        struct drm_gem_object *cur_obj;
+        struct drm_i915_gem_object *cur_obj;
 };
 struct mem_block {
@@ -124,9 +124,9 @@ struct drm_i915_master_private {
 #define I915_FENCE_REG_NONE -1
 struct drm_i915_fence_reg {
-        struct drm_gem_object *obj;
        struct list_head lru_list;
-        bool gpu;
+        struct drm_i915_gem_object *obj;
+        uint32_t setup_seqno;
 };
 struct sdvo_device_mapping {
@@ -139,6 +139,8 @@ struct sdvo_device_mapping {
        u8 ddc_pin;
 };
+struct intel_display_error_state;
 struct drm_i915_error_state {
        u32 eir;
        u32 pgtbl_er;
@@ -148,11 +150,23 @@ struct drm_i915_error_state {
        u32 ipehr;
        u32 instdone;
        u32 acthd;
+        u32 error; /* gen6+ */
+        u32 bcs_acthd; /* gen6+ blt engine */
+        u32 bcs_ipehr;
+        u32 bcs_ipeir;
+        u32 bcs_instdone;
+        u32 bcs_seqno;
+        u32 vcs_acthd; /* gen6+ bsd engine */
+        u32 vcs_ipehr;
+        u32 vcs_ipeir;
+        u32 vcs_instdone;
+        u32 vcs_seqno;
        u32 instpm;
        u32 instps;
        u32 instdone1;
        u32 seqno;
        u64 bbaddr;
+        u64 fence[16];
        struct timeval time;
        struct drm_i915_error_object {
                int page_count;
@@ -171,9 +185,11 @@ struct drm_i915_error_state {
                u32 tiling:2;
                u32 dirty:1;
                u32 purgeable:1;
-        } *active_bo;
+                u32 ring:4;
-        u32 active_bo_count;
+        } *active_bo, *pinned_bo;
+        u32 active_bo_count, pinned_bo_count;
        struct intel_overlay_error_state *overlay;
+        struct intel_display_error_state *display;
 };
 struct drm_i915_display_funcs {
@@ -207,7 +223,6 @@ struct intel_device_info {
        u8 is_broadwater : 1;
        u8 is_crestline : 1;
        u8 has_fbc : 1;
-        u8 has_rc6 : 1;
        u8 has_pipe_cxsr : 1;
        u8 has_hotplug : 1;
        u8 cursor_needs_physical : 1;
@@ -243,6 +258,7 @@ typedef struct drm_i915_private {
        const struct intel_device_info *info;
        int has_gem;
+        int relative_constants_mode;
        void __iomem *regs;
@@ -253,20 +269,15 @@ typedef struct drm_i915_private {
        } *gmbus;
        struct pci_dev *bridge_dev;
-        struct intel_ring_buffer render_ring;
+        struct intel_ring_buffer ring[I915_NUM_RINGS];
-        struct intel_ring_buffer bsd_ring;
-        struct intel_ring_buffer blt_ring;
        uint32_t next_seqno;
        drm_dma_handle_t *status_page_dmah;
-        void *seqno_page;
        dma_addr_t dma_status_page;
        uint32_t counter;
-        unsigned int seqno_gfx_addr;
        drm_local_map_t hws_map;
-        struct drm_gem_object *seqno_obj;
+        struct drm_i915_gem_object *pwrctx;
-        struct drm_gem_object *pwrctx;
+        struct drm_i915_gem_object *renderctx;
-        struct drm_gem_object *renderctx;
        struct resource mch_res;
@@ -275,25 +286,17 @@ typedef struct drm_i915_private {
        int front_offset;
        int current_page;
        int page_flipping;
-#define I915_DEBUG_READ (1<<0)
-#define I915_DEBUG_WRITE (1<<1)
-        unsigned long debug_flags;
-        wait_queue_head_t irq_queue;
        atomic_t irq_received;
-        /** Protects user_irq_refcount and irq_mask_reg */
-        spinlock_t user_irq_lock;
        u32 trace_irq_seqno;
+        /* protects the irq masks */
+        spinlock_t irq_lock;
        /** Cached value of IMR to avoid reads in updating the bitfield */
-        u32 irq_mask_reg;
        u32 pipestat[2];
-        /** splitted irq regs for graphics and display engine on Ironlake,
+        u32 irq_mask;
-            irq_mask_reg is still used for display irq. */
+        u32 gt_irq_mask;
-        u32 gt_irq_mask_reg;
+        u32 pch_irq_mask;
-        u32 gt_irq_enable_reg;
-        u32 de_irq_enable_reg;
-        u32 pch_irq_mask_reg;
-        u32 pch_irq_enable_reg;
        u32 hotplug_supported_mask;
        struct work_struct hotplug_work;
@@ -306,7 +309,7 @@ typedef struct drm_i915_private {
        int num_pipe;
        /* For hangcheck timer */
-#define DRM_I915_HANGCHECK_PERIOD 250 /* in ms */
+#define DRM_I915_HANGCHECK_PERIOD 1500 /* in ms */
        struct timer_list hangcheck_timer;
        int hangcheck_count;
        uint32_t last_acthd;
@@ -530,23 +533,21 @@ typedef struct drm_i915_private {
        struct {
                /** Bridge to intel-gtt-ko */
-                struct intel_gtt *gtt;
+                const struct intel_gtt *gtt;
                /** Memory allocator for GTT stolen memory */
-                struct drm_mm vram;
+                struct drm_mm stolen;
                /** Memory allocator for GTT */
                struct drm_mm gtt_space;
+                /** List of all objects in gtt_space. Used to restore gtt
+                 * mappings on resume */
+                struct list_head gtt_list;
+                /** End of mappable part of GTT */
+                unsigned long gtt_mappable_end;
                struct io_mapping *gtt_mapping;
                int gtt_mtrr;
-                /**
+                struct shrinker inactive_shrinker;
-                 * Membership on list of all loaded devices, used to evict
-                 * inactive buffers under memory pressure.
-                 *
-                 * Modifications should only be done whilst holding the
-                 * shrink_list_lock spinlock.
-                 */
-                struct list_head shrink_list;
                /**
                 * List of objects currently involved in rendering.
@@ -609,16 +610,6 @@ typedef struct drm_i915_private {
                struct delayed_work retire_work;
                /**
-                 * Waiting sequence number, if any
-                 */
-                uint32_t waiting_gem_seqno;
-                /**
-                 * Last seq seen at irq time
-                 */
-                uint32_t irq_gem_seqno;
-                /**
                 * Flag if the X Server, and thus DRM, is not currently in
                 * control of the device.
                 *
@@ -645,16 +636,11 @@ typedef struct drm_i915_private {
                /* storage for physical objects */
                struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];
-                uint32_t flush_rings;
                /* accounting, useful for userland debugging */
-                size_t object_memory;
-                size_t pin_memory;
-                size_t gtt_memory;
                size_t gtt_total;
+                size_t mappable_gtt_total;
+                size_t object_memory;
                u32 object_count;
-                u32 pin_count;
-                u32 gtt_count;
        } mm;
        struct sdvo_device_mapping sdvo_mappings[2];
        /* indicate whether the LVDS_BORDER should be enabled or not */
@@ -688,14 +674,14 @@ typedef struct drm_i915_private {
        u8 fmax;
        u8 fstart;
-        u64 last_count1;
+        u64 last_count1;
-        unsigned long last_time1;
+        unsigned long last_time1;
-        u64 last_count2;
+        u64 last_count2;
-        struct timespec last_time2;
+        struct timespec last_time2;
-        unsigned long gfx_power;
+        unsigned long gfx_power;
-        int c_m;
+        int c_m;
-        int r_t;
+        int r_t;
-        u8 corr;
+        u8 corr;
        spinlock_t *mchdev_lock;
        enum no_fbc_reason no_fbc_reason;
@@ -709,20 +695,20 @@ typedef struct drm_i915_private {
        struct intel_fbdev *fbdev;
 } drm_i915_private_t;
-/** driver private structure attached to each drm_gem_object */
 struct drm_i915_gem_object {
        struct drm_gem_object base;
        /** Current space allocated to this object in the GTT, if any. */
        struct drm_mm_node *gtt_space;
+        struct list_head gtt_list;
        /** This object's place on the active/flushing/inactive lists */
        struct list_head ring_list;
        struct list_head mm_list;
        /** This object's place on GPU write list */
        struct list_head gpu_write_list;
-        /** This object's place on eviction list */
+        /** This object's place in the batchbuffer or on the eviction list */
-        struct list_head evict_list;
+        struct list_head exec_list;
        /**
         * This is set if the object is on the active or flushing lists
@@ -738,6 +724,12 @@ struct drm_i915_gem_object {
        unsigned int dirty : 1;
        /**
+         * This is set if the object has been written to since the last
+         * GPU flush.
+         */
+        unsigned int pending_gpu_write : 1;
+        /**
         * Fence register bits (if any) for this object.  Will be set
         * as needed when mapped into the GTT.
         * Protected by dev->struct_mutex.
@@ -747,29 +739,15 @@ struct drm_i915_gem_object {
        signed int fence_reg : 5;
        /**
-         * Used for checking the object doesn't appear more than once
-         * in an execbuffer object list.
-         */
-        unsigned int in_execbuffer : 1;
-        /**
         * Advice: are the backing pages purgeable?
         */
        unsigned int madv : 2;
        /**
-         * Refcount for the pages array. With the current locking scheme, there
-         * are at most two concurrent users: Binding a bo to the gtt and
-         * pwrite/pread using physical addresses. So two bits for a maximum
-         * of two users are enough.
-         */
-        unsigned int pages_refcount : 2;
-#define DRM_I915_GEM_OBJECT_MAX_PAGES_REFCOUNT 0x3
-        /**
         * Current tiling mode for the object.
         */
        unsigned int tiling_mode : 2;
+        unsigned int tiling_changed : 1;
        /** How many users have pinned this object in GTT space. The following
         * users can each hold at most one reference: pwrite/pread, pin_ioctl
@@ -783,28 +761,54 @@ struct drm_i915_gem_object {
        unsigned int pin_count : 4;
 #define DRM_I915_GEM_OBJECT_MAX_PIN_COUNT 0xf
-        /** AGP memory structure for our GTT binding. */
+        /**
-        DRM_AGP_MEM *agp_mem;
+         * Is the object at the current location in the gtt mappable and
+         * fenceable? Used to avoid costly recalculations.
+         */
+        unsigned int map_and_fenceable : 1;
+        /**
+         * Whether the current gtt mapping needs to be mappable (and isn't just
+         * mappable by accident). Track pin and fault separate for a more
+         * accurate mappable working set.
+         */
+        unsigned int fault_mappable : 1;
+        unsigned int pin_mappable : 1;
+        /*
+         * Is the GPU currently using a fence to access this buffer,
+         */
+        unsigned int pending_fenced_gpu_access:1;
+        unsigned int fenced_gpu_access:1;
        struct page **pages;
        /**
-         * Current offset of the object in GTT space.
+         * DMAR support
-         *
-         * This is the same as gtt_space->start
         */
-        uint32_t gtt_offset;
+        struct scatterlist *sg_list;
+        int num_sg;
-        /* Which ring is refering to is this object */
+        /**
-        struct intel_ring_buffer *ring;
+         * Used for performing relocations during execbuffer insertion.
+         */
+        struct hlist_node exec_node;
+        unsigned long exec_handle;
        /**
-         * Fake offset for use by mmap(2)
+         * Current offset of the object in GTT space.
+         *
+         * This is the same as gtt_space->start
         */
-        uint64_t mmap_offset;
+        uint32_t gtt_offset;
        /** Breadcrumb of last rendering to the buffer. */
        uint32_t last_rendering_seqno;
+        struct intel_ring_buffer *ring;
+        /** Breadcrumb of last fenced GPU access to the buffer. */
+        uint32_t last_fenced_seqno;
+        struct intel_ring_buffer *last_fenced_ring;
        /** Current tiling stride for the object, if it's tiled. */
        uint32_t stride;
@@ -880,6 +884,68 @@ enum intel_chip_family {
        CHIP_I965 = 0x08,
 };
+#define INTEL_INFO(dev) (((struct drm_i915_private *) (dev)->dev_private)->info)
+#define IS_I830(dev)            ((dev)->pci_device == 0x3577)
+#define IS_845G(dev)            ((dev)->pci_device == 0x2562)
+#define IS_I85X(dev)            (INTEL_INFO(dev)->is_i85x)
+#define IS_I865G(dev)           ((dev)->pci_device == 0x2572)
+#define IS_I915G(dev)           (INTEL_INFO(dev)->is_i915g)
+#define IS_I915GM(dev)          ((dev)->pci_device == 0x2592)
+#define IS_I945G(dev)           ((dev)->pci_device == 0x2772)
+#define IS_I945GM(dev)          (INTEL_INFO(dev)->is_i945gm)
+#define IS_BROADWATER(dev)      (INTEL_INFO(dev)->is_broadwater)
+#define IS_CRESTLINE(dev)       (INTEL_INFO(dev)->is_crestline)
+#define IS_GM45(dev)            ((dev)->pci_device == 0x2A42)
+#define IS_G4X(dev)             (INTEL_INFO(dev)->is_g4x)
+#define IS_PINEVIEW_G(dev)      ((dev)->pci_device == 0xa001)
+#define IS_PINEVIEW_M(dev)      ((dev)->pci_device == 0xa011)
+#define IS_PINEVIEW(dev)        (INTEL_INFO(dev)->is_pineview)
+#define IS_G33(dev)             (INTEL_INFO(dev)->is_g33)
+#define IS_IRONLAKE_D(dev)      ((dev)->pci_device == 0x0042)
+#define IS_IRONLAKE_M(dev)      ((dev)->pci_device == 0x0046)
+#define IS_MOBILE(dev)          (INTEL_INFO(dev)->is_mobile)
+#define IS_GEN2(dev)    (INTEL_INFO(dev)->gen == 2)
+#define IS_GEN3(dev)    (INTEL_INFO(dev)->gen == 3)
+#define IS_GEN4(dev)    (INTEL_INFO(dev)->gen == 4)
+#define IS_GEN5(dev)    (INTEL_INFO(dev)->gen == 5)
+#define IS_GEN6(dev)    (INTEL_INFO(dev)->gen == 6)
+#define HAS_BSD(dev)            (INTEL_INFO(dev)->has_bsd_ring)
+#define HAS_BLT(dev)            (INTEL_INFO(dev)->has_blt_ring)
+#define I915_NEED_GFX_HWS(dev)  (INTEL_INFO(dev)->need_gfx_hws)
+#define HAS_OVERLAY(dev)                (INTEL_INFO(dev)->has_overlay)
+#define OVERLAY_NEEDS_PHYSICAL(dev)     (INTEL_INFO(dev)->overlay_needs_physical)
+/* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
+ * rows, which changed the alignment requirements and fence programming.
+ */
+#define HAS_128_BYTE_Y_TILING(dev) (!IS_GEN2(dev) && !(IS_I915G(dev) || \
+                                                      IS_I915GM(dev)))
+#define SUPPORTS_DIGITAL_OUTPUTS(dev)   (!IS_GEN2(dev) && !IS_PINEVIEW(dev))
+#define SUPPORTS_INTEGRATED_HDMI(dev)   (IS_G4X(dev) || IS_GEN5(dev))
+#define SUPPORTS_INTEGRATED_DP(dev)     (IS_G4X(dev) || IS_GEN5(dev))
+#define SUPPORTS_EDP(dev)               (IS_IRONLAKE_M(dev))
+#define SUPPORTS_TV(dev)                (INTEL_INFO(dev)->supports_tv)
+#define I915_HAS_HOTPLUG(dev)            (INTEL_INFO(dev)->has_hotplug)
+/* dsparb controlled by hw only */
+#define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IRONLAKE(dev))
+#define HAS_FW_BLC(dev) (INTEL_INFO(dev)->gen > 2)
+#define HAS_PIPE_CXSR(dev) (INTEL_INFO(dev)->has_pipe_cxsr)
+#define I915_HAS_FBC(dev) (INTEL_INFO(dev)->has_fbc)
+#define HAS_PCH_SPLIT(dev) (IS_GEN5(dev) || IS_GEN6(dev))
+#define HAS_PIPE_CONTROL(dev) (IS_GEN5(dev) || IS_GEN6(dev))
+#define INTEL_PCH_TYPE(dev) (((struct drm_i915_private *)(dev)->dev_private)->pch_type)
+#define HAS_PCH_CPT(dev) (INTEL_PCH_TYPE(dev) == PCH_CPT)
+#define HAS_PCH_IBX(dev) (INTEL_PCH_TYPE(dev) == PCH_IBX)
+#include "i915_trace.h"
 extern struct drm_ioctl_desc i915_ioctls[];
 extern int i915_max_ioctl;
 extern unsigned int i915_fbpercrtc;
@@ -907,8 +973,8 @@ extern int i915_driver_device_is_agp(struct drm_device * dev);
 extern long i915_compat_ioctl(struct file *filp, unsigned int cmd,
                              unsigned long arg);
 extern int i915_emit_box(struct drm_device *dev,
-                         struct drm_clip_rect *boxes,
+                         struct drm_clip_rect *box,
-                         int i, int DR1, int DR4);
+                         int DR1, int DR4);
 extern int i915_reset(struct drm_device *dev, u8 flags);
 extern unsigned long i915_chipset_val(struct drm_i915_private *dev_priv);
 extern unsigned long i915_mch_val(struct drm_i915_private *dev_priv);
@@ -918,6 +984,7 @@ extern void i915_update_gfx_val(struct drm_i915_private *dev_priv);
 /* i915_irq.c */
 void i915_hangcheck_elapsed(unsigned long data);
+void i915_handle_error(struct drm_device *dev, bool wedged);
 extern int i915_irq_emit(struct drm_device *dev, void *data,
                         struct drm_file *file_priv);
 extern int i915_irq_wait(struct drm_device *dev, void *data,
@@ -953,6 +1020,13 @@ void
 i915_disable_pipestat(drm_i915_private_t *dev_priv, int pipe, u32 mask);
 void intel_enable_asle (struct drm_device *dev);
+int i915_get_vblank_timestamp(struct drm_device *dev, int crtc,
+                              int *max_error,
+                              struct timeval *vblank_time,
+                              unsigned flags);
+int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
+                             int *vpos, int *hpos);
 #ifdef CONFIG_DEBUG_FS
 extern void i915_destroy_error_state(struct drm_device *dev);
@@ -1017,15 +1091,28 @@ int i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
 void i915_gem_load(struct drm_device *dev);
 int i915_gem_init_object(struct drm_gem_object *obj);
-struct drm_gem_object * i915_gem_alloc_object(struct drm_device *dev,
+void i915_gem_flush_ring(struct drm_device *dev,
-                                              size_t size);
+                         struct intel_ring_buffer *ring,
+                         uint32_t invalidate_domains,
+                         uint32_t flush_domains);
+struct drm_i915_gem_object *i915_gem_alloc_object(struct drm_device *dev,
+                                                  size_t size);
 void i915_gem_free_object(struct drm_gem_object *obj);
-int i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment);
+int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,
-void i915_gem_object_unpin(struct drm_gem_object *obj);
+                                     uint32_t alignment,
-int i915_gem_object_unbind(struct drm_gem_object *obj);
+                                     bool map_and_fenceable);
-void i915_gem_release_mmap(struct drm_gem_object *obj);
+void i915_gem_object_unpin(struct drm_i915_gem_object *obj);
+int __must_check i915_gem_object_unbind(struct drm_i915_gem_object *obj);
+void i915_gem_release_mmap(struct drm_i915_gem_object *obj);
 void i915_gem_lastclose(struct drm_device *dev);
+int __must_check i915_mutex_lock_interruptible(struct drm_device *dev);
+int __must_check i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
+                                                bool interruptible);
+void i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
+                                    struct intel_ring_buffer *ring,
+                                    u32 seqno);
 /**
 * Returns true if seq1 is later than seq2.
 */
@@ -1035,73 +1122,88 @@ i915_seqno_passed(uint32_t seq1, uint32_t seq2)
        return (int32_t)(seq1 - seq2) >= 0;
 }
-int i915_gem_object_get_fence_reg(struct drm_gem_object *obj,
+static inline u32
-                                  bool interruptible);
+i915_gem_next_request_seqno(struct drm_device *dev,
-int i915_gem_object_put_fence_reg(struct drm_gem_object *obj,
+                            struct intel_ring_buffer *ring)
-                                  bool interruptible);
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        return ring->outstanding_lazy_request = dev_priv->next_seqno;
+}
+int __must_check i915_gem_object_get_fence(struct drm_i915_gem_object *obj,
+                                           struct intel_ring_buffer *pipelined,
+                                           bool interruptible);
+int __must_check i915_gem_object_put_fence(struct drm_i915_gem_object *obj);
 void i915_gem_retire_requests(struct drm_device *dev);
 void i915_gem_reset(struct drm_device *dev);
-void i915_gem_clflush_object(struct drm_gem_object *obj);
+void i915_gem_clflush_object(struct drm_i915_gem_object *obj);
-int i915_gem_object_set_domain(struct drm_gem_object *obj,
+int __must_check i915_gem_object_set_domain(struct drm_i915_gem_object *obj,
-                               uint32_t read_domains,
+                                            uint32_t read_domains,
-                               uint32_t write_domain);
+                                            uint32_t write_domain);
-int i915_gem_object_flush_gpu(struct drm_i915_gem_object *obj,
+int __must_check i915_gem_object_flush_gpu(struct drm_i915_gem_object *obj,
-                              bool interruptible);
+                                           bool interruptible);
-int i915_gem_init_ringbuffer(struct drm_device *dev);
+int __must_check i915_gem_init_ringbuffer(struct drm_device *dev);
 void i915_gem_cleanup_ringbuffer(struct drm_device *dev);
-int i915_gem_do_init(struct drm_device *dev, unsigned long start,
+void i915_gem_do_init(struct drm_device *dev,
-                     unsigned long end);
+                      unsigned long start,
-int i915_gpu_idle(struct drm_device *dev);
+                      unsigned long mappable_end,
-int i915_gem_idle(struct drm_device *dev);
+                      unsigned long end);
-uint32_t i915_add_request(struct drm_device *dev,
+int __must_check i915_gpu_idle(struct drm_device *dev);
-                          struct drm_file *file_priv,
+int __must_check i915_gem_idle(struct drm_device *dev);
-                          struct drm_i915_gem_request *request,
+int __must_check i915_add_request(struct drm_device *dev,
-                          struct intel_ring_buffer *ring);
+                                  struct drm_file *file_priv,
-int i915_do_wait_request(struct drm_device *dev,
+                                  struct drm_i915_gem_request *request,
-                         uint32_t seqno,
+                                  struct intel_ring_buffer *ring);
-                         bool interruptible,
+int __must_check i915_do_wait_request(struct drm_device *dev,
-                         struct intel_ring_buffer *ring);
+                                      uint32_t seqno,
+                                      bool interruptible,
+                                      struct intel_ring_buffer *ring);
 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
-int i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj,
+int __must_check
-                                      int write);
+i915_gem_object_set_to_gtt_domain(struct drm_i915_gem_object *obj,
-int i915_gem_object_set_to_display_plane(struct drm_gem_object *obj,
+                                  bool write);
-                                         bool pipelined);
+int __must_check
+i915_gem_object_set_to_display_plane(struct drm_i915_gem_object *obj,
+                                     struct intel_ring_buffer *pipelined);
 int i915_gem_attach_phys_object(struct drm_device *dev,
-                                struct drm_gem_object *obj,
+                                struct drm_i915_gem_object *obj,
                                int id,
                                int align);
 void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_gem_object *obj);
+                                 struct drm_i915_gem_object *obj);
 void i915_gem_free_all_phys_object(struct drm_device *dev);
-void i915_gem_release(struct drm_device * dev, struct drm_file *file_priv);
+void i915_gem_release(struct drm_device *dev, struct drm_file *file);
-void i915_gem_shrinker_init(void);
+/* i915_gem_gtt.c */
-void i915_gem_shrinker_exit(void);
+void i915_gem_restore_gtt_mappings(struct drm_device *dev);
+int __must_check i915_gem_gtt_bind_object(struct drm_i915_gem_object *obj);
+void i915_gem_gtt_unbind_object(struct drm_i915_gem_object *obj);
 /* i915_gem_evict.c */
-int i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignment);
+int __must_check i915_gem_evict_something(struct drm_device *dev, int min_size,
-int i915_gem_evict_everything(struct drm_device *dev);
+                                          unsigned alignment, bool mappable);
-int i915_gem_evict_inactive(struct drm_device *dev);
+int __must_check i915_gem_evict_everything(struct drm_device *dev,
+                                           bool purgeable_only);
+int __must_check i915_gem_evict_inactive(struct drm_device *dev,
+                                         bool purgeable_only);
 /* i915_gem_tiling.c */
 void i915_gem_detect_bit_6_swizzle(struct drm_device *dev);
-void i915_gem_object_do_bit_17_swizzle(struct drm_gem_object *obj);
+void i915_gem_object_do_bit_17_swizzle(struct drm_i915_gem_object *obj);
-void i915_gem_object_save_bit_17_swizzle(struct drm_gem_object *obj);
+void i915_gem_object_save_bit_17_swizzle(struct drm_i915_gem_object *obj);
-bool i915_tiling_ok(struct drm_device *dev, int stride, int size,
-                    int tiling_mode);
-bool i915_gem_object_fence_offset_ok(struct drm_gem_object *obj,
-                                     int tiling_mode);
 /* i915_gem_debug.c */
-void i915_gem_dump_object(struct drm_gem_object *obj, int len,
+void i915_gem_dump_object(struct drm_i915_gem_object *obj, int len,
                          const char *where, uint32_t mark);
 #if WATCH_LISTS
 int i915_verify_lists(struct drm_device *dev);
 #else
 #define i915_verify_lists(dev) 0
 #endif
-void i915_gem_object_check_coherency(struct drm_gem_object *obj, int handle);
+void i915_gem_object_check_coherency(struct drm_i915_gem_object *obj,
-void i915_gem_dump_object(struct drm_gem_object *obj, int len,
+                                     int handle);
+void i915_gem_dump_object(struct drm_i915_gem_object *obj, int len,
                          const char *where, uint32_t mark);
 /* i915_debugfs.c */
@@ -1163,6 +1265,7 @@ extern void intel_disable_fbc(struct drm_device *dev);
 extern void intel_enable_fbc(struct drm_crtc *crtc, unsigned long interval);
 extern bool intel_fbc_enabled(struct drm_device *dev);
 extern bool ironlake_set_drps(struct drm_device *dev, u8 val);
+extern void gen6_set_rps(struct drm_device *dev, u8 val);
 extern void intel_detect_pch (struct drm_device *dev);
 extern int intel_trans_dp_port_sel (struct drm_crtc *crtc);
@@ -1170,79 +1273,120 @@ extern int intel_trans_dp_port_sel (struct drm_crtc *crtc);
 #ifdef CONFIG_DEBUG_FS
 extern struct intel_overlay_error_state *intel_overlay_capture_error_state(struct drm_device *dev);
 extern void intel_overlay_print_error_state(struct seq_file *m, struct intel_overlay_error_state *error);
+extern struct intel_display_error_state *intel_display_capture_error_state(struct drm_device *dev);
+extern void intel_display_print_error_state(struct seq_file *m,
+                                            struct drm_device *dev,
+                                            struct intel_display_error_state *error);
 #endif
+#define LP_RING(d) (&((struct drm_i915_private *)(d))->ring[RCS])
+#define BEGIN_LP_RING(n) \
+        intel_ring_begin(LP_RING(dev_priv), (n))
+#define OUT_RING(x) \
+        intel_ring_emit(LP_RING(dev_priv), x)
+#define ADVANCE_LP_RING() \
+        intel_ring_advance(LP_RING(dev_priv))
 /**
 * Lock test for when it's just for synchronization of ring access.
 *
 * In that case, we don't need to do it when GEM is initialized as nobody else
 * has access to the ring.
 */
-#define RING_LOCK_TEST_WITH_RETURN(dev, file_priv) do {                 \
+#define RING_LOCK_TEST_WITH_RETURN(dev, file) do {                      \
-        if (((drm_i915_private_t *)dev->dev_private)->render_ring.gem_object \
+        if (LP_RING(dev->dev_private)->obj == NULL)                     \
-                        == NULL)                                        \
+                LOCK_TEST_WITH_RETURN(dev, file);                       \
-                LOCK_TEST_WITH_RETURN(dev, file_priv);                  \
 } while (0)
-static inline u32 i915_read(struct drm_i915_private *dev_priv, u32 reg)
+#define __i915_read(x, y) \
+static inline u##x i915_read##x(struct drm_i915_private *dev_priv, u32 reg) { \
+        u##x val = read##y(dev_priv->regs + reg); \
+        trace_i915_reg_rw('R', reg, val, sizeof(val)); \
+        return val; \
+}
+__i915_read(8, b)
+__i915_read(16, w)
+__i915_read(32, l)
+__i915_read(64, q)
+#undef __i915_read
+#define __i915_write(x, y) \
+static inline void i915_write##x(struct drm_i915_private *dev_priv, u32 reg, u##x val) { \
+        trace_i915_reg_rw('W', reg, val, sizeof(val)); \
+        write##y(val, dev_priv->regs + reg); \
+}
+__i915_write(8, b)
+__i915_write(16, w)
+__i915_write(32, l)
+__i915_write(64, q)
+#undef __i915_write
+#define I915_READ8(reg)         i915_read8(dev_priv, (reg))
+#define I915_WRITE8(reg, val)   i915_write8(dev_priv, (reg), (val))
+#define I915_READ16(reg)        i915_read16(dev_priv, (reg))
+#define I915_WRITE16(reg, val)  i915_write16(dev_priv, (reg), (val))
+#define I915_READ16_NOTRACE(reg)        readw(dev_priv->regs + (reg))
+#define I915_WRITE16_NOTRACE(reg, val)  writew(val, dev_priv->regs + (reg))
+#define I915_READ(reg)          i915_read32(dev_priv, (reg))
+#define I915_WRITE(reg, val)    i915_write32(dev_priv, (reg), (val))
+#define I915_READ_NOTRACE(reg)          readl(dev_priv->regs + (reg))
+#define I915_WRITE_NOTRACE(reg, val)    writel(val, dev_priv->regs + (reg))
+#define I915_WRITE64(reg, val)  i915_write64(dev_priv, (reg), (val))
+#define I915_READ64(reg)        i915_read64(dev_priv, (reg))
+#define POSTING_READ(reg)       (void)I915_READ_NOTRACE(reg)
+#define POSTING_READ16(reg)     (void)I915_READ16_NOTRACE(reg)
+/* On SNB platform, before reading ring registers forcewake bit
+ * must be set to prevent GT core from power down and stale values being
+ * returned.
+ */
+void __gen6_force_wake_get(struct drm_i915_private *dev_priv);
+void __gen6_force_wake_put (struct drm_i915_private *dev_priv);
+static inline u32 i915_safe_read(struct drm_i915_private *dev_priv, u32 reg)
 {
        u32 val;
-        val = readl(dev_priv->regs + reg);
+        if (dev_priv->info->gen >= 6) {
-        if (dev_priv->debug_flags & I915_DEBUG_READ)
+                __gen6_force_wake_get(dev_priv);
-                printk(KERN_ERR "read 0x%08x from 0x%08x\n", val, reg);
+                val = I915_READ(reg);
+                __gen6_force_wake_put(dev_priv);
+        } else
+                val = I915_READ(reg);
        return val;
 }
-static inline void i915_write(struct drm_i915_private *dev_priv, u32 reg,
+static inline void
-                              u32 val)
+i915_write(struct drm_i915_private *dev_priv, u32 reg, u64 val, int len)
 {
-        writel(val, dev_priv->regs + reg);
+       /* Trace down the write operation before the real write */
-        if (dev_priv->debug_flags & I915_DEBUG_WRITE)
+       trace_i915_reg_rw('W', reg, val, len);
-                printk(KERN_ERR "wrote 0x%08x to 0x%08x\n", val, reg);
+       switch (len) {
+       case 8:
+               writeq(val, dev_priv->regs + reg);
+               break;
+       case 4:
+               writel(val, dev_priv->regs + reg);
+               break;
+       case 2:
+               writew(val, dev_priv->regs + reg);
+               break;
+       case 1:
+               writeb(val, dev_priv->regs + reg);
+               break;
+       }
 }
-#define I915_READ(reg)          i915_read(dev_priv, (reg))
-#define I915_WRITE(reg, val)    i915_write(dev_priv, (reg), (val))
-#define I915_READ16(reg)        readw(dev_priv->regs + (reg))
-#define I915_WRITE16(reg, val)  writel(val, dev_priv->regs + (reg))
-#define I915_READ8(reg)         readb(dev_priv->regs + (reg))
-#define I915_WRITE8(reg, val)   writeb(val, dev_priv->regs + (reg))
-#define I915_WRITE64(reg, val)  writeq(val, dev_priv->regs + (reg))
-#define I915_READ64(reg)        readq(dev_priv->regs + (reg))
-#define POSTING_READ(reg)       (void)I915_READ(reg)
-#define POSTING_READ16(reg)     (void)I915_READ16(reg)
-#define I915_DEBUG_ENABLE_IO() (dev_priv->debug_flags |= I915_DEBUG_READ | \
-                                I915_DEBUG_WRITE)
-#define I915_DEBUG_DISABLE_IO() (dev_priv->debug_flags &= ~(I915_DEBUG_READ | \
-                                                            I915_DEBUG_WRITE))
-#define I915_VERBOSE 0
-#define BEGIN_LP_RING(n)  do { \
-        drm_i915_private_t *dev_priv__ = dev->dev_private;                \
-        if (I915_VERBOSE)                                               \
-                DRM_DEBUG("   BEGIN_LP_RING %x\n", (int)(n));           \
-        intel_ring_begin(dev, &dev_priv__->render_ring, (n));           \
-} while (0)
-#define OUT_RING(x) do {                                                \
-        drm_i915_private_t *dev_priv__ = dev->dev_private;              \
-        if (I915_VERBOSE)                                               \
-                DRM_DEBUG("   OUT_RING %x\n", (int)(x));                \
-        intel_ring_emit(dev, &dev_priv__->render_ring, x);              \
-} while (0)
-#define ADVANCE_LP_RING() do {                                          \
-        drm_i915_private_t *dev_priv__ = dev->dev_private;                \
-        if (I915_VERBOSE)                                               \
-                DRM_DEBUG("ADVANCE_LP_RING %x\n",                       \
-                                dev_priv__->render_ring.tail);          \
-        intel_ring_advance(dev, &dev_priv__->render_ring);              \
-} while(0)
 /**
 * Reads a dword out of the status page, which is written to from the command
 * queue by automatic updates, MI_REPORT_HEAD, MI_STORE_DATA_INDEX, or
@@ -1259,72 +1403,9 @@ static inline void i915_write(struct drm_i915_private *dev_priv, u32 reg,
 * The area from dword 0x20 to 0x3ff is available for driver usage.
 */
 #define READ_HWSP(dev_priv, reg)  (((volatile u32 *)\
-                        (dev_priv->render_ring.status_page.page_addr))[reg])
+                        (LP_RING(dev_priv)->status_page.page_addr))[reg])
 #define READ_BREADCRUMB(dev_priv) READ_HWSP(dev_priv, I915_BREADCRUMB_INDEX)
 #define I915_GEM_HWS_INDEX              0x20
 #define I915_BREADCRUMB_INDEX           0x21
-#define INTEL_INFO(dev) (((struct drm_i915_private *) (dev)->dev_private)->info)
-#define IS_I830(dev)            ((dev)->pci_device == 0x3577)
-#define IS_845G(dev)            ((dev)->pci_device == 0x2562)
-#define IS_I85X(dev)            (INTEL_INFO(dev)->is_i85x)
-#define IS_I865G(dev)           ((dev)->pci_device == 0x2572)
-#define IS_I915G(dev)           (INTEL_INFO(dev)->is_i915g)
-#define IS_I915GM(dev)          ((dev)->pci_device == 0x2592)
-#define IS_I945G(dev)           ((dev)->pci_device == 0x2772)
-#define IS_I945GM(dev)          (INTEL_INFO(dev)->is_i945gm)
-#define IS_BROADWATER(dev)      (INTEL_INFO(dev)->is_broadwater)
-#define IS_CRESTLINE(dev)       (INTEL_INFO(dev)->is_crestline)
-#define IS_GM45(dev)            ((dev)->pci_device == 0x2A42)
-#define IS_G4X(dev)             (INTEL_INFO(dev)->is_g4x)
-#define IS_PINEVIEW_G(dev)      ((dev)->pci_device == 0xa001)
-#define IS_PINEVIEW_M(dev)      ((dev)->pci_device == 0xa011)
-#define IS_PINEVIEW(dev)        (INTEL_INFO(dev)->is_pineview)
-#define IS_G33(dev)             (INTEL_INFO(dev)->is_g33)
-#define IS_IRONLAKE_D(dev)      ((dev)->pci_device == 0x0042)
-#define IS_IRONLAKE_M(dev)      ((dev)->pci_device == 0x0046)
-#define IS_MOBILE(dev)          (INTEL_INFO(dev)->is_mobile)
-#define IS_GEN2(dev)    (INTEL_INFO(dev)->gen == 2)
-#define IS_GEN3(dev)    (INTEL_INFO(dev)->gen == 3)
-#define IS_GEN4(dev)    (INTEL_INFO(dev)->gen == 4)
-#define IS_GEN5(dev)    (INTEL_INFO(dev)->gen == 5)
-#define IS_GEN6(dev)    (INTEL_INFO(dev)->gen == 6)
-#define HAS_BSD(dev)            (INTEL_INFO(dev)->has_bsd_ring)
-#define HAS_BLT(dev)            (INTEL_INFO(dev)->has_blt_ring)
-#define I915_NEED_GFX_HWS(dev)  (INTEL_INFO(dev)->need_gfx_hws)
-#define HAS_OVERLAY(dev)                (INTEL_INFO(dev)->has_overlay)
-#define OVERLAY_NEEDS_PHYSICAL(dev)     (INTEL_INFO(dev)->overlay_needs_physical)
-/* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
- * rows, which changed the alignment requirements and fence programming.
- */
-#define HAS_128_BYTE_Y_TILING(dev) (!IS_GEN2(dev) && !(IS_I915G(dev) || \
-                                                      IS_I915GM(dev)))
-#define SUPPORTS_DIGITAL_OUTPUTS(dev)   (!IS_GEN2(dev) && !IS_PINEVIEW(dev))
-#define SUPPORTS_INTEGRATED_HDMI(dev)   (IS_G4X(dev) || IS_GEN5(dev))
-#define SUPPORTS_INTEGRATED_DP(dev)     (IS_G4X(dev) || IS_GEN5(dev))
-#define SUPPORTS_EDP(dev)               (IS_IRONLAKE_M(dev))
-#define SUPPORTS_TV(dev)                (INTEL_INFO(dev)->supports_tv)
-#define I915_HAS_HOTPLUG(dev)            (INTEL_INFO(dev)->has_hotplug)
-/* dsparb controlled by hw only */
-#define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IRONLAKE(dev))
-#define HAS_FW_BLC(dev) (INTEL_INFO(dev)->gen > 2)
-#define HAS_PIPE_CXSR(dev) (INTEL_INFO(dev)->has_pipe_cxsr)
-#define I915_HAS_FBC(dev) (INTEL_INFO(dev)->has_fbc)
-#define I915_HAS_RC6(dev) (INTEL_INFO(dev)->has_rc6)
-#define HAS_PCH_SPLIT(dev) (IS_GEN5(dev) || IS_GEN6(dev))
-#define HAS_PIPE_CONTROL(dev) (IS_GEN5(dev) || IS_GEN6(dev))
-#define INTEL_PCH_TYPE(dev) (((struct drm_i915_private *)(dev)->dev_private)->pch_type)
-#define HAS_PCH_CPT(dev) (INTEL_PCH_TYPE(dev) == PCH_CPT)
-#define HAS_PCH_IBX(dev) (INTEL_PCH_TYPE(dev) == PCH_IBX)
-#define PRIMARY_RINGBUFFER_SIZE         (128*1024)
 #endif
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 17b1cba3b5f1..c79c0b62ef60 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -34,39 +34,31 @@
 #include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/pci.h>
-#include <linux/intel-gtt.h>
-static uint32_t i915_gem_get_gtt_alignment(struct drm_gem_object *obj);
+static void i915_gem_object_flush_gpu_write_domain(struct drm_i915_gem_object *obj);
+static void i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj);
-static int i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj,
+static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj);
-                                                  bool pipelined);
+static int i915_gem_object_set_to_cpu_domain(struct drm_i915_gem_object *obj,
-static void i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj);
+                                             bool write);
-static void i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj);
+static int i915_gem_object_set_cpu_read_domain_range(struct drm_i915_gem_object *obj,
-static int i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj,
-                                             int write);
-static int i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
                                                     uint64_t offset,
                                                     uint64_t size);
-static void i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj);
+static void i915_gem_object_set_to_full_cpu_read_domain(struct drm_i915_gem_object *obj);
-static int i915_gem_object_wait_rendering(struct drm_gem_object *obj,
+static int i915_gem_object_bind_to_gtt(struct drm_i915_gem_object *obj,
-                                          bool interruptible);
+                                       unsigned alignment,
-static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
+                                       bool map_and_fenceable);
-                                           unsigned alignment);
+static void i915_gem_clear_fence_reg(struct drm_device *dev,
-static void i915_gem_clear_fence_reg(struct drm_gem_object *obj);
+                                     struct drm_i915_fence_reg *reg);
-static int i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
+static int i915_gem_phys_pwrite(struct drm_device *dev,
+                                struct drm_i915_gem_object *obj,
                                struct drm_i915_gem_pwrite *args,
-                                struct drm_file *file_priv);
+                                struct drm_file *file);
-static void i915_gem_free_object_tail(struct drm_gem_object *obj);
+static void i915_gem_free_object_tail(struct drm_i915_gem_object *obj);
-static int
+static int i915_gem_inactive_shrink(struct shrinker *shrinker,
-i915_gem_object_get_pages(struct drm_gem_object *obj,
+                                    int nr_to_scan,
-                          gfp_t gfpmask);
+                                    gfp_t gfp_mask);
-static void
-i915_gem_object_put_pages(struct drm_gem_object *obj);
-static LIST_HEAD(shrink_list);
-static DEFINE_SPINLOCK(shrink_list_lock);
 /* some bookkeeping */
 static void i915_gem_info_add_obj(struct drm_i915_private *dev_priv,
@@ -83,34 +75,6 @@ static void i915_gem_info_remove_obj(struct drm_i915_private *dev_priv,
        dev_priv->mm.object_memory -= size;
 }
-static void i915_gem_info_add_gtt(struct drm_i915_private *dev_priv,
-                                  size_t size)
-{
-        dev_priv->mm.gtt_count++;
-        dev_priv->mm.gtt_memory += size;
-}
-static void i915_gem_info_remove_gtt(struct drm_i915_private *dev_priv,
-                                     size_t size)
-{
-        dev_priv->mm.gtt_count--;
-        dev_priv->mm.gtt_memory -= size;
-}
-static void i915_gem_info_add_pin(struct drm_i915_private *dev_priv,
-                                  size_t size)
-{
-        dev_priv->mm.pin_count++;
-        dev_priv->mm.pin_memory += size;
-}
-static void i915_gem_info_remove_pin(struct drm_i915_private *dev_priv,
-                                     size_t size)
-{
-        dev_priv->mm.pin_count--;
-        dev_priv->mm.pin_memory -= size;
-}
 int
 i915_gem_check_is_wedged(struct drm_device *dev)
 {
@@ -141,7 +105,7 @@ i915_gem_check_is_wedged(struct drm_device *dev)
        return -EIO;
 }
-static int i915_mutex_lock_interruptible(struct drm_device *dev)
+int i915_mutex_lock_interruptible(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret;
@@ -164,75 +128,76 @@ static int i915_mutex_lock_interruptible(struct drm_device *dev)
 }
 static inline bool
-i915_gem_object_is_inactive(struct drm_i915_gem_object *obj_priv)
+i915_gem_object_is_inactive(struct drm_i915_gem_object *obj)
 {
-        return obj_priv->gtt_space &&
+        return obj->gtt_space && !obj->active && obj->pin_count == 0;
-                !obj_priv->active &&
-                obj_priv->pin_count == 0;
 }
-int i915_gem_do_init(struct drm_device *dev,
+void i915_gem_do_init(struct drm_device *dev,
-                     unsigned long start,
+                      unsigned long start,
-                     unsigned long end)
+                      unsigned long mappable_end,
+                      unsigned long end)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
-        if (start >= end ||
-            (start & (PAGE_SIZE - 1)) != 0 ||
-            (end & (PAGE_SIZE - 1)) != 0) {
-                return -EINVAL;
-        }
        drm_mm_init(&dev_priv->mm.gtt_space, start,
                    end - start);
        dev_priv->mm.gtt_total = end - start;
+        dev_priv->mm.mappable_gtt_total = min(end, mappable_end) - start;
-        return 0;
+        dev_priv->mm.gtt_mappable_end = mappable_end;
 }
 int
 i915_gem_init_ioctl(struct drm_device *dev, void *data,
-                    struct drm_file *file_priv)
+                    struct drm_file *file)
 {
        struct drm_i915_gem_init *args = data;
-        int ret;
+        if (args->gtt_start >= args->gtt_end ||
+            (args->gtt_end | args->gtt_start) & (PAGE_SIZE - 1))
+                return -EINVAL;
        mutex_lock(&dev->struct_mutex);
-        ret = i915_gem_do_init(dev, args->gtt_start, args->gtt_end);
+        i915_gem_do_init(dev, args->gtt_start, args->gtt_end, args->gtt_end);
        mutex_unlock(&dev->struct_mutex);
-        return ret;
+        return 0;
 }
 int
 i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
-                            struct drm_file *file_priv)
+                            struct drm_file *file)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_get_aperture *args = data;
+        struct drm_i915_gem_object *obj;
+        size_t pinned;
        if (!(dev->driver->driver_features & DRIVER_GEM))
                return -ENODEV;
+        pinned = 0;
        mutex_lock(&dev->struct_mutex);
-        args->aper_size = dev_priv->mm.gtt_total;
+        list_for_each_entry(obj, &dev_priv->mm.pinned_list, mm_list)
-        args->aper_available_size = args->aper_size - dev_priv->mm.pin_memory;
+                pinned += obj->gtt_space->size;
        mutex_unlock(&dev->struct_mutex);
+        args->aper_size = dev_priv->mm.gtt_total;
+        args->aper_available_size = args->aper_size -pinned;
        return 0;
 }
 /**
 * Creates a new mm object and returns a handle to it.
 */
 int
 i915_gem_create_ioctl(struct drm_device *dev, void *data,
-                      struct drm_file *file_priv)
+                      struct drm_file *file)
 {
        struct drm_i915_gem_create *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
        int ret;
        u32 handle;
@@ -243,45 +208,28 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
        if (obj == NULL)
                return -ENOMEM;
-        ret = drm_gem_handle_create(file_priv, obj, &handle);
+        ret = drm_gem_handle_create(file, &obj->base, &handle);
        if (ret) {
-                drm_gem_object_release(obj);
+                drm_gem_object_release(&obj->base);
-                i915_gem_info_remove_obj(dev->dev_private, obj->size);
+                i915_gem_info_remove_obj(dev->dev_private, obj->base.size);
                kfree(obj);
                return ret;
        }
        /* drop reference from allocate - handle holds it now */
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
        trace_i915_gem_object_create(obj);
        args->handle = handle;
        return 0;
 }
-static inline int
+static int i915_gem_object_needs_bit17_swizzle(struct drm_i915_gem_object *obj)
-fast_shmem_read(struct page **pages,
-                loff_t page_base, int page_offset,
-                char __user *data,
-                int length)
 {
-        char *vaddr;
+        drm_i915_private_t *dev_priv = obj->base.dev->dev_private;
-        int ret;
-        vaddr = kmap_atomic(pages[page_base >> PAGE_SHIFT]);
-        ret = __copy_to_user_inatomic(data, vaddr + page_offset, length);
-        kunmap_atomic(vaddr);
-        return ret;
-}
-static int i915_gem_object_needs_bit17_swizzle(struct drm_gem_object *obj)
-{
-        drm_i915_private_t *dev_priv = obj->dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        return dev_priv->mm.bit_6_swizzle_x == I915_BIT_6_SWIZZLE_9_10_17 &&
-                obj_priv->tiling_mode != I915_TILING_NONE;
+                obj->tiling_mode != I915_TILING_NONE;
 }
 static inline void
@@ -357,38 +305,51 @@ slow_shmem_bit17_copy(struct page *gpu_page,
 * fault, it fails so we can fall back to i915_gem_shmem_pwrite_slow().
 */
 static int
-i915_gem_shmem_pread_fast(struct drm_device *dev, struct drm_gem_object *obj,
+i915_gem_shmem_pread_fast(struct drm_device *dev,
+                          struct drm_i915_gem_object *obj,
                          struct drm_i915_gem_pread *args,
-                          struct drm_file *file_priv)
+                          struct drm_file *file)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        struct address_space *mapping = obj->base.filp->f_path.dentry->d_inode->i_mapping;
        ssize_t remain;
-        loff_t offset, page_base;
+        loff_t offset;
        char __user *user_data;
        int page_offset, page_length;
        user_data = (char __user *) (uintptr_t) args->data_ptr;
        remain = args->size;
-        obj_priv = to_intel_bo(obj);
        offset = args->offset;
        while (remain > 0) {
+                struct page *page;
+                char *vaddr;
+                int ret;
                /* Operation in this page
                 *
-                 * page_base = page offset within aperture
                 * page_offset = offset within page
                 * page_length = bytes to copy for this page
                 */
-                page_base = (offset & ~(PAGE_SIZE-1));
                page_offset = offset & (PAGE_SIZE-1);
                page_length = remain;
                if ((page_offset + remain) > PAGE_SIZE)
                        page_length = PAGE_SIZE - page_offset;
-                if (fast_shmem_read(obj_priv->pages,
+                page = read_cache_page_gfp(mapping, offset >> PAGE_SHIFT,
-                                    page_base, page_offset,
+                                           GFP_HIGHUSER | __GFP_RECLAIMABLE);
-                                    user_data, page_length))
+                if (IS_ERR(page))
+                        return PTR_ERR(page);
+                vaddr = kmap_atomic(page);
+                ret = __copy_to_user_inatomic(user_data,
+                                              vaddr + page_offset,
+                                              page_length);
+                kunmap_atomic(vaddr);
+                mark_page_accessed(page);
+                page_cache_release(page);
+                if (ret)
                        return -EFAULT;
                remain -= page_length;
@@ -399,30 +360,6 @@ i915_gem_shmem_pread_fast(struct drm_device *dev, struct drm_gem_object *obj,
        return 0;
 }
-static int
-i915_gem_object_get_pages_or_evict(struct drm_gem_object *obj)
-{
-        int ret;
-        ret = i915_gem_object_get_pages(obj, __GFP_NORETRY | __GFP_NOWARN);
-        /* If we've insufficient memory to map in the pages, attempt
-         * to make some space by throwing out some old buffers.
-         */
-        if (ret == -ENOMEM) {
-                struct drm_device *dev = obj->dev;
-                ret = i915_gem_evict_something(dev, obj->size,
-                                               i915_gem_get_gtt_alignment(obj));
-                if (ret)
-                        return ret;
-                ret = i915_gem_object_get_pages(obj, 0);
-        }
-        return ret;
-}
 /**
 * This is the fallback shmem pread path, which allocates temporary storage
 * in kernel space to copy_to_user into outside of the struct_mutex, so we
@@ -430,18 +367,19 @@ i915_gem_object_get_pages_or_evict(struct drm_gem_object *obj)
 * and not take page faults.
 */
 static int
-i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
+i915_gem_shmem_pread_slow(struct drm_device *dev,
+                          struct drm_i915_gem_object *obj,
                          struct drm_i915_gem_pread *args,
-                          struct drm_file *file_priv)
+                          struct drm_file *file)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        struct address_space *mapping = obj->base.filp->f_path.dentry->d_inode->i_mapping;
        struct mm_struct *mm = current->mm;
        struct page **user_pages;
        ssize_t remain;
        loff_t offset, pinned_pages, i;
        loff_t first_data_page, last_data_page, num_pages;
-        int shmem_page_index, shmem_page_offset;
+        int shmem_page_offset;
-        int data_page_index,  data_page_offset;
+        int data_page_index, data_page_offset;
        int page_length;
        int ret;
        uint64_t data_ptr = args->data_ptr;
@@ -480,19 +418,18 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
        do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
-        obj_priv = to_intel_bo(obj);
        offset = args->offset;
        while (remain > 0) {
+                struct page *page;
                /* Operation in this page
                 *
-                 * shmem_page_index = page number within shmem file
                 * shmem_page_offset = offset within page in shmem file
                 * data_page_index = page number in get_user_pages return
                 * data_page_offset = offset with data_page_index page.
                 * page_length = bytes to copy for this page
                 */
-                shmem_page_index = offset / PAGE_SIZE;
                shmem_page_offset = offset & ~PAGE_MASK;
                data_page_index = data_ptr / PAGE_SIZE - first_data_page;
                data_page_offset = data_ptr & ~PAGE_MASK;
@@ -503,8 +440,13 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
                if ((data_page_offset + page_length) > PAGE_SIZE)
                        page_length = PAGE_SIZE - data_page_offset;
+                page = read_cache_page_gfp(mapping, offset >> PAGE_SHIFT,
+                                           GFP_HIGHUSER | __GFP_RECLAIMABLE);
+                if (IS_ERR(page))
+                        return PTR_ERR(page);
                if (do_bit17_swizzling) {
-                        slow_shmem_bit17_copy(obj_priv->pages[shmem_page_index],
+                        slow_shmem_bit17_copy(page,
                                              shmem_page_offset,
                                              user_pages[data_page_index],
                                              data_page_offset,
@@ -513,11 +455,14 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
                } else {
                        slow_shmem_copy(user_pages[data_page_index],
                                        data_page_offset,
-                                        obj_priv->pages[shmem_page_index],
+                                        page,
                                        shmem_page_offset,
                                        page_length);
                }
+                mark_page_accessed(page);
+                page_cache_release(page);
                remain -= page_length;
                data_ptr += page_length;
                offset += page_length;
@@ -526,6 +471,7 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
 out:
        for (i = 0; i < pinned_pages; i++) {
                SetPageDirty(user_pages[i]);
+                mark_page_accessed(user_pages[i]);
                page_cache_release(user_pages[i]);
        }
        drm_free_large(user_pages);
@@ -540,11 +486,10 @@ out:
 */
 int
 i915_gem_pread_ioctl(struct drm_device *dev, void *data,
-                     struct drm_file *file_priv)
+                     struct drm_file *file)
 {
        struct drm_i915_gem_pread *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret = 0;
        if (args->size == 0)
@@ -564,39 +509,33 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
        /* Bounds check source.  */
-        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+        if (args->offset > obj->base.size ||
+            args->size > obj->base.size - args->offset) {
                ret = -EINVAL;
                goto out;
        }
-        ret = i915_gem_object_get_pages_or_evict(obj);
-        if (ret)
-                goto out;
        ret = i915_gem_object_set_cpu_read_domain_range(obj,
                                                        args->offset,
                                                        args->size);
        if (ret)
-                goto out_put;
+                goto out;
        ret = -EFAULT;
        if (!i915_gem_object_needs_bit17_swizzle(obj))
-                ret = i915_gem_shmem_pread_fast(dev, obj, args, file_priv);
+                ret = i915_gem_shmem_pread_fast(dev, obj, args, file);
        if (ret == -EFAULT)
-                ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);
+                ret = i915_gem_shmem_pread_slow(dev, obj, args, file);
-out_put:
-        i915_gem_object_put_pages(obj);
 out:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
@@ -646,32 +585,16 @@ slow_kernel_write(struct io_mapping *mapping,
        io_mapping_unmap(dst_vaddr);
 }
-static inline int
-fast_shmem_write(struct page **pages,
-                 loff_t page_base, int page_offset,
-                 char __user *data,
-                 int length)
-{
-        char *vaddr;
-        int ret;
-        vaddr = kmap_atomic(pages[page_base >> PAGE_SHIFT]);
-        ret = __copy_from_user_inatomic(vaddr + page_offset, data, length);
-        kunmap_atomic(vaddr);
-        return ret;
-}
 /**
 * This is the fast pwrite path, where we copy the data directly from the
 * user into the GTT, uncached.
 */
 static int
-i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
+i915_gem_gtt_pwrite_fast(struct drm_device *dev,
+                         struct drm_i915_gem_object *obj,
                         struct drm_i915_gem_pwrite *args,
-                         struct drm_file *file_priv)
+                         struct drm_file *file)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        drm_i915_private_t *dev_priv = dev->dev_private;
        ssize_t remain;
        loff_t offset, page_base;
@@ -681,8 +604,7 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
        user_data = (char __user *) (uintptr_t) args->data_ptr;
        remain = args->size;
-        obj_priv = to_intel_bo(obj);
+        offset = obj->gtt_offset + args->offset;
-        offset = obj_priv->gtt_offset + args->offset;
        while (remain > 0) {
                /* Operation in this page
@@ -722,11 +644,11 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
 * than using i915_gem_gtt_pwrite_fast on a G45 (32-bit).
 */
 static int
-i915_gem_gtt_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
+i915_gem_gtt_pwrite_slow(struct drm_device *dev,
+                         struct drm_i915_gem_object *obj,
                         struct drm_i915_gem_pwrite *args,
-                         struct drm_file *file_priv)
+                         struct drm_file *file)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        drm_i915_private_t *dev_priv = dev->dev_private;
        ssize_t remain;
        loff_t gtt_page_base, offset;
@@ -763,12 +685,15 @@ i915_gem_gtt_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
                goto out_unpin_pages;
        }
-        ret = i915_gem_object_set_to_gtt_domain(obj, 1);
+        ret = i915_gem_object_set_to_gtt_domain(obj, true);
+        if (ret)
+                goto out_unpin_pages;
+        ret = i915_gem_object_put_fence(obj);
        if (ret)
                goto out_unpin_pages;
-        obj_priv = to_intel_bo(obj);
+        offset = obj->gtt_offset + args->offset;
-        offset = obj_priv->gtt_offset + args->offset;
        while (remain > 0) {
                /* Operation in this page
@@ -814,39 +739,58 @@ out_unpin_pages:
 * copy_from_user into the kmapped pages backing the object.
 */
 static int
-i915_gem_shmem_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
+i915_gem_shmem_pwrite_fast(struct drm_device *dev,
+                           struct drm_i915_gem_object *obj,
                           struct drm_i915_gem_pwrite *args,
-                           struct drm_file *file_priv)
+                           struct drm_file *file)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        struct address_space *mapping = obj->base.filp->f_path.dentry->d_inode->i_mapping;
        ssize_t remain;
-        loff_t offset, page_base;
+        loff_t offset;
        char __user *user_data;
        int page_offset, page_length;
        user_data = (char __user *) (uintptr_t) args->data_ptr;
        remain = args->size;
-        obj_priv = to_intel_bo(obj);
        offset = args->offset;
-        obj_priv->dirty = 1;
+        obj->dirty = 1;
        while (remain > 0) {
+                struct page *page;
+                char *vaddr;
+                int ret;
                /* Operation in this page
                 *
-                 * page_base = page offset within aperture
                 * page_offset = offset within page
                 * page_length = bytes to copy for this page
                 */
-                page_base = (offset & ~(PAGE_SIZE-1));
                page_offset = offset & (PAGE_SIZE-1);
                page_length = remain;
                if ((page_offset + remain) > PAGE_SIZE)
                        page_length = PAGE_SIZE - page_offset;
-                if (fast_shmem_write(obj_priv->pages,
+                page = read_cache_page_gfp(mapping, offset >> PAGE_SHIFT,
-                                       page_base, page_offset,
+                                           GFP_HIGHUSER | __GFP_RECLAIMABLE);
-                                       user_data, page_length))
+                if (IS_ERR(page))
+                        return PTR_ERR(page);
+                vaddr = kmap_atomic(page, KM_USER0);
+                ret = __copy_from_user_inatomic(vaddr + page_offset,
+                                                user_data,
+                                                page_length);
+                kunmap_atomic(vaddr, KM_USER0);
+                set_page_dirty(page);
+                mark_page_accessed(page);
+                page_cache_release(page);
+                /* If we get a fault while copying data, then (presumably) our
+                 * source page isn't available.  Return the error and we'll
+                 * retry in the slow path.
+                 */
+                if (ret)
                        return -EFAULT;
                remain -= page_length;
@@ -865,17 +809,18 @@ i915_gem_shmem_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
 * struct_mutex is held.
 */
 static int
-i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
+i915_gem_shmem_pwrite_slow(struct drm_device *dev,
+                           struct drm_i915_gem_object *obj,
                           struct drm_i915_gem_pwrite *args,
-                           struct drm_file *file_priv)
+                           struct drm_file *file)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        struct address_space *mapping = obj->base.filp->f_path.dentry->d_inode->i_mapping;
        struct mm_struct *mm = current->mm;
        struct page **user_pages;
        ssize_t remain;
        loff_t offset, pinned_pages, i;
        loff_t first_data_page, last_data_page, num_pages;
-        int shmem_page_index, shmem_page_offset;
+        int shmem_page_offset;
        int data_page_index,  data_page_offset;
        int page_length;
        int ret;
@@ -913,20 +858,19 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
        do_bit17_swizzling = i915_gem_object_needs_bit17_swizzle(obj);
-        obj_priv = to_intel_bo(obj);
        offset = args->offset;
-        obj_priv->dirty = 1;
+        obj->dirty = 1;
        while (remain > 0) {
+                struct page *page;
                /* Operation in this page
                 *
-                 * shmem_page_index = page number within shmem file
                 * shmem_page_offset = offset within page in shmem file
                 * data_page_index = page number in get_user_pages return
                 * data_page_offset = offset with data_page_index page.
                 * page_length = bytes to copy for this page
                 */
-                shmem_page_index = offset / PAGE_SIZE;
                shmem_page_offset = offset & ~PAGE_MASK;
                data_page_index = data_ptr / PAGE_SIZE - first_data_page;
                data_page_offset = data_ptr & ~PAGE_MASK;
@@ -937,21 +881,32 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
                if ((data_page_offset + page_length) > PAGE_SIZE)
                        page_length = PAGE_SIZE - data_page_offset;
+                page = read_cache_page_gfp(mapping, offset >> PAGE_SHIFT,
+                                           GFP_HIGHUSER | __GFP_RECLAIMABLE);
+                if (IS_ERR(page)) {
+                        ret = PTR_ERR(page);
+                        goto out;
+                }
                if (do_bit17_swizzling) {
-                        slow_shmem_bit17_copy(obj_priv->pages[shmem_page_index],
+                        slow_shmem_bit17_copy(page,
                                              shmem_page_offset,
                                              user_pages[data_page_index],
                                              data_page_offset,
                                              page_length,
                                              0);
                } else {
-                        slow_shmem_copy(obj_priv->pages[shmem_page_index],
+                        slow_shmem_copy(page,
                                        shmem_page_offset,
                                        user_pages[data_page_index],
                                        data_page_offset,
                                        page_length);
                }
+                set_page_dirty(page);
+                mark_page_accessed(page);
+                page_cache_release(page);
                remain -= page_length;
                data_ptr += page_length;
                offset += page_length;
@@ -975,8 +930,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                      struct drm_file *file)
 {
        struct drm_i915_gem_pwrite *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        if (args->size == 0)
@@ -996,15 +950,15 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
        /* Bounds check destination. */
-        if (args->offset > obj->size || args->size > obj->size - args->offset) {
+        if (args->offset > obj->base.size ||
+            args->size > obj->base.size - args->offset) {
                ret = -EINVAL;
                goto out;
        }
@@ -1015,16 +969,19 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
         * pread/pwrite currently are reading and writing from the CPU
         * perspective, requiring manual detiling by the client.
         */
-        if (obj_priv->phys_obj)
+        if (obj->phys_obj)
                ret = i915_gem_phys_pwrite(dev, obj, args, file);
-        else if (obj_priv->tiling_mode == I915_TILING_NONE &&
+        else if (obj->gtt_space &&
-                 obj_priv->gtt_space &&
+                 obj->base.write_domain != I915_GEM_DOMAIN_CPU) {
-                 obj->write_domain != I915_GEM_DOMAIN_CPU) {
+                ret = i915_gem_object_pin(obj, 0, true);
-                ret = i915_gem_object_pin(obj, 0);
                if (ret)
                        goto out;
-                ret = i915_gem_object_set_to_gtt_domain(obj, 1);
+                ret = i915_gem_object_set_to_gtt_domain(obj, true);
+                if (ret)
+                        goto out_unpin;
+                ret = i915_gem_object_put_fence(obj);
                if (ret)
                        goto out_unpin;
@@ -1035,26 +992,19 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
 out_unpin:
                i915_gem_object_unpin(obj);
        } else {
-                ret = i915_gem_object_get_pages_or_evict(obj);
-                if (ret)
-                        goto out;
                ret = i915_gem_object_set_to_cpu_domain(obj, 1);
                if (ret)
-                        goto out_put;
+                        goto out;
                ret = -EFAULT;
                if (!i915_gem_object_needs_bit17_swizzle(obj))
                        ret = i915_gem_shmem_pwrite_fast(dev, obj, args, file);
                if (ret == -EFAULT)
                        ret = i915_gem_shmem_pwrite_slow(dev, obj, args, file);
-out_put:
-                i915_gem_object_put_pages(obj);
        }
 out:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
@@ -1066,12 +1016,10 @@ unlock:
 */
 int
 i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
-                          struct drm_file *file_priv)
+                          struct drm_file *file)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_set_domain *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        uint32_t read_domains = args->read_domains;
        uint32_t write_domain = args->write_domain;
        int ret;
@@ -1096,28 +1044,15 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
-        intel_mark_busy(dev, obj);
        if (read_domains & I915_GEM_DOMAIN_GTT) {
                ret = i915_gem_object_set_to_gtt_domain(obj, write_domain != 0);
-                /* Update the LRU on the fence for the CPU access that's
-                 * about to occur.
-                 */
-                if (obj_priv->fence_reg != I915_FENCE_REG_NONE) {
-                        struct drm_i915_fence_reg *reg =
-                                &dev_priv->fence_regs[obj_priv->fence_reg];
-                        list_move_tail(&reg->lru_list,
-                                       &dev_priv->mm.fence_list);
-                }
                /* Silently promote "you're not bound, there was nothing to do"
                 * to success, since the client was just asking us to
                 * make sure everything was done.
@@ -1128,11 +1063,7 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
                ret = i915_gem_object_set_to_cpu_domain(obj, write_domain != 0);
        }
-        /* Maintain LRU order of "inactive" objects */
+        drm_gem_object_unreference(&obj->base);
-        if (ret == 0 && i915_gem_object_is_inactive(obj_priv))
-                list_move_tail(&obj_priv->mm_list, &dev_priv->mm.inactive_list);
-        drm_gem_object_unreference(obj);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
@@ -1143,10 +1074,10 @@ unlock:
 */
 int
 i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
-                      struct drm_file *file_priv)
+                         struct drm_file *file)
 {
        struct drm_i915_gem_sw_finish *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
        int ret = 0;
        if (!(dev->driver->driver_features & DRIVER_GEM))
@@ -1156,17 +1087,17 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
        /* Pinned buffers may be scanout, so flush the cache */
-        if (to_intel_bo(obj)->pin_count)
+        if (obj->pin_count)
                i915_gem_object_flush_cpu_write_domain(obj);
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
@@ -1181,8 +1112,9 @@ unlock:
 */
 int
 i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
-                   struct drm_file *file_priv)
+                    struct drm_file *file)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_mmap *args = data;
        struct drm_gem_object *obj;
        loff_t offset;
@@ -1191,10 +1123,15 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
        if (!(dev->driver->driver_features & DRIVER_GEM))
                return -ENODEV;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = drm_gem_object_lookup(dev, file, args->handle);
        if (obj == NULL)
                return -ENOENT;
+        if (obj->size > dev_priv->mm.gtt_mappable_end) {
+                drm_gem_object_unreference_unlocked(obj);
+                return -E2BIG;
+        }
        offset = args->offset;
        down_write(&current->mm->mmap_sem);
@@ -1229,10 +1166,9 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 */
 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
-        struct drm_gem_object *obj = vma->vm_private_data;
+        struct drm_i915_gem_object *obj = to_intel_bo(vma->vm_private_data);
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        pgoff_t page_offset;
        unsigned long pfn;
        int ret = 0;
@@ -1244,27 +1180,35 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        /* Now bind it into the GTT if needed */
        mutex_lock(&dev->struct_mutex);
-        if (!obj_priv->gtt_space) {
-                ret = i915_gem_object_bind_to_gtt(obj, 0);
-                if (ret)
-                        goto unlock;
-                ret = i915_gem_object_set_to_gtt_domain(obj, write);
+        if (!obj->map_and_fenceable) {
+                ret = i915_gem_object_unbind(obj);
                if (ret)
                        goto unlock;
        }
+        if (!obj->gtt_space) {
-        /* Need a new fence register? */
+                ret = i915_gem_object_bind_to_gtt(obj, 0, true);
-        if (obj_priv->tiling_mode != I915_TILING_NONE) {
-                ret = i915_gem_object_get_fence_reg(obj, true);
                if (ret)
                        goto unlock;
        }
-        if (i915_gem_object_is_inactive(obj_priv))
+        ret = i915_gem_object_set_to_gtt_domain(obj, write);
-                list_move_tail(&obj_priv->mm_list, &dev_priv->mm.inactive_list);
+        if (ret)
+                goto unlock;
+        if (obj->tiling_mode == I915_TILING_NONE)
+                ret = i915_gem_object_put_fence(obj);
+        else
+                ret = i915_gem_object_get_fence(obj, NULL, true);
+        if (ret)
+                goto unlock;
+        if (i915_gem_object_is_inactive(obj))
+                list_move_tail(&obj->mm_list, &dev_priv->mm.inactive_list);
+        obj->fault_mappable = true;
-        pfn = ((dev->agp->base + obj_priv->gtt_offset) >> PAGE_SHIFT) +
+        pfn = ((dev->agp->base + obj->gtt_offset) >> PAGE_SHIFT) +
                page_offset;
        /* Finally, remap it using the new GTT offset */
@@ -1273,11 +1217,12 @@ unlock:
        mutex_unlock(&dev->struct_mutex);
        switch (ret) {
+        case -EAGAIN:
+                set_need_resched();
        case 0:
        case -ERESTARTSYS:
                return VM_FAULT_NOPAGE;
        case -ENOMEM:
-        case -EAGAIN:
                return VM_FAULT_OOM;
        default:
                return VM_FAULT_SIGBUS;
@@ -1296,37 +1241,39 @@ unlock:
 * This routine allocates and attaches a fake offset for @obj.
 */
 static int
-i915_gem_create_mmap_offset(struct drm_gem_object *obj)
+i915_gem_create_mmap_offset(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        struct drm_gem_mm *mm = dev->mm_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        struct drm_map_list *list;
        struct drm_local_map *map;
        int ret = 0;
        /* Set the object up for mmap'ing */
-        list = &obj->map_list;
+        list = &obj->base.map_list;
        list->map = kzalloc(sizeof(struct drm_map_list), GFP_KERNEL);
        if (!list->map)
                return -ENOMEM;
        map = list->map;
        map->type = _DRM_GEM;
-        map->size = obj->size;
+        map->size = obj->base.size;
        map->handle = obj;
        /* Get a DRM GEM mmap offset allocated... */
        list->file_offset_node = drm_mm_search_free(&mm->offset_manager,
-                                                    obj->size / PAGE_SIZE, 0, 0);
+                                                    obj->base.size / PAGE_SIZE,
+                                                    0, 0);
        if (!list->file_offset_node) {
-                DRM_ERROR("failed to allocate offset for bo %d\n", obj->name);
+                DRM_ERROR("failed to allocate offset for bo %d\n",
+                          obj->base.name);
                ret = -ENOSPC;
                goto out_free_list;
        }
        list->file_offset_node = drm_mm_get_block(list->file_offset_node,
-                                                  obj->size / PAGE_SIZE, 0);
+                                                  obj->base.size / PAGE_SIZE,
+                                                  0);
        if (!list->file_offset_node) {
                ret = -ENOMEM;
                goto out_free_list;
@@ -1339,16 +1286,13 @@ i915_gem_create_mmap_offset(struct drm_gem_object *obj)
                goto out_free_mm;
        }
-        /* By now we should be all set, any drm_mmap request on the offset
-         * below will get to our mmap & fault handler */
-        obj_priv->mmap_offset = ((uint64_t) list->hash.key) << PAGE_SHIFT;
        return 0;
 out_free_mm:
        drm_mm_put_block(list->file_offset_node);
 out_free_list:
        kfree(list->map);
+        list->map = NULL;
        return ret;
 }
@@ -1368,38 +1312,51 @@ out_free_list:
 * fixup by i915_gem_fault().
 */
 void
-i915_gem_release_mmap(struct drm_gem_object *obj)
+i915_gem_release_mmap(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        if (!obj->fault_mappable)
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+                return;
+        unmap_mapping_range(obj->base.dev->dev_mapping,
+                            (loff_t)obj->base.map_list.hash.key<<PAGE_SHIFT,
+                            obj->base.size, 1);
-        if (dev->dev_mapping)
+        obj->fault_mappable = false;
-                unmap_mapping_range(dev->dev_mapping,
-                                    obj_priv->mmap_offset, obj->size, 1);
 }
 static void
-i915_gem_free_mmap_offset(struct drm_gem_object *obj)
+i915_gem_free_mmap_offset(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        struct drm_gem_mm *mm = dev->mm_private;
-        struct drm_map_list *list;
+        struct drm_map_list *list = &obj->base.map_list;
-        list = &obj->map_list;
        drm_ht_remove_item(&mm->offset_hash, &list->hash);
+        drm_mm_put_block(list->file_offset_node);
+        kfree(list->map);
+        list->map = NULL;
+}
-        if (list->file_offset_node) {
+static uint32_t
-                drm_mm_put_block(list->file_offset_node);
+i915_gem_get_gtt_size(struct drm_i915_gem_object *obj)
-                list->file_offset_node = NULL;
+{
-        }
+        struct drm_device *dev = obj->base.dev;
+        uint32_t size;
-        if (list->map) {
+        if (INTEL_INFO(dev)->gen >= 4 ||
-                kfree(list->map);
+            obj->tiling_mode == I915_TILING_NONE)
-                list->map = NULL;
+                return obj->base.size;
-        }
-        obj_priv->mmap_offset = 0;
+        /* Previous chips need a power-of-two fence region when tiling */
+        if (INTEL_INFO(dev)->gen == 3)
+                size = 1024*1024;
+        else
+                size = 512*1024;
+        while (size < obj->base.size)
+                size <<= 1;
+        return size;
 }
 /**
@@ -1407,42 +1364,68 @@ i915_gem_free_mmap_offset(struct drm_gem_object *obj)
 * @obj: object to check
 *
 * Return the required GTT alignment for an object, taking into account
- * potential fence register mapping if needed.
+ * potential fence register mapping.
 */
 static uint32_t
-i915_gem_get_gtt_alignment(struct drm_gem_object *obj)
+i915_gem_get_gtt_alignment(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
-        int start, i;
        /*
         * Minimum alignment is 4k (GTT page size), but might be greater
         * if a fence register is needed for the object.
         */
-        if (INTEL_INFO(dev)->gen >= 4 || obj_priv->tiling_mode == I915_TILING_NONE)
+        if (INTEL_INFO(dev)->gen >= 4 ||
+            obj->tiling_mode == I915_TILING_NONE)
                return 4096;
        /*
         * Previous chips need to be aligned to the size of the smallest
         * fence register that can contain the object.
         */
-        if (INTEL_INFO(dev)->gen == 3)
+        return i915_gem_get_gtt_size(obj);
-                start = 1024*1024;
+}
-        else
-                start = 512*1024;
-        for (i = start; i < obj->size; i <<= 1)
+/**
-                ;
+ * i915_gem_get_unfenced_gtt_alignment - return required GTT alignment for an
+ *                                       unfenced object
+ * @obj: object to check
+ *
+ * Return the required GTT alignment for an object, only taking into account
+ * unfenced tiled surface requirements.
+ */
+static uint32_t
+i915_gem_get_unfenced_gtt_alignment(struct drm_i915_gem_object *obj)
+{
+        struct drm_device *dev = obj->base.dev;
+        int tile_height;
+        /*
+         * Minimum alignment is 4k (GTT page size) for sane hw.
+         */
+        if (INTEL_INFO(dev)->gen >= 4 || IS_G33(dev) ||
+            obj->tiling_mode == I915_TILING_NONE)
+                return 4096;
+        /*
+         * Older chips need unfenced tiled buffers to be aligned to the left
+         * edge of an even tile row (where tile rows are counted as if the bo is
+         * placed in a fenced gtt region).
+         */
+        if (IS_GEN2(dev) ||
+            (obj->tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev)))
+                tile_height = 32;
+        else
+                tile_height = 8;
-        return i;
+        return tile_height * obj->stride * 2;
 }
 /**
 * i915_gem_mmap_gtt_ioctl - prepare an object for GTT mmap'ing
 * @dev: DRM device
 * @data: GTT mapping ioctl data
- * @file_priv: GEM object info
+ * @file: GEM object info
 *
 * Simply returns the fake offset to userspace so it can mmap it.
 * The mmap call will end up in drm_gem_mmap(), which will set things
@@ -1455,11 +1438,11 @@ i915_gem_get_gtt_alignment(struct drm_gem_object *obj)
 */
 int
 i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
-                        struct drm_file *file_priv)
+                        struct drm_file *file)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_mmap_gtt *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        if (!(dev->driver->driver_features & DRIVER_GEM))
@@ -1469,130 +1452,196 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
-        if (obj_priv->madv != I915_MADV_WILLNEED) {
+        if (obj->base.size > dev_priv->mm.gtt_mappable_end) {
+                ret = -E2BIG;
+                goto unlock;
+        }
+        if (obj->madv != I915_MADV_WILLNEED) {
                DRM_ERROR("Attempting to mmap a purgeable buffer\n");
                ret = -EINVAL;
                goto out;
        }
-        if (!obj_priv->mmap_offset) {
+        if (!obj->base.map_list.map) {
                ret = i915_gem_create_mmap_offset(obj);
                if (ret)
                        goto out;
        }
-        args->offset = obj_priv->mmap_offset;
+        args->offset = (u64)obj->base.map_list.hash.key << PAGE_SHIFT;
-        /*
-         * Pull it into the GTT so that we have a page list (makes the
-         * initial fault faster and any subsequent flushing possible).
-         */
-        if (!obj_priv->agp_mem) {
-                ret = i915_gem_object_bind_to_gtt(obj, 0);
-                if (ret)
-                        goto out;
-        }
 out:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
 }
+static int
+i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj,
+                              gfp_t gfpmask)
+{
+        int page_count, i;
+        struct address_space *mapping;
+        struct inode *inode;
+        struct page *page;
+        /* Get the list of pages out of our struct file.  They'll be pinned
+         * at this point until we release them.
+         */
+        page_count = obj->base.size / PAGE_SIZE;
+        BUG_ON(obj->pages != NULL);
+        obj->pages = drm_malloc_ab(page_count, sizeof(struct page *));
+        if (obj->pages == NULL)
+                return -ENOMEM;
+        inode = obj->base.filp->f_path.dentry->d_inode;
+        mapping = inode->i_mapping;
+        for (i = 0; i < page_count; i++) {
+                page = read_cache_page_gfp(mapping, i,
+                                           GFP_HIGHUSER |
+                                           __GFP_COLD |
+                                           __GFP_RECLAIMABLE |
+                                           gfpmask);
+                if (IS_ERR(page))
+                        goto err_pages;
+                obj->pages[i] = page;
+        }
+        if (obj->tiling_mode != I915_TILING_NONE)
+                i915_gem_object_do_bit_17_swizzle(obj);
+        return 0;
+err_pages:
+        while (i--)
+                page_cache_release(obj->pages[i]);
+        drm_free_large(obj->pages);
+        obj->pages = NULL;
+        return PTR_ERR(page);
+}
 static void
-i915_gem_object_put_pages(struct drm_gem_object *obj)
+i915_gem_object_put_pages_gtt(struct drm_i915_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        int page_count = obj->base.size / PAGE_SIZE;
-        int page_count = obj->size / PAGE_SIZE;
        int i;
-        BUG_ON(obj_priv->pages_refcount == 0);
+        BUG_ON(obj->madv == __I915_MADV_PURGED);
-        BUG_ON(obj_priv->madv == __I915_MADV_PURGED);
-        if (--obj_priv->pages_refcount != 0)
+        if (obj->tiling_mode != I915_TILING_NONE)
-                return;
-        if (obj_priv->tiling_mode != I915_TILING_NONE)
                i915_gem_object_save_bit_17_swizzle(obj);
-        if (obj_priv->madv == I915_MADV_DONTNEED)
+        if (obj->madv == I915_MADV_DONTNEED)
-                obj_priv->dirty = 0;
+                obj->dirty = 0;
        for (i = 0; i < page_count; i++) {
-                if (obj_priv->dirty)
+                if (obj->dirty)
-                        set_page_dirty(obj_priv->pages[i]);
+                        set_page_dirty(obj->pages[i]);
-                if (obj_priv->madv == I915_MADV_WILLNEED)
+                if (obj->madv == I915_MADV_WILLNEED)
-                        mark_page_accessed(obj_priv->pages[i]);
+                        mark_page_accessed(obj->pages[i]);
-                page_cache_release(obj_priv->pages[i]);
+                page_cache_release(obj->pages[i]);
        }
-        obj_priv->dirty = 0;
+        obj->dirty = 0;
-        drm_free_large(obj_priv->pages);
-        obj_priv->pages = NULL;
-}
-static uint32_t
-i915_gem_next_request_seqno(struct drm_device *dev,
-                            struct intel_ring_buffer *ring)
-{
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        ring->outstanding_lazy_request = true;
+        drm_free_large(obj->pages);
-        return dev_priv->next_seqno;
+        obj->pages = NULL;
 }
-static void
+void
-i915_gem_object_move_to_active(struct drm_gem_object *obj,
+i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
-                               struct intel_ring_buffer *ring)
+                               struct intel_ring_buffer *ring,
+                               u32 seqno)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
-        uint32_t seqno = i915_gem_next_request_seqno(dev, ring);
        BUG_ON(ring == NULL);
-        obj_priv->ring = ring;
+        obj->ring = ring;
        /* Add a reference if we're newly entering the active list. */
-        if (!obj_priv->active) {
+        if (!obj->active) {
-                drm_gem_object_reference(obj);
+                drm_gem_object_reference(&obj->base);
-                obj_priv->active = 1;
+                obj->active = 1;
        }
        /* Move from whatever list we were on to the tail of execution. */
-        list_move_tail(&obj_priv->mm_list, &dev_priv->mm.active_list);
+        list_move_tail(&obj->mm_list, &dev_priv->mm.active_list);
-        list_move_tail(&obj_priv->ring_list, &ring->active_list);
+        list_move_tail(&obj->ring_list, &ring->active_list);
-        obj_priv->last_rendering_seqno = seqno;
+        obj->last_rendering_seqno = seqno;
+        if (obj->fenced_gpu_access) {
+                struct drm_i915_fence_reg *reg;
+                BUG_ON(obj->fence_reg == I915_FENCE_REG_NONE);
+                obj->last_fenced_seqno = seqno;
+                obj->last_fenced_ring = ring;
+                reg = &dev_priv->fence_regs[obj->fence_reg];
+                list_move_tail(&reg->lru_list, &dev_priv->mm.fence_list);
+        }
+}
+static void
+i915_gem_object_move_off_active(struct drm_i915_gem_object *obj)
+{
+        list_del_init(&obj->ring_list);
+        obj->last_rendering_seqno = 0;
 }
 static void
-i915_gem_object_move_to_flushing(struct drm_gem_object *obj)
+i915_gem_object_move_to_flushing(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
-        BUG_ON(!obj_priv->active);
+        BUG_ON(!obj->active);
-        list_move_tail(&obj_priv->mm_list, &dev_priv->mm.flushing_list);
+        list_move_tail(&obj->mm_list, &dev_priv->mm.flushing_list);
-        list_del_init(&obj_priv->ring_list);
-        obj_priv->last_rendering_seqno = 0;
+        i915_gem_object_move_off_active(obj);
+}
+static void
+i915_gem_object_move_to_inactive(struct drm_i915_gem_object *obj)
+{
+        struct drm_device *dev = obj->base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (obj->pin_count != 0)
+                list_move_tail(&obj->mm_list, &dev_priv->mm.pinned_list);
+        else
+                list_move_tail(&obj->mm_list, &dev_priv->mm.inactive_list);
+        BUG_ON(!list_empty(&obj->gpu_write_list));
+        BUG_ON(!obj->active);
+        obj->ring = NULL;
+        i915_gem_object_move_off_active(obj);
+        obj->fenced_gpu_access = false;
+        obj->active = 0;
+        obj->pending_gpu_write = false;
+        drm_gem_object_unreference(&obj->base);
+        WARN_ON(i915_verify_lists(dev));
 }
 /* Immediately discard the backing storage */
 static void
-i915_gem_object_truncate(struct drm_gem_object *obj)
+i915_gem_object_truncate(struct drm_i915_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        struct inode *inode;
        /* Our goal here is to return as much of the memory as
@@ -1601,42 +1650,18 @@ i915_gem_object_truncate(struct drm_gem_object *obj)
         * backing pages, *now*. Here we mirror the actions taken
         * when by shmem_delete_inode() to release the backing store.
         */
-        inode = obj->filp->f_path.dentry->d_inode;
+        inode = obj->base.filp->f_path.dentry->d_inode;
        truncate_inode_pages(inode->i_mapping, 0);
        if (inode->i_op->truncate_range)
                inode->i_op->truncate_range(inode, 0, (loff_t)-1);
-        obj_priv->madv = __I915_MADV_PURGED;
+        obj->madv = __I915_MADV_PURGED;
 }
 static inline int
-i915_gem_object_is_purgeable(struct drm_i915_gem_object *obj_priv)
+i915_gem_object_is_purgeable(struct drm_i915_gem_object *obj)
-{
-        return obj_priv->madv == I915_MADV_DONTNEED;
-}
-static void
-i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        return obj->madv == I915_MADV_DONTNEED;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
-        if (obj_priv->pin_count != 0)
-                list_move_tail(&obj_priv->mm_list, &dev_priv->mm.pinned_list);
-        else
-                list_move_tail(&obj_priv->mm_list, &dev_priv->mm.inactive_list);
-        list_del_init(&obj_priv->ring_list);
-        BUG_ON(!list_empty(&obj_priv->gpu_write_list));
-        obj_priv->last_rendering_seqno = 0;
-        obj_priv->ring = NULL;
-        if (obj_priv->active) {
-                obj_priv->active = 0;
-                drm_gem_object_unreference(obj);
-        }
-        WARN_ON(i915_verify_lists(dev));
 }
 static void
@@ -1644,37 +1669,27 @@ i915_gem_process_flushing_list(struct drm_device *dev,
                               uint32_t flush_domains,
                               struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj, *next;
-        struct drm_i915_gem_object *obj_priv, *next;
-        list_for_each_entry_safe(obj_priv, next,
+        list_for_each_entry_safe(obj, next,
                                 &ring->gpu_write_list,
                                 gpu_write_list) {
-                struct drm_gem_object *obj = &obj_priv->base;
+                if (obj->base.write_domain & flush_domains) {
+                        uint32_t old_write_domain = obj->base.write_domain;
-                if (obj->write_domain & flush_domains) {
-                        uint32_t old_write_domain = obj->write_domain;
-                        obj->write_domain = 0;
+                        obj->base.write_domain = 0;
-                        list_del_init(&obj_priv->gpu_write_list);
+                        list_del_init(&obj->gpu_write_list);
-                        i915_gem_object_move_to_active(obj, ring);
+                        i915_gem_object_move_to_active(obj, ring,
+                                                       i915_gem_next_request_seqno(dev, ring));
-                        /* update the fence lru list */
-                        if (obj_priv->fence_reg != I915_FENCE_REG_NONE) {
-                                struct drm_i915_fence_reg *reg =
-                                        &dev_priv->fence_regs[obj_priv->fence_reg];
-                                list_move_tail(&reg->lru_list,
-                                                &dev_priv->mm.fence_list);
-                        }
                        trace_i915_gem_object_change_domain(obj,
-                                                            obj->read_domains,
+                                                            obj->base.read_domains,
                                                            old_write_domain);
                }
        }
 }
-uint32_t
+int
 i915_add_request(struct drm_device *dev,
                 struct drm_file *file,
                 struct drm_i915_gem_request *request,
@@ -1684,17 +1699,17 @@ i915_add_request(struct drm_device *dev,
        struct drm_i915_file_private *file_priv = NULL;
        uint32_t seqno;
        int was_empty;
+        int ret;
+        BUG_ON(request == NULL);
        if (file != NULL)
                file_priv = file->driver_priv;
-        if (request == NULL) {
+        ret = ring->add_request(ring, &seqno);
-                request = kzalloc(sizeof(*request), GFP_KERNEL);
+        if (ret)
-                if (request == NULL)
+            return ret;
-                        return 0;
-        }
-        seqno = ring->add_request(dev, ring, 0);
        ring->outstanding_lazy_request = false;
        request->seqno = seqno;
@@ -1718,26 +1733,7 @@ i915_add_request(struct drm_device *dev,
                        queue_delayed_work(dev_priv->wq,
                                           &dev_priv->mm.retire_work, HZ);
        }
-        return seqno;
+        return 0;
-}
-/**
- * Command execution barrier
- *
- * Ensures that all commands in the ring are finished
- * before signalling the CPU
- */
-static void
-i915_retire_commands(struct drm_device *dev, struct intel_ring_buffer *ring)
-{
-        uint32_t flush_domains = 0;
-        /* The sampler always gets flushed on i965 (sigh) */
-        if (INTEL_INFO(dev)->gen >= 4)
-                flush_domains |= I915_GEM_DOMAIN_SAMPLER;
-        ring->flush(dev, ring,
-                        I915_GEM_DOMAIN_COMMAND, flush_domains);
 }
 static inline void
@@ -1770,62 +1766,76 @@ static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
        }
        while (!list_empty(&ring->active_list)) {
-                struct drm_i915_gem_object *obj_priv;
+                struct drm_i915_gem_object *obj;
-                obj_priv = list_first_entry(&ring->active_list,
+                obj = list_first_entry(&ring->active_list,
-                                            struct drm_i915_gem_object,
+                                       struct drm_i915_gem_object,
-                                            ring_list);
+                                       ring_list);
-                obj_priv->base.write_domain = 0;
+                obj->base.write_domain = 0;
-                list_del_init(&obj_priv->gpu_write_list);
+                list_del_init(&obj->gpu_write_list);
-                i915_gem_object_move_to_inactive(&obj_priv->base);
+                i915_gem_object_move_to_inactive(obj);
+        }
+}
+static void i915_gem_reset_fences(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int i;
+        for (i = 0; i < 16; i++) {
+                struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
+                struct drm_i915_gem_object *obj = reg->obj;
+                if (!obj)
+                        continue;
+                if (obj->tiling_mode)
+                        i915_gem_release_mmap(obj);
+                reg->obj->fence_reg = I915_FENCE_REG_NONE;
+                reg->obj->fenced_gpu_access = false;
+                reg->obj->last_fenced_seqno = 0;
+                reg->obj->last_fenced_ring = NULL;
+                i915_gem_clear_fence_reg(dev, reg);
        }
 }
 void i915_gem_reset(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        int i;
-        i915_gem_reset_ring_lists(dev_priv, &dev_priv->render_ring);
+        for (i = 0; i < I915_NUM_RINGS; i++)
-        i915_gem_reset_ring_lists(dev_priv, &dev_priv->bsd_ring);
+                i915_gem_reset_ring_lists(dev_priv, &dev_priv->ring[i]);
-        i915_gem_reset_ring_lists(dev_priv, &dev_priv->blt_ring);
        /* Remove anything from the flushing lists. The GPU cache is likely
         * to be lost on reset along with the data, so simply move the
         * lost bo to the inactive list.
         */
        while (!list_empty(&dev_priv->mm.flushing_list)) {
-                obj_priv = list_first_entry(&dev_priv->mm.flushing_list,
+                obj= list_first_entry(&dev_priv->mm.flushing_list,
-                                            struct drm_i915_gem_object,
+                                      struct drm_i915_gem_object,
-                                            mm_list);
+                                      mm_list);
-                obj_priv->base.write_domain = 0;
+                obj->base.write_domain = 0;
-                list_del_init(&obj_priv->gpu_write_list);
+                list_del_init(&obj->gpu_write_list);
-                i915_gem_object_move_to_inactive(&obj_priv->base);
+                i915_gem_object_move_to_inactive(obj);
        }
        /* Move everything out of the GPU domains to ensure we do any
         * necessary invalidation upon reuse.
         */
-        list_for_each_entry(obj_priv,
+        list_for_each_entry(obj,
                            &dev_priv->mm.inactive_list,
                            mm_list)
        {
-                obj_priv->base.read_domains &= ~I915_GEM_GPU_DOMAINS;
+                obj->base.read_domains &= ~I915_GEM_GPU_DOMAINS;
        }
        /* The fence registers are invalidated so clear them out */
-        for (i = 0; i < 16; i++) {
+        i915_gem_reset_fences(dev);
-                struct drm_i915_fence_reg *reg;
-                reg = &dev_priv->fence_regs[i];
-                if (!reg->obj)
-                        continue;
-                i915_gem_clear_fence_reg(reg->obj);
-        }
 }
 /**
@@ -1837,6 +1847,7 @@ i915_gem_retire_requests_ring(struct drm_device *dev,
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        uint32_t seqno;
+        int i;
        if (!ring->status_page.page_addr ||
            list_empty(&ring->request_list))
@@ -1844,7 +1855,12 @@ i915_gem_retire_requests_ring(struct drm_device *dev,
        WARN_ON(i915_verify_lists(dev));
-        seqno = ring->get_seqno(dev, ring);
+        seqno = ring->get_seqno(ring);
+        for (i = 0; i < I915_NUM_RINGS; i++)
+                if (seqno >= ring->sync_seqno[i])
+                        ring->sync_seqno[i] = 0;
        while (!list_empty(&ring->request_list)) {
                struct drm_i915_gem_request *request;
@@ -1866,18 +1882,16 @@ i915_gem_retire_requests_ring(struct drm_device *dev,
         * by the ringbuffer to the flushing/inactive lists as appropriate.
         */
        while (!list_empty(&ring->active_list)) {
-                struct drm_gem_object *obj;
+                struct drm_i915_gem_object *obj;
-                struct drm_i915_gem_object *obj_priv;
-                obj_priv = list_first_entry(&ring->active_list,
+                obj= list_first_entry(&ring->active_list,
-                                            struct drm_i915_gem_object,
+                                      struct drm_i915_gem_object,
-                                            ring_list);
+                                      ring_list);
-                if (!i915_seqno_passed(seqno, obj_priv->last_rendering_seqno))
+                if (!i915_seqno_passed(seqno, obj->last_rendering_seqno))
                        break;
-                obj = &obj_priv->base;
+                if (obj->base.write_domain != 0)
-                if (obj->write_domain != 0)
                        i915_gem_object_move_to_flushing(obj);
                else
                        i915_gem_object_move_to_inactive(obj);
@@ -1885,7 +1899,7 @@ i915_gem_retire_requests_ring(struct drm_device *dev,
        if (unlikely (dev_priv->trace_irq_seqno &&
                      i915_seqno_passed(dev_priv->trace_irq_seqno, seqno))) {
-                ring->user_irq_put(dev, ring);
+                ring->irq_put(ring);
                dev_priv->trace_irq_seqno = 0;
        }
@@ -1896,24 +1910,24 @@ void
 i915_gem_retire_requests(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        int i;
        if (!list_empty(&dev_priv->mm.deferred_free_list)) {
-            struct drm_i915_gem_object *obj_priv, *tmp;
+            struct drm_i915_gem_object *obj, *next;
            /* We must be careful that during unbind() we do not
             * accidentally infinitely recurse into retire requests.
             * Currently:
             *   retire -> free -> unbind -> wait -> retire_ring
             */
-            list_for_each_entry_safe(obj_priv, tmp,
+            list_for_each_entry_safe(obj, next,
                                     &dev_priv->mm.deferred_free_list,
                                     mm_list)
-                    i915_gem_free_object_tail(&obj_priv->base);
+                    i915_gem_free_object_tail(obj);
        }
-        i915_gem_retire_requests_ring(dev, &dev_priv->render_ring);
+        for (i = 0; i < I915_NUM_RINGS; i++)
-        i915_gem_retire_requests_ring(dev, &dev_priv->bsd_ring);
+                i915_gem_retire_requests_ring(dev, &dev_priv->ring[i]);
-        i915_gem_retire_requests_ring(dev, &dev_priv->blt_ring);
 }
 static void
@@ -1935,9 +1949,9 @@ i915_gem_retire_work_handler(struct work_struct *work)
        i915_gem_retire_requests(dev);
        if (!dev_priv->mm.suspended &&
-                (!list_empty(&dev_priv->render_ring.request_list) ||
+                (!list_empty(&dev_priv->ring[RCS].request_list) ||
-                 !list_empty(&dev_priv->bsd_ring.request_list) ||
+                 !list_empty(&dev_priv->ring[VCS].request_list) ||
-                 !list_empty(&dev_priv->blt_ring.request_list)))
+                 !list_empty(&dev_priv->ring[BCS].request_list)))
                queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work, HZ);
        mutex_unlock(&dev->struct_mutex);
 }
@@ -1955,14 +1969,23 @@ i915_do_wait_request(struct drm_device *dev, uint32_t seqno,
        if (atomic_read(&dev_priv->mm.wedged))
                return -EAGAIN;
-        if (ring->outstanding_lazy_request) {
+        if (seqno == ring->outstanding_lazy_request) {
-                seqno = i915_add_request(dev, NULL, NULL, ring);
+                struct drm_i915_gem_request *request;
-                if (seqno == 0)
+                request = kzalloc(sizeof(*request), GFP_KERNEL);
+                if (request == NULL)
                        return -ENOMEM;
+                ret = i915_add_request(dev, NULL, request, ring);
+                if (ret) {
+                        kfree(request);
+                        return ret;
+                }
+                seqno = request->seqno;
        }
-        BUG_ON(seqno == dev_priv->next_seqno);
-        if (!i915_seqno_passed(ring->get_seqno(dev, ring), seqno)) {
+        if (!i915_seqno_passed(ring->get_seqno(ring), seqno)) {
                if (HAS_PCH_SPLIT(dev))
                        ier = I915_READ(DEIER) | I915_READ(GTIER);
                else
@@ -1976,21 +1999,23 @@ i915_do_wait_request(struct drm_device *dev, uint32_t seqno,
                trace_i915_gem_request_wait_begin(dev, seqno);
-                ring->waiting_gem_seqno = seqno;
+                ring->waiting_seqno = seqno;
-                ring->user_irq_get(dev, ring);
+                if (ring->irq_get(ring)) {
-                if (interruptible)
+                        if (interruptible)
-                        ret = wait_event_interruptible(ring->irq_queue,
+                                ret = wait_event_interruptible(ring->irq_queue,
-                                i915_seqno_passed(
+                                                               i915_seqno_passed(ring->get_seqno(ring), seqno)
-                                        ring->get_seqno(dev, ring), seqno)
+                                                               || atomic_read(&dev_priv->mm.wedged));
-                                || atomic_read(&dev_priv->mm.wedged));
+                        else
-                else
+                                wait_event(ring->irq_queue,
-                        wait_event(ring->irq_queue,
+                                           i915_seqno_passed(ring->get_seqno(ring), seqno)
-                                i915_seqno_passed(
+                                           || atomic_read(&dev_priv->mm.wedged));
-                                        ring->get_seqno(dev, ring), seqno)
-                                || atomic_read(&dev_priv->mm.wedged));
-                ring->user_irq_put(dev, ring);
+                        ring->irq_put(ring);
-                ring->waiting_gem_seqno = 0;
+                } else if (wait_for(i915_seqno_passed(ring->get_seqno(ring),
+                                                      seqno) ||
+                                    atomic_read(&dev_priv->mm.wedged), 3000))
+                        ret = -EBUSY;
+                ring->waiting_seqno = 0;
                trace_i915_gem_request_wait_end(dev, seqno);
        }
@@ -1999,7 +2024,7 @@ i915_do_wait_request(struct drm_device *dev, uint32_t seqno,
        if (ret && ret != -ERESTARTSYS)
                DRM_ERROR("%s returns %d (awaiting %d at %d, next %d)\n",
-                          __func__, ret, seqno, ring->get_seqno(dev, ring),
+                          __func__, ret, seqno, ring->get_seqno(ring),
                          dev_priv->next_seqno);
        /* Directly dispatch request retiring.  While we have the work queue
@@ -2024,70 +2049,30 @@ i915_wait_request(struct drm_device *dev, uint32_t seqno,
        return i915_do_wait_request(dev, seqno, 1, ring);
 }
-static void
-i915_gem_flush_ring(struct drm_device *dev,
-                    struct drm_file *file_priv,
-                    struct intel_ring_buffer *ring,
-                    uint32_t invalidate_domains,
-                    uint32_t flush_domains)
-{
-        ring->flush(dev, ring, invalidate_domains, flush_domains);
-        i915_gem_process_flushing_list(dev, flush_domains, ring);
-}
-static void
-i915_gem_flush(struct drm_device *dev,
-               struct drm_file *file_priv,
-               uint32_t invalidate_domains,
-               uint32_t flush_domains,
-               uint32_t flush_rings)
-{
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        if (flush_domains & I915_GEM_DOMAIN_CPU)
-                drm_agp_chipset_flush(dev);
-        if ((flush_domains | invalidate_domains) & I915_GEM_GPU_DOMAINS) {
-                if (flush_rings & RING_RENDER)
-                        i915_gem_flush_ring(dev, file_priv,
-                                            &dev_priv->render_ring,
-                                            invalidate_domains, flush_domains);
-                if (flush_rings & RING_BSD)
-                        i915_gem_flush_ring(dev, file_priv,
-                                            &dev_priv->bsd_ring,
-                                            invalidate_domains, flush_domains);
-                if (flush_rings & RING_BLT)
-                        i915_gem_flush_ring(dev, file_priv,
-                                            &dev_priv->blt_ring,
-                                            invalidate_domains, flush_domains);
-        }
-}
 /**
 * Ensures that all rendering to the object has completed and the object is
 * safe to unbind from the GTT or access from the CPU.
 */
-static int
+int
-i915_gem_object_wait_rendering(struct drm_gem_object *obj,
+i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
                               bool interruptible)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        int ret;
        /* This function only exists to support waiting for existing rendering,
         * not for emitting required flushes.
         */
-        BUG_ON((obj->write_domain & I915_GEM_GPU_DOMAINS) != 0);
+        BUG_ON((obj->base.write_domain & I915_GEM_GPU_DOMAINS) != 0);
        /* If there is rendering queued on the buffer being evicted, wait for
         * it.
         */
-        if (obj_priv->active) {
+        if (obj->active) {
                ret = i915_do_wait_request(dev,
-                                           obj_priv->last_rendering_seqno,
+                                           obj->last_rendering_seqno,
                                           interruptible,
-                                           obj_priv->ring);
+                                           obj->ring);
                if (ret)
                        return ret;
        }
@@ -2099,17 +2084,14 @@ i915_gem_object_wait_rendering(struct drm_gem_object *obj,
 * Unbinds an object from the GTT aperture.
 */
 int
-i915_gem_object_unbind(struct drm_gem_object *obj)
+i915_gem_object_unbind(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        int ret = 0;
-        if (obj_priv->gtt_space == NULL)
+        if (obj->gtt_space == NULL)
                return 0;
-        if (obj_priv->pin_count != 0) {
+        if (obj->pin_count != 0) {
                DRM_ERROR("Attempting to unbind pinned buffer\n");
                return -EINVAL;
        }
@@ -2132,27 +2114,27 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
         */
        if (ret) {
                i915_gem_clflush_object(obj);
-                obj->read_domains = obj->write_domain = I915_GEM_DOMAIN_CPU;
+                obj->base.read_domains = obj->base.write_domain = I915_GEM_DOMAIN_CPU;
        }
        /* release the fence reg _after_ flushing */
-        if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
+        ret = i915_gem_object_put_fence(obj);
-                i915_gem_clear_fence_reg(obj);
+        if (ret == -ERESTARTSYS)
+                return ret;
-        drm_unbind_agp(obj_priv->agp_mem);
-        drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
-        i915_gem_object_put_pages(obj);
+        i915_gem_gtt_unbind_object(obj);
-        BUG_ON(obj_priv->pages_refcount);
+        i915_gem_object_put_pages_gtt(obj);
-        i915_gem_info_remove_gtt(dev_priv, obj->size);
+        list_del_init(&obj->gtt_list);
-        list_del_init(&obj_priv->mm_list);
+        list_del_init(&obj->mm_list);
+        /* Avoid an unnecessary call to unbind on rebind. */
+        obj->map_and_fenceable = true;
-        drm_mm_put_block(obj_priv->gtt_space);
+        drm_mm_put_block(obj->gtt_space);
-        obj_priv->gtt_space = NULL;
+        obj->gtt_space = NULL;
-        obj_priv->gtt_offset = 0;
+        obj->gtt_offset = 0;
-        if (i915_gem_object_is_purgeable(obj_priv))
+        if (i915_gem_object_is_purgeable(obj))
                i915_gem_object_truncate(obj);
        trace_i915_gem_object_unbind(obj);
@@ -2160,14 +2142,25 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
        return ret;
 }
+void
+i915_gem_flush_ring(struct drm_device *dev,
+                    struct intel_ring_buffer *ring,
+                    uint32_t invalidate_domains,
+                    uint32_t flush_domains)
+{
+        ring->flush(ring, invalidate_domains, flush_domains);
+        i915_gem_process_flushing_list(dev, flush_domains, ring);
+}
 static int i915_ring_idle(struct drm_device *dev,
                          struct intel_ring_buffer *ring)
 {
        if (list_empty(&ring->gpu_write_list) && list_empty(&ring->active_list))
                return 0;
-        i915_gem_flush_ring(dev, NULL, ring,
+        if (!list_empty(&ring->gpu_write_list))
-                            I915_GEM_GPU_DOMAINS, I915_GEM_GPU_DOMAINS);
+                i915_gem_flush_ring(dev, ring,
+                                    I915_GEM_GPU_DOMAINS, I915_GEM_GPU_DOMAINS);
        return i915_wait_request(dev,
                                 i915_gem_next_request_seqno(dev, ring),
                                 ring);
@@ -2178,7 +2171,7 @@ i915_gpu_idle(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        bool lists_empty;
-        int ret;
+        int ret, i;
        lists_empty = (list_empty(&dev_priv->mm.flushing_list) &&
                       list_empty(&dev_priv->mm.active_list));
@@ -2186,258 +2179,296 @@ i915_gpu_idle(struct drm_device *dev)
                return 0;
        /* Flush everything onto the inactive list. */
-        ret = i915_ring_idle(dev, &dev_priv->render_ring);
+        for (i = 0; i < I915_NUM_RINGS; i++) {
-        if (ret)
+                ret = i915_ring_idle(dev, &dev_priv->ring[i]);
-                return ret;
+                if (ret)
+                        return ret;
-        ret = i915_ring_idle(dev, &dev_priv->bsd_ring);
-        if (ret)
-                return ret;
-        ret = i915_ring_idle(dev, &dev_priv->blt_ring);
-        if (ret)
-                return ret;
-        return 0;
-}
-static int
-i915_gem_object_get_pages(struct drm_gem_object *obj,
-                          gfp_t gfpmask)
-{
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
-        int page_count, i;
-        struct address_space *mapping;
-        struct inode *inode;
-        struct page *page;
-        BUG_ON(obj_priv->pages_refcount
-                        == DRM_I915_GEM_OBJECT_MAX_PAGES_REFCOUNT);
-        if (obj_priv->pages_refcount++ != 0)
-                return 0;
-        /* Get the list of pages out of our struct file.  They'll be pinned
-         * at this point until we release them.
-         */
-        page_count = obj->size / PAGE_SIZE;
-        BUG_ON(obj_priv->pages != NULL);
-        obj_priv->pages = drm_calloc_large(page_count, sizeof(struct page *));
-        if (obj_priv->pages == NULL) {
-                obj_priv->pages_refcount--;
-                return -ENOMEM;
-        }
-        inode = obj->filp->f_path.dentry->d_inode;
-        mapping = inode->i_mapping;
-        for (i = 0; i < page_count; i++) {
-                page = read_cache_page_gfp(mapping, i,
-                                           GFP_HIGHUSER |
-                                           __GFP_COLD |
-                                           __GFP_RECLAIMABLE |
-                                           gfpmask);
-                if (IS_ERR(page))
-                        goto err_pages;
-                obj_priv->pages[i] = page;
        }
-        if (obj_priv->tiling_mode != I915_TILING_NONE)
-                i915_gem_object_do_bit_17_swizzle(obj);
        return 0;
-err_pages:
-        while (i--)
-                page_cache_release(obj_priv->pages[i]);
-        drm_free_large(obj_priv->pages);
-        obj_priv->pages = NULL;
-        obj_priv->pages_refcount--;
-        return PTR_ERR(page);
 }
-static void sandybridge_write_fence_reg(struct drm_i915_fence_reg *reg)
+static int sandybridge_write_fence_reg(struct drm_i915_gem_object *obj,
+                                       struct intel_ring_buffer *pipelined)
 {
-        struct drm_gem_object *obj = reg->obj;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_device *dev = obj->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        u32 size = obj->gtt_space->size;
-        int regnum = obj_priv->fence_reg;
+        int regnum = obj->fence_reg;
        uint64_t val;
-        val = (uint64_t)((obj_priv->gtt_offset + obj->size - 4096) &
+        val = (uint64_t)((obj->gtt_offset + size - 4096) &
-                    0xfffff000) << 32;
+                         0xfffff000) << 32;
-        val |= obj_priv->gtt_offset & 0xfffff000;
+        val |= obj->gtt_offset & 0xfffff000;
-        val |= (uint64_t)((obj_priv->stride / 128) - 1) <<
+        val |= (uint64_t)((obj->stride / 128) - 1) <<
                SANDYBRIDGE_FENCE_PITCH_SHIFT;
-        if (obj_priv->tiling_mode == I915_TILING_Y)
+        if (obj->tiling_mode == I915_TILING_Y)
                val |= 1 << I965_FENCE_TILING_Y_SHIFT;
        val |= I965_FENCE_REG_VALID;
-        I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + (regnum * 8), val);
+        if (pipelined) {
+                int ret = intel_ring_begin(pipelined, 6);
+                if (ret)
+                        return ret;
+                intel_ring_emit(pipelined, MI_NOOP);
+                intel_ring_emit(pipelined, MI_LOAD_REGISTER_IMM(2));
+                intel_ring_emit(pipelined, FENCE_REG_SANDYBRIDGE_0 + regnum*8);
+                intel_ring_emit(pipelined, (u32)val);
+                intel_ring_emit(pipelined, FENCE_REG_SANDYBRIDGE_0 + regnum*8 + 4);
+                intel_ring_emit(pipelined, (u32)(val >> 32));
+                intel_ring_advance(pipelined);
+        } else
+                I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + regnum * 8, val);
+        return 0;
 }
-static void i965_write_fence_reg(struct drm_i915_fence_reg *reg)
+static int i965_write_fence_reg(struct drm_i915_gem_object *obj,
+                                struct intel_ring_buffer *pipelined)
 {
-        struct drm_gem_object *obj = reg->obj;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_device *dev = obj->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        u32 size = obj->gtt_space->size;
-        int regnum = obj_priv->fence_reg;
+        int regnum = obj->fence_reg;
        uint64_t val;
-        val = (uint64_t)((obj_priv->gtt_offset + obj->size - 4096) &
+        val = (uint64_t)((obj->gtt_offset + size - 4096) &
                    0xfffff000) << 32;
-        val |= obj_priv->gtt_offset & 0xfffff000;
+        val |= obj->gtt_offset & 0xfffff000;
-        val |= ((obj_priv->stride / 128) - 1) << I965_FENCE_PITCH_SHIFT;
+        val |= ((obj->stride / 128) - 1) << I965_FENCE_PITCH_SHIFT;
-        if (obj_priv->tiling_mode == I915_TILING_Y)
+        if (obj->tiling_mode == I915_TILING_Y)
                val |= 1 << I965_FENCE_TILING_Y_SHIFT;
        val |= I965_FENCE_REG_VALID;
-        I915_WRITE64(FENCE_REG_965_0 + (regnum * 8), val);
+        if (pipelined) {
+                int ret = intel_ring_begin(pipelined, 6);
+                if (ret)
+                        return ret;
+                intel_ring_emit(pipelined, MI_NOOP);
+                intel_ring_emit(pipelined, MI_LOAD_REGISTER_IMM(2));
+                intel_ring_emit(pipelined, FENCE_REG_965_0 + regnum*8);
+                intel_ring_emit(pipelined, (u32)val);
+                intel_ring_emit(pipelined, FENCE_REG_965_0 + regnum*8 + 4);
+                intel_ring_emit(pipelined, (u32)(val >> 32));
+                intel_ring_advance(pipelined);
+        } else
+                I915_WRITE64(FENCE_REG_965_0 + regnum * 8, val);
+        return 0;
 }
-static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
+static int i915_write_fence_reg(struct drm_i915_gem_object *obj,
+                                struct intel_ring_buffer *pipelined)
 {
-        struct drm_gem_object *obj = reg->obj;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_device *dev = obj->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        u32 size = obj->gtt_space->size;
-        int regnum = obj_priv->fence_reg;
+        u32 fence_reg, val, pitch_val;
        int tile_width;
-        uint32_t fence_reg, val;
-        uint32_t pitch_val;
-        if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
+        if (WARN((obj->gtt_offset & ~I915_FENCE_START_MASK) ||
-            (obj_priv->gtt_offset & (obj->size - 1))) {
+                 (size & -size) != size ||
-                WARN(1, "%s: object 0x%08x not 1M or size (0x%zx) aligned\n",
+                 (obj->gtt_offset & (size - 1)),
-                     __func__, obj_priv->gtt_offset, obj->size);
+                 "object 0x%08x [fenceable? %d] not 1M or pot-size (0x%08x) aligned\n",
-                return;
+                 obj->gtt_offset, obj->map_and_fenceable, size))
-        }
+                return -EINVAL;
-        if (obj_priv->tiling_mode == I915_TILING_Y &&
+        if (obj->tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev))
-            HAS_128_BYTE_Y_TILING(dev))
                tile_width = 128;
        else
                tile_width = 512;
        /* Note: pitch better be a power of two tile widths */
-        pitch_val = obj_priv->stride / tile_width;
+        pitch_val = obj->stride / tile_width;
        pitch_val = ffs(pitch_val) - 1;
-        if (obj_priv->tiling_mode == I915_TILING_Y &&
+        val = obj->gtt_offset;
-            HAS_128_BYTE_Y_TILING(dev))
+        if (obj->tiling_mode == I915_TILING_Y)
-                WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
-        else
-                WARN_ON(pitch_val > I915_FENCE_MAX_PITCH_VAL);
-        val = obj_priv->gtt_offset;
-        if (obj_priv->tiling_mode == I915_TILING_Y)
                val |= 1 << I830_FENCE_TILING_Y_SHIFT;
-        val |= I915_FENCE_SIZE_BITS(obj->size);
+        val |= I915_FENCE_SIZE_BITS(size);
        val |= pitch_val << I830_FENCE_PITCH_SHIFT;
        val |= I830_FENCE_REG_VALID;
-        if (regnum < 8)
+        fence_reg = obj->fence_reg;
-                fence_reg = FENCE_REG_830_0 + (regnum * 4);
+        if (fence_reg < 8)
+                fence_reg = FENCE_REG_830_0 + fence_reg * 4;
        else
-                fence_reg = FENCE_REG_945_8 + ((regnum - 8) * 4);
+                fence_reg = FENCE_REG_945_8 + (fence_reg - 8) * 4;
-        I915_WRITE(fence_reg, val);
+        if (pipelined) {
+                int ret = intel_ring_begin(pipelined, 4);
+                if (ret)
+                        return ret;
+                intel_ring_emit(pipelined, MI_NOOP);
+                intel_ring_emit(pipelined, MI_LOAD_REGISTER_IMM(1));
+                intel_ring_emit(pipelined, fence_reg);
+                intel_ring_emit(pipelined, val);
+                intel_ring_advance(pipelined);
+        } else
+                I915_WRITE(fence_reg, val);
+        return 0;
 }
-static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
+static int i830_write_fence_reg(struct drm_i915_gem_object *obj,
+                                struct intel_ring_buffer *pipelined)
 {
-        struct drm_gem_object *obj = reg->obj;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_device *dev = obj->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        u32 size = obj->gtt_space->size;
-        int regnum = obj_priv->fence_reg;
+        int regnum = obj->fence_reg;
        uint32_t val;
        uint32_t pitch_val;
-        uint32_t fence_size_bits;
-        if ((obj_priv->gtt_offset & ~I830_FENCE_START_MASK) ||
+        if (WARN((obj->gtt_offset & ~I830_FENCE_START_MASK) ||
-            (obj_priv->gtt_offset & (obj->size - 1))) {
+                 (size & -size) != size ||
-                WARN(1, "%s: object 0x%08x not 512K or size aligned\n",
+                 (obj->gtt_offset & (size - 1)),
-                     __func__, obj_priv->gtt_offset);
+                 "object 0x%08x not 512K or pot-size 0x%08x aligned\n",
-                return;
+                 obj->gtt_offset, size))
-        }
+                return -EINVAL;
-        pitch_val = obj_priv->stride / 128;
+        pitch_val = obj->stride / 128;
        pitch_val = ffs(pitch_val) - 1;
-        WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
-        val = obj_priv->gtt_offset;
+        val = obj->gtt_offset;
-        if (obj_priv->tiling_mode == I915_TILING_Y)
+        if (obj->tiling_mode == I915_TILING_Y)
                val |= 1 << I830_FENCE_TILING_Y_SHIFT;
-        fence_size_bits = I830_FENCE_SIZE_BITS(obj->size);
+        val |= I830_FENCE_SIZE_BITS(size);
-        WARN_ON(fence_size_bits & ~0x00000f00);
-        val |= fence_size_bits;
        val |= pitch_val << I830_FENCE_PITCH_SHIFT;
        val |= I830_FENCE_REG_VALID;
-        I915_WRITE(FENCE_REG_830_0 + (regnum * 4), val);
+        if (pipelined) {
+                int ret = intel_ring_begin(pipelined, 4);
+                if (ret)
+                        return ret;
+                intel_ring_emit(pipelined, MI_NOOP);
+                intel_ring_emit(pipelined, MI_LOAD_REGISTER_IMM(1));
+                intel_ring_emit(pipelined, FENCE_REG_830_0 + regnum*4);
+                intel_ring_emit(pipelined, val);
+                intel_ring_advance(pipelined);
+        } else
+                I915_WRITE(FENCE_REG_830_0 + regnum * 4, val);
+        return 0;
 }
-static int i915_find_fence_reg(struct drm_device *dev,
+static bool ring_passed_seqno(struct intel_ring_buffer *ring, u32 seqno)
-                               bool interruptible)
+{
+        return i915_seqno_passed(ring->get_seqno(ring), seqno);
+}
+static int
+i915_gem_object_flush_fence(struct drm_i915_gem_object *obj,
+                            struct intel_ring_buffer *pipelined,
+                            bool interruptible)
+{
+        int ret;
+        if (obj->fenced_gpu_access) {
+                if (obj->base.write_domain & I915_GEM_GPU_DOMAINS)
+                        i915_gem_flush_ring(obj->base.dev,
+                                            obj->last_fenced_ring,
+                                            0, obj->base.write_domain);
+                obj->fenced_gpu_access = false;
+        }
+        if (obj->last_fenced_seqno && pipelined != obj->last_fenced_ring) {
+                if (!ring_passed_seqno(obj->last_fenced_ring,
+                                       obj->last_fenced_seqno)) {
+                        ret = i915_do_wait_request(obj->base.dev,
+                                                   obj->last_fenced_seqno,
+                                                   interruptible,
+                                                   obj->last_fenced_ring);
+                        if (ret)
+                                return ret;
+                }
+                obj->last_fenced_seqno = 0;
+                obj->last_fenced_ring = NULL;
+        }
+        return 0;
+}
+int
+i915_gem_object_put_fence(struct drm_i915_gem_object *obj)
+{
+        int ret;
+        if (obj->tiling_mode)
+                i915_gem_release_mmap(obj);
+        ret = i915_gem_object_flush_fence(obj, NULL, true);
+        if (ret)
+                return ret;
+        if (obj->fence_reg != I915_FENCE_REG_NONE) {
+                struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
+                i915_gem_clear_fence_reg(obj->base.dev,
+                                         &dev_priv->fence_regs[obj->fence_reg]);
+                obj->fence_reg = I915_FENCE_REG_NONE;
+        }
+        return 0;
+}
+static struct drm_i915_fence_reg *
+i915_find_fence_reg(struct drm_device *dev,
+                    struct intel_ring_buffer *pipelined)
 {
-        struct drm_i915_fence_reg *reg = NULL;
-        struct drm_i915_gem_object *obj_priv = NULL;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_gem_object *obj = NULL;
+        struct drm_i915_fence_reg *reg, *first, *avail;
-        int i, avail, ret;
+        int i;
        /* First try to find a free reg */
-        avail = 0;
+        avail = NULL;
        for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
                reg = &dev_priv->fence_regs[i];
                if (!reg->obj)
-                        return i;
+                        return reg;
-                obj_priv = to_intel_bo(reg->obj);
+                if (!reg->obj->pin_count)
-                if (!obj_priv->pin_count)
+                        avail = reg;
-                    avail++;
        }
-        if (avail == 0)
+        if (avail == NULL)
-                return -ENOSPC;
+                return NULL;
        /* None available, try to steal one or wait for a user to finish */
-        i = I915_FENCE_REG_NONE;
+        avail = first = NULL;
-        list_for_each_entry(reg, &dev_priv->mm.fence_list,
+        list_for_each_entry(reg, &dev_priv->mm.fence_list, lru_list) {
-                            lru_list) {
+                if (reg->obj->pin_count)
-                obj = reg->obj;
-                obj_priv = to_intel_bo(obj);
-                if (obj_priv->pin_count)
                        continue;
-                /* found one! */
+                if (first == NULL)
-                i = obj_priv->fence_reg;
+                        first = reg;
-                break;
+                if (!pipelined ||
+                    !reg->obj->last_fenced_ring ||
+                    reg->obj->last_fenced_ring == pipelined) {
+                        avail = reg;
+                        break;
+                }
        }
-        BUG_ON(i == I915_FENCE_REG_NONE);
+        if (avail == NULL)
+                avail = first;
-        /* We only have a reference on obj from the active list. put_fence_reg
+        return avail;
-         * might drop that one, causing a use-after-free in it. So hold a
-         * private reference to obj like the other callers of put_fence_reg
-         * (set_tiling ioctl) do. */
-        drm_gem_object_reference(obj);
-        ret = i915_gem_object_put_fence_reg(obj, interruptible);
-        drm_gem_object_unreference(obj);
-        if (ret != 0)
-                return ret;
-        return i;
 }
 /**
- * i915_gem_object_get_fence_reg - set up a fence reg for an object
+ * i915_gem_object_get_fence - set up a fence reg for an object
 * @obj: object to map through a fence reg
+ * @pipelined: ring on which to queue the change, or NULL for CPU access
+ * @interruptible: must we wait uninterruptibly for the register to retire?
 *
 * When mapping objects through the GTT, userspace wants to be able to write
 * to them without having to worry about swizzling if the object is tiled.
@@ -2449,72 +2480,138 @@ static int i915_find_fence_reg(struct drm_device *dev,
 * and tiling format.
 */
 int
-i915_gem_object_get_fence_reg(struct drm_gem_object *obj,
+i915_gem_object_get_fence(struct drm_i915_gem_object *obj,
-                              bool interruptible)
+                          struct intel_ring_buffer *pipelined,
+                          bool interruptible)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        struct drm_i915_fence_reg *reg;
-        struct drm_i915_fence_reg *reg = NULL;
        int ret;
-        /* Just update our place in the LRU if our fence is getting used. */
+        /* XXX disable pipelining. There are bugs. Shocking. */
-        if (obj_priv->fence_reg != I915_FENCE_REG_NONE) {
+        pipelined = NULL;
-                reg = &dev_priv->fence_regs[obj_priv->fence_reg];
+        /* Just update our place in the LRU if our fence is getting reused. */
+        if (obj->fence_reg != I915_FENCE_REG_NONE) {
+                reg = &dev_priv->fence_regs[obj->fence_reg];
                list_move_tail(&reg->lru_list, &dev_priv->mm.fence_list);
+                if (!obj->fenced_gpu_access && !obj->last_fenced_seqno)
+                        pipelined = NULL;
+                if (!pipelined) {
+                        if (reg->setup_seqno) {
+                                if (!ring_passed_seqno(obj->last_fenced_ring,
+                                                       reg->setup_seqno)) {
+                                        ret = i915_do_wait_request(obj->base.dev,
+                                                                   reg->setup_seqno,
+                                                                   interruptible,
+                                                                   obj->last_fenced_ring);
+                                        if (ret)
+                                                return ret;
+                                }
+                                reg->setup_seqno = 0;
+                        }
+                } else if (obj->last_fenced_ring &&
+                           obj->last_fenced_ring != pipelined) {
+                        ret = i915_gem_object_flush_fence(obj,
+                                                          pipelined,
+                                                          interruptible);
+                        if (ret)
+                                return ret;
+                } else if (obj->tiling_changed) {
+                        if (obj->fenced_gpu_access) {
+                                if (obj->base.write_domain & I915_GEM_GPU_DOMAINS)
+                                        i915_gem_flush_ring(obj->base.dev, obj->ring,
+                                                            0, obj->base.write_domain);
+                                obj->fenced_gpu_access = false;
+                        }
+                }
+                if (!obj->fenced_gpu_access && !obj->last_fenced_seqno)
+                        pipelined = NULL;
+                BUG_ON(!pipelined && reg->setup_seqno);
+                if (obj->tiling_changed) {
+                        if (pipelined) {
+                                reg->setup_seqno =
+                                        i915_gem_next_request_seqno(dev, pipelined);
+                                obj->last_fenced_seqno = reg->setup_seqno;
+                                obj->last_fenced_ring = pipelined;
+                        }
+                        goto update;
+                }
                return 0;
        }
-        switch (obj_priv->tiling_mode) {
+        reg = i915_find_fence_reg(dev, pipelined);
-        case I915_TILING_NONE:
+        if (reg == NULL)
-                WARN(1, "allocating a fence for non-tiled object?\n");
+                return -ENOSPC;
-                break;
-        case I915_TILING_X:
-                if (!obj_priv->stride)
-                        return -EINVAL;
-                WARN((obj_priv->stride & (512 - 1)),
-                     "object 0x%08x is X tiled but has non-512B pitch\n",
-                     obj_priv->gtt_offset);
-                break;
-        case I915_TILING_Y:
-                if (!obj_priv->stride)
-                        return -EINVAL;
-                WARN((obj_priv->stride & (128 - 1)),
-                     "object 0x%08x is Y tiled but has non-128B pitch\n",
-                     obj_priv->gtt_offset);
-                break;
-        }
-        ret = i915_find_fence_reg(dev, interruptible);
+        ret = i915_gem_object_flush_fence(obj, pipelined, interruptible);
-        if (ret < 0)
+        if (ret)
                return ret;
-        obj_priv->fence_reg = ret;
+        if (reg->obj) {
-        reg = &dev_priv->fence_regs[obj_priv->fence_reg];
+                struct drm_i915_gem_object *old = reg->obj;
-        list_add_tail(&reg->lru_list, &dev_priv->mm.fence_list);
+                drm_gem_object_reference(&old->base);
+                if (old->tiling_mode)
+                        i915_gem_release_mmap(old);
+                ret = i915_gem_object_flush_fence(old,
+                                                  pipelined,
+                                                  interruptible);
+                if (ret) {
+                        drm_gem_object_unreference(&old->base);
+                        return ret;
+                }
+                if (old->last_fenced_seqno == 0 && obj->last_fenced_seqno == 0)
+                        pipelined = NULL;
+                old->fence_reg = I915_FENCE_REG_NONE;
+                old->last_fenced_ring = pipelined;
+                old->last_fenced_seqno =
+                        pipelined ? i915_gem_next_request_seqno(dev, pipelined) : 0;
+                drm_gem_object_unreference(&old->base);
+        } else if (obj->last_fenced_seqno == 0)
+                pipelined = NULL;
        reg->obj = obj;
+        list_move_tail(&reg->lru_list, &dev_priv->mm.fence_list);
+        obj->fence_reg = reg - dev_priv->fence_regs;
+        obj->last_fenced_ring = pipelined;
+        reg->setup_seqno =
+                pipelined ? i915_gem_next_request_seqno(dev, pipelined) : 0;
+        obj->last_fenced_seqno = reg->setup_seqno;
+update:
+        obj->tiling_changed = false;
        switch (INTEL_INFO(dev)->gen) {
        case 6:
-                sandybridge_write_fence_reg(reg);
+                ret = sandybridge_write_fence_reg(obj, pipelined);
                break;
        case 5:
        case 4:
-                i965_write_fence_reg(reg);
+                ret = i965_write_fence_reg(obj, pipelined);
                break;
        case 3:
-                i915_write_fence_reg(reg);
+                ret = i915_write_fence_reg(obj, pipelined);
                break;
        case 2:
-                i830_write_fence_reg(reg);
+                ret = i830_write_fence_reg(obj, pipelined);
                break;
        }
-        trace_i915_gem_object_get_fence(obj, obj_priv->fence_reg,
+        return ret;
-                        obj_priv->tiling_mode);
-        return 0;
 }
 /**
@@ -2522,154 +2619,127 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj,
 * @obj: object to clear
 *
 * Zeroes out the fence register itself and clears out the associated
- * data structures in dev_priv and obj_priv.
+ * data structures in dev_priv and obj.
 */
 static void
-i915_gem_clear_fence_reg(struct drm_gem_object *obj)
+i915_gem_clear_fence_reg(struct drm_device *dev,
+                         struct drm_i915_fence_reg *reg)
 {
-        struct drm_device *dev = obj->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        uint32_t fence_reg = reg - dev_priv->fence_regs;
-        struct drm_i915_fence_reg *reg =
-                &dev_priv->fence_regs[obj_priv->fence_reg];
-        uint32_t fence_reg;
        switch (INTEL_INFO(dev)->gen) {
        case 6:
-                I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 +
+                I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + fence_reg*8, 0);
-                             (obj_priv->fence_reg * 8), 0);
                break;
        case 5:
        case 4:
-                I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
+                I915_WRITE64(FENCE_REG_965_0 + fence_reg*8, 0);
                break;
        case 3:
-                if (obj_priv->fence_reg >= 8)
+                if (fence_reg >= 8)
-                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg - 8) * 4;
+                        fence_reg = FENCE_REG_945_8 + (fence_reg - 8) * 4;
                else
        case 2:
-                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
+                        fence_reg = FENCE_REG_830_0 + fence_reg * 4;
                I915_WRITE(fence_reg, 0);
                break;
        }
-        reg->obj = NULL;
-        obj_priv->fence_reg = I915_FENCE_REG_NONE;
        list_del_init(&reg->lru_list);
-}
+        reg->obj = NULL;
+        reg->setup_seqno = 0;
-/**
- * i915_gem_object_put_fence_reg - waits on outstanding fenced access
- * to the buffer to finish, and then resets the fence register.
- * @obj: tiled object holding a fence register.
- * @bool: whether the wait upon the fence is interruptible
- *
- * Zeroes out the fence register itself and clears out the associated
- * data structures in dev_priv and obj_priv.
- */
-int
-i915_gem_object_put_fence_reg(struct drm_gem_object *obj,
-                              bool interruptible)
-{
-        struct drm_device *dev = obj->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
-        struct drm_i915_fence_reg *reg;
-        if (obj_priv->fence_reg == I915_FENCE_REG_NONE)
-                return 0;
-        /* If we've changed tiling, GTT-mappings of the object
-         * need to re-fault to ensure that the correct fence register
-         * setup is in place.
-         */
-        i915_gem_release_mmap(obj);
-        /* On the i915, GPU access to tiled buffers is via a fence,
-         * therefore we must wait for any outstanding access to complete
-         * before clearing the fence.
-         */
-        reg = &dev_priv->fence_regs[obj_priv->fence_reg];
-        if (reg->gpu) {
-                int ret;
-                ret = i915_gem_object_flush_gpu_write_domain(obj, true);
-                if (ret)
-                        return ret;
-                ret = i915_gem_object_wait_rendering(obj, interruptible);
-                if (ret)
-                        return ret;
-                reg->gpu = false;
-        }
-        i915_gem_object_flush_gtt_write_domain(obj);
-        i915_gem_clear_fence_reg(obj);
-        return 0;
 }
 /**
 * Finds free space in the GTT aperture and binds the object there.
 */
 static int
-i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
+i915_gem_object_bind_to_gtt(struct drm_i915_gem_object *obj,
+                            unsigned alignment,
+                            bool map_and_fenceable)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        struct drm_mm_node *free_space;
-        gfp_t gfpmask =  __GFP_NORETRY | __GFP_NOWARN;
+        gfp_t gfpmask = __GFP_NORETRY | __GFP_NOWARN;
+        u32 size, fence_size, fence_alignment, unfenced_alignment;
+        bool mappable, fenceable;
        int ret;
-        if (obj_priv->madv != I915_MADV_WILLNEED) {
+        if (obj->madv != I915_MADV_WILLNEED) {
                DRM_ERROR("Attempting to bind a purgeable object\n");
                return -EINVAL;
        }
+        fence_size = i915_gem_get_gtt_size(obj);
+        fence_alignment = i915_gem_get_gtt_alignment(obj);
+        unfenced_alignment = i915_gem_get_unfenced_gtt_alignment(obj);
        if (alignment == 0)
-                alignment = i915_gem_get_gtt_alignment(obj);
+                alignment = map_and_fenceable ? fence_alignment :
-        if (alignment & (i915_gem_get_gtt_alignment(obj) - 1)) {
+                                                unfenced_alignment;
+        if (map_and_fenceable && alignment & (fence_alignment - 1)) {
                DRM_ERROR("Invalid object alignment requested %u\n", alignment);
                return -EINVAL;
        }
+        size = map_and_fenceable ? fence_size : obj->base.size;
        /* If the object is bigger than the entire aperture, reject it early
         * before evicting everything in a vain attempt to find space.
         */
-        if (obj->size > dev_priv->mm.gtt_total) {
+        if (obj->base.size >
+            (map_and_fenceable ? dev_priv->mm.gtt_mappable_end : dev_priv->mm.gtt_total)) {
                DRM_ERROR("Attempting to bind an object larger than the aperture\n");
                return -E2BIG;
        }
 search_free:
-        free_space = drm_mm_search_free(&dev_priv->mm.gtt_space,
+        if (map_and_fenceable)
-                                        obj->size, alignment, 0);
+                free_space =
-        if (free_space != NULL)
+                        drm_mm_search_free_in_range(&dev_priv->mm.gtt_space,
-                obj_priv->gtt_space = drm_mm_get_block(free_space, obj->size,
+                                                    size, alignment, 0,
-                                                       alignment);
+                                                    dev_priv->mm.gtt_mappable_end,
-        if (obj_priv->gtt_space == NULL) {
+                                                    0);
+        else
+                free_space = drm_mm_search_free(&dev_priv->mm.gtt_space,
+                                                size, alignment, 0);
+        if (free_space != NULL) {
+                if (map_and_fenceable)
+                        obj->gtt_space =
+                                drm_mm_get_block_range_generic(free_space,
+                                                               size, alignment, 0,
+                                                               dev_priv->mm.gtt_mappable_end,
+                                                               0);
+                else
+                        obj->gtt_space =
+                                drm_mm_get_block(free_space, size, alignment);
+        }
+        if (obj->gtt_space == NULL) {
                /* If the gtt is empty and we're still having trouble
                 * fitting our object in, we're out of memory.
                 */
-                ret = i915_gem_evict_something(dev, obj->size, alignment);
+                ret = i915_gem_evict_something(dev, size, alignment,
+                                               map_and_fenceable);
                if (ret)
                        return ret;
                goto search_free;
        }
-        ret = i915_gem_object_get_pages(obj, gfpmask);
+        ret = i915_gem_object_get_pages_gtt(obj, gfpmask);
        if (ret) {
-                drm_mm_put_block(obj_priv->gtt_space);
+                drm_mm_put_block(obj->gtt_space);
-                obj_priv->gtt_space = NULL;
+                obj->gtt_space = NULL;
                if (ret == -ENOMEM) {
                        /* first try to clear up some space from the GTT */
-                        ret = i915_gem_evict_something(dev, obj->size,
+                        ret = i915_gem_evict_something(dev, size,
-                                                       alignment);
+                                                       alignment,
+                                                       map_and_fenceable);
                        if (ret) {
                                /* now try to shrink everyone else */
                                if (gfpmask) {
@@ -2686,126 +2756,113 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
                return ret;
        }
-        /* Create an AGP memory structure pointing at our pages, and bind it
+        ret = i915_gem_gtt_bind_object(obj);
-         * into the GTT.
+        if (ret) {
-         */
+                i915_gem_object_put_pages_gtt(obj);
-        obj_priv->agp_mem = drm_agp_bind_pages(dev,
+                drm_mm_put_block(obj->gtt_space);
-                                               obj_priv->pages,
+                obj->gtt_space = NULL;
-                                               obj->size >> PAGE_SHIFT,
-                                               obj_priv->gtt_space->start,
+                ret = i915_gem_evict_something(dev, size,
-                                               obj_priv->agp_type);
+                                               alignment, map_and_fenceable);
-        if (obj_priv->agp_mem == NULL) {
-                i915_gem_object_put_pages(obj);
-                drm_mm_put_block(obj_priv->gtt_space);
-                obj_priv->gtt_space = NULL;
-                ret = i915_gem_evict_something(dev, obj->size, alignment);
                if (ret)
                        return ret;
                goto search_free;
        }
-        /* keep track of bounds object by adding it to the inactive list */
+        list_add_tail(&obj->gtt_list, &dev_priv->mm.gtt_list);
-        list_add_tail(&obj_priv->mm_list, &dev_priv->mm.inactive_list);
+        list_add_tail(&obj->mm_list, &dev_priv->mm.inactive_list);
-        i915_gem_info_add_gtt(dev_priv, obj->size);
        /* Assert that the object is not currently in any GPU domain. As it
         * wasn't in the GTT, there shouldn't be any way it could have been in
         * a GPU cache
         */
-        BUG_ON(obj->read_domains & I915_GEM_GPU_DOMAINS);
+        BUG_ON(obj->base.read_domains & I915_GEM_GPU_DOMAINS);
-        BUG_ON(obj->write_domain & I915_GEM_GPU_DOMAINS);
+        BUG_ON(obj->base.write_domain & I915_GEM_GPU_DOMAINS);
-        obj_priv->gtt_offset = obj_priv->gtt_space->start;
+        obj->gtt_offset = obj->gtt_space->start;
-        trace_i915_gem_object_bind(obj, obj_priv->gtt_offset);
+        fenceable =
+                obj->gtt_space->size == fence_size &&
+                (obj->gtt_space->start & (fence_alignment -1)) == 0;
+        mappable =
+                obj->gtt_offset + obj->base.size <= dev_priv->mm.gtt_mappable_end;
+        obj->map_and_fenceable = mappable && fenceable;
+        trace_i915_gem_object_bind(obj, obj->gtt_offset, map_and_fenceable);
        return 0;
 }
 void
-i915_gem_clflush_object(struct drm_gem_object *obj)
+i915_gem_clflush_object(struct drm_i915_gem_object *obj)
 {
-        struct drm_i915_gem_object      *obj_priv = to_intel_bo(obj);
        /* If we don't have a page list set up, then we're not pinned
         * to GPU, and we can ignore the cache flush because it'll happen
         * again at bind time.
         */
-        if (obj_priv->pages == NULL)
+        if (obj->pages == NULL)
                return;
        trace_i915_gem_object_clflush(obj);
-        drm_clflush_pages(obj_priv->pages, obj->size / PAGE_SIZE);
+        drm_clflush_pages(obj->pages, obj->base.size / PAGE_SIZE);
 }
 /** Flushes any GPU write domain for the object if it's dirty. */
-static int
+static void
-i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj,
+i915_gem_object_flush_gpu_write_domain(struct drm_i915_gem_object *obj)
-                                       bool pipelined)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
-        uint32_t old_write_domain;
-        if ((obj->write_domain & I915_GEM_GPU_DOMAINS) == 0)
+        if ((obj->base.write_domain & I915_GEM_GPU_DOMAINS) == 0)
-                return 0;
+                return;
        /* Queue the GPU write cache flushing we need. */
-        old_write_domain = obj->write_domain;
+        i915_gem_flush_ring(dev, obj->ring, 0, obj->base.write_domain);
-        i915_gem_flush_ring(dev, NULL,
+        BUG_ON(obj->base.write_domain);
-                            to_intel_bo(obj)->ring,
-                            0, obj->write_domain);
-        BUG_ON(obj->write_domain);
-        trace_i915_gem_object_change_domain(obj,
-                                            obj->read_domains,
-                                            old_write_domain);
-        if (pipelined)
-                return 0;
-        return i915_gem_object_wait_rendering(obj, true);
 }
 /** Flushes the GTT write domain for the object if it's dirty. */
 static void
-i915_gem_object_flush_gtt_write_domain(struct drm_gem_object *obj)
+i915_gem_object_flush_gtt_write_domain(struct drm_i915_gem_object *obj)
 {
        uint32_t old_write_domain;
-        if (obj->write_domain != I915_GEM_DOMAIN_GTT)
+        if (obj->base.write_domain != I915_GEM_DOMAIN_GTT)
                return;
        /* No actual flushing is required for the GTT write domain.   Writes
         * to it immediately go to main memory as far as we know, so there's
         * no chipset flush.  It also doesn't land in render cache.
         */
-        old_write_domain = obj->write_domain;
+        i915_gem_release_mmap(obj);
-        obj->write_domain = 0;
+        old_write_domain = obj->base.write_domain;
+        obj->base.write_domain = 0;
        trace_i915_gem_object_change_domain(obj,
-                                            obj->read_domains,
+                                            obj->base.read_domains,
                                            old_write_domain);
 }
 /** Flushes the CPU write domain for the object if it's dirty. */
 static void
-i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj)
+i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
        uint32_t old_write_domain;
-        if (obj->write_domain != I915_GEM_DOMAIN_CPU)
+        if (obj->base.write_domain != I915_GEM_DOMAIN_CPU)
                return;
        i915_gem_clflush_object(obj);
-        drm_agp_chipset_flush(dev);
+        intel_gtt_chipset_flush();
-        old_write_domain = obj->write_domain;
+        old_write_domain = obj->base.write_domain;
-        obj->write_domain = 0;
+        obj->base.write_domain = 0;
        trace_i915_gem_object_change_domain(obj,
-                                            obj->read_domains,
+                                            obj->base.read_domains,
                                            old_write_domain);
 }
@@ -2816,40 +2873,36 @@ i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj)
 * flushes to occur.
 */
 int
-i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
+i915_gem_object_set_to_gtt_domain(struct drm_i915_gem_object *obj, bool write)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        uint32_t old_write_domain, old_read_domains;
        int ret;
        /* Not valid to be called on unbound objects. */
-        if (obj_priv->gtt_space == NULL)
+        if (obj->gtt_space == NULL)
                return -EINVAL;
-        ret = i915_gem_object_flush_gpu_write_domain(obj, false);
+        i915_gem_object_flush_gpu_write_domain(obj);
-        if (ret != 0)
+        if (obj->pending_gpu_write || write) {
-                return ret;
-        i915_gem_object_flush_cpu_write_domain(obj);
-        if (write) {
                ret = i915_gem_object_wait_rendering(obj, true);
                if (ret)
                        return ret;
        }
-        old_write_domain = obj->write_domain;
+        i915_gem_object_flush_cpu_write_domain(obj);
-        old_read_domains = obj->read_domains;
+        old_write_domain = obj->base.write_domain;
+        old_read_domains = obj->base.read_domains;
        /* It should now be out of any other write domains, and we can update
         * the domain values for our changes.
         */
-        BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_GTT) != 0);
+        BUG_ON((obj->base.write_domain & ~I915_GEM_DOMAIN_GTT) != 0);
-        obj->read_domains |= I915_GEM_DOMAIN_GTT;
+        obj->base.read_domains |= I915_GEM_DOMAIN_GTT;
        if (write) {
-                obj->read_domains = I915_GEM_DOMAIN_GTT;
+                obj->base.read_domains = I915_GEM_DOMAIN_GTT;
-                obj->write_domain = I915_GEM_DOMAIN_GTT;
+                obj->base.write_domain = I915_GEM_DOMAIN_GTT;
-                obj_priv->dirty = 1;
+                obj->dirty = 1;
        }
        trace_i915_gem_object_change_domain(obj,
@@ -2864,23 +2917,20 @@ i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
 * wait, as in modesetting process we're not supposed to be interrupted.
 */
 int
-i915_gem_object_set_to_display_plane(struct drm_gem_object *obj,
+i915_gem_object_set_to_display_plane(struct drm_i915_gem_object *obj,
-                                     bool pipelined)
+                                     struct intel_ring_buffer *pipelined)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        uint32_t old_read_domains;
        int ret;
        /* Not valid to be called on unbound objects. */
-        if (obj_priv->gtt_space == NULL)
+        if (obj->gtt_space == NULL)
                return -EINVAL;
-        ret = i915_gem_object_flush_gpu_write_domain(obj, true);
+        i915_gem_object_flush_gpu_write_domain(obj);
-        if (ret)
-                return ret;
        /* Currently, we are always called from an non-interruptible context. */
-        if (!pipelined) {
+        if (pipelined != obj->ring) {
                ret = i915_gem_object_wait_rendering(obj, false);
                if (ret)
                        return ret;
@@ -2888,12 +2938,12 @@ i915_gem_object_set_to_display_plane(struct drm_gem_object *obj,
        i915_gem_object_flush_cpu_write_domain(obj);
-        old_read_domains = obj->read_domains;
+        old_read_domains = obj->base.read_domains;
-        obj->read_domains |= I915_GEM_DOMAIN_GTT;
+        obj->base.read_domains |= I915_GEM_DOMAIN_GTT;
        trace_i915_gem_object_change_domain(obj,
                                            old_read_domains,
-                                            obj->write_domain);
+                                            obj->base.write_domain);
        return 0;
 }
@@ -2906,10 +2956,10 @@ i915_gem_object_flush_gpu(struct drm_i915_gem_object *obj,
                return 0;
        if (obj->base.write_domain & I915_GEM_GPU_DOMAINS)
-                i915_gem_flush_ring(obj->base.dev, NULL, obj->ring,
+                i915_gem_flush_ring(obj->base.dev, obj->ring,
                                    0, obj->base.write_domain);
-        return i915_gem_object_wait_rendering(&obj->base, interruptible);
+        return i915_gem_object_wait_rendering(obj, interruptible);
 }
 /**
@@ -2919,13 +2969,14 @@ i915_gem_object_flush_gpu(struct drm_i915_gem_object *obj,
 * flushes to occur.
 */
 static int
-i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
+i915_gem_object_set_to_cpu_domain(struct drm_i915_gem_object *obj, bool write)
 {
        uint32_t old_write_domain, old_read_domains;
        int ret;
-        ret = i915_gem_object_flush_gpu_write_domain(obj, false);
+        i915_gem_object_flush_gpu_write_domain(obj);
-        if (ret != 0)
+        ret = i915_gem_object_wait_rendering(obj, true);
+        if (ret)
                return ret;
        i915_gem_object_flush_gtt_write_domain(obj);
@@ -2935,33 +2986,27 @@ i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
         */
        i915_gem_object_set_to_full_cpu_read_domain(obj);
-        if (write) {
+        old_write_domain = obj->base.write_domain;
-                ret = i915_gem_object_wait_rendering(obj, true);
+        old_read_domains = obj->base.read_domains;
-                if (ret)
-                        return ret;
-        }
-        old_write_domain = obj->write_domain;
-        old_read_domains = obj->read_domains;
        /* Flush the CPU cache if it's still invalid. */
-        if ((obj->read_domains & I915_GEM_DOMAIN_CPU) == 0) {
+        if ((obj->base.read_domains & I915_GEM_DOMAIN_CPU) == 0) {
                i915_gem_clflush_object(obj);
-                obj->read_domains |= I915_GEM_DOMAIN_CPU;
+                obj->base.read_domains |= I915_GEM_DOMAIN_CPU;
        }
        /* It should now be out of any other write domains, and we can update
         * the domain values for our changes.
         */
-        BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
+        BUG_ON((obj->base.write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
        /* If we're writing through the CPU, then the GPU read domains will
         * need to be invalidated at next use.
         */
        if (write) {
-                obj->read_domains = I915_GEM_DOMAIN_CPU;
+                obj->base.read_domains = I915_GEM_DOMAIN_CPU;
-                obj->write_domain = I915_GEM_DOMAIN_CPU;
+                obj->base.write_domain = I915_GEM_DOMAIN_CPU;
        }
        trace_i915_gem_object_change_domain(obj,
@@ -2971,184 +3016,6 @@ i915_gem_object_set_to_cpu_domain(struct drm_gem_object *obj, int write)
        return 0;
 }
-/*
- * Set the next domain for the specified object. This
- * may not actually perform the necessary flushing/invaliding though,
- * as that may want to be batched with other set_domain operations
- *
- * This is (we hope) the only really tricky part of gem. The goal
- * is fairly simple -- track which caches hold bits of the object
- * and make sure they remain coherent. A few concrete examples may
- * help to explain how it works. For shorthand, we use the notation
- * (read_domains, write_domain), e.g. (CPU, CPU) to indicate the
- * a pair of read and write domain masks.
- *
- * Case 1: the batch buffer
- *
- *      1. Allocated
- *      2. Written by CPU
- *      3. Mapped to GTT
- *      4. Read by GPU
- *      5. Unmapped from GTT
- *      6. Freed
- *
- *      Let's take these a step at a time
- *
- *      1. Allocated
- *              Pages allocated from the kernel may still have
- *              cache contents, so we set them to (CPU, CPU) always.
- *      2. Written by CPU (using pwrite)
- *              The pwrite function calls set_domain (CPU, CPU) and
- *              this function does nothing (as nothing changes)
- *      3. Mapped by GTT
- *              This function asserts that the object is not
- *              currently in any GPU-based read or write domains
- *      4. Read by GPU
- *              i915_gem_execbuffer calls set_domain (COMMAND, 0).
- *              As write_domain is zero, this function adds in the
- *              current read domains (CPU+COMMAND, 0).
- *              flush_domains is set to CPU.
- *              invalidate_domains is set to COMMAND
- *              clflush is run to get data out of the CPU caches
- *              then i915_dev_set_domain calls i915_gem_flush to
- *              emit an MI_FLUSH and drm_agp_chipset_flush
- *      5. Unmapped from GTT
- *              i915_gem_object_unbind calls set_domain (CPU, CPU)
- *              flush_domains and invalidate_domains end up both zero
- *              so no flushing/invalidating happens
- *      6. Freed
- *              yay, done
- *
- * Case 2: The shared render buffer
- *
- *      1. Allocated
- *      2. Mapped to GTT
- *      3. Read/written by GPU
- *      4. set_domain to (CPU,CPU)
- *      5. Read/written by CPU
- *      6. Read/written by GPU
- *
- *      1. Allocated
- *              Same as last example, (CPU, CPU)
- *      2. Mapped to GTT
- *              Nothing changes (assertions find that it is not in the GPU)
- *      3. Read/written by GPU
- *              execbuffer calls set_domain (RENDER, RENDER)
- *              flush_domains gets CPU
- *              invalidate_domains gets GPU
- *              clflush (obj)
- *              MI_FLUSH and drm_agp_chipset_flush
- *      4. set_domain (CPU, CPU)
- *              flush_domains gets GPU
- *              invalidate_domains gets CPU
- *              wait_rendering (obj) to make sure all drawing is complete.
- *              This will include an MI_FLUSH to get the data from GPU
- *              to memory
- *              clflush (obj) to invalidate the CPU cache
- *              Another MI_FLUSH in i915_gem_flush (eliminate this somehow?)
- *      5. Read/written by CPU
- *              cache lines are loaded and dirtied
- *      6. Read written by GPU
- *              Same as last GPU access
- *
- * Case 3: The constant buffer
- *
- *      1. Allocated
- *      2. Written by CPU
- *      3. Read by GPU
- *      4. Updated (written) by CPU again
- *      5. Read by GPU
- *
- *      1. Allocated
- *              (CPU, CPU)
- *      2. Written by CPU
- *              (CPU, CPU)
- *      3. Read by GPU
- *              (CPU+RENDER, 0)
- *              flush_domains = CPU
- *              invalidate_domains = RENDER
- *              clflush (obj)
- *              MI_FLUSH
- *              drm_agp_chipset_flush
- *      4. Updated (written) by CPU again
- *              (CPU, CPU)
- *              flush_domains = 0 (no previous write domain)
- *              invalidate_domains = 0 (no new read domains)
- *      5. Read by GPU
- *              (CPU+RENDER, 0)
- *              flush_domains = CPU
- *              invalidate_domains = RENDER
- *              clflush (obj)
- *              MI_FLUSH
- *              drm_agp_chipset_flush
- */
-static void
-i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
-                                  struct intel_ring_buffer *ring)
-{
-        struct drm_device               *dev = obj->dev;
-        struct drm_i915_private         *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object      *obj_priv = to_intel_bo(obj);
-        uint32_t                        invalidate_domains = 0;
-        uint32_t                        flush_domains = 0;
-        uint32_t                        old_read_domains;
-        intel_mark_busy(dev, obj);
-        /*
-         * If the object isn't moving to a new write domain,
-         * let the object stay in multiple read domains
-         */
-        if (obj->pending_write_domain == 0)
-                obj->pending_read_domains |= obj->read_domains;
-        else
-                obj_priv->dirty = 1;
-        /*
-         * Flush the current write domain if
-         * the new read domains don't match. Invalidate
-         * any read domains which differ from the old
-         * write domain
-         */
-        if (obj->write_domain &&
-            (obj->write_domain != obj->pending_read_domains ||
-             obj_priv->ring != ring)) {
-                flush_domains |= obj->write_domain;
-                invalidate_domains |=
-                        obj->pending_read_domains & ~obj->write_domain;
-        }
-        /*
-         * Invalidate any read caches which may have
-         * stale data. That is, any new read domains.
-         */
-        invalidate_domains |= obj->pending_read_domains & ~obj->read_domains;
-        if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_CPU)
-                i915_gem_clflush_object(obj);
-        old_read_domains = obj->read_domains;
-        /* The actual obj->write_domain will be updated with
-         * pending_write_domain after we emit the accumulated flush for all
-         * of our domain changes in execbuffers (which clears objects'
-         * write_domains).  So if we have a current write domain that we
-         * aren't changing, set pending_write_domain to that.
-         */
-        if (flush_domains == 0 && obj->pending_write_domain == 0)
-                obj->pending_write_domain = obj->write_domain;
-        obj->read_domains = obj->pending_read_domains;
-        dev->invalidate_domains |= invalidate_domains;
-        dev->flush_domains |= flush_domains;
-        if (flush_domains & I915_GEM_GPU_DOMAINS)
-                dev_priv->mm.flush_rings |= obj_priv->ring->id;
-        if (invalidate_domains & I915_GEM_GPU_DOMAINS)
-                dev_priv->mm.flush_rings |= ring->id;
-        trace_i915_gem_object_change_domain(obj,
-                                            old_read_domains,
-                                            obj->write_domain);
-}
 /**
 * Moves the object from a partially CPU read to a full one.
 *
@@ -3156,30 +3023,28 @@ i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj,
 * and doesn't handle transitioning from !(read_domains & I915_GEM_DOMAIN_CPU).
 */
 static void
-i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj)
+i915_gem_object_set_to_full_cpu_read_domain(struct drm_i915_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        if (!obj->page_cpu_valid)
-        if (!obj_priv->page_cpu_valid)
                return;
        /* If we're partially in the CPU read domain, finish moving it in.
         */
-        if (obj->read_domains & I915_GEM_DOMAIN_CPU) {
+        if (obj->base.read_domains & I915_GEM_DOMAIN_CPU) {
                int i;
-                for (i = 0; i <= (obj->size - 1) / PAGE_SIZE; i++) {
+                for (i = 0; i <= (obj->base.size - 1) / PAGE_SIZE; i++) {
-                        if (obj_priv->page_cpu_valid[i])
+                        if (obj->page_cpu_valid[i])
                                continue;
-                        drm_clflush_pages(obj_priv->pages + i, 1);
+                        drm_clflush_pages(obj->pages + i, 1);
                }
        }
        /* Free the page_cpu_valid mappings which are now stale, whether
         * or not we've got I915_GEM_DOMAIN_CPU.
         */
-        kfree(obj_priv->page_cpu_valid);
+        kfree(obj->page_cpu_valid);
-        obj_priv->page_cpu_valid = NULL;
+        obj->page_cpu_valid = NULL;
 }
 /**
@@ -3195,354 +3060,62 @@ i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj)
 * flushes to occur.
 */
 static int
-i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
+i915_gem_object_set_cpu_read_domain_range(struct drm_i915_gem_object *obj,
                                          uint64_t offset, uint64_t size)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        uint32_t old_read_domains;
        int i, ret;
-        if (offset == 0 && size == obj->size)
+        if (offset == 0 && size == obj->base.size)
                return i915_gem_object_set_to_cpu_domain(obj, 0);
-        ret = i915_gem_object_flush_gpu_write_domain(obj, false);
+        i915_gem_object_flush_gpu_write_domain(obj);
-        if (ret != 0)
+        ret = i915_gem_object_wait_rendering(obj, true);
+        if (ret)
                return ret;
        i915_gem_object_flush_gtt_write_domain(obj);
        /* If we're already fully in the CPU read domain, we're done. */
-        if (obj_priv->page_cpu_valid == NULL &&
+        if (obj->page_cpu_valid == NULL &&
-            (obj->read_domains & I915_GEM_DOMAIN_CPU) != 0)
+            (obj->base.read_domains & I915_GEM_DOMAIN_CPU) != 0)
                return 0;
        /* Otherwise, create/clear the per-page CPU read domain flag if we're
         * newly adding I915_GEM_DOMAIN_CPU
         */
-        if (obj_priv->page_cpu_valid == NULL) {
+        if (obj->page_cpu_valid == NULL) {
-                obj_priv->page_cpu_valid = kzalloc(obj->size / PAGE_SIZE,
+                obj->page_cpu_valid = kzalloc(obj->base.size / PAGE_SIZE,
-                                                   GFP_KERNEL);
+                                              GFP_KERNEL);
-                if (obj_priv->page_cpu_valid == NULL)
+                if (obj->page_cpu_valid == NULL)
                        return -ENOMEM;
-        } else if ((obj->read_domains & I915_GEM_DOMAIN_CPU) == 0)
+        } else if ((obj->base.read_domains & I915_GEM_DOMAIN_CPU) == 0)
-                memset(obj_priv->page_cpu_valid, 0, obj->size / PAGE_SIZE);
+                memset(obj->page_cpu_valid, 0, obj->base.size / PAGE_SIZE);
        /* Flush the cache on any pages that are still invalid from the CPU's
         * perspective.
         */
        for (i = offset / PAGE_SIZE; i <= (offset + size - 1) / PAGE_SIZE;
             i++) {
-                if (obj_priv->page_cpu_valid[i])
+                if (obj->page_cpu_valid[i])
                        continue;
-                drm_clflush_pages(obj_priv->pages + i, 1);
+                drm_clflush_pages(obj->pages + i, 1);
-                obj_priv->page_cpu_valid[i] = 1;
+                obj->page_cpu_valid[i] = 1;
        }
        /* It should now be out of any other write domains, and we can update
         * the domain values for our changes.
         */
-        BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
+        BUG_ON((obj->base.write_domain & ~I915_GEM_DOMAIN_CPU) != 0);
-        old_read_domains = obj->read_domains;
+        old_read_domains = obj->base.read_domains;
-        obj->read_domains |= I915_GEM_DOMAIN_CPU;
+        obj->base.read_domains |= I915_GEM_DOMAIN_CPU;
        trace_i915_gem_object_change_domain(obj,
                                            old_read_domains,
-                                            obj->write_domain);
+                                            obj->base.write_domain);
-        return 0;
-}
-/**
- * Pin an object to the GTT and evaluate the relocations landing in it.
- */
-static int
-i915_gem_execbuffer_relocate(struct drm_i915_gem_object *obj,
-                             struct drm_file *file_priv,
-                             struct drm_i915_gem_exec_object2 *entry)
-{
-        struct drm_device *dev = obj->base.dev;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_relocation_entry __user *user_relocs;
-        struct drm_gem_object *target_obj = NULL;
-        uint32_t target_handle = 0;
-        int i, ret = 0;
-        user_relocs = (void __user *)(uintptr_t)entry->relocs_ptr;
-        for (i = 0; i < entry->relocation_count; i++) {
-                struct drm_i915_gem_relocation_entry reloc;
-                uint32_t target_offset;
-                if (__copy_from_user_inatomic(&reloc,
-                                              user_relocs+i,
-                                              sizeof(reloc))) {
-                        ret = -EFAULT;
-                        break;
-                }
-                if (reloc.target_handle != target_handle) {
-                        drm_gem_object_unreference(target_obj);
-                        target_obj = drm_gem_object_lookup(dev, file_priv,
-                                                           reloc.target_handle);
-                        if (target_obj == NULL) {
-                                ret = -ENOENT;
-                                break;
-                        }
-                        target_handle = reloc.target_handle;
-                }
-                target_offset = to_intel_bo(target_obj)->gtt_offset;
-#if WATCH_RELOC
-                DRM_INFO("%s: obj %p offset %08x target %d "
-                         "read %08x write %08x gtt %08x "
-                         "presumed %08x delta %08x\n",
-                         __func__,
-                         obj,
-                         (int) reloc.offset,
-                         (int) reloc.target_handle,
-                         (int) reloc.read_domains,
-                         (int) reloc.write_domain,
-                         (int) target_offset,
-                         (int) reloc.presumed_offset,
-                         reloc.delta);
-#endif
-                /* The target buffer should have appeared before us in the
-                 * exec_object list, so it should have a GTT space bound by now.
-                 */
-                if (target_offset == 0) {
-                        DRM_ERROR("No GTT space found for object %d\n",
-                                  reloc.target_handle);
-                        ret = -EINVAL;
-                        break;
-                }
-                /* Validate that the target is in a valid r/w GPU domain */
-                if (reloc.write_domain & (reloc.write_domain - 1)) {
-                        DRM_ERROR("reloc with multiple write domains: "
-                                  "obj %p target %d offset %d "
-                                  "read %08x write %08x",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset,
-                                  reloc.read_domains,
-                                  reloc.write_domain);
-                        ret = -EINVAL;
-                        break;
-                }
-                if (reloc.write_domain & I915_GEM_DOMAIN_CPU ||
-                    reloc.read_domains & I915_GEM_DOMAIN_CPU) {
-                        DRM_ERROR("reloc with read/write CPU domains: "
-                                  "obj %p target %d offset %d "
-                                  "read %08x write %08x",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset,
-                                  reloc.read_domains,
-                                  reloc.write_domain);
-                        ret = -EINVAL;
-                        break;
-                }
-                if (reloc.write_domain && target_obj->pending_write_domain &&
-                    reloc.write_domain != target_obj->pending_write_domain) {
-                        DRM_ERROR("Write domain conflict: "
-                                  "obj %p target %d offset %d "
-                                  "new %08x old %08x\n",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset,
-                                  reloc.write_domain,
-                                  target_obj->pending_write_domain);
-                        ret = -EINVAL;
-                        break;
-                }
-                target_obj->pending_read_domains |= reloc.read_domains;
-                target_obj->pending_write_domain |= reloc.write_domain;
-                /* If the relocation already has the right value in it, no
-                 * more work needs to be done.
-                 */
-                if (target_offset == reloc.presumed_offset)
-                        continue;
-                /* Check that the relocation address is valid... */
-                if (reloc.offset > obj->base.size - 4) {
-                        DRM_ERROR("Relocation beyond object bounds: "
-                                  "obj %p target %d offset %d size %d.\n",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset, (int) obj->base.size);
-                        ret = -EINVAL;
-                        break;
-                }
-                if (reloc.offset & 3) {
-                        DRM_ERROR("Relocation not 4-byte aligned: "
-                                  "obj %p target %d offset %d.\n",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.offset);
-                        ret = -EINVAL;
-                        break;
-                }
-                /* and points to somewhere within the target object. */
-                if (reloc.delta >= target_obj->size) {
-                        DRM_ERROR("Relocation beyond target object bounds: "
-                                  "obj %p target %d delta %d size %d.\n",
-                                  obj, reloc.target_handle,
-                                  (int) reloc.delta, (int) target_obj->size);
-                        ret = -EINVAL;
-                        break;
-                }
-                reloc.delta += target_offset;
-                if (obj->base.write_domain == I915_GEM_DOMAIN_CPU) {
-                        uint32_t page_offset = reloc.offset & ~PAGE_MASK;
-                        char *vaddr;
-                        vaddr = kmap_atomic(obj->pages[reloc.offset >> PAGE_SHIFT]);
-                        *(uint32_t *)(vaddr + page_offset) = reloc.delta;
-                        kunmap_atomic(vaddr);
-                } else {
-                        uint32_t __iomem *reloc_entry;
-                        void __iomem *reloc_page;
-                        ret = i915_gem_object_set_to_gtt_domain(&obj->base, 1);
-                        if (ret)
-                                break;
-                        /* Map the page containing the relocation we're going to perform.  */
-                        reloc.offset += obj->gtt_offset;
-                        reloc_page = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
-                                                              reloc.offset & PAGE_MASK);
-                        reloc_entry = (uint32_t __iomem *)
-                                (reloc_page + (reloc.offset & ~PAGE_MASK));
-                        iowrite32(reloc.delta, reloc_entry);
-                        io_mapping_unmap_atomic(reloc_page);
-                }
-                /* and update the user's relocation entry */
-                reloc.presumed_offset = target_offset;
-                if (__copy_to_user_inatomic(&user_relocs[i].presumed_offset,
-                                              &reloc.presumed_offset,
-                                              sizeof(reloc.presumed_offset))) {
-                    ret = -EFAULT;
-                    break;
-                }
-        }
-        drm_gem_object_unreference(target_obj);
-        return ret;
-}
-static int
-i915_gem_execbuffer_pin(struct drm_device *dev,
-                        struct drm_file *file,
-                        struct drm_gem_object **object_list,
-                        struct drm_i915_gem_exec_object2 *exec_list,
-                        int count)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret, i, retry;
-        /* attempt to pin all of the buffers into the GTT */
-        for (retry = 0; retry < 2; retry++) {
-                ret = 0;
-                for (i = 0; i < count; i++) {
-                        struct drm_i915_gem_exec_object2 *entry = &exec_list[i];
-                        struct drm_i915_gem_object *obj= to_intel_bo(object_list[i]);
-                        bool need_fence =
-                                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
-                                obj->tiling_mode != I915_TILING_NONE;
-                        /* Check fence reg constraints and rebind if necessary */
-                        if (need_fence &&
-                            !i915_gem_object_fence_offset_ok(&obj->base,
-                                                             obj->tiling_mode)) {
-                                ret = i915_gem_object_unbind(&obj->base);
-                                if (ret)
-                                        break;
-                        }
-                        ret = i915_gem_object_pin(&obj->base, entry->alignment);
-                        if (ret)
-                                break;
-                        /*
-                         * Pre-965 chips need a fence register set up in order
-                         * to properly handle blits to/from tiled surfaces.
-                         */
-                        if (need_fence) {
-                                ret = i915_gem_object_get_fence_reg(&obj->base, true);
-                                if (ret) {
-                                        i915_gem_object_unpin(&obj->base);
-                                        break;
-                                }
-                                dev_priv->fence_regs[obj->fence_reg].gpu = true;
-                        }
-                        entry->offset = obj->gtt_offset;
-                }
-                while (i--)
-                        i915_gem_object_unpin(object_list[i]);
-                if (ret == 0)
-                        break;
-                if (ret != -ENOSPC || retry)
-                        return ret;
-                ret = i915_gem_evict_everything(dev);
-                if (ret)
-                        return ret;
-        }
-        return 0;
-}
-static int
-i915_gem_execbuffer_move_to_gpu(struct drm_device *dev,
-                                struct drm_file *file,
-                                struct intel_ring_buffer *ring,
-                                struct drm_gem_object **objects,
-                                int count)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret, i;
-        /* Zero the global flush/invalidate flags. These
-         * will be modified as new domains are computed
-         * for each object
-         */
-        dev->invalidate_domains = 0;
-        dev->flush_domains = 0;
-        dev_priv->mm.flush_rings = 0;
-        for (i = 0; i < count; i++)
-                i915_gem_object_set_to_gpu_domain(objects[i], ring);
-        if (dev->invalidate_domains | dev->flush_domains) {
-#if WATCH_EXEC
-                DRM_INFO("%s: invalidate_domains %08x flush_domains %08x\n",
-                          __func__,
-                         dev->invalidate_domains,
-                         dev->flush_domains);
-#endif
-                i915_gem_flush(dev, file,
-                               dev->invalidate_domains,
-                               dev->flush_domains,
-                               dev_priv->mm.flush_rings);
-        }
-        for (i = 0; i < count; i++) {
-                struct drm_i915_gem_object *obj = to_intel_bo(objects[i]);
-                /* XXX replace with semaphores */
-                if (obj->ring && ring != obj->ring) {
-                        ret = i915_gem_object_wait_rendering(&obj->base, true);
-                        if (ret)
-                                return ret;
-                }
-        }
        return 0;
 }
@@ -3582,586 +3155,129 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
                return 0;
        ret = 0;
-        if (!i915_seqno_passed(ring->get_seqno(dev, ring), seqno)) {
+        if (!i915_seqno_passed(ring->get_seqno(ring), seqno)) {
                /* And wait for the seqno passing without holding any locks and
                 * causing extra latency for others. This is safe as the irq
                 * generation is designed to be run atomically and so is
                 * lockless.
                 */
-                ring->user_irq_get(dev, ring);
+                if (ring->irq_get(ring)) {
-                ret = wait_event_interruptible(ring->irq_queue,
+                        ret = wait_event_interruptible(ring->irq_queue,
-                                               i915_seqno_passed(ring->get_seqno(dev, ring), seqno)
+                                                       i915_seqno_passed(ring->get_seqno(ring), seqno)
-                                               || atomic_read(&dev_priv->mm.wedged));
+                                                       || atomic_read(&dev_priv->mm.wedged));
-                ring->user_irq_put(dev, ring);
+                        ring->irq_put(ring);
-                if (ret == 0 && atomic_read(&dev_priv->mm.wedged))
-                        ret = -EIO;
-        }
-        if (ret == 0)
-                queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work, 0);
-        return ret;
-}
-static int
-i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec,
-                          uint64_t exec_offset)
-{
-        uint32_t exec_start, exec_len;
-        exec_start = (uint32_t) exec_offset + exec->batch_start_offset;
-        exec_len = (uint32_t) exec->batch_len;
-        if ((exec_start | exec_len) & 0x7)
-                return -EINVAL;
-        if (!exec_start)
-                return -EINVAL;
-        return 0;
-}
-static int
-validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
-                   int count)
-{
-        int i;
-        for (i = 0; i < count; i++) {
-                char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
-                size_t length = exec[i].relocation_count * sizeof(struct drm_i915_gem_relocation_entry);
-                if (!access_ok(VERIFY_READ, ptr, length))
-                        return -EFAULT;
-                /* we may also need to update the presumed offsets */
-                if (!access_ok(VERIFY_WRITE, ptr, length))
-                        return -EFAULT;
-                if (fault_in_pages_readable(ptr, length))
-                        return -EFAULT;
-        }
-        return 0;
-}
-static int
-i915_gem_do_execbuffer(struct drm_device *dev, void *data,
-                       struct drm_file *file,
-                       struct drm_i915_gem_execbuffer2 *args,
-                       struct drm_i915_gem_exec_object2 *exec_list)
-{
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_gem_object **object_list = NULL;
-        struct drm_gem_object *batch_obj;
-        struct drm_i915_gem_object *obj_priv;
-        struct drm_clip_rect *cliprects = NULL;
-        struct drm_i915_gem_request *request = NULL;
-        int ret, i, flips;
-        uint64_t exec_offset;
-        struct intel_ring_buffer *ring = NULL;
-        ret = i915_gem_check_is_wedged(dev);
-        if (ret)
-                return ret;
-        ret = validate_exec_list(exec_list, args->buffer_count);
-        if (ret)
-                return ret;
-#if WATCH_EXEC
-        DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
-                  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
-#endif
-        switch (args->flags & I915_EXEC_RING_MASK) {
-        case I915_EXEC_DEFAULT:
-        case I915_EXEC_RENDER:
-                ring = &dev_priv->render_ring;
-                break;
-        case I915_EXEC_BSD:
-                if (!HAS_BSD(dev)) {
-                        DRM_ERROR("execbuf with invalid ring (BSD)\n");
-                        return -EINVAL;
-                }
-                ring = &dev_priv->bsd_ring;
-                break;
-        case I915_EXEC_BLT:
-                if (!HAS_BLT(dev)) {
-                        DRM_ERROR("execbuf with invalid ring (BLT)\n");
-                        return -EINVAL;
-                }
-                ring = &dev_priv->blt_ring;
-                break;
-        default:
-                DRM_ERROR("execbuf with unknown ring: %d\n",
-                          (int)(args->flags & I915_EXEC_RING_MASK));
-                return -EINVAL;
-        }
-        if (args->buffer_count < 1) {
-                DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
-                return -EINVAL;
-        }
-        object_list = drm_malloc_ab(sizeof(*object_list), args->buffer_count);
-        if (object_list == NULL) {
-                DRM_ERROR("Failed to allocate object list for %d buffers\n",
-                          args->buffer_count);
-                ret = -ENOMEM;
-                goto pre_mutex_err;
-        }
-        if (args->num_cliprects != 0) {
-                cliprects = kcalloc(args->num_cliprects, sizeof(*cliprects),
-                                    GFP_KERNEL);
-                if (cliprects == NULL) {
-                        ret = -ENOMEM;
-                        goto pre_mutex_err;
-                }
-                ret = copy_from_user(cliprects,
-                                     (struct drm_clip_rect __user *)
-                                     (uintptr_t) args->cliprects_ptr,
-                                     sizeof(*cliprects) * args->num_cliprects);
-                if (ret != 0) {
-                        DRM_ERROR("copy %d cliprects failed: %d\n",
-                                  args->num_cliprects, ret);
-                        ret = -EFAULT;
-                        goto pre_mutex_err;
-                }
-        }
-        request = kzalloc(sizeof(*request), GFP_KERNEL);
-        if (request == NULL) {
-                ret = -ENOMEM;
-                goto pre_mutex_err;
-        }
-        ret = i915_mutex_lock_interruptible(dev);
-        if (ret)
-                goto pre_mutex_err;
-        if (dev_priv->mm.suspended) {
-                mutex_unlock(&dev->struct_mutex);
-                ret = -EBUSY;
-                goto pre_mutex_err;
-        }
-        /* Look up object handles */
-        for (i = 0; i < args->buffer_count; i++) {
-                object_list[i] = drm_gem_object_lookup(dev, file,
-                                                       exec_list[i].handle);
-                if (object_list[i] == NULL) {
-                        DRM_ERROR("Invalid object handle %d at index %d\n",
-                                   exec_list[i].handle, i);
-                        /* prevent error path from reading uninitialized data */
-                        args->buffer_count = i + 1;
-                        ret = -ENOENT;
-                        goto err;
-                }
-                obj_priv = to_intel_bo(object_list[i]);
-                if (obj_priv->in_execbuffer) {
-                        DRM_ERROR("Object %p appears more than once in object list\n",
-                                   object_list[i]);
-                        /* prevent error path from reading uninitialized data */
-                        args->buffer_count = i + 1;
-                        ret = -EINVAL;
-                        goto err;
-                }
-                obj_priv->in_execbuffer = true;
-        }
-        /* Move the objects en-masse into the GTT, evicting if necessary. */
-        ret = i915_gem_execbuffer_pin(dev, file,
-                                      object_list, exec_list,
-                                      args->buffer_count);
-        if (ret)
-                goto err;
-        /* The objects are in their final locations, apply the relocations. */
-        for (i = 0; i < args->buffer_count; i++) {
-                struct drm_i915_gem_object *obj = to_intel_bo(object_list[i]);
-                obj->base.pending_read_domains = 0;
-                obj->base.pending_write_domain = 0;
-                ret = i915_gem_execbuffer_relocate(obj, file, &exec_list[i]);
-                if (ret)
-                        goto err;
-        }
-        /* Set the pending read domains for the batch buffer to COMMAND */
-        batch_obj = object_list[args->buffer_count-1];
-        if (batch_obj->pending_write_domain) {
-                DRM_ERROR("Attempting to use self-modifying batch buffer\n");
-                ret = -EINVAL;
-                goto err;
-        }
-        batch_obj->pending_read_domains |= I915_GEM_DOMAIN_COMMAND;
-        /* Sanity check the batch buffer */
-        exec_offset = to_intel_bo(batch_obj)->gtt_offset;
-        ret = i915_gem_check_execbuffer(args, exec_offset);
-        if (ret != 0) {
-                DRM_ERROR("execbuf with invalid offset/length\n");
-                goto err;
-        }
-        ret = i915_gem_execbuffer_move_to_gpu(dev, file, ring,
-                                              object_list, args->buffer_count);
-        if (ret)
-                goto err;
-        for (i = 0; i < args->buffer_count; i++) {
-                struct drm_gem_object *obj = object_list[i];
-                uint32_t old_write_domain = obj->write_domain;
-                obj->write_domain = obj->pending_write_domain;
-                trace_i915_gem_object_change_domain(obj,
-                                                    obj->read_domains,
-                                                    old_write_domain);
-        }
-#if WATCH_COHERENCY
-        for (i = 0; i < args->buffer_count; i++) {
-                i915_gem_object_check_coherency(object_list[i],
-                                                exec_list[i].handle);
-        }
-#endif
-#if WATCH_EXEC
-        i915_gem_dump_object(batch_obj,
-                              args->batch_len,
-                              __func__,
-                              ~0);
-#endif
-        /* Check for any pending flips. As we only maintain a flip queue depth
-         * of 1, we can simply insert a WAIT for the next display flip prior
-         * to executing the batch and avoid stalling the CPU.
-         */
-        flips = 0;
-        for (i = 0; i < args->buffer_count; i++) {
-                if (object_list[i]->write_domain)
-                        flips |= atomic_read(&to_intel_bo(object_list[i])->pending_flip);
-        }
-        if (flips) {
-                int plane, flip_mask;
-                for (plane = 0; flips >> plane; plane++) {
-                        if (((flips >> plane) & 1) == 0)
-                                continue;
-                        if (plane)
-                                flip_mask = MI_WAIT_FOR_PLANE_B_FLIP;
-                        else
-                                flip_mask = MI_WAIT_FOR_PLANE_A_FLIP;
-                        intel_ring_begin(dev, ring, 2);
-                        intel_ring_emit(dev, ring,
-                                        MI_WAIT_FOR_EVENT | flip_mask);
-                        intel_ring_emit(dev, ring, MI_NOOP);
-                        intel_ring_advance(dev, ring);
-                }
-        }
-        /* Exec the batchbuffer */
-        ret = ring->dispatch_gem_execbuffer(dev, ring, args,
-                                            cliprects, exec_offset);
-        if (ret) {
-                DRM_ERROR("dispatch failed %d\n", ret);
-                goto err;
-        }
-        /*
-         * Ensure that the commands in the batch buffer are
-         * finished before the interrupt fires
-         */
-        i915_retire_commands(dev, ring);
-        for (i = 0; i < args->buffer_count; i++) {
-                struct drm_gem_object *obj = object_list[i];
-                i915_gem_object_move_to_active(obj, ring);
-                if (obj->write_domain)
-                        list_move_tail(&to_intel_bo(obj)->gpu_write_list,
-                                       &ring->gpu_write_list);
-        }
-        i915_add_request(dev, file, request, ring);
-        request = NULL;
-err:
-        for (i = 0; i < args->buffer_count; i++) {
-                if (object_list[i]) {
-                        obj_priv = to_intel_bo(object_list[i]);
-                        obj_priv->in_execbuffer = false;
-                }
-                drm_gem_object_unreference(object_list[i]);
-        }
-        mutex_unlock(&dev->struct_mutex);
-pre_mutex_err:
-        drm_free_large(object_list);
-        kfree(cliprects);
-        kfree(request);
-        return ret;
-}
-/*
- * Legacy execbuffer just creates an exec2 list from the original exec object
- * list array and passes it to the real function.
- */
-int
-i915_gem_execbuffer(struct drm_device *dev, void *data,
-                    struct drm_file *file_priv)
-{
-        struct drm_i915_gem_execbuffer *args = data;
-        struct drm_i915_gem_execbuffer2 exec2;
-        struct drm_i915_gem_exec_object *exec_list = NULL;
-        struct drm_i915_gem_exec_object2 *exec2_list = NULL;
-        int ret, i;
-#if WATCH_EXEC
-        DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
-                  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
-#endif
-        if (args->buffer_count < 1) {
-                DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
-                return -EINVAL;
-        }
-        /* Copy in the exec list from userland */
-        exec_list = drm_malloc_ab(sizeof(*exec_list), args->buffer_count);
-        exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
-        if (exec_list == NULL || exec2_list == NULL) {
-                DRM_ERROR("Failed to allocate exec list for %d buffers\n",
-                          args->buffer_count);
-                drm_free_large(exec_list);
-                drm_free_large(exec2_list);
-                return -ENOMEM;
-        }
-        ret = copy_from_user(exec_list,
-                             (struct drm_i915_relocation_entry __user *)
-                             (uintptr_t) args->buffers_ptr,
-                             sizeof(*exec_list) * args->buffer_count);
-        if (ret != 0) {
-                DRM_ERROR("copy %d exec entries failed %d\n",
-                          args->buffer_count, ret);
-                drm_free_large(exec_list);
-                drm_free_large(exec2_list);
-                return -EFAULT;
-        }
-        for (i = 0; i < args->buffer_count; i++) {
-                exec2_list[i].handle = exec_list[i].handle;
-                exec2_list[i].relocation_count = exec_list[i].relocation_count;
-                exec2_list[i].relocs_ptr = exec_list[i].relocs_ptr;
-                exec2_list[i].alignment = exec_list[i].alignment;
-                exec2_list[i].offset = exec_list[i].offset;
-                if (INTEL_INFO(dev)->gen < 4)
-                        exec2_list[i].flags = EXEC_OBJECT_NEEDS_FENCE;
-                else
-                        exec2_list[i].flags = 0;
-        }
-        exec2.buffers_ptr = args->buffers_ptr;
+                        if (ret == 0 && atomic_read(&dev_priv->mm.wedged))
-        exec2.buffer_count = args->buffer_count;
+                                ret = -EIO;
-        exec2.batch_start_offset = args->batch_start_offset;
-        exec2.batch_len = args->batch_len;
-        exec2.DR1 = args->DR1;
-        exec2.DR4 = args->DR4;
-        exec2.num_cliprects = args->num_cliprects;
-        exec2.cliprects_ptr = args->cliprects_ptr;
-        exec2.flags = I915_EXEC_RENDER;
-        ret = i915_gem_do_execbuffer(dev, data, file_priv, &exec2, exec2_list);
-        if (!ret) {
-                /* Copy the new buffer offsets back to the user's exec list. */
-                for (i = 0; i < args->buffer_count; i++)
-                        exec_list[i].offset = exec2_list[i].offset;
-                /* ... and back out to userspace */
-                ret = copy_to_user((struct drm_i915_relocation_entry __user *)
-                                   (uintptr_t) args->buffers_ptr,
-                                   exec_list,
-                                   sizeof(*exec_list) * args->buffer_count);
-                if (ret) {
-                        ret = -EFAULT;
-                        DRM_ERROR("failed to copy %d exec entries "
-                                  "back to user (%d)\n",
-                                  args->buffer_count, ret);
                }
        }
-        drm_free_large(exec_list);
+        if (ret == 0)
-        drm_free_large(exec2_list);
+                queue_delayed_work(dev_priv->wq, &dev_priv->mm.retire_work, 0);
-        return ret;
-}
-int
-i915_gem_execbuffer2(struct drm_device *dev, void *data,
-                     struct drm_file *file_priv)
-{
-        struct drm_i915_gem_execbuffer2 *args = data;
-        struct drm_i915_gem_exec_object2 *exec2_list = NULL;
-        int ret;
-#if WATCH_EXEC
-        DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
-                  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
-#endif
-        if (args->buffer_count < 1) {
-                DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count);
-                return -EINVAL;
-        }
-        exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
-        if (exec2_list == NULL) {
-                DRM_ERROR("Failed to allocate exec list for %d buffers\n",
-                          args->buffer_count);
-                return -ENOMEM;
-        }
-        ret = copy_from_user(exec2_list,
-                             (struct drm_i915_relocation_entry __user *)
-                             (uintptr_t) args->buffers_ptr,
-                             sizeof(*exec2_list) * args->buffer_count);
-        if (ret != 0) {
-                DRM_ERROR("copy %d exec entries failed %d\n",
-                          args->buffer_count, ret);
-                drm_free_large(exec2_list);
-                return -EFAULT;
-        }
-        ret = i915_gem_do_execbuffer(dev, data, file_priv, args, exec2_list);
-        if (!ret) {
-                /* Copy the new buffer offsets back to the user's exec list. */
-                ret = copy_to_user((struct drm_i915_relocation_entry __user *)
-                                   (uintptr_t) args->buffers_ptr,
-                                   exec2_list,
-                                   sizeof(*exec2_list) * args->buffer_count);
-                if (ret) {
-                        ret = -EFAULT;
-                        DRM_ERROR("failed to copy %d exec entries "
-                                  "back to user (%d)\n",
-                                  args->buffer_count, ret);
-                }
-        }
-        drm_free_large(exec2_list);
        return ret;
 }
 int
-i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
+i915_gem_object_pin(struct drm_i915_gem_object *obj,
+                    uint32_t alignment,
+                    bool map_and_fenceable)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        int ret;
-        BUG_ON(obj_priv->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT);
+        BUG_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT);
        WARN_ON(i915_verify_lists(dev));
-        if (obj_priv->gtt_space != NULL) {
+        if (obj->gtt_space != NULL) {
-                if (alignment == 0)
+                if ((alignment && obj->gtt_offset & (alignment - 1)) ||
-                        alignment = i915_gem_get_gtt_alignment(obj);
+                    (map_and_fenceable && !obj->map_and_fenceable)) {
-                if (obj_priv->gtt_offset & (alignment - 1)) {
+                        WARN(obj->pin_count,
-                        WARN(obj_priv->pin_count,
+                             "bo is already pinned with incorrect alignment:"
-                             "bo is already pinned with incorrect alignment: offset=%x, req.alignment=%x\n",
+                             " offset=%x, req.alignment=%x, req.map_and_fenceable=%d,"
-                             obj_priv->gtt_offset, alignment);
+                             " obj->map_and_fenceable=%d\n",
+                             obj->gtt_offset, alignment,
+                             map_and_fenceable,
+                             obj->map_and_fenceable);
                        ret = i915_gem_object_unbind(obj);
                        if (ret)
                                return ret;
                }
        }
-        if (obj_priv->gtt_space == NULL) {
+        if (obj->gtt_space == NULL) {
-                ret = i915_gem_object_bind_to_gtt(obj, alignment);
+                ret = i915_gem_object_bind_to_gtt(obj, alignment,
+                                                  map_and_fenceable);
                if (ret)
                        return ret;
        }
-        obj_priv->pin_count++;
+        if (obj->pin_count++ == 0) {
+                if (!obj->active)
-        /* If the object is not active and not pending a flush,
+                        list_move_tail(&obj->mm_list,
-         * remove it from the inactive list
-         */
-        if (obj_priv->pin_count == 1) {
-                i915_gem_info_add_pin(dev_priv, obj->size);
-                if (!obj_priv->active)
-                        list_move_tail(&obj_priv->mm_list,
                                       &dev_priv->mm.pinned_list);
        }
+        obj->pin_mappable |= map_and_fenceable;
        WARN_ON(i915_verify_lists(dev));
        return 0;
 }
 void
-i915_gem_object_unpin(struct drm_gem_object *obj)
+i915_gem_object_unpin(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        WARN_ON(i915_verify_lists(dev));
-        obj_priv->pin_count--;
+        BUG_ON(obj->pin_count == 0);
-        BUG_ON(obj_priv->pin_count < 0);
+        BUG_ON(obj->gtt_space == NULL);
-        BUG_ON(obj_priv->gtt_space == NULL);
-        /* If the object is no longer pinned, and is
+        if (--obj->pin_count == 0) {
-         * neither active nor being flushed, then stick it on
+                if (!obj->active)
-         * the inactive list
+                        list_move_tail(&obj->mm_list,
-         */
-        if (obj_priv->pin_count == 0) {
-                if (!obj_priv->active)
-                        list_move_tail(&obj_priv->mm_list,
                                       &dev_priv->mm.inactive_list);
-                i915_gem_info_remove_pin(dev_priv, obj->size);
+                obj->pin_mappable = false;
        }
        WARN_ON(i915_verify_lists(dev));
 }
 int
 i915_gem_pin_ioctl(struct drm_device *dev, void *data,
-                   struct drm_file *file_priv)
+                   struct drm_file *file)
 {
        struct drm_i915_gem_pin *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        ret = i915_mutex_lock_interruptible(dev);
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
-        if (obj_priv->madv != I915_MADV_WILLNEED) {
+        if (obj->madv != I915_MADV_WILLNEED) {
                DRM_ERROR("Attempting to pin a purgeable buffer\n");
                ret = -EINVAL;
                goto out;
        }
-        if (obj_priv->pin_filp != NULL && obj_priv->pin_filp != file_priv) {
+        if (obj->pin_filp != NULL && obj->pin_filp != file) {
                DRM_ERROR("Already pinned in i915_gem_pin_ioctl(): %d\n",
                          args->handle);
                ret = -EINVAL;
                goto out;
        }
-        obj_priv->user_pin_count++;
+        obj->user_pin_count++;
-        obj_priv->pin_filp = file_priv;
+        obj->pin_filp = file;
-        if (obj_priv->user_pin_count == 1) {
+        if (obj->user_pin_count == 1) {
-                ret = i915_gem_object_pin(obj, args->alignment);
+                ret = i915_gem_object_pin(obj, args->alignment, true);
                if (ret)
                        goto out;
        }
@@ -4170,9 +3286,9 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
         * as the X server doesn't manage domains yet
         */
        i915_gem_object_flush_cpu_write_domain(obj);
-        args->offset = obj_priv->gtt_offset;
+        args->offset = obj->gtt_offset;
 out:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
@@ -4180,38 +3296,36 @@ unlock:
 int
 i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
-                     struct drm_file *file_priv)
+                     struct drm_file *file)
 {
        struct drm_i915_gem_pin *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        ret = i915_mutex_lock_interruptible(dev);
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
-        if (obj_priv->pin_filp != file_priv) {
+        if (obj->pin_filp != file) {
                DRM_ERROR("Not pinned by caller in i915_gem_pin_ioctl(): %d\n",
                          args->handle);
                ret = -EINVAL;
                goto out;
        }
-        obj_priv->user_pin_count--;
+        obj->user_pin_count--;
-        if (obj_priv->user_pin_count == 0) {
+        if (obj->user_pin_count == 0) {
-                obj_priv->pin_filp = NULL;
+                obj->pin_filp = NULL;
                i915_gem_object_unpin(obj);
        }
 out:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
@@ -4219,52 +3333,64 @@ unlock:
 int
 i915_gem_busy_ioctl(struct drm_device *dev, void *data,
-                    struct drm_file *file_priv)
+                    struct drm_file *file)
 {
        struct drm_i915_gem_busy *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        ret = i915_mutex_lock_interruptible(dev);
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
        /* Count all active objects as busy, even if they are currently not used
         * by the gpu. Users of this interface expect objects to eventually
         * become non-busy without any further actions, therefore emit any
         * necessary flushes here.
         */
-        args->busy = obj_priv->active;
+        args->busy = obj->active;
        if (args->busy) {
                /* Unconditionally flush objects, even when the gpu still uses this
                 * object. Userspace calling this function indicates that it wants to
                 * use this buffer rather sooner than later, so issuing the required
                 * flush earlier is beneficial.
                 */
-                if (obj->write_domain & I915_GEM_GPU_DOMAINS)
+                if (obj->base.write_domain & I915_GEM_GPU_DOMAINS) {
-                        i915_gem_flush_ring(dev, file_priv,
+                        i915_gem_flush_ring(dev, obj->ring,
-                                            obj_priv->ring,
+                                            0, obj->base.write_domain);
-                                            0, obj->write_domain);
+                } else if (obj->ring->outstanding_lazy_request ==
+                           obj->last_rendering_seqno) {
+                        struct drm_i915_gem_request *request;
+                        /* This ring is not being cleared by active usage,
+                         * so emit a request to do so.
+                         */
+                        request = kzalloc(sizeof(*request), GFP_KERNEL);
+                        if (request)
+                                ret = i915_add_request(dev,
+                                                       NULL, request,
+                                                       obj->ring);
+                        else
+                                ret = -ENOMEM;
+                }
                /* Update the active list for the hardware's current position.
                 * Otherwise this only updates on a delayed timer or when irqs
                 * are actually unmasked, and our working set ends up being
                 * larger than required.
                 */
-                i915_gem_retire_requests_ring(dev, obj_priv->ring);
+                i915_gem_retire_requests_ring(dev, obj->ring);
-                args->busy = obj_priv->active;
+                args->busy = obj->active;
        }
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
@@ -4282,8 +3408,7 @@ i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
                       struct drm_file *file_priv)
 {
        struct drm_i915_gem_madvise *args = data;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        switch (args->madv) {
@@ -4298,37 +3423,36 @@ i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file_priv, args->handle));
        if (obj == NULL) {
                ret = -ENOENT;
                goto unlock;
        }
-        obj_priv = to_intel_bo(obj);
-        if (obj_priv->pin_count) {
+        if (obj->pin_count) {
                ret = -EINVAL;
                goto out;
        }
-        if (obj_priv->madv != __I915_MADV_PURGED)
+        if (obj->madv != __I915_MADV_PURGED)
-                obj_priv->madv = args->madv;
+                obj->madv = args->madv;
        /* if the object is no longer bound, discard its backing storage */
-        if (i915_gem_object_is_purgeable(obj_priv) &&
+        if (i915_gem_object_is_purgeable(obj) &&
-            obj_priv->gtt_space == NULL)
+            obj->gtt_space == NULL)
                i915_gem_object_truncate(obj);
-        args->retained = obj_priv->madv != __I915_MADV_PURGED;
+        args->retained = obj->madv != __I915_MADV_PURGED;
 out:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 unlock:
        mutex_unlock(&dev->struct_mutex);
        return ret;
 }
-struct drm_gem_object * i915_gem_alloc_object(struct drm_device *dev,
+struct drm_i915_gem_object *i915_gem_alloc_object(struct drm_device *dev,
-                                              size_t size)
+                                                  size_t size)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj;
@@ -4351,11 +3475,15 @@ struct drm_gem_object * i915_gem_alloc_object(struct drm_device *dev,
        obj->base.driver_private = NULL;
        obj->fence_reg = I915_FENCE_REG_NONE;
        INIT_LIST_HEAD(&obj->mm_list);
+        INIT_LIST_HEAD(&obj->gtt_list);
        INIT_LIST_HEAD(&obj->ring_list);
+        INIT_LIST_HEAD(&obj->exec_list);
        INIT_LIST_HEAD(&obj->gpu_write_list);
        obj->madv = I915_MADV_WILLNEED;
+        /* Avoid an unnecessary call to unbind on the first bind. */
+        obj->map_and_fenceable = true;
-        return &obj->base;
+        return obj;
 }
 int i915_gem_init_object(struct drm_gem_object *obj)
@@ -4365,42 +3493,41 @@ int i915_gem_init_object(struct drm_gem_object *obj)
        return 0;
 }
-static void i915_gem_free_object_tail(struct drm_gem_object *obj)
+static void i915_gem_free_object_tail(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        int ret;
        ret = i915_gem_object_unbind(obj);
        if (ret == -ERESTARTSYS) {
-                list_move(&obj_priv->mm_list,
+                list_move(&obj->mm_list,
                          &dev_priv->mm.deferred_free_list);
                return;
        }
-        if (obj_priv->mmap_offset)
+        if (obj->base.map_list.map)
                i915_gem_free_mmap_offset(obj);
-        drm_gem_object_release(obj);
+        drm_gem_object_release(&obj->base);
-        i915_gem_info_remove_obj(dev_priv, obj->size);
+        i915_gem_info_remove_obj(dev_priv, obj->base.size);
-        kfree(obj_priv->page_cpu_valid);
+        kfree(obj->page_cpu_valid);
-        kfree(obj_priv->bit_17);
+        kfree(obj->bit_17);
-        kfree(obj_priv);
+        kfree(obj);
 }
-void i915_gem_free_object(struct drm_gem_object *obj)
+void i915_gem_free_object(struct drm_gem_object *gem_obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_i915_gem_object *obj = to_intel_bo(gem_obj);
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        struct drm_device *dev = obj->base.dev;
        trace_i915_gem_object_destroy(obj);
-        while (obj_priv->pin_count > 0)
+        while (obj->pin_count > 0)
                i915_gem_object_unpin(obj);
-        if (obj_priv->phys_obj)
+        if (obj->phys_obj)
                i915_gem_detach_phys_object(dev, obj);
        i915_gem_free_object_tail(obj);
@@ -4427,13 +3554,15 @@ i915_gem_idle(struct drm_device *dev)
        /* Under UMS, be paranoid and evict. */
        if (!drm_core_check_feature(dev, DRIVER_MODESET)) {
-                ret = i915_gem_evict_inactive(dev);
+                ret = i915_gem_evict_inactive(dev, false);
                if (ret) {
                        mutex_unlock(&dev->struct_mutex);
                        return ret;
                }
        }
+        i915_gem_reset_fences(dev);
        /* Hack!  Don't let anybody do execbuf while we don't control the chip.
         * We need to replace this with a semaphore, or something.
         * And not confound mm.suspended!
@@ -4452,82 +3581,15 @@ i915_gem_idle(struct drm_device *dev)
        return 0;
 }
-/*
- * 965+ support PIPE_CONTROL commands, which provide finer grained control
- * over cache flushing.
- */
-static int
-i915_gem_init_pipe_control(struct drm_device *dev)
-{
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
-        int ret;
-        obj = i915_gem_alloc_object(dev, 4096);
-        if (obj == NULL) {
-                DRM_ERROR("Failed to allocate seqno page\n");
-                ret = -ENOMEM;
-                goto err;
-        }
-        obj_priv = to_intel_bo(obj);
-        obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
-        ret = i915_gem_object_pin(obj, 4096);
-        if (ret)
-                goto err_unref;
-        dev_priv->seqno_gfx_addr = obj_priv->gtt_offset;
-        dev_priv->seqno_page =  kmap(obj_priv->pages[0]);
-        if (dev_priv->seqno_page == NULL)
-                goto err_unpin;
-        dev_priv->seqno_obj = obj;
-        memset(dev_priv->seqno_page, 0, PAGE_SIZE);
-        return 0;
-err_unpin:
-        i915_gem_object_unpin(obj);
-err_unref:
-        drm_gem_object_unreference(obj);
-err:
-        return ret;
-}
-static void
-i915_gem_cleanup_pipe_control(struct drm_device *dev)
-{
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
-        obj = dev_priv->seqno_obj;
-        obj_priv = to_intel_bo(obj);
-        kunmap(obj_priv->pages[0]);
-        i915_gem_object_unpin(obj);
-        drm_gem_object_unreference(obj);
-        dev_priv->seqno_obj = NULL;
-        dev_priv->seqno_page = NULL;
-}
 int
 i915_gem_init_ringbuffer(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        int ret;
-        if (HAS_PIPE_CONTROL(dev)) {
-                ret = i915_gem_init_pipe_control(dev);
-                if (ret)
-                        return ret;
-        }
        ret = intel_init_render_ring_buffer(dev);
        if (ret)
-                goto cleanup_pipe_control;
+                return ret;
        if (HAS_BSD(dev)) {
                ret = intel_init_bsd_ring_buffer(dev);
@@ -4546,12 +3608,9 @@ i915_gem_init_ringbuffer(struct drm_device *dev)
        return 0;
 cleanup_bsd_ring:
-        intel_cleanup_ring_buffer(dev, &dev_priv->bsd_ring);
+        intel_cleanup_ring_buffer(&dev_priv->ring[VCS]);
 cleanup_render_ring:
-        intel_cleanup_ring_buffer(dev, &dev_priv->render_ring);
+        intel_cleanup_ring_buffer(&dev_priv->ring[RCS]);
-cleanup_pipe_control:
-        if (HAS_PIPE_CONTROL(dev))
-                i915_gem_cleanup_pipe_control(dev);
        return ret;
 }
@@ -4559,12 +3618,10 @@ void
 i915_gem_cleanup_ringbuffer(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        int i;
-        intel_cleanup_ring_buffer(dev, &dev_priv->render_ring);
+        for (i = 0; i < I915_NUM_RINGS; i++)
-        intel_cleanup_ring_buffer(dev, &dev_priv->bsd_ring);
+                intel_cleanup_ring_buffer(&dev_priv->ring[i]);
-        intel_cleanup_ring_buffer(dev, &dev_priv->blt_ring);
-        if (HAS_PIPE_CONTROL(dev))
-                i915_gem_cleanup_pipe_control(dev);
 }
 int
@@ -4572,7 +3629,7 @@ i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
                       struct drm_file *file_priv)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
-        int ret;
+        int ret, i;
        if (drm_core_check_feature(dev, DRIVER_MODESET))
                return 0;
@@ -4592,14 +3649,12 @@ i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
        }
        BUG_ON(!list_empty(&dev_priv->mm.active_list));
-        BUG_ON(!list_empty(&dev_priv->render_ring.active_list));
-        BUG_ON(!list_empty(&dev_priv->bsd_ring.active_list));
-        BUG_ON(!list_empty(&dev_priv->blt_ring.active_list));
        BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
        BUG_ON(!list_empty(&dev_priv->mm.inactive_list));
-        BUG_ON(!list_empty(&dev_priv->render_ring.request_list));
+        for (i = 0; i < I915_NUM_RINGS; i++) {
-        BUG_ON(!list_empty(&dev_priv->bsd_ring.request_list));
+                BUG_ON(!list_empty(&dev_priv->ring[i].active_list));
-        BUG_ON(!list_empty(&dev_priv->blt_ring.request_list));
+                BUG_ON(!list_empty(&dev_priv->ring[i].request_list));
+        }
        mutex_unlock(&dev->struct_mutex);
        ret = drm_irq_install(dev);
@@ -4661,17 +3716,14 @@ i915_gem_load(struct drm_device *dev)
        INIT_LIST_HEAD(&dev_priv->mm.pinned_list);
        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
        INIT_LIST_HEAD(&dev_priv->mm.deferred_free_list);
-        init_ring_lists(&dev_priv->render_ring);
+        INIT_LIST_HEAD(&dev_priv->mm.gtt_list);
-        init_ring_lists(&dev_priv->bsd_ring);
+        for (i = 0; i < I915_NUM_RINGS; i++)
-        init_ring_lists(&dev_priv->blt_ring);
+                init_ring_lists(&dev_priv->ring[i]);
        for (i = 0; i < 16; i++)
                INIT_LIST_HEAD(&dev_priv->fence_regs[i].lru_list);
        INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
                          i915_gem_retire_work_handler);
        init_completion(&dev_priv->error_completion);
-        spin_lock(&shrink_list_lock);
-        list_add(&dev_priv->mm.shrink_list, &shrink_list);
-        spin_unlock(&shrink_list_lock);
        /* On GEN3 we really need to make sure the ARB C3 LP bit is set */
        if (IS_GEN3(dev)) {
@@ -4683,6 +3735,8 @@ i915_gem_load(struct drm_device *dev)
                }
        }
+        dev_priv->relative_constants_mode = I915_EXEC_CONSTANTS_REL_GENERAL;
        /* Old X drivers will take 0-2 for front, back, depth buffers */
        if (!drm_core_check_feature(dev, DRIVER_MODESET))
                dev_priv->fence_reg_start = 3;
@@ -4714,6 +3768,10 @@ i915_gem_load(struct drm_device *dev)
        }
        i915_gem_detect_bit_6_swizzle(dev);
        init_waitqueue_head(&dev_priv->pending_flip_queue);
+        dev_priv->mm.inactive_shrinker.shrink = i915_gem_inactive_shrink;
+        dev_priv->mm.inactive_shrinker.seeks = DEFAULT_SEEKS;
+        register_shrinker(&dev_priv->mm.inactive_shrinker);
 }
 /*
@@ -4783,47 +3841,47 @@ void i915_gem_free_all_phys_object(struct drm_device *dev)
 }
 void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_gem_object *obj)
+                                 struct drm_i915_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv;
+        struct address_space *mapping = obj->base.filp->f_path.dentry->d_inode->i_mapping;
+        char *vaddr;
        int i;
-        int ret;
        int page_count;
-        obj_priv = to_intel_bo(obj);
+        if (!obj->phys_obj)
-        if (!obj_priv->phys_obj)
                return;
+        vaddr = obj->phys_obj->handle->vaddr;
-        ret = i915_gem_object_get_pages(obj, 0);
+        page_count = obj->base.size / PAGE_SIZE;
-        if (ret)
-                goto out;
-        page_count = obj->size / PAGE_SIZE;
        for (i = 0; i < page_count; i++) {
-                char *dst = kmap_atomic(obj_priv->pages[i]);
+                struct page *page = read_cache_page_gfp(mapping, i,
-                char *src = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
+                                                        GFP_HIGHUSER | __GFP_RECLAIMABLE);
+                if (!IS_ERR(page)) {
-                memcpy(dst, src, PAGE_SIZE);
+                        char *dst = kmap_atomic(page);
-                kunmap_atomic(dst);
+                        memcpy(dst, vaddr + i*PAGE_SIZE, PAGE_SIZE);
+                        kunmap_atomic(dst);
+                        drm_clflush_pages(&page, 1);
+                        set_page_dirty(page);
+                        mark_page_accessed(page);
+                        page_cache_release(page);
+                }
        }
-        drm_clflush_pages(obj_priv->pages, page_count);
+        intel_gtt_chipset_flush();
-        drm_agp_chipset_flush(dev);
-        i915_gem_object_put_pages(obj);
+        obj->phys_obj->cur_obj = NULL;
-out:
+        obj->phys_obj = NULL;
-        obj_priv->phys_obj->cur_obj = NULL;
-        obj_priv->phys_obj = NULL;
 }
 int
 i915_gem_attach_phys_object(struct drm_device *dev,
-                            struct drm_gem_object *obj,
+                            struct drm_i915_gem_object *obj,
                            int id,
                            int align)
 {
+        struct address_space *mapping = obj->base.filp->f_path.dentry->d_inode->i_mapping;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
        int ret = 0;
        int page_count;
        int i;
@@ -4831,10 +3889,8 @@ i915_gem_attach_phys_object(struct drm_device *dev,
        if (id > I915_MAX_PHYS_OBJECT)
                return -EINVAL;
-        obj_priv = to_intel_bo(obj);
+        if (obj->phys_obj) {
+                if (obj->phys_obj->id == id)
-        if (obj_priv->phys_obj) {
-                if (obj_priv->phys_obj->id == id)
                        return 0;
                i915_gem_detach_phys_object(dev, obj);
        }
@@ -4842,51 +3898,50 @@ i915_gem_attach_phys_object(struct drm_device *dev,
        /* create a new object */
        if (!dev_priv->mm.phys_objs[id - 1]) {
                ret = i915_gem_init_phys_object(dev, id,
-                                                obj->size, align);
+                                                obj->base.size, align);
                if (ret) {
-                        DRM_ERROR("failed to init phys object %d size: %zu\n", id, obj->size);
+                        DRM_ERROR("failed to init phys object %d size: %zu\n",
-                        goto out;
+                                  id, obj->base.size);
+                        return ret;
                }
        }
        /* bind to the object */
-        obj_priv->phys_obj = dev_priv->mm.phys_objs[id - 1];
+        obj->phys_obj = dev_priv->mm.phys_objs[id - 1];
-        obj_priv->phys_obj->cur_obj = obj;
+        obj->phys_obj->cur_obj = obj;
-        ret = i915_gem_object_get_pages(obj, 0);
-        if (ret) {
-                DRM_ERROR("failed to get page list\n");
-                goto out;
-        }
-        page_count = obj->size / PAGE_SIZE;
+        page_count = obj->base.size / PAGE_SIZE;
        for (i = 0; i < page_count; i++) {
-                char *src = kmap_atomic(obj_priv->pages[i]);
+                struct page *page;
-                char *dst = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
+                char *dst, *src;
+                page = read_cache_page_gfp(mapping, i,
+                                           GFP_HIGHUSER | __GFP_RECLAIMABLE);
+                if (IS_ERR(page))
+                        return PTR_ERR(page);
+                src = kmap_atomic(page);
+                dst = obj->phys_obj->handle->vaddr + (i * PAGE_SIZE);
                memcpy(dst, src, PAGE_SIZE);
                kunmap_atomic(src);
-        }
-        i915_gem_object_put_pages(obj);
+                mark_page_accessed(page);
+                page_cache_release(page);
+        }
        return 0;
-out:
-        return ret;
 }
 static int
-i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
+i915_gem_phys_pwrite(struct drm_device *dev,
+                     struct drm_i915_gem_object *obj,
                     struct drm_i915_gem_pwrite *args,
                     struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        void *vaddr = obj->phys_obj->handle->vaddr + args->offset;
-        void *vaddr = obj_priv->phys_obj->handle->vaddr + args->offset;
        char __user *user_data = (char __user *) (uintptr_t) args->data_ptr;
-        DRM_DEBUG_DRIVER("vaddr %p, %lld\n", vaddr, args->size);
        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
                unsigned long unwritten;
@@ -4901,7 +3956,7 @@ i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
                        return -EFAULT;
        }
-        drm_agp_chipset_flush(dev);
+        intel_gtt_chipset_flush();
        return 0;
 }
@@ -4939,144 +3994,68 @@ i915_gpu_is_active(struct drm_device *dev)
 }
 static int
-i915_gem_shrink(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
+i915_gem_inactive_shrink(struct shrinker *shrinker,
-{
+                         int nr_to_scan,
-        drm_i915_private_t *dev_priv, *next_dev;
+                         gfp_t gfp_mask)
-        struct drm_i915_gem_object *obj_priv, *next_obj;
+{
-        int cnt = 0;
+        struct drm_i915_private *dev_priv =
-        int would_deadlock = 1;
+                container_of(shrinker,
+                             struct drm_i915_private,
+                             mm.inactive_shrinker);
+        struct drm_device *dev = dev_priv->dev;
+        struct drm_i915_gem_object *obj, *next;
+        int cnt;
+        if (!mutex_trylock(&dev->struct_mutex))
+                return 0;
        /* "fast-path" to count number of available objects */
        if (nr_to_scan == 0) {
-                spin_lock(&shrink_list_lock);
+                cnt = 0;
-                list_for_each_entry(dev_priv, &shrink_list, mm.shrink_list) {
+                list_for_each_entry(obj,
-                        struct drm_device *dev = dev_priv->dev;
+                                    &dev_priv->mm.inactive_list,
+                                    mm_list)
-                        if (mutex_trylock(&dev->struct_mutex)) {
+                        cnt++;
-                                list_for_each_entry(obj_priv,
+                mutex_unlock(&dev->struct_mutex);
-                                                    &dev_priv->mm.inactive_list,
+                return cnt / 100 * sysctl_vfs_cache_pressure;
-                                                    mm_list)
-                                        cnt++;
-                                mutex_unlock(&dev->struct_mutex);
-                        }
-                }
-                spin_unlock(&shrink_list_lock);
-                return (cnt / 100) * sysctl_vfs_cache_pressure;
        }
-        spin_lock(&shrink_list_lock);
 rescan:
        /* first scan for clean buffers */
-        list_for_each_entry_safe(dev_priv, next_dev,
+        i915_gem_retire_requests(dev);
-                                 &shrink_list, mm.shrink_list) {
-                struct drm_device *dev = dev_priv->dev;
-                if (! mutex_trylock(&dev->struct_mutex))
-                        continue;
-                spin_unlock(&shrink_list_lock);
-                i915_gem_retire_requests(dev);
-                list_for_each_entry_safe(obj_priv, next_obj,
+        list_for_each_entry_safe(obj, next,
-                                         &dev_priv->mm.inactive_list,
+                                 &dev_priv->mm.inactive_list,
-                                         mm_list) {
+                                 mm_list) {
-                        if (i915_gem_object_is_purgeable(obj_priv)) {
+                if (i915_gem_object_is_purgeable(obj)) {
-                                i915_gem_object_unbind(&obj_priv->base);
+                        if (i915_gem_object_unbind(obj) == 0 &&
-                                if (--nr_to_scan <= 0)
+                            --nr_to_scan == 0)
-                                        break;
+                                break;
-                        }
                }
-                spin_lock(&shrink_list_lock);
-                mutex_unlock(&dev->struct_mutex);
-                would_deadlock = 0;
-                if (nr_to_scan <= 0)
-                        break;
        }
        /* second pass, evict/count anything still on the inactive list */
-        list_for_each_entry_safe(dev_priv, next_dev,
+        cnt = 0;
-                                 &shrink_list, mm.shrink_list) {
+        list_for_each_entry_safe(obj, next,
-                struct drm_device *dev = dev_priv->dev;
+                                 &dev_priv->mm.inactive_list,
+                                 mm_list) {
-                if (! mutex_trylock(&dev->struct_mutex))
+                if (nr_to_scan &&
-                        continue;
+                    i915_gem_object_unbind(obj) == 0)
+                        nr_to_scan--;
-                spin_unlock(&shrink_list_lock);
+                else
+                        cnt++;
-                list_for_each_entry_safe(obj_priv, next_obj,
-                                         &dev_priv->mm.inactive_list,
-                                         mm_list) {
-                        if (nr_to_scan > 0) {
-                                i915_gem_object_unbind(&obj_priv->base);
-                                nr_to_scan--;
-                        } else
-                                cnt++;
-                }
-                spin_lock(&shrink_list_lock);
-                mutex_unlock(&dev->struct_mutex);
-                would_deadlock = 0;
        }
-        if (nr_to_scan) {
+        if (nr_to_scan && i915_gpu_is_active(dev)) {
-                int active = 0;
                /*
                 * We are desperate for pages, so as a last resort, wait
                 * for the GPU to finish and discard whatever we can.
                 * This has a dramatic impact to reduce the number of
                 * OOM-killer events whilst running the GPU aggressively.
                 */
-                list_for_each_entry(dev_priv, &shrink_list, mm.shrink_list) {
+                if (i915_gpu_idle(dev) == 0)
-                        struct drm_device *dev = dev_priv->dev;
-                        if (!mutex_trylock(&dev->struct_mutex))
-                                continue;
-                        spin_unlock(&shrink_list_lock);
-                        if (i915_gpu_is_active(dev)) {
-                                i915_gpu_idle(dev);
-                                active++;
-                        }
-                        spin_lock(&shrink_list_lock);
-                        mutex_unlock(&dev->struct_mutex);
-                }
-                if (active)
                        goto rescan;
        }
+        mutex_unlock(&dev->struct_mutex);
-        spin_unlock(&shrink_list_lock);
+        return cnt / 100 * sysctl_vfs_cache_pressure;
-        if (would_deadlock)
-                return -1;
-        else if (cnt > 0)
-                return (cnt / 100) * sysctl_vfs_cache_pressure;
-        else
-                return 0;
-}
-static struct shrinker shrinker = {
-        .shrink = i915_gem_shrink,
-        .seeks = DEFAULT_SEEKS,
-};
-__init void
-i915_gem_shrinker_init(void)
-{
-    register_shrinker(&shrinker);
-}
-__exit void
-i915_gem_shrinker_exit(void)
-{
-    unregister_shrinker(&shrinker);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_debug.c b/drivers/gpu/drm/i915/i915_gem_debug.c
index 48644b840a8d..29d014c48ca2 100644
--- a/drivers/gpu/drm/i915/i915_gem_debug.c
+++ b/drivers/gpu/drm/i915/i915_gem_debug.c
@@ -152,13 +152,12 @@ i915_gem_dump_page(struct page *page, uint32_t start, uint32_t end,
 }
 void
-i915_gem_dump_object(struct drm_gem_object *obj, int len,
+i915_gem_dump_object(struct drm_i915_gem_object *obj, int len,
                     const char *where, uint32_t mark)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        int page;
-        DRM_INFO("%s: object at offset %08x\n", where, obj_priv->gtt_offset);
+        DRM_INFO("%s: object at offset %08x\n", where, obj->gtt_offset);
        for (page = 0; page < (len + PAGE_SIZE-1) / PAGE_SIZE; page++) {
                int page_len, chunk, chunk_len;
@@ -170,9 +169,9 @@ i915_gem_dump_object(struct drm_gem_object *obj, int len,
                        chunk_len = page_len - chunk;
                        if (chunk_len > 128)
                                chunk_len = 128;
-                        i915_gem_dump_page(obj_priv->pages[page],
+                        i915_gem_dump_page(obj->pages[page],
                                           chunk, chunk + chunk_len,
-                                           obj_priv->gtt_offset +
+                                           obj->gtt_offset +
                                           page * PAGE_SIZE,
                                           mark);
                }
@@ -182,21 +181,19 @@ i915_gem_dump_object(struct drm_gem_object *obj, int len,
 #if WATCH_COHERENCY
 void
-i915_gem_object_check_coherency(struct drm_gem_object *obj, int handle)
+i915_gem_object_check_coherency(struct drm_i915_gem_object *obj, int handle)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        int page;
        uint32_t *gtt_mapping;
        uint32_t *backing_map = NULL;
        int bad_count = 0;
        DRM_INFO("%s: checking coherency of object %p@0x%08x (%d, %zdkb):\n",
-                 __func__, obj, obj_priv->gtt_offset, handle,
+                 __func__, obj, obj->gtt_offset, handle,
                 obj->size / 1024);
-        gtt_mapping = ioremap(dev->agp->base + obj_priv->gtt_offset,
+        gtt_mapping = ioremap(dev->agp->base + obj->gtt_offset, obj->base.size);
-                              obj->size);
        if (gtt_mapping == NULL) {
                DRM_ERROR("failed to map GTT space\n");
                return;
@@ -205,7 +202,7 @@ i915_gem_object_check_coherency(struct drm_gem_object *obj, int handle)
        for (page = 0; page < obj->size / PAGE_SIZE; page++) {
                int i;
-                backing_map = kmap_atomic(obj_priv->pages[page], KM_USER0);
+                backing_map = kmap_atomic(obj->pages[page], KM_USER0);
                if (backing_map == NULL) {
                        DRM_ERROR("failed to map backing page\n");
@@ -220,7 +217,7 @@ i915_gem_object_check_coherency(struct drm_gem_object *obj, int handle)
                        if (cpuval != gttval) {
                                DRM_INFO("incoherent CPU vs GPU at 0x%08x: "
                                         "0x%08x vs 0x%08x\n",
-                                         (int)(obj_priv->gtt_offset +
+                                         (int)(obj->gtt_offset +
                                               page * PAGE_SIZE + i * 4),
                                         cpuval, gttval);
                                if (bad_count++ >= 8) {
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index d8ae7d1d0cc6..78b8cf90c922 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -32,28 +32,36 @@
 #include "i915_drm.h"
 static bool
-mark_free(struct drm_i915_gem_object *obj_priv,
+mark_free(struct drm_i915_gem_object *obj, struct list_head *unwind)
-           struct list_head *unwind)
 {
-        list_add(&obj_priv->evict_list, unwind);
+        list_add(&obj->exec_list, unwind);
-        drm_gem_object_reference(&obj_priv->base);
+        drm_gem_object_reference(&obj->base);
-        return drm_mm_scan_add_block(obj_priv->gtt_space);
+        return drm_mm_scan_add_block(obj->gtt_space);
 }
 int
-i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignment)
+i915_gem_evict_something(struct drm_device *dev, int min_size,
+                         unsigned alignment, bool mappable)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct list_head eviction_list, unwind_list;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        int ret = 0;
        i915_gem_retire_requests(dev);
        /* Re-check for free space after retiring requests */
-        if (drm_mm_search_free(&dev_priv->mm.gtt_space,
+        if (mappable) {
-                               min_size, alignment, 0))
+                if (drm_mm_search_free_in_range(&dev_priv->mm.gtt_space,
-                return 0;
+                                                min_size, alignment, 0,
+                                                dev_priv->mm.gtt_mappable_end,
+                                                0))
+                        return 0;
+        } else {
+                if (drm_mm_search_free(&dev_priv->mm.gtt_space,
+                                       min_size, alignment, 0))
+                        return 0;
+        }
        /*
         * The goal is to evict objects and amalgamate space in LRU order.
@@ -79,45 +87,50 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
         */
        INIT_LIST_HEAD(&unwind_list);
-        drm_mm_init_scan(&dev_priv->mm.gtt_space, min_size, alignment);
+        if (mappable)
+                drm_mm_init_scan_with_range(&dev_priv->mm.gtt_space, min_size,
+                                            alignment, 0,
+                                            dev_priv->mm.gtt_mappable_end);
+        else
+                drm_mm_init_scan(&dev_priv->mm.gtt_space, min_size, alignment);
        /* First see if there is a large enough contiguous idle region... */
-        list_for_each_entry(obj_priv, &dev_priv->mm.inactive_list, mm_list) {
+        list_for_each_entry(obj, &dev_priv->mm.inactive_list, mm_list) {
-                if (mark_free(obj_priv, &unwind_list))
+                if (mark_free(obj, &unwind_list))
                        goto found;
        }
        /* Now merge in the soon-to-be-expired objects... */
-        list_for_each_entry(obj_priv, &dev_priv->mm.active_list, mm_list) {
+        list_for_each_entry(obj, &dev_priv->mm.active_list, mm_list) {
                /* Does the object require an outstanding flush? */
-                if (obj_priv->base.write_domain || obj_priv->pin_count)
+                if (obj->base.write_domain || obj->pin_count)
                        continue;
-                if (mark_free(obj_priv, &unwind_list))
+                if (mark_free(obj, &unwind_list))
                        goto found;
        }
        /* Finally add anything with a pending flush (in order of retirement) */
-        list_for_each_entry(obj_priv, &dev_priv->mm.flushing_list, mm_list) {
+        list_for_each_entry(obj, &dev_priv->mm.flushing_list, mm_list) {
-                if (obj_priv->pin_count)
+                if (obj->pin_count)
                        continue;
-                if (mark_free(obj_priv, &unwind_list))
+                if (mark_free(obj, &unwind_list))
                        goto found;
        }
-        list_for_each_entry(obj_priv, &dev_priv->mm.active_list, mm_list) {
+        list_for_each_entry(obj, &dev_priv->mm.active_list, mm_list) {
-                if (! obj_priv->base.write_domain || obj_priv->pin_count)
+                if (! obj->base.write_domain || obj->pin_count)
                        continue;
-                if (mark_free(obj_priv, &unwind_list))
+                if (mark_free(obj, &unwind_list))
                        goto found;
        }
        /* Nothing found, clean up and bail out! */
-        list_for_each_entry(obj_priv, &unwind_list, evict_list) {
+        list_for_each_entry(obj, &unwind_list, exec_list) {
-                ret = drm_mm_scan_remove_block(obj_priv->gtt_space);
+                ret = drm_mm_scan_remove_block(obj->gtt_space);
                BUG_ON(ret);
-                drm_gem_object_unreference(&obj_priv->base);
+                drm_gem_object_unreference(&obj->base);
        }
        /* We expect the caller to unpin, evict all and try again, or give up.
@@ -131,33 +144,33 @@ found:
         * temporary list. */
        INIT_LIST_HEAD(&eviction_list);
        while (!list_empty(&unwind_list)) {
-                obj_priv = list_first_entry(&unwind_list,
+                obj = list_first_entry(&unwind_list,
-                                            struct drm_i915_gem_object,
+                                       struct drm_i915_gem_object,
-                                            evict_list);
+                                       exec_list);
-                if (drm_mm_scan_remove_block(obj_priv->gtt_space)) {
+                if (drm_mm_scan_remove_block(obj->gtt_space)) {
-                        list_move(&obj_priv->evict_list, &eviction_list);
+                        list_move(&obj->exec_list, &eviction_list);
                        continue;
                }
-                list_del(&obj_priv->evict_list);
+                list_del_init(&obj->exec_list);
-                drm_gem_object_unreference(&obj_priv->base);
+                drm_gem_object_unreference(&obj->base);
        }
        /* Unbinding will emit any required flushes */
        while (!list_empty(&eviction_list)) {
-                obj_priv = list_first_entry(&eviction_list,
+                obj = list_first_entry(&eviction_list,
-                                            struct drm_i915_gem_object,
+                                       struct drm_i915_gem_object,
-                                            evict_list);
+                                       exec_list);
                if (ret == 0)
-                        ret = i915_gem_object_unbind(&obj_priv->base);
+                        ret = i915_gem_object_unbind(obj);
-                list_del(&obj_priv->evict_list);
+                list_del_init(&obj->exec_list);
-                drm_gem_object_unreference(&obj_priv->base);
+                drm_gem_object_unreference(&obj->base);
        }
        return ret;
 }
 int
-i915_gem_evict_everything(struct drm_device *dev)
+i915_gem_evict_everything(struct drm_device *dev, bool purgeable_only)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        int ret;
@@ -176,36 +189,22 @@ i915_gem_evict_everything(struct drm_device *dev)
        BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
-        ret = i915_gem_evict_inactive(dev);
+        return i915_gem_evict_inactive(dev, purgeable_only);
-        if (ret)
-                return ret;
-        lists_empty = (list_empty(&dev_priv->mm.inactive_list) &&
-                       list_empty(&dev_priv->mm.flushing_list) &&
-                       list_empty(&dev_priv->mm.active_list));
-        BUG_ON(!lists_empty);
-        return 0;
 }
 /** Unbinds all inactive objects. */
 int
-i915_gem_evict_inactive(struct drm_device *dev)
+i915_gem_evict_inactive(struct drm_device *dev, bool purgeable_only)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj, *next;
-        while (!list_empty(&dev_priv->mm.inactive_list)) {
-                struct drm_gem_object *obj;
+        list_for_each_entry_safe(obj, next,
-                int ret;
+                                 &dev_priv->mm.inactive_list, mm_list) {
+                if (!purgeable_only || obj->madv != I915_MADV_WILLNEED) {
-                obj = &list_first_entry(&dev_priv->mm.inactive_list,
+                        int ret = i915_gem_object_unbind(obj);
-                                        struct drm_i915_gem_object,
+                        if (ret)
-                                        mm_list)->base;
+                                return ret;
-                ret = i915_gem_object_unbind(obj);
-                if (ret != 0) {
-                        DRM_ERROR("Error unbinding object: %d\n", ret);
-                        return ret;
                }
        }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
new file mode 100644
index 000000000000..61129e6759eb
--- /dev/null
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -0,0 +1,1343 @@
+/*
+ * Copyright © 2008,2010 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Eric Anholt <eric@anholt.net>
+ *    Chris Wilson <chris@chris-wilson.co.uk>
+ *
+ */
+#include "drmP.h"
+#include "drm.h"
+#include "i915_drm.h"
+#include "i915_drv.h"
+#include "i915_trace.h"
+#include "intel_drv.h"
+struct change_domains {
+        uint32_t invalidate_domains;
+        uint32_t flush_domains;
+        uint32_t flush_rings;
+};
+/*
+ * Set the next domain for the specified object. This
+ * may not actually perform the necessary flushing/invaliding though,
+ * as that may want to be batched with other set_domain operations
+ *
+ * This is (we hope) the only really tricky part of gem. The goal
+ * is fairly simple -- track which caches hold bits of the object
+ * and make sure they remain coherent. A few concrete examples may
+ * help to explain how it works. For shorthand, we use the notation
+ * (read_domains, write_domain), e.g. (CPU, CPU) to indicate the
+ * a pair of read and write domain masks.
+ *
+ * Case 1: the batch buffer
+ *
+ *      1. Allocated
+ *      2. Written by CPU
+ *      3. Mapped to GTT
+ *      4. Read by GPU
+ *      5. Unmapped from GTT
+ *      6. Freed
+ *
+ *      Let's take these a step at a time
+ *
+ *      1. Allocated
+ *              Pages allocated from the kernel may still have
+ *              cache contents, so we set them to (CPU, CPU) always.
+ *      2. Written by CPU (using pwrite)
+ *              The pwrite function calls set_domain (CPU, CPU) and
+ *              this function does nothing (as nothing changes)
+ *      3. Mapped by GTT
+ *              This function asserts that the object is not
+ *              currently in any GPU-based read or write domains
+ *      4. Read by GPU
+ *              i915_gem_execbuffer calls set_domain (COMMAND, 0).
+ *              As write_domain is zero, this function adds in the
+ *              current read domains (CPU+COMMAND, 0).
+ *              flush_domains is set to CPU.
+ *              invalidate_domains is set to COMMAND
+ *              clflush is run to get data out of the CPU caches
+ *              then i915_dev_set_domain calls i915_gem_flush to
+ *              emit an MI_FLUSH and drm_agp_chipset_flush
+ *      5. Unmapped from GTT
+ *              i915_gem_object_unbind calls set_domain (CPU, CPU)
+ *              flush_domains and invalidate_domains end up both zero
+ *              so no flushing/invalidating happens
+ *      6. Freed
+ *              yay, done
+ *
+ * Case 2: The shared render buffer
+ *
+ *      1. Allocated
+ *      2. Mapped to GTT
+ *      3. Read/written by GPU
+ *      4. set_domain to (CPU,CPU)
+ *      5. Read/written by CPU
+ *      6. Read/written by GPU
+ *
+ *      1. Allocated
+ *              Same as last example, (CPU, CPU)
+ *      2. Mapped to GTT
+ *              Nothing changes (assertions find that it is not in the GPU)
+ *      3. Read/written by GPU
+ *              execbuffer calls set_domain (RENDER, RENDER)
+ *              flush_domains gets CPU
+ *              invalidate_domains gets GPU
+ *              clflush (obj)
+ *              MI_FLUSH and drm_agp_chipset_flush
+ *      4. set_domain (CPU, CPU)
+ *              flush_domains gets GPU
+ *              invalidate_domains gets CPU
+ *              wait_rendering (obj) to make sure all drawing is complete.
+ *              This will include an MI_FLUSH to get the data from GPU
+ *              to memory
+ *              clflush (obj) to invalidate the CPU cache
+ *              Another MI_FLUSH in i915_gem_flush (eliminate this somehow?)
+ *      5. Read/written by CPU
+ *              cache lines are loaded and dirtied
+ *      6. Read written by GPU
+ *              Same as last GPU access
+ *
+ * Case 3: The constant buffer
+ *
+ *      1. Allocated
+ *      2. Written by CPU
+ *      3. Read by GPU
+ *      4. Updated (written) by CPU again
+ *      5. Read by GPU
+ *
+ *      1. Allocated
+ *              (CPU, CPU)
+ *      2. Written by CPU
+ *              (CPU, CPU)
+ *      3. Read by GPU
+ *              (CPU+RENDER, 0)
+ *              flush_domains = CPU
+ *              invalidate_domains = RENDER
+ *              clflush (obj)
+ *              MI_FLUSH
+ *              drm_agp_chipset_flush
+ *      4. Updated (written) by CPU again
+ *              (CPU, CPU)
+ *              flush_domains = 0 (no previous write domain)
+ *              invalidate_domains = 0 (no new read domains)
+ *      5. Read by GPU
+ *              (CPU+RENDER, 0)
+ *              flush_domains = CPU
+ *              invalidate_domains = RENDER
+ *              clflush (obj)
+ *              MI_FLUSH
+ *              drm_agp_chipset_flush
+ */
+static void
+i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
+                                  struct intel_ring_buffer *ring,
+                                  struct change_domains *cd)
+{
+        uint32_t invalidate_domains = 0, flush_domains = 0;
+        /*
+         * If the object isn't moving to a new write domain,
+         * let the object stay in multiple read domains
+         */
+        if (obj->base.pending_write_domain == 0)
+                obj->base.pending_read_domains |= obj->base.read_domains;
+        /*
+         * Flush the current write domain if
+         * the new read domains don't match. Invalidate
+         * any read domains which differ from the old
+         * write domain
+         */
+        if (obj->base.write_domain &&
+            (((obj->base.write_domain != obj->base.pending_read_domains ||
+               obj->ring != ring)) ||
+             (obj->fenced_gpu_access && !obj->pending_fenced_gpu_access))) {
+                flush_domains |= obj->base.write_domain;
+                invalidate_domains |=
+                        obj->base.pending_read_domains & ~obj->base.write_domain;
+        }
+        /*
+         * Invalidate any read caches which may have
+         * stale data. That is, any new read domains.
+         */
+        invalidate_domains |= obj->base.pending_read_domains & ~obj->base.read_domains;
+        if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_CPU)
+                i915_gem_clflush_object(obj);
+        /* blow away mappings if mapped through GTT */
+        if ((flush_domains | invalidate_domains) & I915_GEM_DOMAIN_GTT)
+                i915_gem_release_mmap(obj);
+        /* The actual obj->write_domain will be updated with
+         * pending_write_domain after we emit the accumulated flush for all
+         * of our domain changes in execbuffers (which clears objects'
+         * write_domains).  So if we have a current write domain that we
+         * aren't changing, set pending_write_domain to that.
+         */
+        if (flush_domains == 0 && obj->base.pending_write_domain == 0)
+                obj->base.pending_write_domain = obj->base.write_domain;
+        cd->invalidate_domains |= invalidate_domains;
+        cd->flush_domains |= flush_domains;
+        if (flush_domains & I915_GEM_GPU_DOMAINS)
+                cd->flush_rings |= obj->ring->id;
+        if (invalidate_domains & I915_GEM_GPU_DOMAINS)
+                cd->flush_rings |= ring->id;
+}
+struct eb_objects {
+        int and;
+        struct hlist_head buckets[0];
+};
+static struct eb_objects *
+eb_create(int size)
+{
+        struct eb_objects *eb;
+        int count = PAGE_SIZE / sizeof(struct hlist_head) / 2;
+        while (count > size)
+                count >>= 1;
+        eb = kzalloc(count*sizeof(struct hlist_head) +
+                     sizeof(struct eb_objects),
+                     GFP_KERNEL);
+        if (eb == NULL)
+                return eb;
+        eb->and = count - 1;
+        return eb;
+}
+static void
+eb_reset(struct eb_objects *eb)
+{
+        memset(eb->buckets, 0, (eb->and+1)*sizeof(struct hlist_head));
+}
+static void
+eb_add_object(struct eb_objects *eb, struct drm_i915_gem_object *obj)
+{
+        hlist_add_head(&obj->exec_node,
+                       &eb->buckets[obj->exec_handle & eb->and]);
+}
+static struct drm_i915_gem_object *
+eb_get_object(struct eb_objects *eb, unsigned long handle)
+{
+        struct hlist_head *head;
+        struct hlist_node *node;
+        struct drm_i915_gem_object *obj;
+        head = &eb->buckets[handle & eb->and];
+        hlist_for_each(node, head) {
+                obj = hlist_entry(node, struct drm_i915_gem_object, exec_node);
+                if (obj->exec_handle == handle)
+                        return obj;
+        }
+        return NULL;
+}
+static void
+eb_destroy(struct eb_objects *eb)
+{
+        kfree(eb);
+}
+static int
+i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
+                                   struct eb_objects *eb,
+                                   struct drm_i915_gem_exec_object2 *entry,
+                                   struct drm_i915_gem_relocation_entry *reloc)
+{
+        struct drm_device *dev = obj->base.dev;
+        struct drm_gem_object *target_obj;
+        uint32_t target_offset;
+        int ret = -EINVAL;
+        /* we've already hold a reference to all valid objects */
+        target_obj = &eb_get_object(eb, reloc->target_handle)->base;
+        if (unlikely(target_obj == NULL))
+                return -ENOENT;
+        target_offset = to_intel_bo(target_obj)->gtt_offset;
+#if WATCH_RELOC
+        DRM_INFO("%s: obj %p offset %08x target %d "
+                 "read %08x write %08x gtt %08x "
+                 "presumed %08x delta %08x\n",
+                 __func__,
+                 obj,
+                 (int) reloc->offset,
+                 (int) reloc->target_handle,
+                 (int) reloc->read_domains,
+                 (int) reloc->write_domain,
+                 (int) target_offset,
+                 (int) reloc->presumed_offset,
+                 reloc->delta);
+#endif
+        /* The target buffer should have appeared before us in the
+         * exec_object list, so it should have a GTT space bound by now.
+         */
+        if (unlikely(target_offset == 0)) {
+                DRM_ERROR("No GTT space found for object %d\n",
+                          reloc->target_handle);
+                return ret;
+        }
+        /* Validate that the target is in a valid r/w GPU domain */
+        if (unlikely(reloc->write_domain & (reloc->write_domain - 1))) {
+                DRM_ERROR("reloc with multiple write domains: "
+                          "obj %p target %d offset %d "
+                          "read %08x write %08x",
+                          obj, reloc->target_handle,
+                          (int) reloc->offset,
+                          reloc->read_domains,
+                          reloc->write_domain);
+                return ret;
+        }
+        if (unlikely((reloc->write_domain | reloc->read_domains) & I915_GEM_DOMAIN_CPU)) {
+                DRM_ERROR("reloc with read/write CPU domains: "
+                          "obj %p target %d offset %d "
+                          "read %08x write %08x",
+                          obj, reloc->target_handle,
+                          (int) reloc->offset,
+                          reloc->read_domains,
+                          reloc->write_domain);
+                return ret;
+        }
+        if (unlikely(reloc->write_domain && target_obj->pending_write_domain &&
+                     reloc->write_domain != target_obj->pending_write_domain)) {
+                DRM_ERROR("Write domain conflict: "
+                          "obj %p target %d offset %d "
+                          "new %08x old %08x\n",
+                          obj, reloc->target_handle,
+                          (int) reloc->offset,
+                          reloc->write_domain,
+                          target_obj->pending_write_domain);
+                return ret;
+        }
+        target_obj->pending_read_domains |= reloc->read_domains;
+        target_obj->pending_write_domain |= reloc->write_domain;
+        /* If the relocation already has the right value in it, no
+         * more work needs to be done.
+         */
+        if (target_offset == reloc->presumed_offset)
+                return 0;
+        /* Check that the relocation address is valid... */
+        if (unlikely(reloc->offset > obj->base.size - 4)) {
+                DRM_ERROR("Relocation beyond object bounds: "
+                          "obj %p target %d offset %d size %d.\n",
+                          obj, reloc->target_handle,
+                          (int) reloc->offset,
+                          (int) obj->base.size);
+                return ret;
+        }
+        if (unlikely(reloc->offset & 3)) {
+                DRM_ERROR("Relocation not 4-byte aligned: "
+                          "obj %p target %d offset %d.\n",
+                          obj, reloc->target_handle,
+                          (int) reloc->offset);
+                return ret;
+        }
+        /* and points to somewhere within the target object. */
+        if (unlikely(reloc->delta >= target_obj->size)) {
+                DRM_ERROR("Relocation beyond target object bounds: "
+                          "obj %p target %d delta %d size %d.\n",
+                          obj, reloc->target_handle,
+                          (int) reloc->delta,
+                          (int) target_obj->size);
+                return ret;
+        }
+        reloc->delta += target_offset;
+        if (obj->base.write_domain == I915_GEM_DOMAIN_CPU) {
+                uint32_t page_offset = reloc->offset & ~PAGE_MASK;
+                char *vaddr;
+                vaddr = kmap_atomic(obj->pages[reloc->offset >> PAGE_SHIFT]);
+                *(uint32_t *)(vaddr + page_offset) = reloc->delta;
+                kunmap_atomic(vaddr);
+        } else {
+                struct drm_i915_private *dev_priv = dev->dev_private;
+                uint32_t __iomem *reloc_entry;
+                void __iomem *reloc_page;
+                ret = i915_gem_object_set_to_gtt_domain(obj, 1);
+                if (ret)
+                        return ret;
+                /* Map the page containing the relocation we're going to perform.  */
+                reloc->offset += obj->gtt_offset;
+                reloc_page = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
+                                                      reloc->offset & PAGE_MASK);
+                reloc_entry = (uint32_t __iomem *)
+                        (reloc_page + (reloc->offset & ~PAGE_MASK));
+                iowrite32(reloc->delta, reloc_entry);
+                io_mapping_unmap_atomic(reloc_page);
+        }
+        /* and update the user's relocation entry */
+        reloc->presumed_offset = target_offset;
+        return 0;
+}
+static int
+i915_gem_execbuffer_relocate_object(struct drm_i915_gem_object *obj,
+                                    struct eb_objects *eb,
+                                    struct drm_i915_gem_exec_object2 *entry)
+{
+        struct drm_i915_gem_relocation_entry __user *user_relocs;
+        int i, ret;
+        user_relocs = (void __user *)(uintptr_t)entry->relocs_ptr;
+        for (i = 0; i < entry->relocation_count; i++) {
+                struct drm_i915_gem_relocation_entry reloc;
+                if (__copy_from_user_inatomic(&reloc,
+                                              user_relocs+i,
+                                              sizeof(reloc)))
+                        return -EFAULT;
+                ret = i915_gem_execbuffer_relocate_entry(obj, eb, entry, &reloc);
+                if (ret)
+                        return ret;
+                if (__copy_to_user_inatomic(&user_relocs[i].presumed_offset,
+                                            &reloc.presumed_offset,
+                                            sizeof(reloc.presumed_offset)))
+                        return -EFAULT;
+        }
+        return 0;
+}
+static int
+i915_gem_execbuffer_relocate_object_slow(struct drm_i915_gem_object *obj,
+                                         struct eb_objects *eb,
+                                         struct drm_i915_gem_exec_object2 *entry,
+                                         struct drm_i915_gem_relocation_entry *relocs)
+{
+        int i, ret;
+        for (i = 0; i < entry->relocation_count; i++) {
+                ret = i915_gem_execbuffer_relocate_entry(obj, eb, entry, &relocs[i]);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
+static int
+i915_gem_execbuffer_relocate(struct drm_device *dev,
+                             struct eb_objects *eb,
+                             struct list_head *objects,
+                             struct drm_i915_gem_exec_object2 *exec)
+{
+        struct drm_i915_gem_object *obj;
+        int ret;
+        list_for_each_entry(obj, objects, exec_list) {
+                obj->base.pending_read_domains = 0;
+                obj->base.pending_write_domain = 0;
+                ret = i915_gem_execbuffer_relocate_object(obj, eb, exec++);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
+static int
+i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
+                            struct drm_file *file,
+                            struct list_head *objects,
+                            struct drm_i915_gem_exec_object2 *exec)
+{
+        struct drm_i915_gem_object *obj;
+        struct drm_i915_gem_exec_object2 *entry;
+        int ret, retry;
+        bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
+        /* Attempt to pin all of the buffers into the GTT.
+         * This is done in 3 phases:
+         *
+         * 1a. Unbind all objects that do not match the GTT constraints for
+         *     the execbuffer (fenceable, mappable, alignment etc).
+         * 1b. Increment pin count for already bound objects.
+         * 2.  Bind new objects.
+         * 3.  Decrement pin count.
+         *
+         * This avoid unnecessary unbinding of later objects in order to makr
+         * room for the earlier objects *unless* we need to defragment.
+         */
+        retry = 0;
+        do {
+                ret = 0;
+                /* Unbind any ill-fitting objects or pin. */
+                entry = exec;
+                list_for_each_entry(obj, objects, exec_list) {
+                        bool need_fence, need_mappable;
+                        if (!obj->gtt_space) {
+                                entry++;
+                                continue;
+                        }
+                        need_fence =
+                                has_fenced_gpu_access &&
+                                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                                obj->tiling_mode != I915_TILING_NONE;
+                        need_mappable =
+                                entry->relocation_count ? true : need_fence;
+                        if ((entry->alignment && obj->gtt_offset & (entry->alignment - 1)) ||
+                            (need_mappable && !obj->map_and_fenceable))
+                                ret = i915_gem_object_unbind(obj);
+                        else
+                                ret = i915_gem_object_pin(obj,
+                                                          entry->alignment,
+                                                          need_mappable);
+                        if (ret)
+                                goto err;
+                        entry++;
+                }
+                /* Bind fresh objects */
+                entry = exec;
+                list_for_each_entry(obj, objects, exec_list) {
+                        bool need_fence;
+                        need_fence =
+                                has_fenced_gpu_access &&
+                                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                                obj->tiling_mode != I915_TILING_NONE;
+                        if (!obj->gtt_space) {
+                                bool need_mappable =
+                                        entry->relocation_count ? true : need_fence;
+                                ret = i915_gem_object_pin(obj,
+                                                          entry->alignment,
+                                                          need_mappable);
+                                if (ret)
+                                        break;
+                        }
+                        if (has_fenced_gpu_access) {
+                                if (need_fence) {
+                                        ret = i915_gem_object_get_fence(obj, ring, 1);
+                                        if (ret)
+                                                break;
+                                } else if (entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                                           obj->tiling_mode == I915_TILING_NONE) {
+                                        /* XXX pipelined! */
+                                        ret = i915_gem_object_put_fence(obj);
+                                        if (ret)
+                                                break;
+                                }
+                                obj->pending_fenced_gpu_access = need_fence;
+                        }
+                        entry->offset = obj->gtt_offset;
+                        entry++;
+                }
+                /* Decrement pin count for bound objects */
+                list_for_each_entry(obj, objects, exec_list) {
+                        if (obj->gtt_space)
+                                i915_gem_object_unpin(obj);
+                }
+                if (ret != -ENOSPC || retry > 1)
+                        return ret;
+                /* First attempt, just clear anything that is purgeable.
+                 * Second attempt, clear the entire GTT.
+                 */
+                ret = i915_gem_evict_everything(ring->dev, retry == 0);
+                if (ret)
+                        return ret;
+                retry++;
+        } while (1);
+err:
+        obj = list_entry(obj->exec_list.prev,
+                         struct drm_i915_gem_object,
+                         exec_list);
+        while (objects != &obj->exec_list) {
+                if (obj->gtt_space)
+                        i915_gem_object_unpin(obj);
+                obj = list_entry(obj->exec_list.prev,
+                                 struct drm_i915_gem_object,
+                                 exec_list);
+        }
+        return ret;
+}
+static int
+i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
+                                  struct drm_file *file,
+                                  struct intel_ring_buffer *ring,
+                                  struct list_head *objects,
+                                  struct eb_objects *eb,
+                                  struct drm_i915_gem_exec_object2 *exec,
+                                  int count)
+{
+        struct drm_i915_gem_relocation_entry *reloc;
+        struct drm_i915_gem_object *obj;
+        int i, total, ret;
+        /* We may process another execbuffer during the unlock... */
+        while (list_empty(objects)) {
+                obj = list_first_entry(objects,
+                                       struct drm_i915_gem_object,
+                                       exec_list);
+                list_del_init(&obj->exec_list);
+                drm_gem_object_unreference(&obj->base);
+        }
+        mutex_unlock(&dev->struct_mutex);
+        total = 0;
+        for (i = 0; i < count; i++)
+                total += exec[i].relocation_count;
+        reloc = drm_malloc_ab(total, sizeof(*reloc));
+        if (reloc == NULL) {
+                mutex_lock(&dev->struct_mutex);
+                return -ENOMEM;
+        }
+        total = 0;
+        for (i = 0; i < count; i++) {
+                struct drm_i915_gem_relocation_entry __user *user_relocs;
+                user_relocs = (void __user *)(uintptr_t)exec[i].relocs_ptr;
+                if (copy_from_user(reloc+total, user_relocs,
+                                   exec[i].relocation_count * sizeof(*reloc))) {
+                        ret = -EFAULT;
+                        mutex_lock(&dev->struct_mutex);
+                        goto err;
+                }
+                total += exec[i].relocation_count;
+        }
+        ret = i915_mutex_lock_interruptible(dev);
+        if (ret) {
+                mutex_lock(&dev->struct_mutex);
+                goto err;
+        }
+        /* reacquire the objects */
+        INIT_LIST_HEAD(objects);
+        eb_reset(eb);
+        for (i = 0; i < count; i++) {
+                struct drm_i915_gem_object *obj;
+                obj = to_intel_bo(drm_gem_object_lookup(dev, file,
+                                                        exec[i].handle));
+                if (obj == NULL) {
+                        DRM_ERROR("Invalid object handle %d at index %d\n",
+                                   exec[i].handle, i);
+                        ret = -ENOENT;
+                        goto err;
+                }
+                list_add_tail(&obj->exec_list, objects);
+                obj->exec_handle = exec[i].handle;
+                eb_add_object(eb, obj);
+        }
+        ret = i915_gem_execbuffer_reserve(ring, file, objects, exec);
+        if (ret)
+                goto err;
+        total = 0;
+        list_for_each_entry(obj, objects, exec_list) {
+                obj->base.pending_read_domains = 0;
+                obj->base.pending_write_domain = 0;
+                ret = i915_gem_execbuffer_relocate_object_slow(obj, eb,
+                                                               exec,
+                                                               reloc + total);
+                if (ret)
+                        goto err;
+                total += exec->relocation_count;
+                exec++;
+        }
+        /* Leave the user relocations as are, this is the painfully slow path,
+         * and we want to avoid the complication of dropping the lock whilst
+         * having buffers reserved in the aperture and so causing spurious
+         * ENOSPC for random operations.
+         */
+err:
+        drm_free_large(reloc);
+        return ret;
+}
+static void
+i915_gem_execbuffer_flush(struct drm_device *dev,
+                          uint32_t invalidate_domains,
+                          uint32_t flush_domains,
+                          uint32_t flush_rings)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        int i;
+        if (flush_domains & I915_GEM_DOMAIN_CPU)
+                intel_gtt_chipset_flush();
+        if ((flush_domains | invalidate_domains) & I915_GEM_GPU_DOMAINS) {
+                for (i = 0; i < I915_NUM_RINGS; i++)
+                        if (flush_rings & (1 << i))
+                                i915_gem_flush_ring(dev, &dev_priv->ring[i],
+                                                    invalidate_domains,
+                                                    flush_domains);
+        }
+}
+static int
+i915_gem_execbuffer_sync_rings(struct drm_i915_gem_object *obj,
+                               struct intel_ring_buffer *to)
+{
+        struct intel_ring_buffer *from = obj->ring;
+        u32 seqno;
+        int ret, idx;
+        if (from == NULL || to == from)
+                return 0;
+        if (INTEL_INFO(obj->base.dev)->gen < 6)
+                return i915_gem_object_wait_rendering(obj, true);
+        idx = intel_ring_sync_index(from, to);
+        seqno = obj->last_rendering_seqno;
+        if (seqno <= from->sync_seqno[idx])
+                return 0;
+        if (seqno == from->outstanding_lazy_request) {
+                struct drm_i915_gem_request *request;
+                request = kzalloc(sizeof(*request), GFP_KERNEL);
+                if (request == NULL)
+                        return -ENOMEM;
+                ret = i915_add_request(obj->base.dev, NULL, request, from);
+                if (ret) {
+                        kfree(request);
+                        return ret;
+                }
+                seqno = request->seqno;
+        }
+        from->sync_seqno[idx] = seqno;
+        return intel_ring_sync(to, from, seqno - 1);
+}
+static int
+i915_gem_execbuffer_move_to_gpu(struct intel_ring_buffer *ring,
+                                struct list_head *objects)
+{
+        struct drm_i915_gem_object *obj;
+        struct change_domains cd;
+        int ret;
+        cd.invalidate_domains = 0;
+        cd.flush_domains = 0;
+        cd.flush_rings = 0;
+        list_for_each_entry(obj, objects, exec_list)
+                i915_gem_object_set_to_gpu_domain(obj, ring, &cd);
+        if (cd.invalidate_domains | cd.flush_domains) {
+#if WATCH_EXEC
+                DRM_INFO("%s: invalidate_domains %08x flush_domains %08x\n",
+                          __func__,
+                         cd.invalidate_domains,
+                         cd.flush_domains);
+#endif
+                i915_gem_execbuffer_flush(ring->dev,
+                                          cd.invalidate_domains,
+                                          cd.flush_domains,
+                                          cd.flush_rings);
+        }
+        list_for_each_entry(obj, objects, exec_list) {
+                ret = i915_gem_execbuffer_sync_rings(obj, ring);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
+static bool
+i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
+{
+        return ((exec->batch_start_offset | exec->batch_len) & 0x7) == 0;
+}
+static int
+validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
+                   int count)
+{
+        int i;
+        for (i = 0; i < count; i++) {
+                char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
+                int length; /* limited by fault_in_pages_readable() */
+                /* First check for malicious input causing overflow */
+                if (exec[i].relocation_count >
+                    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
+                        return -EINVAL;
+                length = exec[i].relocation_count *
+                        sizeof(struct drm_i915_gem_relocation_entry);
+                if (!access_ok(VERIFY_READ, ptr, length))
+                        return -EFAULT;
+                /* we may also need to update the presumed offsets */
+                if (!access_ok(VERIFY_WRITE, ptr, length))
+                        return -EFAULT;
+                if (fault_in_pages_readable(ptr, length))
+                        return -EFAULT;
+        }
+        return 0;
+}
+static int
+i915_gem_execbuffer_wait_for_flips(struct intel_ring_buffer *ring,
+                                   struct list_head *objects)
+{
+        struct drm_i915_gem_object *obj;
+        int flips;
+        /* Check for any pending flips. As we only maintain a flip queue depth
+         * of 1, we can simply insert a WAIT for the next display flip prior
+         * to executing the batch and avoid stalling the CPU.
+         */
+        flips = 0;
+        list_for_each_entry(obj, objects, exec_list) {
+                if (obj->base.write_domain)
+                        flips |= atomic_read(&obj->pending_flip);
+        }
+        if (flips) {
+                int plane, flip_mask, ret;
+                for (plane = 0; flips >> plane; plane++) {
+                        if (((flips >> plane) & 1) == 0)
+                                continue;
+                        if (plane)
+                                flip_mask = MI_WAIT_FOR_PLANE_B_FLIP;
+                        else
+                                flip_mask = MI_WAIT_FOR_PLANE_A_FLIP;
+                        ret = intel_ring_begin(ring, 2);
+                        if (ret)
+                                return ret;
+                        intel_ring_emit(ring, MI_WAIT_FOR_EVENT | flip_mask);
+                        intel_ring_emit(ring, MI_NOOP);
+                        intel_ring_advance(ring);
+                }
+        }
+        return 0;
+}
+static void
+i915_gem_execbuffer_move_to_active(struct list_head *objects,
+                                   struct intel_ring_buffer *ring,
+                                   u32 seqno)
+{
+        struct drm_i915_gem_object *obj;
+        list_for_each_entry(obj, objects, exec_list) {
+                obj->base.read_domains = obj->base.pending_read_domains;
+                obj->base.write_domain = obj->base.pending_write_domain;
+                obj->fenced_gpu_access = obj->pending_fenced_gpu_access;
+                i915_gem_object_move_to_active(obj, ring, seqno);
+                if (obj->base.write_domain) {
+                        obj->dirty = 1;
+                        obj->pending_gpu_write = true;
+                        list_move_tail(&obj->gpu_write_list,
+                                       &ring->gpu_write_list);
+                        intel_mark_busy(ring->dev, obj);
+                }
+                trace_i915_gem_object_change_domain(obj,
+                                                    obj->base.read_domains,
+                                                    obj->base.write_domain);
+        }
+}
+static void
+i915_gem_execbuffer_retire_commands(struct drm_device *dev,
+                                    struct drm_file *file,
+                                    struct intel_ring_buffer *ring)
+{
+        struct drm_i915_gem_request *request;
+        u32 flush_domains;
+        /*
+         * Ensure that the commands in the batch buffer are
+         * finished before the interrupt fires.
+         *
+         * The sampler always gets flushed on i965 (sigh).
+         */
+        flush_domains = 0;
+        if (INTEL_INFO(dev)->gen >= 4)
+                flush_domains |= I915_GEM_DOMAIN_SAMPLER;
+        ring->flush(ring, I915_GEM_DOMAIN_COMMAND, flush_domains);
+        /* Add a breadcrumb for the completion of the batch buffer */
+        request = kzalloc(sizeof(*request), GFP_KERNEL);
+        if (request == NULL || i915_add_request(dev, file, request, ring)) {
+                i915_gem_next_request_seqno(dev, ring);
+                kfree(request);
+        }
+}
+static int
+i915_gem_do_execbuffer(struct drm_device *dev, void *data,
+                       struct drm_file *file,
+                       struct drm_i915_gem_execbuffer2 *args,
+                       struct drm_i915_gem_exec_object2 *exec)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct list_head objects;
+        struct eb_objects *eb;
+        struct drm_i915_gem_object *batch_obj;
+        struct drm_clip_rect *cliprects = NULL;
+        struct intel_ring_buffer *ring;
+        u32 exec_start, exec_len;
+        u32 seqno;
+        int ret, mode, i;
+        if (!i915_gem_check_execbuffer(args)) {
+                DRM_ERROR("execbuf with invalid offset/length\n");
+                return -EINVAL;
+        }
+        ret = validate_exec_list(exec, args->buffer_count);
+        if (ret)
+                return ret;
+#if WATCH_EXEC
+        DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
+                  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
+#endif
+        switch (args->flags & I915_EXEC_RING_MASK) {
+        case I915_EXEC_DEFAULT:
+        case I915_EXEC_RENDER:
+                ring = &dev_priv->ring[RCS];
+                break;
+        case I915_EXEC_BSD:
+                if (!HAS_BSD(dev)) {
+                        DRM_ERROR("execbuf with invalid ring (BSD)\n");
+                        return -EINVAL;
+                }
+                ring = &dev_priv->ring[VCS];
+                break;
+        case I915_EXEC_BLT:
+                if (!HAS_BLT(dev)) {
+                        DRM_ERROR("execbuf with invalid ring (BLT)\n");
+                        return -EINVAL;
+                }
+                ring = &dev_priv->ring[BCS];
+                break;
+        default:
+                DRM_ERROR("execbuf with unknown ring: %d\n",
+                          (int)(args->flags & I915_EXEC_RING_MASK));
+                return -EINVAL;
+        }
+        mode = args->flags & I915_EXEC_CONSTANTS_MASK;
+        switch (mode) {
+        case I915_EXEC_CONSTANTS_REL_GENERAL:
+        case I915_EXEC_CONSTANTS_ABSOLUTE:
+        case I915_EXEC_CONSTANTS_REL_SURFACE:
+                if (ring == &dev_priv->ring[RCS] &&
+                    mode != dev_priv->relative_constants_mode) {
+                        if (INTEL_INFO(dev)->gen < 4)
+                                return -EINVAL;
+                        if (INTEL_INFO(dev)->gen > 5 &&
+                            mode == I915_EXEC_CONSTANTS_REL_SURFACE)
+                                return -EINVAL;
+                        ret = intel_ring_begin(ring, 4);
+                        if (ret)
+                                return ret;
+                        intel_ring_emit(ring, MI_NOOP);
+                        intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
+                        intel_ring_emit(ring, INSTPM);
+                        intel_ring_emit(ring,
+                                        I915_EXEC_CONSTANTS_MASK << 16 | mode);
+                        intel_ring_advance(ring);
+                        dev_priv->relative_constants_mode = mode;
+                }
+                break;
+        default:
+                DRM_ERROR("execbuf with unknown constants: %d\n", mode);
+                return -EINVAL;
+        }
+        if (args->buffer_count < 1) {
+                DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
+                return -EINVAL;
+        }
+        if (args->num_cliprects != 0) {
+                if (ring != &dev_priv->ring[RCS]) {
+                        DRM_ERROR("clip rectangles are only valid with the render ring\n");
+                        return -EINVAL;
+                }
+                cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
+                                    GFP_KERNEL);
+                if (cliprects == NULL) {
+                        ret = -ENOMEM;
+                        goto pre_mutex_err;
+                }
+                if (copy_from_user(cliprects,
+                                     (struct drm_clip_rect __user *)(uintptr_t)
+                                     args->cliprects_ptr,
+                                     sizeof(*cliprects)*args->num_cliprects)) {
+                        ret = -EFAULT;
+                        goto pre_mutex_err;
+                }
+        }
+        ret = i915_mutex_lock_interruptible(dev);
+        if (ret)
+                goto pre_mutex_err;
+        if (dev_priv->mm.suspended) {
+                mutex_unlock(&dev->struct_mutex);
+                ret = -EBUSY;
+                goto pre_mutex_err;
+        }
+        eb = eb_create(args->buffer_count);
+        if (eb == NULL) {
+                mutex_unlock(&dev->struct_mutex);
+                ret = -ENOMEM;
+                goto pre_mutex_err;
+        }
+        /* Look up object handles */
+        INIT_LIST_HEAD(&objects);
+        for (i = 0; i < args->buffer_count; i++) {
+                struct drm_i915_gem_object *obj;
+                obj = to_intel_bo(drm_gem_object_lookup(dev, file,
+                                                        exec[i].handle));
+                if (obj == NULL) {
+                        DRM_ERROR("Invalid object handle %d at index %d\n",
+                                   exec[i].handle, i);
+                        /* prevent error path from reading uninitialized data */
+                        ret = -ENOENT;
+                        goto err;
+                }
+                if (!list_empty(&obj->exec_list)) {
+                        DRM_ERROR("Object %p [handle %d, index %d] appears more than once in object list\n",
+                                   obj, exec[i].handle, i);
+                        ret = -EINVAL;
+                        goto err;
+                }
+                list_add_tail(&obj->exec_list, &objects);
+                obj->exec_handle = exec[i].handle;
+                eb_add_object(eb, obj);
+        }
+        /* Move the objects en-masse into the GTT, evicting if necessary. */
+        ret = i915_gem_execbuffer_reserve(ring, file, &objects, exec);
+        if (ret)
+                goto err;
+        /* The objects are in their final locations, apply the relocations. */
+        ret = i915_gem_execbuffer_relocate(dev, eb, &objects, exec);
+        if (ret) {
+                if (ret == -EFAULT) {
+                        ret = i915_gem_execbuffer_relocate_slow(dev, file, ring,
+                                                                &objects, eb,
+                                                                exec,
+                                                                args->buffer_count);
+                        BUG_ON(!mutex_is_locked(&dev->struct_mutex));
+                }
+                if (ret)
+                        goto err;
+        }
+        /* Set the pending read domains for the batch buffer to COMMAND */
+        batch_obj = list_entry(objects.prev,
+                               struct drm_i915_gem_object,
+                               exec_list);
+        if (batch_obj->base.pending_write_domain) {
+                DRM_ERROR("Attempting to use self-modifying batch buffer\n");
+                ret = -EINVAL;
+                goto err;
+        }
+        batch_obj->base.pending_read_domains |= I915_GEM_DOMAIN_COMMAND;
+        ret = i915_gem_execbuffer_move_to_gpu(ring, &objects);
+        if (ret)
+                goto err;
+        ret = i915_gem_execbuffer_wait_for_flips(ring, &objects);
+        if (ret)
+                goto err;
+        seqno = i915_gem_next_request_seqno(dev, ring);
+        for (i = 0; i < I915_NUM_RINGS-1; i++) {
+                if (seqno < ring->sync_seqno[i]) {
+                        /* The GPU can not handle its semaphore value wrapping,
+                         * so every billion or so execbuffers, we need to stall
+                         * the GPU in order to reset the counters.
+                         */
+                        ret = i915_gpu_idle(dev);
+                        if (ret)
+                                goto err;
+                        BUG_ON(ring->sync_seqno[i]);
+                }
+        }
+        exec_start = batch_obj->gtt_offset + args->batch_start_offset;
+        exec_len = args->batch_len;
+        if (cliprects) {
+                for (i = 0; i < args->num_cliprects; i++) {
+                        ret = i915_emit_box(dev, &cliprects[i],
+                                            args->DR1, args->DR4);
+                        if (ret)
+                                goto err;
+                        ret = ring->dispatch_execbuffer(ring,
+                                                        exec_start, exec_len);
+                        if (ret)
+                                goto err;
+                }
+        } else {
+                ret = ring->dispatch_execbuffer(ring, exec_start, exec_len);
+                if (ret)
+                        goto err;
+        }
+        i915_gem_execbuffer_move_to_active(&objects, ring, seqno);
+        i915_gem_execbuffer_retire_commands(dev, file, ring);
+err:
+        eb_destroy(eb);
+        while (!list_empty(&objects)) {
+                struct drm_i915_gem_object *obj;
+                obj = list_first_entry(&objects,
+                                       struct drm_i915_gem_object,
+                                       exec_list);
+                list_del_init(&obj->exec_list);
+                drm_gem_object_unreference(&obj->base);
+        }
+        mutex_unlock(&dev->struct_mutex);
+pre_mutex_err:
+        kfree(cliprects);
+        return ret;
+}
+/*
+ * Legacy execbuffer just creates an exec2 list from the original exec object
+ * list array and passes it to the real function.
+ */
+int
+i915_gem_execbuffer(struct drm_device *dev, void *data,
+                    struct drm_file *file)
+{
+        struct drm_i915_gem_execbuffer *args = data;
+        struct drm_i915_gem_execbuffer2 exec2;
+        struct drm_i915_gem_exec_object *exec_list = NULL;
+        struct drm_i915_gem_exec_object2 *exec2_list = NULL;
+        int ret, i;
+#if WATCH_EXEC
+        DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
+                  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
+#endif
+        if (args->buffer_count < 1) {
+                DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
+                return -EINVAL;
+        }
+        /* Copy in the exec list from userland */
+        exec_list = drm_malloc_ab(sizeof(*exec_list), args->buffer_count);
+        exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
+        if (exec_list == NULL || exec2_list == NULL) {
+                DRM_ERROR("Failed to allocate exec list for %d buffers\n",
+                          args->buffer_count);
+                drm_free_large(exec_list);
+                drm_free_large(exec2_list);
+                return -ENOMEM;
+        }
+        ret = copy_from_user(exec_list,
+                             (struct drm_i915_relocation_entry __user *)
+                             (uintptr_t) args->buffers_ptr,
+                             sizeof(*exec_list) * args->buffer_count);
+        if (ret != 0) {
+                DRM_ERROR("copy %d exec entries failed %d\n",
+                          args->buffer_count, ret);
+                drm_free_large(exec_list);
+                drm_free_large(exec2_list);
+                return -EFAULT;
+        }
+        for (i = 0; i < args->buffer_count; i++) {
+                exec2_list[i].handle = exec_list[i].handle;
+                exec2_list[i].relocation_count = exec_list[i].relocation_count;
+                exec2_list[i].relocs_ptr = exec_list[i].relocs_ptr;
+                exec2_list[i].alignment = exec_list[i].alignment;
+                exec2_list[i].offset = exec_list[i].offset;
+                if (INTEL_INFO(dev)->gen < 4)
+                        exec2_list[i].flags = EXEC_OBJECT_NEEDS_FENCE;
+                else
+                        exec2_list[i].flags = 0;
+        }
+        exec2.buffers_ptr = args->buffers_ptr;
+        exec2.buffer_count = args->buffer_count;
+        exec2.batch_start_offset = args->batch_start_offset;
+        exec2.batch_len = args->batch_len;
+        exec2.DR1 = args->DR1;
+        exec2.DR4 = args->DR4;
+        exec2.num_cliprects = args->num_cliprects;
+        exec2.cliprects_ptr = args->cliprects_ptr;
+        exec2.flags = I915_EXEC_RENDER;
+        ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
+        if (!ret) {
+                /* Copy the new buffer offsets back to the user's exec list. */
+                for (i = 0; i < args->buffer_count; i++)
+                        exec_list[i].offset = exec2_list[i].offset;
+                /* ... and back out to userspace */
+                ret = copy_to_user((struct drm_i915_relocation_entry __user *)
+                                   (uintptr_t) args->buffers_ptr,
+                                   exec_list,
+                                   sizeof(*exec_list) * args->buffer_count);
+                if (ret) {
+                        ret = -EFAULT;
+                        DRM_ERROR("failed to copy %d exec entries "
+                                  "back to user (%d)\n",
+                                  args->buffer_count, ret);
+                }
+        }
+        drm_free_large(exec_list);
+        drm_free_large(exec2_list);
+        return ret;
+}
+int
+i915_gem_execbuffer2(struct drm_device *dev, void *data,
+                     struct drm_file *file)
+{
+        struct drm_i915_gem_execbuffer2 *args = data;
+        struct drm_i915_gem_exec_object2 *exec2_list = NULL;
+        int ret;
+#if WATCH_EXEC
+        DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
+                  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
+#endif
+        if (args->buffer_count < 1) {
+                DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count);
+                return -EINVAL;
+        }
+        exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
+        if (exec2_list == NULL) {
+                DRM_ERROR("Failed to allocate exec list for %d buffers\n",
+                          args->buffer_count);
+                return -ENOMEM;
+        }
+        ret = copy_from_user(exec2_list,
+                             (struct drm_i915_relocation_entry __user *)
+                             (uintptr_t) args->buffers_ptr,
+                             sizeof(*exec2_list) * args->buffer_count);
+        if (ret != 0) {
+                DRM_ERROR("copy %d exec entries failed %d\n",
+                          args->buffer_count, ret);
+                drm_free_large(exec2_list);
+                return -EFAULT;
+        }
+        ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
+        if (!ret) {
+                /* Copy the new buffer offsets back to the user's exec list. */
+                ret = copy_to_user((struct drm_i915_relocation_entry __user *)
+                                   (uintptr_t) args->buffers_ptr,
+                                   exec2_list,
+                                   sizeof(*exec2_list) * args->buffer_count);
+                if (ret) {
+                        ret = -EFAULT;
+                        DRM_ERROR("failed to copy %d exec entries "
+                                  "back to user (%d)\n",
+                                  args->buffer_count, ret);
+                }
+        }
+        drm_free_large(exec2_list);
+        return ret;
+}
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
new file mode 100644
index 000000000000..86673e77d7cb
--- /dev/null
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -0,0 +1,99 @@
+/*
+ * Copyright © 2010 Daniel Vetter
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ */
+#include "drmP.h"
+#include "drm.h"
+#include "i915_drm.h"
+#include "i915_drv.h"
+#include "i915_trace.h"
+#include "intel_drv.h"
+void i915_gem_restore_gtt_mappings(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj;
+        list_for_each_entry(obj, &dev_priv->mm.gtt_list, gtt_list) {
+                i915_gem_clflush_object(obj);
+                if (dev_priv->mm.gtt->needs_dmar) {
+                        BUG_ON(!obj->sg_list);
+                        intel_gtt_insert_sg_entries(obj->sg_list,
+                                                    obj->num_sg,
+                                                    obj->gtt_space->start
+                                                        >> PAGE_SHIFT,
+                                                    obj->agp_type);
+                } else
+                        intel_gtt_insert_pages(obj->gtt_space->start
+                                                   >> PAGE_SHIFT,
+                                               obj->base.size >> PAGE_SHIFT,
+                                               obj->pages,
+                                               obj->agp_type);
+        }
+        intel_gtt_chipset_flush();
+}
+int i915_gem_gtt_bind_object(struct drm_i915_gem_object *obj)
+{
+        struct drm_device *dev = obj->base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int ret;
+        if (dev_priv->mm.gtt->needs_dmar) {
+                ret = intel_gtt_map_memory(obj->pages,
+                                           obj->base.size >> PAGE_SHIFT,
+                                           &obj->sg_list,
+                                           &obj->num_sg);
+                if (ret != 0)
+                        return ret;
+                intel_gtt_insert_sg_entries(obj->sg_list,
+                                            obj->num_sg,
+                                            obj->gtt_space->start >> PAGE_SHIFT,
+                                            obj->agp_type);
+        } else
+                intel_gtt_insert_pages(obj->gtt_space->start >> PAGE_SHIFT,
+                                       obj->base.size >> PAGE_SHIFT,
+                                       obj->pages,
+                                       obj->agp_type);
+        return 0;
+}
+void i915_gem_gtt_unbind_object(struct drm_i915_gem_object *obj)
+{
+        struct drm_device *dev = obj->base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (dev_priv->mm.gtt->needs_dmar) {
+                intel_gtt_unmap_memory(obj->sg_list, obj->num_sg);
+                obj->sg_list = NULL;
+                obj->num_sg = 0;
+        }
+        intel_gtt_clear_range(obj->gtt_space->start >> PAGE_SHIFT,
+                              obj->base.size >> PAGE_SHIFT);
+}
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index af352de70be1..22a32b9932c5 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -181,7 +181,7 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
 }
 /* Check pitch constriants for all chips & tiling formats */
-bool
+static bool
 i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
 {
        int tile_width;
@@ -232,32 +232,44 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
        return true;
 }
-bool
+/* Is the current GTT allocation valid for the change in tiling? */
-i915_gem_object_fence_offset_ok(struct drm_gem_object *obj, int tiling_mode)
+static bool
+i915_gem_object_fence_ok(struct drm_i915_gem_object *obj, int tiling_mode)
 {
-        struct drm_device *dev = obj->dev;
+        u32 size;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
-        if (obj_priv->gtt_space == NULL)
-                return true;
        if (tiling_mode == I915_TILING_NONE)
                return true;
-        if (INTEL_INFO(dev)->gen >= 4)
+        if (INTEL_INFO(obj->base.dev)->gen >= 4)
                return true;
-        if (obj_priv->gtt_offset & (obj->size - 1))
+        if (INTEL_INFO(obj->base.dev)->gen == 3) {
-                return false;
+                if (obj->gtt_offset & ~I915_FENCE_START_MASK)
-        if (IS_GEN3(dev)) {
-                if (obj_priv->gtt_offset & ~I915_FENCE_START_MASK)
                        return false;
        } else {
-                if (obj_priv->gtt_offset & ~I830_FENCE_START_MASK)
+                if (obj->gtt_offset & ~I830_FENCE_START_MASK)
                        return false;
        }
+        /*
+         * Previous chips need to be aligned to the size of the smallest
+         * fence register that can contain the object.
+         */
+        if (INTEL_INFO(obj->base.dev)->gen == 3)
+                size = 1024*1024;
+        else
+                size = 512*1024;
+        while (size < obj->base.size)
+                size <<= 1;
+        if (obj->gtt_space->size != size)
+                return false;
+        if (obj->gtt_offset & (size - 1))
+                return false;
        return true;
 }
@@ -267,30 +279,29 @@ i915_gem_object_fence_offset_ok(struct drm_gem_object *obj, int tiling_mode)
 */
 int
 i915_gem_set_tiling(struct drm_device *dev, void *data,
-                   struct drm_file *file_priv)
+                   struct drm_file *file)
 {
        struct drm_i915_gem_set_tiling *args = data;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        ret = i915_gem_check_is_wedged(dev);
        if (ret)
                return ret;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL)
                return -ENOENT;
-        obj_priv = to_intel_bo(obj);
-        if (!i915_tiling_ok(dev, args->stride, obj->size, args->tiling_mode)) {
+        if (!i915_tiling_ok(dev,
-                drm_gem_object_unreference_unlocked(obj);
+                            args->stride, obj->base.size, args->tiling_mode)) {
+                drm_gem_object_unreference_unlocked(&obj->base);
                return -EINVAL;
        }
-        if (obj_priv->pin_count) {
+        if (obj->pin_count) {
-                drm_gem_object_unreference_unlocked(obj);
+                drm_gem_object_unreference_unlocked(&obj->base);
                return -EBUSY;
        }
@@ -324,34 +335,28 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
        }
        mutex_lock(&dev->struct_mutex);
-        if (args->tiling_mode != obj_priv->tiling_mode ||
+        if (args->tiling_mode != obj->tiling_mode ||
-            args->stride != obj_priv->stride) {
+            args->stride != obj->stride) {
                /* We need to rebind the object if its current allocation
                 * no longer meets the alignment restrictions for its new
                 * tiling mode. Otherwise we can just leave it alone, but
                 * need to ensure that any fence register is cleared.
                 */
-                if (!i915_gem_object_fence_offset_ok(obj, args->tiling_mode))
+                i915_gem_release_mmap(obj);
-                        ret = i915_gem_object_unbind(obj);
-                else if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
-                        ret = i915_gem_object_put_fence_reg(obj, true);
-                else
-                        i915_gem_release_mmap(obj);
-                if (ret != 0) {
+                obj->map_and_fenceable =
-                        args->tiling_mode = obj_priv->tiling_mode;
+                        obj->gtt_space == NULL ||
-                        args->stride = obj_priv->stride;
+                        (obj->gtt_offset + obj->base.size <= dev_priv->mm.gtt_mappable_end &&
-                        goto err;
+                         i915_gem_object_fence_ok(obj, args->tiling_mode));
-                }
-                obj_priv->tiling_mode = args->tiling_mode;
+                obj->tiling_changed = true;
-                obj_priv->stride = args->stride;
+                obj->tiling_mode = args->tiling_mode;
+                obj->stride = args->stride;
        }
-err:
+        drm_gem_object_unreference(&obj->base);
-        drm_gem_object_unreference(obj);
        mutex_unlock(&dev->struct_mutex);
-        return ret;
+        return 0;
 }
 /**
@@ -359,22 +364,20 @@ err:
 */
 int
 i915_gem_get_tiling(struct drm_device *dev, void *data,
-                   struct drm_file *file_priv)
+                   struct drm_file *file)
 {
        struct drm_i915_gem_get_tiling *args = data;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
-        obj = drm_gem_object_lookup(dev, file_priv, args->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, args->handle));
        if (obj == NULL)
                return -ENOENT;
-        obj_priv = to_intel_bo(obj);
        mutex_lock(&dev->struct_mutex);
-        args->tiling_mode = obj_priv->tiling_mode;
+        args->tiling_mode = obj->tiling_mode;
-        switch (obj_priv->tiling_mode) {
+        switch (obj->tiling_mode) {
        case I915_TILING_X:
                args->swizzle_mode = dev_priv->mm.bit_6_swizzle_x;
                break;
@@ -394,7 +397,7 @@ i915_gem_get_tiling(struct drm_device *dev, void *data,
        if (args->swizzle_mode == I915_BIT_6_SWIZZLE_9_10_17)
                args->swizzle_mode = I915_BIT_6_SWIZZLE_9_10;
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
        mutex_unlock(&dev->struct_mutex);
        return 0;
@@ -424,46 +427,44 @@ i915_gem_swizzle_page(struct page *page)
 }
 void
-i915_gem_object_do_bit_17_swizzle(struct drm_gem_object *obj)
+i915_gem_object_do_bit_17_swizzle(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        int page_count = obj->base.size >> PAGE_SHIFT;
-        int page_count = obj->size >> PAGE_SHIFT;
        int i;
        if (dev_priv->mm.bit_6_swizzle_x != I915_BIT_6_SWIZZLE_9_10_17)
                return;
-        if (obj_priv->bit_17 == NULL)
+        if (obj->bit_17 == NULL)
                return;
        for (i = 0; i < page_count; i++) {
-                char new_bit_17 = page_to_phys(obj_priv->pages[i]) >> 17;
+                char new_bit_17 = page_to_phys(obj->pages[i]) >> 17;
                if ((new_bit_17 & 0x1) !=
-                    (test_bit(i, obj_priv->bit_17) != 0)) {
+                    (test_bit(i, obj->bit_17) != 0)) {
-                        i915_gem_swizzle_page(obj_priv->pages[i]);
+                        i915_gem_swizzle_page(obj->pages[i]);
-                        set_page_dirty(obj_priv->pages[i]);
+                        set_page_dirty(obj->pages[i]);
                }
        }
 }
 void
-i915_gem_object_save_bit_17_swizzle(struct drm_gem_object *obj)
+i915_gem_object_save_bit_17_swizzle(struct drm_i915_gem_object *obj)
 {
-        struct drm_device *dev = obj->dev;
+        struct drm_device *dev = obj->base.dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
+        int page_count = obj->base.size >> PAGE_SHIFT;
-        int page_count = obj->size >> PAGE_SHIFT;
        int i;
        if (dev_priv->mm.bit_6_swizzle_x != I915_BIT_6_SWIZZLE_9_10_17)
                return;
-        if (obj_priv->bit_17 == NULL) {
+        if (obj->bit_17 == NULL) {
-                obj_priv->bit_17 = kmalloc(BITS_TO_LONGS(page_count) *
+                obj->bit_17 = kmalloc(BITS_TO_LONGS(page_count) *
                                           sizeof(long), GFP_KERNEL);
-                if (obj_priv->bit_17 == NULL) {
+                if (obj->bit_17 == NULL) {
                        DRM_ERROR("Failed to allocate memory for bit 17 "
                                  "record\n");
                        return;
@@ -471,9 +472,9 @@ i915_gem_object_save_bit_17_swizzle(struct drm_gem_object *obj)
        }
        for (i = 0; i < page_count; i++) {
-                if (page_to_phys(obj_priv->pages[i]) & (1 << 17))
+                if (page_to_phys(obj->pages[i]) & (1 << 17))
-                        __set_bit(i, obj_priv->bit_17);
+                        __set_bit(i, obj->bit_17);
                else
-                        __clear_bit(i, obj_priv->bit_17);
+                        __clear_bit(i, obj->bit_17);
        }
 }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 729fd0c91d7b..0dadc025b77b 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -67,20 +67,20 @@
 void
 ironlake_enable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
-        if ((dev_priv->gt_irq_mask_reg & mask) != 0) {
+        if ((dev_priv->gt_irq_mask & mask) != 0) {
-                dev_priv->gt_irq_mask_reg &= ~mask;
+                dev_priv->gt_irq_mask &= ~mask;
-                I915_WRITE(GTIMR, dev_priv->gt_irq_mask_reg);
+                I915_WRITE(GTIMR, dev_priv->gt_irq_mask);
-                (void) I915_READ(GTIMR);
+                POSTING_READ(GTIMR);
        }
 }
 void
 ironlake_disable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
-        if ((dev_priv->gt_irq_mask_reg & mask) != mask) {
+        if ((dev_priv->gt_irq_mask & mask) != mask) {
-                dev_priv->gt_irq_mask_reg |= mask;
+                dev_priv->gt_irq_mask |= mask;
-                I915_WRITE(GTIMR, dev_priv->gt_irq_mask_reg);
+                I915_WRITE(GTIMR, dev_priv->gt_irq_mask);
-                (void) I915_READ(GTIMR);
+                POSTING_READ(GTIMR);
        }
 }
@@ -88,40 +88,40 @@ ironlake_disable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
 static void
 ironlake_enable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
-        if ((dev_priv->irq_mask_reg & mask) != 0) {
+        if ((dev_priv->irq_mask & mask) != 0) {
-                dev_priv->irq_mask_reg &= ~mask;
+                dev_priv->irq_mask &= ~mask;
-                I915_WRITE(DEIMR, dev_priv->irq_mask_reg);
+                I915_WRITE(DEIMR, dev_priv->irq_mask);
-                (void) I915_READ(DEIMR);
+                POSTING_READ(DEIMR);
        }
 }
 static inline void
 ironlake_disable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
-        if ((dev_priv->irq_mask_reg & mask) != mask) {
+        if ((dev_priv->irq_mask & mask) != mask) {
-                dev_priv->irq_mask_reg |= mask;
+                dev_priv->irq_mask |= mask;
-                I915_WRITE(DEIMR, dev_priv->irq_mask_reg);
+                I915_WRITE(DEIMR, dev_priv->irq_mask);
-                (void) I915_READ(DEIMR);
+                POSTING_READ(DEIMR);
        }
 }
 void
 i915_enable_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
-        if ((dev_priv->irq_mask_reg & mask) != 0) {
+        if ((dev_priv->irq_mask & mask) != 0) {
-                dev_priv->irq_mask_reg &= ~mask;
+                dev_priv->irq_mask &= ~mask;
-                I915_WRITE(IMR, dev_priv->irq_mask_reg);
+                I915_WRITE(IMR, dev_priv->irq_mask);
-                (void) I915_READ(IMR);
+                POSTING_READ(IMR);
        }
 }
 void
 i915_disable_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
-        if ((dev_priv->irq_mask_reg & mask) != mask) {
+        if ((dev_priv->irq_mask & mask) != mask) {
-                dev_priv->irq_mask_reg |= mask;
+                dev_priv->irq_mask |= mask;
-                I915_WRITE(IMR, dev_priv->irq_mask_reg);
+                I915_WRITE(IMR, dev_priv->irq_mask);
-                (void) I915_READ(IMR);
+                POSTING_READ(IMR);
        }
 }
@@ -144,7 +144,7 @@ i915_enable_pipestat(drm_i915_private_t *dev_priv, int pipe, u32 mask)
                dev_priv->pipestat[pipe] |= mask;
                /* Enable the interrupt, clear any pending status */
                I915_WRITE(reg, dev_priv->pipestat[pipe] | (mask >> 16));
-                (void) I915_READ(reg);
+                POSTING_READ(reg);
        }
 }
@@ -156,16 +156,19 @@ i915_disable_pipestat(drm_i915_private_t *dev_priv, int pipe, u32 mask)
                dev_priv->pipestat[pipe] &= ~mask;
                I915_WRITE(reg, dev_priv->pipestat[pipe]);
-                (void) I915_READ(reg);
+                POSTING_READ(reg);
        }
 }
 /**
 * intel_enable_asle - enable ASLE interrupt for OpRegion
 */
-void intel_enable_asle (struct drm_device *dev)
+void intel_enable_asle(struct drm_device *dev)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        unsigned long irqflags;
+        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
        if (HAS_PCH_SPLIT(dev))
                ironlake_enable_display_irq(dev_priv, DE_GSE);
@@ -176,6 +179,8 @@ void intel_enable_asle (struct drm_device *dev)
                        i915_enable_pipestat(dev_priv, 0,
                                             PIPE_LEGACY_BLC_EVENT_ENABLE);
        }
+        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 /**
@@ -243,6 +248,92 @@ u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
        return I915_READ(reg);
 }
+int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
+                             int *vpos, int *hpos)
+{
+        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        u32 vbl = 0, position = 0;
+        int vbl_start, vbl_end, htotal, vtotal;
+        bool in_vbl = true;
+        int ret = 0;
+        if (!i915_pipe_enabled(dev, pipe)) {
+                DRM_DEBUG_DRIVER("trying to get scanoutpos for disabled "
+                                        "pipe %d\n", pipe);
+                return 0;
+        }
+        /* Get vtotal. */
+        vtotal = 1 + ((I915_READ(VTOTAL(pipe)) >> 16) & 0x1fff);
+        if (INTEL_INFO(dev)->gen >= 4) {
+                /* No obvious pixelcount register. Only query vertical
+                 * scanout position from Display scan line register.
+                 */
+                position = I915_READ(PIPEDSL(pipe));
+                /* Decode into vertical scanout position. Don't have
+                 * horizontal scanout position.
+                 */
+                *vpos = position & 0x1fff;
+                *hpos = 0;
+        } else {
+                /* Have access to pixelcount since start of frame.
+                 * We can split this into vertical and horizontal
+                 * scanout position.
+                 */
+                position = (I915_READ(PIPEFRAMEPIXEL(pipe)) & PIPE_PIXEL_MASK) >> PIPE_PIXEL_SHIFT;
+                htotal = 1 + ((I915_READ(HTOTAL(pipe)) >> 16) & 0x1fff);
+                *vpos = position / htotal;
+                *hpos = position - (*vpos * htotal);
+        }
+        /* Query vblank area. */
+        vbl = I915_READ(VBLANK(pipe));
+        /* Test position against vblank region. */
+        vbl_start = vbl & 0x1fff;
+        vbl_end = (vbl >> 16) & 0x1fff;
+        if ((*vpos < vbl_start) || (*vpos > vbl_end))
+                in_vbl = false;
+        /* Inside "upper part" of vblank area? Apply corrective offset: */
+        if (in_vbl && (*vpos >= vbl_start))
+                *vpos = *vpos - vtotal;
+        /* Readouts valid? */
+        if (vbl > 0)
+                ret |= DRM_SCANOUTPOS_VALID | DRM_SCANOUTPOS_ACCURATE;
+        /* In vblank? */
+        if (in_vbl)
+                ret |= DRM_SCANOUTPOS_INVBL;
+        return ret;
+}
+int i915_get_vblank_timestamp(struct drm_device *dev, int crtc,
+                              int *max_error,
+                              struct timeval *vblank_time,
+                              unsigned flags)
+{
+        struct drm_crtc *drmcrtc;
+        if (crtc < 0 || crtc >= dev->num_crtcs) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return -EINVAL;
+        }
+        /* Get drm_crtc to timestamp: */
+        drmcrtc = intel_get_crtc_for_pipe(dev, crtc);
+        /* Helper routine in DRM core does all the work: */
+        return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
+                                                     vblank_time, flags, drmcrtc);
+}
 /*
 * Handle hotplug events outside the interrupt handler proper.
 */
@@ -297,8 +388,8 @@ static void notify_ring(struct drm_device *dev,
                        struct intel_ring_buffer *ring)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 seqno = ring->get_seqno(dev, ring);
+        u32 seqno = ring->get_seqno(ring);
-        ring->irq_gem_seqno = seqno;
+        ring->irq_seqno = seqno;
        trace_i915_gem_request_complete(dev, seqno);
        wake_up_all(&ring->irq_queue);
        dev_priv->hangcheck_count = 0;
@@ -306,11 +397,49 @@ static void notify_ring(struct drm_device *dev,
                  jiffies + msecs_to_jiffies(DRM_I915_HANGCHECK_PERIOD));
 }
+static void gen6_pm_irq_handler(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        u8 new_delay = dev_priv->cur_delay;
+        u32 pm_iir;
+        pm_iir = I915_READ(GEN6_PMIIR);
+        if (!pm_iir)
+                return;
+        if (pm_iir & GEN6_PM_RP_UP_THRESHOLD) {
+                if (dev_priv->cur_delay != dev_priv->max_delay)
+                        new_delay = dev_priv->cur_delay + 1;
+                if (new_delay > dev_priv->max_delay)
+                        new_delay = dev_priv->max_delay;
+        } else if (pm_iir & (GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT)) {
+                if (dev_priv->cur_delay != dev_priv->min_delay)
+                        new_delay = dev_priv->cur_delay - 1;
+                if (new_delay < dev_priv->min_delay) {
+                        new_delay = dev_priv->min_delay;
+                        I915_WRITE(GEN6_RP_INTERRUPT_LIMITS,
+                                   I915_READ(GEN6_RP_INTERRUPT_LIMITS) |
+                                   ((new_delay << 16) & 0x3f0000));
+                } else {
+                        /* Make sure we continue to get down interrupts
+                         * until we hit the minimum frequency */
+                        I915_WRITE(GEN6_RP_INTERRUPT_LIMITS,
+                                   I915_READ(GEN6_RP_INTERRUPT_LIMITS) & ~0x3f0000);
+                }
+        }
+        gen6_set_rps(dev, new_delay);
+        dev_priv->cur_delay = new_delay;
+        I915_WRITE(GEN6_PMIIR, pm_iir);
+}
 static irqreturn_t ironlake_irq_handler(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        int ret = IRQ_NONE;
-        u32 de_iir, gt_iir, de_ier, pch_iir;
+        u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
        u32 hotplug_mask;
        struct drm_i915_master_private *master_priv;
        u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
@@ -321,13 +450,15 @@ static irqreturn_t ironlake_irq_handler(struct drm_device *dev)
        /* disable master interrupt before clearing iir  */
        de_ier = I915_READ(DEIER);
        I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL);
-        (void)I915_READ(DEIER);
+        POSTING_READ(DEIER);
        de_iir = I915_READ(DEIIR);
        gt_iir = I915_READ(GTIIR);
        pch_iir = I915_READ(SDEIIR);
+        pm_iir = I915_READ(GEN6_PMIIR);
-        if (de_iir == 0 && gt_iir == 0 && pch_iir == 0)
+        if (de_iir == 0 && gt_iir == 0 && pch_iir == 0 &&
+            (!IS_GEN6(dev) || pm_iir == 0))
                goto done;
        if (HAS_PCH_CPT(dev))
@@ -344,12 +475,12 @@ static irqreturn_t ironlake_irq_handler(struct drm_device *dev)
                                READ_BREADCRUMB(dev_priv);
        }
-        if (gt_iir & GT_PIPE_NOTIFY)
+        if (gt_iir & (GT_USER_INTERRUPT | GT_PIPE_NOTIFY))
-                notify_ring(dev, &dev_priv->render_ring);
+                notify_ring(dev, &dev_priv->ring[RCS]);
        if (gt_iir & bsd_usr_interrupt)
-                notify_ring(dev, &dev_priv->bsd_ring);
+                notify_ring(dev, &dev_priv->ring[VCS]);
-        if (HAS_BLT(dev) && gt_iir & GT_BLT_USER_INTERRUPT)
+        if (gt_iir & GT_BLT_USER_INTERRUPT)
-                notify_ring(dev, &dev_priv->blt_ring);
+                notify_ring(dev, &dev_priv->ring[BCS]);
        if (de_iir & DE_GSE)
                intel_opregion_gse_intr(dev);
@@ -379,6 +510,9 @@ static irqreturn_t ironlake_irq_handler(struct drm_device *dev)
                i915_handle_rps_change(dev);
        }
+        if (IS_GEN6(dev))
+                gen6_pm_irq_handler(dev);
        /* should clear PCH hotplug event before clear CPU irq */
        I915_WRITE(SDEIIR, pch_iir);
        I915_WRITE(GTIIR, gt_iir);
@@ -386,7 +520,7 @@ static irqreturn_t ironlake_irq_handler(struct drm_device *dev)
 done:
        I915_WRITE(DEIER, de_ier);
-        (void)I915_READ(DEIER);
+        POSTING_READ(DEIER);
        return ret;
 }
@@ -423,28 +557,23 @@ static void i915_error_work_func(struct work_struct *work)
 #ifdef CONFIG_DEBUG_FS
 static struct drm_i915_error_object *
 i915_error_object_create(struct drm_device *dev,
-                         struct drm_gem_object *src)
+                         struct drm_i915_gem_object *src)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_error_object *dst;
-        struct drm_i915_gem_object *src_priv;
        int page, page_count;
        u32 reloc_offset;
-        if (src == NULL)
+        if (src == NULL || src->pages == NULL)
-                return NULL;
-        src_priv = to_intel_bo(src);
-        if (src_priv->pages == NULL)
                return NULL;
-        page_count = src->size / PAGE_SIZE;
+        page_count = src->base.size / PAGE_SIZE;
        dst = kmalloc(sizeof(*dst) + page_count * sizeof (u32 *), GFP_ATOMIC);
        if (dst == NULL)
                return NULL;
-        reloc_offset = src_priv->gtt_offset;
+        reloc_offset = src->gtt_offset;
        for (page = 0; page < page_count; page++) {
                unsigned long flags;
                void __iomem *s;
@@ -466,7 +595,7 @@ i915_error_object_create(struct drm_device *dev,
                reloc_offset += PAGE_SIZE;
        }
        dst->page_count = page_count;
-        dst->gtt_offset = src_priv->gtt_offset;
+        dst->gtt_offset = src->gtt_offset;
        return dst;
@@ -520,36 +649,96 @@ i915_get_bbaddr(struct drm_device *dev, u32 *ring)
 }
 static u32
-i915_ringbuffer_last_batch(struct drm_device *dev)
+i915_ringbuffer_last_batch(struct drm_device *dev,
+                           struct intel_ring_buffer *ring)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 head, bbaddr;
-        u32 *ring;
+        u32 *val;
        /* Locate the current position in the ringbuffer and walk back
         * to find the most recently dispatched batch buffer.
         */
-        bbaddr = 0;
+        head = I915_READ_HEAD(ring) & HEAD_ADDR;
-        head = I915_READ(PRB0_HEAD) & HEAD_ADDR;
-        ring = (u32 *)(dev_priv->render_ring.virtual_start + head);
-        while (--ring >= (u32 *)dev_priv->render_ring.virtual_start) {
+        val = (u32 *)(ring->virtual_start + head);
-                bbaddr = i915_get_bbaddr(dev, ring);
+        while (--val >= (u32 *)ring->virtual_start) {
+                bbaddr = i915_get_bbaddr(dev, val);
                if (bbaddr)
-                        break;
+                        return bbaddr;
        }
-        if (bbaddr == 0) {
+        val = (u32 *)(ring->virtual_start + ring->size);
-                ring = (u32 *)(dev_priv->render_ring.virtual_start
+        while (--val >= (u32 *)ring->virtual_start) {
-                                + dev_priv->render_ring.size);
+                bbaddr = i915_get_bbaddr(dev, val);
-                while (--ring >= (u32 *)dev_priv->render_ring.virtual_start) {
+                if (bbaddr)
-                        bbaddr = i915_get_bbaddr(dev, ring);
+                        return bbaddr;
-                        if (bbaddr)
-                                break;
-                }
        }
-        return bbaddr;
+        return 0;
+}
+static u32 capture_bo_list(struct drm_i915_error_buffer *err,
+                           int count,
+                           struct list_head *head)
+{
+        struct drm_i915_gem_object *obj;
+        int i = 0;
+        list_for_each_entry(obj, head, mm_list) {
+                err->size = obj->base.size;
+                err->name = obj->base.name;
+                err->seqno = obj->last_rendering_seqno;
+                err->gtt_offset = obj->gtt_offset;
+                err->read_domains = obj->base.read_domains;
+                err->write_domain = obj->base.write_domain;
+                err->fence_reg = obj->fence_reg;
+                err->pinned = 0;
+                if (obj->pin_count > 0)
+                        err->pinned = 1;
+                if (obj->user_pin_count > 0)
+                        err->pinned = -1;
+                err->tiling = obj->tiling_mode;
+                err->dirty = obj->dirty;
+                err->purgeable = obj->madv != I915_MADV_WILLNEED;
+                err->ring = obj->ring ? obj->ring->id : 0;
+                if (++i == count)
+                        break;
+                err++;
+        }
+        return i;
+}
+static void i915_gem_record_fences(struct drm_device *dev,
+                                   struct drm_i915_error_state *error)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int i;
+        /* Fences */
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        error->fence[i] = I915_READ64(FENCE_REG_SANDYBRIDGE_0 + (i * 8));
+                break;
+        case 5:
+        case 4:
+                for (i = 0; i < 16; i++)
+                        error->fence[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
+                break;
+        case 3:
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                error->fence[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        case 2:
+                for (i = 0; i < 8; i++)
+                        error->fence[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+                break;
+        }
 }
 /**
@@ -564,9 +753,9 @@ i915_ringbuffer_last_batch(struct drm_device *dev)
 static void i915_capture_error_state(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        struct drm_i915_error_state *error;
-        struct drm_gem_object *batchbuffer[2];
+        struct drm_i915_gem_object *batchbuffer[2];
        unsigned long flags;
        u32 bbaddr;
        int count;
@@ -585,20 +774,33 @@ static void i915_capture_error_state(struct drm_device *dev)
        DRM_DEBUG_DRIVER("generating error event\n");
-        error->seqno =
+        error->seqno = dev_priv->ring[RCS].get_seqno(&dev_priv->ring[RCS]);
-                dev_priv->render_ring.get_seqno(dev, &dev_priv->render_ring);
        error->eir = I915_READ(EIR);
        error->pgtbl_er = I915_READ(PGTBL_ER);
        error->pipeastat = I915_READ(PIPEASTAT);
        error->pipebstat = I915_READ(PIPEBSTAT);
        error->instpm = I915_READ(INSTPM);
-        if (INTEL_INFO(dev)->gen < 4) {
+        error->error = 0;
-                error->ipeir = I915_READ(IPEIR);
+        if (INTEL_INFO(dev)->gen >= 6) {
-                error->ipehr = I915_READ(IPEHR);
+                error->error = I915_READ(ERROR_GEN6);
-                error->instdone = I915_READ(INSTDONE);
-                error->acthd = I915_READ(ACTHD);
+                error->bcs_acthd = I915_READ(BCS_ACTHD);
-                error->bbaddr = 0;
+                error->bcs_ipehr = I915_READ(BCS_IPEHR);
-        } else {
+                error->bcs_ipeir = I915_READ(BCS_IPEIR);
+                error->bcs_instdone = I915_READ(BCS_INSTDONE);
+                error->bcs_seqno = 0;
+                if (dev_priv->ring[BCS].get_seqno)
+                        error->bcs_seqno = dev_priv->ring[BCS].get_seqno(&dev_priv->ring[BCS]);
+                error->vcs_acthd = I915_READ(VCS_ACTHD);
+                error->vcs_ipehr = I915_READ(VCS_IPEHR);
+                error->vcs_ipeir = I915_READ(VCS_IPEIR);
+                error->vcs_instdone = I915_READ(VCS_INSTDONE);
+                error->vcs_seqno = 0;
+                if (dev_priv->ring[VCS].get_seqno)
+                        error->vcs_seqno = dev_priv->ring[VCS].get_seqno(&dev_priv->ring[VCS]);
+        }
+        if (INTEL_INFO(dev)->gen >= 4) {
                error->ipeir = I915_READ(IPEIR_I965);
                error->ipehr = I915_READ(IPEHR_I965);
                error->instdone = I915_READ(INSTDONE_I965);
@@ -606,42 +808,45 @@ static void i915_capture_error_state(struct drm_device *dev)
                error->instdone1 = I915_READ(INSTDONE1);
                error->acthd = I915_READ(ACTHD_I965);
                error->bbaddr = I915_READ64(BB_ADDR);
+        } else {
+                error->ipeir = I915_READ(IPEIR);
+                error->ipehr = I915_READ(IPEHR);
+                error->instdone = I915_READ(INSTDONE);
+                error->acthd = I915_READ(ACTHD);
+                error->bbaddr = 0;
        }
+        i915_gem_record_fences(dev, error);
-        bbaddr = i915_ringbuffer_last_batch(dev);
+        bbaddr = i915_ringbuffer_last_batch(dev, &dev_priv->ring[RCS]);
        /* Grab the current batchbuffer, most likely to have crashed. */
        batchbuffer[0] = NULL;
        batchbuffer[1] = NULL;
        count = 0;
-        list_for_each_entry(obj_priv, &dev_priv->mm.active_list, mm_list) {
+        list_for_each_entry(obj, &dev_priv->mm.active_list, mm_list) {
-                struct drm_gem_object *obj = &obj_priv->base;
                if (batchbuffer[0] == NULL &&
-                    bbaddr >= obj_priv->gtt_offset &&
+                    bbaddr >= obj->gtt_offset &&
-                    bbaddr < obj_priv->gtt_offset + obj->size)
+                    bbaddr < obj->gtt_offset + obj->base.size)
                        batchbuffer[0] = obj;
                if (batchbuffer[1] == NULL &&
-                    error->acthd >= obj_priv->gtt_offset &&
+                    error->acthd >= obj->gtt_offset &&
-                    error->acthd < obj_priv->gtt_offset + obj->size)
+                    error->acthd < obj->gtt_offset + obj->base.size)
                        batchbuffer[1] = obj;
                count++;
        }
        /* Scan the other lists for completeness for those bizarre errors. */
        if (batchbuffer[0] == NULL || batchbuffer[1] == NULL) {
-                list_for_each_entry(obj_priv, &dev_priv->mm.flushing_list, mm_list) {
+                list_for_each_entry(obj, &dev_priv->mm.flushing_list, mm_list) {
-                        struct drm_gem_object *obj = &obj_priv->base;
                        if (batchbuffer[0] == NULL &&
-                            bbaddr >= obj_priv->gtt_offset &&
+                            bbaddr >= obj->gtt_offset &&
-                            bbaddr < obj_priv->gtt_offset + obj->size)
+                            bbaddr < obj->gtt_offset + obj->base.size)
                                batchbuffer[0] = obj;
                        if (batchbuffer[1] == NULL &&
-                            error->acthd >= obj_priv->gtt_offset &&
+                            error->acthd >= obj->gtt_offset &&
-                            error->acthd < obj_priv->gtt_offset + obj->size)
+                            error->acthd < obj->gtt_offset + obj->base.size)
                                batchbuffer[1] = obj;
                        if (batchbuffer[0] && batchbuffer[1])
@@ -649,17 +854,15 @@ static void i915_capture_error_state(struct drm_device *dev)
                }
        }
        if (batchbuffer[0] == NULL || batchbuffer[1] == NULL) {
-                list_for_each_entry(obj_priv, &dev_priv->mm.inactive_list, mm_list) {
+                list_for_each_entry(obj, &dev_priv->mm.inactive_list, mm_list) {
-                        struct drm_gem_object *obj = &obj_priv->base;
                        if (batchbuffer[0] == NULL &&
-                            bbaddr >= obj_priv->gtt_offset &&
+                            bbaddr >= obj->gtt_offset &&
-                            bbaddr < obj_priv->gtt_offset + obj->size)
+                            bbaddr < obj->gtt_offset + obj->base.size)
                                batchbuffer[0] = obj;
                        if (batchbuffer[1] == NULL &&
-                            error->acthd >= obj_priv->gtt_offset &&
+                            error->acthd >= obj->gtt_offset &&
-                            error->acthd < obj_priv->gtt_offset + obj->size)
+                            error->acthd < obj->gtt_offset + obj->base.size)
                                batchbuffer[1] = obj;
                        if (batchbuffer[0] && batchbuffer[1])
@@ -678,46 +881,41 @@ static void i915_capture_error_state(struct drm_device *dev)
        /* Record the ringbuffer */
        error->ringbuffer = i915_error_object_create(dev,
-                        dev_priv->render_ring.gem_object);
+                                                     dev_priv->ring[RCS].obj);
-        /* Record buffers on the active list. */
+        /* Record buffers on the active and pinned lists. */
        error->active_bo = NULL;
-        error->active_bo_count = 0;
+        error->pinned_bo = NULL;
-        if (count)
+        error->active_bo_count = count;
+        list_for_each_entry(obj, &dev_priv->mm.pinned_list, mm_list)
+                count++;
+        error->pinned_bo_count = count - error->active_bo_count;
+        if (count) {
                error->active_bo = kmalloc(sizeof(*error->active_bo)*count,
                                           GFP_ATOMIC);
+                if (error->active_bo)
-        if (error->active_bo) {
+                        error->pinned_bo =
-                int i = 0;
+                                error->active_bo + error->active_bo_count;
-                list_for_each_entry(obj_priv, &dev_priv->mm.active_list, mm_list) {
-                        struct drm_gem_object *obj = &obj_priv->base;
-                        error->active_bo[i].size = obj->size;
-                        error->active_bo[i].name = obj->name;
-                        error->active_bo[i].seqno = obj_priv->last_rendering_seqno;
-                        error->active_bo[i].gtt_offset = obj_priv->gtt_offset;
-                        error->active_bo[i].read_domains = obj->read_domains;
-                        error->active_bo[i].write_domain = obj->write_domain;
-                        error->active_bo[i].fence_reg = obj_priv->fence_reg;
-                        error->active_bo[i].pinned = 0;
-                        if (obj_priv->pin_count > 0)
-                                error->active_bo[i].pinned = 1;
-                        if (obj_priv->user_pin_count > 0)
-                                error->active_bo[i].pinned = -1;
-                        error->active_bo[i].tiling = obj_priv->tiling_mode;
-                        error->active_bo[i].dirty = obj_priv->dirty;
-                        error->active_bo[i].purgeable = obj_priv->madv != I915_MADV_WILLNEED;
-                        if (++i == count)
-                                break;
-                }
-                error->active_bo_count = i;
        }
+        if (error->active_bo)
+                error->active_bo_count =
+                        capture_bo_list(error->active_bo,
+                                        error->active_bo_count,
+                                        &dev_priv->mm.active_list);
+        if (error->pinned_bo)
+                error->pinned_bo_count =
+                        capture_bo_list(error->pinned_bo,
+                                        error->pinned_bo_count,
+                                        &dev_priv->mm.pinned_list);
        do_gettimeofday(&error->time);
        error->overlay = intel_overlay_capture_error_state(dev);
+        error->display = intel_display_capture_error_state(dev);
        spin_lock_irqsave(&dev_priv->error_lock, flags);
        if (dev_priv->first_error == NULL) {
@@ -775,7 +973,7 @@ static void i915_report_and_clear_eir(struct drm_device *dev)
                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
                               I915_READ(ACTHD_I965));
                        I915_WRITE(IPEIR_I965, ipeir);
-                        (void)I915_READ(IPEIR_I965);
+                        POSTING_READ(IPEIR_I965);
                }
                if (eir & GM45_ERROR_PAGE_TABLE) {
                        u32 pgtbl_err = I915_READ(PGTBL_ER);
@@ -783,7 +981,7 @@ static void i915_report_and_clear_eir(struct drm_device *dev)
                        printk(KERN_ERR "  PGTBL_ER: 0x%08x\n",
                               pgtbl_err);
                        I915_WRITE(PGTBL_ER, pgtbl_err);
-                        (void)I915_READ(PGTBL_ER);
+                        POSTING_READ(PGTBL_ER);
                }
        }
@@ -794,7 +992,7 @@ static void i915_report_and_clear_eir(struct drm_device *dev)
                        printk(KERN_ERR "  PGTBL_ER: 0x%08x\n",
                               pgtbl_err);
                        I915_WRITE(PGTBL_ER, pgtbl_err);
-                        (void)I915_READ(PGTBL_ER);
+                        POSTING_READ(PGTBL_ER);
                }
        }
@@ -825,7 +1023,7 @@ static void i915_report_and_clear_eir(struct drm_device *dev)
                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
                               I915_READ(ACTHD));
                        I915_WRITE(IPEIR, ipeir);
-                        (void)I915_READ(IPEIR);
+                        POSTING_READ(IPEIR);
                } else {
                        u32 ipeir = I915_READ(IPEIR_I965);
@@ -842,12 +1040,12 @@ static void i915_report_and_clear_eir(struct drm_device *dev)
                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
                               I915_READ(ACTHD_I965));
                        I915_WRITE(IPEIR_I965, ipeir);
-                        (void)I915_READ(IPEIR_I965);
+                        POSTING_READ(IPEIR_I965);
                }
        }
        I915_WRITE(EIR, eir);
-        (void)I915_READ(EIR);
+        POSTING_READ(EIR);
        eir = I915_READ(EIR);
        if (eir) {
                /*
@@ -870,7 +1068,7 @@ static void i915_report_and_clear_eir(struct drm_device *dev)
 * so userspace knows something bad happened (should trigger collection
 * of a ring dump etc.).
 */
-static void i915_handle_error(struct drm_device *dev, bool wedged)
+void i915_handle_error(struct drm_device *dev, bool wedged)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -884,11 +1082,11 @@ static void i915_handle_error(struct drm_device *dev, bool wedged)
                /*
                 * Wakeup waiting processes so they don't hang
                 */
-                wake_up_all(&dev_priv->render_ring.irq_queue);
+                wake_up_all(&dev_priv->ring[RCS].irq_queue);
                if (HAS_BSD(dev))
-                        wake_up_all(&dev_priv->bsd_ring.irq_queue);
+                        wake_up_all(&dev_priv->ring[VCS].irq_queue);
                if (HAS_BLT(dev))
-                        wake_up_all(&dev_priv->blt_ring.irq_queue);
+                        wake_up_all(&dev_priv->ring[BCS].irq_queue);
        }
        queue_work(dev_priv->wq, &dev_priv->error_work);
@@ -899,7 +1097,7 @@ static void i915_pageflip_stall_check(struct drm_device *dev, int pipe)
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        struct intel_unpin_work *work;
        unsigned long flags;
        bool stall_detected;
@@ -918,13 +1116,13 @@ static void i915_pageflip_stall_check(struct drm_device *dev, int pipe)
        }
        /* Potential stall - if we see that the flip has happened, assume a missed interrupt */
-        obj_priv = to_intel_bo(work->pending_flip_obj);
+        obj = work->pending_flip_obj;
        if (INTEL_INFO(dev)->gen >= 4) {
                int dspsurf = intel_crtc->plane == 0 ? DSPASURF : DSPBSURF;
-                stall_detected = I915_READ(dspsurf) == obj_priv->gtt_offset;
+                stall_detected = I915_READ(dspsurf) == obj->gtt_offset;
        } else {
                int dspaddr = intel_crtc->plane == 0 ? DSPAADDR : DSPBADDR;
-                stall_detected = I915_READ(dspaddr) == (obj_priv->gtt_offset +
+                stall_detected = I915_READ(dspaddr) == (obj->gtt_offset +
                                                        crtc->y * crtc->fb->pitch +
                                                        crtc->x * crtc->fb->bits_per_pixel/8);
        }
@@ -970,7 +1168,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                 * It doesn't set the bit in iir again, but it still produces
                 * interrupts (for non-MSI).
                 */
-                spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+                spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
                pipea_stats = I915_READ(PIPEASTAT);
                pipeb_stats = I915_READ(PIPEBSTAT);
@@ -993,7 +1191,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                        I915_WRITE(PIPEBSTAT, pipeb_stats);
                        irq_received = 1;
                }
-                spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+                spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
                if (!irq_received)
                        break;
@@ -1026,9 +1224,9 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                }
                if (iir & I915_USER_INTERRUPT)
-                        notify_ring(dev, &dev_priv->render_ring);
+                        notify_ring(dev, &dev_priv->ring[RCS]);
-                if (HAS_BSD(dev) && (iir & I915_BSD_USER_INTERRUPT))
+                if (iir & I915_BSD_USER_INTERRUPT)
-                        notify_ring(dev, &dev_priv->bsd_ring);
+                        notify_ring(dev, &dev_priv->ring[VCS]);
                if (iir & I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT) {
                        intel_prepare_page_flip(dev, 0);
@@ -1101,12 +1299,13 @@ static int i915_emit_irq(struct drm_device * dev)
        if (master_priv->sarea_priv)
                master_priv->sarea_priv->last_enqueue = dev_priv->counter;
-        BEGIN_LP_RING(4);
+        if (BEGIN_LP_RING(4) == 0) {
-        OUT_RING(MI_STORE_DWORD_INDEX);
+                OUT_RING(MI_STORE_DWORD_INDEX);
-        OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+                OUT_RING(I915_BREADCRUMB_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-        OUT_RING(dev_priv->counter);
+                OUT_RING(dev_priv->counter);
-        OUT_RING(MI_USER_INTERRUPT);
+                OUT_RING(MI_USER_INTERRUPT);
-        ADVANCE_LP_RING();
+                ADVANCE_LP_RING();
+        }
        return dev_priv->counter;
 }
@@ -1114,12 +1313,11 @@ static int i915_emit_irq(struct drm_device * dev)
 void i915_trace_irq_get(struct drm_device *dev, u32 seqno)
 {
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-        struct intel_ring_buffer *render_ring = &dev_priv->render_ring;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
-        if (dev_priv->trace_irq_seqno == 0)
+        if (dev_priv->trace_irq_seqno == 0 &&
-                render_ring->user_irq_get(dev, render_ring);
+            ring->irq_get(ring))
+                dev_priv->trace_irq_seqno = seqno;
-        dev_priv->trace_irq_seqno = seqno;
 }
 static int i915_wait_irq(struct drm_device * dev, int irq_nr)
@@ -1127,7 +1325,7 @@ static int i915_wait_irq(struct drm_device * dev, int irq_nr)
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
        int ret = 0;
-        struct intel_ring_buffer *render_ring = &dev_priv->render_ring;
+        struct intel_ring_buffer *ring = LP_RING(dev_priv);
        DRM_DEBUG_DRIVER("irq_nr=%d breadcrumb=%d\n", irq_nr,
                  READ_BREADCRUMB(dev_priv));
@@ -1141,10 +1339,12 @@ static int i915_wait_irq(struct drm_device * dev, int irq_nr)
        if (master_priv->sarea_priv)
                master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
-        render_ring->user_irq_get(dev, render_ring);
+        ret = -ENODEV;
-        DRM_WAIT_ON(ret, dev_priv->render_ring.irq_queue, 3 * DRM_HZ,
+        if (ring->irq_get(ring)) {
-                    READ_BREADCRUMB(dev_priv) >= irq_nr);
+                DRM_WAIT_ON(ret, ring->irq_queue, 3 * DRM_HZ,
-        render_ring->user_irq_put(dev, render_ring);
+                            READ_BREADCRUMB(dev_priv) >= irq_nr);
+                ring->irq_put(ring);
+        }
        if (ret == -EBUSY) {
                DRM_ERROR("EBUSY -- rec: %d emitted: %d\n",
@@ -1163,7 +1363,7 @@ int i915_irq_emit(struct drm_device *dev, void *data,
        drm_i915_irq_emit_t *emit = data;
        int result;
-        if (!dev_priv || !dev_priv->render_ring.virtual_start) {
+        if (!dev_priv || !LP_RING(dev_priv)->virtual_start) {
                DRM_ERROR("called with no initialization\n");
                return -EINVAL;
        }
@@ -1209,9 +1409,9 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
        if (!i915_pipe_enabled(dev, pipe))
                return -EINVAL;
-        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
        if (HAS_PCH_SPLIT(dev))
-                ironlake_enable_display_irq(dev_priv, (pipe == 0) ? 
+                ironlake_enable_display_irq(dev_priv, (pipe == 0) ?
                                            DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
        else if (INTEL_INFO(dev)->gen >= 4)
                i915_enable_pipestat(dev_priv, pipe,
@@ -1219,7 +1419,7 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
        else
                i915_enable_pipestat(dev_priv, pipe,
                                     PIPE_VBLANK_INTERRUPT_ENABLE);
-        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
        return 0;
 }
@@ -1231,15 +1431,15 @@ void i915_disable_vblank(struct drm_device *dev, int pipe)
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        unsigned long irqflags;
-        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
        if (HAS_PCH_SPLIT(dev))
-                ironlake_disable_display_irq(dev_priv, (pipe == 0) ? 
+                ironlake_disable_display_irq(dev_priv, (pipe == 0) ?
                                             DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
        else
                i915_disable_pipestat(dev_priv, pipe,
                                      PIPE_VBLANK_INTERRUPT_ENABLE |
                                      PIPE_START_VBLANK_INTERRUPT_ENABLE);
-        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 void i915_enable_interrupt (struct drm_device *dev)
@@ -1306,12 +1506,50 @@ int i915_vblank_swap(struct drm_device *dev, void *data,
        return -EINVAL;
 }
-static struct drm_i915_gem_request *
+static u32
-i915_get_tail_request(struct drm_device *dev)
+ring_last_seqno(struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        return list_entry(ring->request_list.prev,
-        return list_entry(dev_priv->render_ring.request_list.prev,
+                          struct drm_i915_gem_request, list)->seqno;
-                        struct drm_i915_gem_request, list);
+}
+static bool i915_hangcheck_ring_idle(struct intel_ring_buffer *ring, bool *err)
+{
+        if (list_empty(&ring->request_list) ||
+            i915_seqno_passed(ring->get_seqno(ring), ring_last_seqno(ring))) {
+                /* Issue a wake-up to catch stuck h/w. */
+                if (ring->waiting_seqno && waitqueue_active(&ring->irq_queue)) {
+                        DRM_ERROR("Hangcheck timer elapsed... %s idle [waiting on %d, at %d], missed IRQ?\n",
+                                  ring->name,
+                                  ring->waiting_seqno,
+                                  ring->get_seqno(ring));
+                        wake_up_all(&ring->irq_queue);
+                        *err = true;
+                }
+                return true;
+        }
+        return false;
+}
+static bool kick_ring(struct intel_ring_buffer *ring)
+{
+        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 tmp = I915_READ_CTL(ring);
+        if (tmp & RING_WAIT) {
+                DRM_ERROR("Kicking stuck wait on %s\n",
+                          ring->name);
+                I915_WRITE_CTL(ring, tmp);
+                return true;
+        }
+        if (IS_GEN6(dev) &&
+            (tmp & RING_WAIT_SEMAPHORE)) {
+                DRM_ERROR("Kicking stuck semaphore on %s\n",
+                          ring->name);
+                I915_WRITE_CTL(ring, tmp);
+                return true;
+        }
+        return false;
 }
 /**
@@ -1325,6 +1563,17 @@ void i915_hangcheck_elapsed(unsigned long data)
        struct drm_device *dev = (struct drm_device *)data;
        drm_i915_private_t *dev_priv = dev->dev_private;
        uint32_t acthd, instdone, instdone1;
+        bool err = false;
+        /* If all work is done then ACTHD clearly hasn't advanced. */
+        if (i915_hangcheck_ring_idle(&dev_priv->ring[RCS], &err) &&
+            i915_hangcheck_ring_idle(&dev_priv->ring[VCS], &err) &&
+            i915_hangcheck_ring_idle(&dev_priv->ring[BCS], &err)) {
+                dev_priv->hangcheck_count = 0;
+                if (err)
+                        goto repeat;
+                return;
+        }
        if (INTEL_INFO(dev)->gen < 4) {
                acthd = I915_READ(ACTHD);
@@ -1336,38 +1585,6 @@ void i915_hangcheck_elapsed(unsigned long data)
                instdone1 = I915_READ(INSTDONE1);
        }
-        /* If all work is done then ACTHD clearly hasn't advanced. */
-        if (list_empty(&dev_priv->render_ring.request_list) ||
-                i915_seqno_passed(dev_priv->render_ring.get_seqno(dev, &dev_priv->render_ring),
-                                  i915_get_tail_request(dev)->seqno)) {
-                bool missed_wakeup = false;
-                dev_priv->hangcheck_count = 0;
-                /* Issue a wake-up to catch stuck h/w. */
-                if (dev_priv->render_ring.waiting_gem_seqno &&
-                    waitqueue_active(&dev_priv->render_ring.irq_queue)) {
-                        wake_up_all(&dev_priv->render_ring.irq_queue);
-                        missed_wakeup = true;
-                }
-                if (dev_priv->bsd_ring.waiting_gem_seqno &&
-                    waitqueue_active(&dev_priv->bsd_ring.irq_queue)) {
-                        wake_up_all(&dev_priv->bsd_ring.irq_queue);
-                        missed_wakeup = true;
-                }
-                if (dev_priv->blt_ring.waiting_gem_seqno &&
-                    waitqueue_active(&dev_priv->blt_ring.irq_queue)) {
-                        wake_up_all(&dev_priv->blt_ring.irq_queue);
-                        missed_wakeup = true;
-                }
-                if (missed_wakeup)
-                        DRM_ERROR("Hangcheck timer elapsed... GPU idle, missed IRQ.\n");
-                return;
-        }
        if (dev_priv->last_acthd == acthd &&
            dev_priv->last_instdone == instdone &&
            dev_priv->last_instdone1 == instdone1) {
@@ -1380,12 +1597,17 @@ void i915_hangcheck_elapsed(unsigned long data)
                                 * and break the hang. This should work on
                                 * all but the second generation chipsets.
                                 */
-                                u32 tmp = I915_READ(PRB0_CTL);
-                                if (tmp & RING_WAIT) {
+                                if (kick_ring(&dev_priv->ring[RCS]))
-                                        I915_WRITE(PRB0_CTL, tmp);
+                                        goto repeat;
-                                        POSTING_READ(PRB0_CTL);
-                                        goto out;
+                                if (HAS_BSD(dev) &&
-                                }
+                                    kick_ring(&dev_priv->ring[VCS]))
+                                        goto repeat;
+                                if (HAS_BLT(dev) &&
+                                    kick_ring(&dev_priv->ring[BCS]))
+                                        goto repeat;
                        }
                        i915_handle_error(dev, true);
@@ -1399,7 +1621,7 @@ void i915_hangcheck_elapsed(unsigned long data)
                dev_priv->last_instdone1 = instdone1;
        }
-out:
+repeat:
        /* Reset timer case chip hangs without another request being added */
        mod_timer(&dev_priv->hangcheck_timer,
                  jiffies + msecs_to_jiffies(DRM_I915_HANGCHECK_PERIOD));
@@ -1417,17 +1639,17 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
        I915_WRITE(DEIMR, 0xffffffff);
        I915_WRITE(DEIER, 0x0);
-        (void) I915_READ(DEIER);
+        POSTING_READ(DEIER);
        /* and GT */
        I915_WRITE(GTIMR, 0xffffffff);
        I915_WRITE(GTIER, 0x0);
-        (void) I915_READ(GTIER);
+        POSTING_READ(GTIER);
        /* south display irq */
        I915_WRITE(SDEIMR, 0xffffffff);
        I915_WRITE(SDEIER, 0x0);
-        (void) I915_READ(SDEIER);
+        POSTING_READ(SDEIER);
 }
 static int ironlake_irq_postinstall(struct drm_device *dev)
@@ -1436,38 +1658,39 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
        /* enable kind of interrupts always enabled */
        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
                           DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
-        u32 render_mask = GT_PIPE_NOTIFY | GT_BSD_USER_INTERRUPT;
+        u32 render_irqs;
        u32 hotplug_mask;
-        dev_priv->irq_mask_reg = ~display_mask;
+        dev_priv->irq_mask = ~display_mask;
-        dev_priv->de_irq_enable_reg = display_mask | DE_PIPEA_VBLANK | DE_PIPEB_VBLANK;
        /* should always can generate irq */
        I915_WRITE(DEIIR, I915_READ(DEIIR));
-        I915_WRITE(DEIMR, dev_priv->irq_mask_reg);
+        I915_WRITE(DEIMR, dev_priv->irq_mask);
-        I915_WRITE(DEIER, dev_priv->de_irq_enable_reg);
+        I915_WRITE(DEIER, display_mask | DE_PIPEA_VBLANK | DE_PIPEB_VBLANK);
-        (void) I915_READ(DEIER);
+        POSTING_READ(DEIER);
-        if (IS_GEN6(dev)) {
+        dev_priv->gt_irq_mask = ~0;
-                render_mask =
-                        GT_PIPE_NOTIFY |
-                        GT_GEN6_BSD_USER_INTERRUPT |
-                        GT_BLT_USER_INTERRUPT;
-        }
-        dev_priv->gt_irq_mask_reg = ~render_mask;
-        dev_priv->gt_irq_enable_reg = render_mask;
        I915_WRITE(GTIIR, I915_READ(GTIIR));
-        I915_WRITE(GTIMR, dev_priv->gt_irq_mask_reg);
+        I915_WRITE(GTIMR, dev_priv->gt_irq_mask);
        if (IS_GEN6(dev)) {
-                I915_WRITE(GEN6_RENDER_IMR, ~GEN6_RENDER_PIPE_CONTROL_NOTIFY_INTERRUPT);
+                I915_WRITE(GEN6_RENDER_IMR, ~GEN6_RENDER_USER_INTERRUPT);
-                I915_WRITE(GEN6_BSD_IMR, ~GEN6_BSD_IMR_USER_INTERRUPT);
+                I915_WRITE(GEN6_BSD_IMR, ~GEN6_BSD_USER_INTERRUPT);
                I915_WRITE(GEN6_BLITTER_IMR, ~GEN6_BLITTER_USER_INTERRUPT);
        }
-        I915_WRITE(GTIER, dev_priv->gt_irq_enable_reg);
+        if (IS_GEN6(dev))
-        (void) I915_READ(GTIER);
+                render_irqs =
+                        GT_USER_INTERRUPT |
+                        GT_GEN6_BSD_USER_INTERRUPT |
+                        GT_BLT_USER_INTERRUPT;
+        else
+                render_irqs =
+                        GT_USER_INTERRUPT |
+                        GT_PIPE_NOTIFY |
+                        GT_BSD_USER_INTERRUPT;
+        I915_WRITE(GTIER, render_irqs);
+        POSTING_READ(GTIER);
        if (HAS_PCH_CPT(dev)) {
                hotplug_mask = SDE_CRT_HOTPLUG_CPT | SDE_PORTB_HOTPLUG_CPT  |
@@ -1477,13 +1700,12 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
                               SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
        }
-        dev_priv->pch_irq_mask_reg = ~hotplug_mask;
+        dev_priv->pch_irq_mask = ~hotplug_mask;
-        dev_priv->pch_irq_enable_reg = hotplug_mask;
        I915_WRITE(SDEIIR, I915_READ(SDEIIR));
-        I915_WRITE(SDEIMR, dev_priv->pch_irq_mask_reg);
+        I915_WRITE(SDEIMR, dev_priv->pch_irq_mask);
-        I915_WRITE(SDEIER, dev_priv->pch_irq_enable_reg);
+        I915_WRITE(SDEIER, hotplug_mask);
-        (void) I915_READ(SDEIER);
+        POSTING_READ(SDEIER);
        if (IS_IRONLAKE_M(dev)) {
                /* Clear & enable PCU event interrupts */
@@ -1519,7 +1741,7 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
        I915_WRITE(PIPEBSTAT, 0);
        I915_WRITE(IMR, 0xffffffff);
        I915_WRITE(IER, 0x0);
-        (void) I915_READ(IER);
+        POSTING_READ(IER);
 }
 /*
@@ -1532,11 +1754,11 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
        u32 enable_mask = I915_INTERRUPT_ENABLE_FIX | I915_INTERRUPT_ENABLE_VAR;
        u32 error_mask;
-        DRM_INIT_WAITQUEUE(&dev_priv->render_ring.irq_queue);
+        DRM_INIT_WAITQUEUE(&dev_priv->ring[RCS].irq_queue);
        if (HAS_BSD(dev))
-                DRM_INIT_WAITQUEUE(&dev_priv->bsd_ring.irq_queue);
+                DRM_INIT_WAITQUEUE(&dev_priv->ring[VCS].irq_queue);
        if (HAS_BLT(dev))
-                DRM_INIT_WAITQUEUE(&dev_priv->blt_ring.irq_queue);
+                DRM_INIT_WAITQUEUE(&dev_priv->ring[BCS].irq_queue);
        dev_priv->vblank_pipe = DRM_I915_VBLANK_PIPE_A | DRM_I915_VBLANK_PIPE_B;
@@ -1544,7 +1766,7 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
                return ironlake_irq_postinstall(dev);
        /* Unmask the interrupts that we always want on. */
-        dev_priv->irq_mask_reg = ~I915_INTERRUPT_ENABLE_FIX;
+        dev_priv->irq_mask = ~I915_INTERRUPT_ENABLE_FIX;
        dev_priv->pipestat[0] = 0;
        dev_priv->pipestat[1] = 0;
@@ -1553,7 +1775,7 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
                /* Enable in IER... */
                enable_mask |= I915_DISPLAY_PORT_INTERRUPT;
                /* and unmask in IMR */
-                dev_priv->irq_mask_reg &= ~I915_DISPLAY_PORT_INTERRUPT;
+                dev_priv->irq_mask &= ~I915_DISPLAY_PORT_INTERRUPT;
        }
        /*
@@ -1571,9 +1793,9 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
        }
        I915_WRITE(EMR, error_mask);
-        I915_WRITE(IMR, dev_priv->irq_mask_reg);
+        I915_WRITE(IMR, dev_priv->irq_mask);
        I915_WRITE(IER, enable_mask);
-        (void) I915_READ(IER);
+        POSTING_READ(IER);
        if (I915_HAS_HOTPLUG(dev)) {
                u32 hotplug_en = I915_READ(PORT_HOTPLUG_EN);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 25ed911a3112..d60860ec8cf4 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -78,6 +78,12 @@
 #define  GRDOM_RENDER   (1<<2)
 #define  GRDOM_MEDIA    (3<<2)
+#define GEN6_GDRST      0x941c
+#define  GEN6_GRDOM_FULL                (1 << 0)
+#define  GEN6_GRDOM_RENDER              (1 << 1)
+#define  GEN6_GRDOM_MEDIA               (1 << 2)
+#define  GEN6_GRDOM_BLT                 (1 << 3)
 /* VGA stuff */
 #define VGA_ST01_MDA 0x3ba
@@ -158,12 +164,23 @@
 #define   MI_MEM_VIRTUAL        (1 << 22) /* 965+ only */
 #define MI_STORE_DWORD_INDEX    MI_INSTR(0x21, 1)
 #define   MI_STORE_DWORD_INDEX_SHIFT 2
-#define MI_LOAD_REGISTER_IMM    MI_INSTR(0x22, 1)
+/* Official intel docs are somewhat sloppy concerning MI_LOAD_REGISTER_IMM:
+ * - Always issue a MI_NOOP _before_ the MI_LOAD_REGISTER_IMM - otherwise hw
+ *   simply ignores the register load under certain conditions.
+ * - One can actually load arbitrary many arbitrary registers: Simply issue x
+ *   address/value pairs. Don't overdue it, though, x <= 2^4 must hold!
+ */
+#define MI_LOAD_REGISTER_IMM(x) MI_INSTR(0x22, 2*x-1)
 #define MI_FLUSH_DW             MI_INSTR(0x26, 2) /* for GEN6 */
 #define MI_BATCH_BUFFER         MI_INSTR(0x30, 1)
 #define   MI_BATCH_NON_SECURE   (1)
 #define   MI_BATCH_NON_SECURE_I965 (1<<8)
 #define MI_BATCH_BUFFER_START   MI_INSTR(0x31, 0)
+#define MI_SEMAPHORE_MBOX       MI_INSTR(0x16, 1) /* gen6+ */
+#define  MI_SEMAPHORE_GLOBAL_GTT    (1<<22)
+#define  MI_SEMAPHORE_UPDATE        (1<<21)
+#define  MI_SEMAPHORE_COMPARE       (1<<20)
+#define  MI_SEMAPHORE_REGISTER      (1<<18)
 /*
 * 3D instructions used by the kernel
 */
@@ -256,10 +273,6 @@
 * Instruction and interrupt control regs
 */
 #define PGTBL_ER        0x02024
-#define PRB0_TAIL       0x02030
-#define PRB0_HEAD       0x02034
-#define PRB0_START      0x02038
-#define PRB0_CTL        0x0203c
 #define RENDER_RING_BASE        0x02000
 #define BSD_RING_BASE           0x04000
 #define GEN6_BSD_RING_BASE      0x12000
@@ -268,9 +281,13 @@
 #define RING_HEAD(base)         ((base)+0x34)
 #define RING_START(base)        ((base)+0x38)
 #define RING_CTL(base)          ((base)+0x3c)
+#define RING_SYNC_0(base)       ((base)+0x40)
+#define RING_SYNC_1(base)       ((base)+0x44)
+#define RING_MAX_IDLE(base)     ((base)+0x54)
 #define RING_HWS_PGA(base)      ((base)+0x80)
 #define RING_HWS_PGA_GEN6(base) ((base)+0x2080)
 #define RING_ACTHD(base)        ((base)+0x74)
+#define RING_NOPID(base)        ((base)+0x94)
 #define   TAIL_ADDR             0x001FFFF8
 #define   HEAD_WRAP_COUNT       0xFFE00000
 #define   HEAD_WRAP_ONE         0x00200000
@@ -285,10 +302,17 @@
 #define   RING_INVALID          0x00000000
 #define   RING_WAIT_I8XX        (1<<0) /* gen2, PRBx_HEAD */
 #define   RING_WAIT             (1<<11) /* gen3+, PRBx_CTL */
+#define   RING_WAIT_SEMAPHORE   (1<<10) /* gen6+ */
+#if 0
+#define PRB0_TAIL       0x02030
+#define PRB0_HEAD       0x02034
+#define PRB0_START      0x02038
+#define PRB0_CTL        0x0203c
 #define PRB1_TAIL       0x02040 /* 915+ only */
 #define PRB1_HEAD       0x02044 /* 915+ only */
 #define PRB1_START      0x02048 /* 915+ only */
 #define PRB1_CTL        0x0204c /* 915+ only */
+#endif
 #define IPEIR_I965      0x02064
 #define IPEHR_I965      0x02068
 #define INSTDONE_I965   0x0206c
@@ -305,11 +329,42 @@
 #define INSTDONE        0x02090
 #define NOPID           0x02094
 #define HWSTAM          0x02098
+#define VCS_INSTDONE    0x1206C
+#define VCS_IPEIR       0x12064
+#define VCS_IPEHR       0x12068
+#define VCS_ACTHD       0x12074
+#define BCS_INSTDONE    0x2206C
+#define BCS_IPEIR       0x22064
+#define BCS_IPEHR       0x22068
+#define BCS_ACTHD       0x22074
+#define ERROR_GEN6      0x040a0
+/* GM45+ chicken bits -- debug workaround bits that may be required
+ * for various sorts of correct behavior.  The top 16 bits of each are
+ * the enables for writing to the corresponding low bit.
+ */
+#define _3D_CHICKEN     0x02084
+#define _3D_CHICKEN2    0x0208c
+/* Disables pipelining of read flushes past the SF-WIZ interface.
+ * Required on all Ironlake steppings according to the B-Spec, but the
+ * particular danger of not doing so is not specified.
+ */
+# define _3D_CHICKEN2_WM_READ_PIPELINED                 (1 << 14)
+#define _3D_CHICKEN3    0x02090
 #define MI_MODE         0x0209c
 # define VS_TIMER_DISPATCH                              (1 << 6)
 # define MI_FLUSH_ENABLE                                (1 << 11)
+#define GFX_MODE        0x02520
+#define   GFX_RUN_LIST_ENABLE           (1<<15)
+#define   GFX_TLB_INVALIDATE_ALWAYS     (1<<13)
+#define   GFX_SURFACE_FAULT_ENABLE      (1<<12)
+#define   GFX_REPLAY_MODE               (1<<11)
+#define   GFX_PSMI_GRANULARITY          (1<<10)
+#define   GFX_PPGTT_ENABLE              (1<<9)
 #define SCPD0           0x0209c /* 915+ only */
 #define IER             0x020a0
 #define IIR             0x020a4
@@ -461,7 +516,7 @@
 #define   GEN6_BSD_SLEEP_PSMI_CONTROL_IDLE_INDICATOR                    (1 << 3)
 #define GEN6_BSD_IMR                    0x120a8
-#define   GEN6_BSD_IMR_USER_INTERRUPT   (1 << 12)
+#define   GEN6_BSD_USER_INTERRUPT       (1 << 12)
 #define GEN6_BSD_RNCID                  0x12198
@@ -541,6 +596,18 @@
 #define ILK_DISPLAY_CHICKEN1    0x42000
 #define   ILK_FBCQ_DIS          (1<<22)
+#define   ILK_PABSTRETCH_DIS    (1<<21)
+/*
+ * Framebuffer compression for Sandybridge
+ *
+ * The following two registers are of type GTTMMADR
+ */
+#define SNB_DPFC_CTL_SA         0x100100
+#define   SNB_CPU_FENCE_ENABLE  (1<<29)
+#define DPFC_CPU_FENCE_OFFSET   0x100104
 /*
 * GPIO regs
@@ -900,6 +967,8 @@
 */
 #define MCHBAR_MIRROR_BASE      0x10000
+#define MCHBAR_MIRROR_BASE_SNB  0x140000
 /** 915-945 and GM965 MCH register controlling DRAM channel access */
 #define DCC                     0x10200
 #define DCC_ADDRESSING_MODE_SINGLE_CHANNEL              (0 << 0)
@@ -1119,6 +1188,10 @@
 #define DDRMPLL1                0X12c20
 #define PEG_BAND_GAP_DATA       0x14d68
+#define GEN6_GT_PERF_STATUS     0x145948
+#define GEN6_RP_STATE_LIMITS    0x145994
+#define GEN6_RP_STATE_CAP       0x145998
 /*
 * Logical Context regs
 */
@@ -1168,7 +1241,6 @@
 #define VTOTAL(pipe) _PIPE(pipe, VTOTAL_A, VTOTAL_B)
 #define VBLANK(pipe) _PIPE(pipe, VBLANK_A, VBLANK_B)
 #define VSYNC(pipe) _PIPE(pipe, VSYNC_A, VSYNC_B)
-#define PIPESRC(pipe) _PIPE(pipe, PIPEASRC, PIPEBSRC)
 #define BCLRPAT(pipe) _PIPE(pipe, BCLRPAT_A, BCLRPAT_B)
 /* VGA port control */
@@ -2182,8 +2254,10 @@
 #define   PIPE_6BPC                             (2 << 5)
 #define   PIPE_12BPC                            (3 << 5)
+#define PIPESRC(pipe) _PIPE(pipe, PIPEASRC, PIPEBSRC)
 #define PIPECONF(pipe) _PIPE(pipe, PIPEACONF, PIPEBCONF)
 #define PIPEDSL(pipe)  _PIPE(pipe, PIPEADSL, PIPEBDSL)
+#define PIPEFRAMEPIXEL(pipe)  _PIPE(pipe, PIPEAFRAMEPIXEL, PIPEBFRAMEPIXEL)
 #define DSPARB                  0x70030
 #define   DSPARB_CSTART_MASK    (0x7f << 7)
@@ -2291,6 +2365,40 @@
 #define ILK_FIFO_LINE_SIZE      64
+/* define the WM info on Sandybridge */
+#define SNB_DISPLAY_FIFO        128
+#define SNB_DISPLAY_MAXWM       0x7f    /* bit 16:22 */
+#define SNB_DISPLAY_DFTWM       8
+#define SNB_CURSOR_FIFO         32
+#define SNB_CURSOR_MAXWM        0x1f    /* bit 4:0 */
+#define SNB_CURSOR_DFTWM        8
+#define SNB_DISPLAY_SR_FIFO     512
+#define SNB_DISPLAY_MAX_SRWM    0x1ff   /* bit 16:8 */
+#define SNB_DISPLAY_DFT_SRWM    0x3f
+#define SNB_CURSOR_SR_FIFO      64
+#define SNB_CURSOR_MAX_SRWM     0x3f    /* bit 5:0 */
+#define SNB_CURSOR_DFT_SRWM     8
+#define SNB_FBC_MAX_SRWM        0xf     /* bit 23:20 */
+#define SNB_FIFO_LINE_SIZE      64
+/* the address where we get all kinds of latency value */
+#define SSKPD                   0x5d10
+#define SSKPD_WM_MASK           0x3f
+#define SSKPD_WM0_SHIFT         0
+#define SSKPD_WM1_SHIFT         8
+#define SSKPD_WM2_SHIFT         16
+#define SSKPD_WM3_SHIFT         24
+#define SNB_LATENCY(shift)      (I915_READ(MCHBAR_MIRROR_BASE_SNB + SSKPD) >> (shift) & SSKPD_WM_MASK)
+#define SNB_READ_WM0_LATENCY()          SNB_LATENCY(SSKPD_WM0_SHIFT)
+#define SNB_READ_WM1_LATENCY()          SNB_LATENCY(SSKPD_WM1_SHIFT)
+#define SNB_READ_WM2_LATENCY()          SNB_LATENCY(SSKPD_WM2_SHIFT)
+#define SNB_READ_WM3_LATENCY()          SNB_LATENCY(SSKPD_WM3_SHIFT)
 /*
 * The two pipe frame counter registers are not synchronized, so
 * reading a stable value is somewhat tricky. The following code
@@ -2351,6 +2459,10 @@
 #define CURBBASE                0x700c4
 #define CURBPOS                 0x700c8
+#define CURCNTR(pipe) _PIPE(pipe, CURACNTR, CURBCNTR)
+#define CURBASE(pipe) _PIPE(pipe, CURABASE, CURBBASE)
+#define CURPOS(pipe) _PIPE(pipe, CURAPOS, CURBPOS)
 /* Display A control */
 #define DSPACNTR                0x70180
 #define   DISPLAY_PLANE_ENABLE                  (1<<31)
@@ -2586,10 +2698,14 @@
 #define GTIER   0x4401c
 #define ILK_DISPLAY_CHICKEN2    0x42004
+/* Required on all Ironlake and Sandybridge according to the B-Spec. */
+#define  ILK_ELPIN_409_SELECT   (1 << 25)
 #define  ILK_DPARB_GATE (1<<22)
 #define  ILK_VSDPFD_FULL        (1<<21)
 #define ILK_DSPCLK_GATE         0x42020
 #define  ILK_DPARB_CLK_GATE     (1<<5)
+#define  ILK_DPFD_CLK_GATE      (1<<7)
 /* According to spec this bit 7/8/9 of 0x42020 should be set to enable FBC */
 #define   ILK_CLK_FBC           (1<<7)
 #define   ILK_DPFC_DIS1         (1<<8)
@@ -2669,6 +2785,7 @@
 #define PCH_DPLL(pipe) _PIPE(pipe, PCH_DPLL_A, PCH_DPLL_B)
 #define PCH_FPA0                0xc6040
+#define  FP_CB_TUNE             (0x3<<22)
 #define PCH_FPA1                0xc6044
 #define PCH_FPB0                0xc6048
 #define PCH_FPB1                0xc604c
@@ -3033,6 +3150,7 @@
 #define  TRANS_DP_10BPC         (1<<9)
 #define  TRANS_DP_6BPC          (2<<9)
 #define  TRANS_DP_12BPC         (3<<9)
+#define  TRANS_DP_BPC_MASK      (3<<9)
 #define  TRANS_DP_VSYNC_ACTIVE_HIGH     (1<<4)
 #define  TRANS_DP_VSYNC_ACTIVE_LOW      0
 #define  TRANS_DP_HSYNC_ACTIVE_HIGH     (1<<3)
@@ -3052,4 +3170,66 @@
 #define  EDP_LINK_TRAIN_800MV_0DB_SNB_B         (0x38<<22)
 #define  EDP_LINK_TRAIN_VOL_EMP_MASK_SNB        (0x3f<<22)
+#define  FORCEWAKE                              0xA18C
+#define  FORCEWAKE_ACK                          0x130090
+#define GEN6_RPNSWREQ                           0xA008
+#define   GEN6_TURBO_DISABLE                    (1<<31)
+#define   GEN6_FREQUENCY(x)                     ((x)<<25)
+#define   GEN6_OFFSET(x)                        ((x)<<19)
+#define   GEN6_AGGRESSIVE_TURBO                 (0<<15)
+#define GEN6_RC_VIDEO_FREQ                      0xA00C
+#define GEN6_RC_CONTROL                         0xA090
+#define   GEN6_RC_CTL_RC6pp_ENABLE              (1<<16)
+#define   GEN6_RC_CTL_RC6p_ENABLE               (1<<17)
+#define   GEN6_RC_CTL_RC6_ENABLE                (1<<18)
+#define   GEN6_RC_CTL_RC1e_ENABLE               (1<<20)
+#define   GEN6_RC_CTL_RC7_ENABLE                (1<<22)
+#define   GEN6_RC_CTL_EI_MODE(x)                ((x)<<27)
+#define   GEN6_RC_CTL_HW_ENABLE                 (1<<31)
+#define GEN6_RP_DOWN_TIMEOUT                    0xA010
+#define GEN6_RP_INTERRUPT_LIMITS                0xA014
+#define GEN6_RPSTAT1                            0xA01C
+#define GEN6_RP_CONTROL                         0xA024
+#define   GEN6_RP_MEDIA_TURBO                   (1<<11)
+#define   GEN6_RP_USE_NORMAL_FREQ               (1<<9)
+#define   GEN6_RP_MEDIA_IS_GFX                  (1<<8)
+#define   GEN6_RP_ENABLE                        (1<<7)
+#define   GEN6_RP_UP_BUSY_MAX                   (0x2<<3)
+#define   GEN6_RP_DOWN_BUSY_MIN                 (0x2<<0)
+#define GEN6_RP_UP_THRESHOLD                    0xA02C
+#define GEN6_RP_DOWN_THRESHOLD                  0xA030
+#define GEN6_RP_UP_EI                           0xA068
+#define GEN6_RP_DOWN_EI                         0xA06C
+#define GEN6_RP_IDLE_HYSTERSIS                  0xA070
+#define GEN6_RC_STATE                           0xA094
+#define GEN6_RC1_WAKE_RATE_LIMIT                0xA098
+#define GEN6_RC6_WAKE_RATE_LIMIT                0xA09C
+#define GEN6_RC6pp_WAKE_RATE_LIMIT              0xA0A0
+#define GEN6_RC_EVALUATION_INTERVAL             0xA0A8
+#define GEN6_RC_IDLE_HYSTERSIS                  0xA0AC
+#define GEN6_RC_SLEEP                           0xA0B0
+#define GEN6_RC1e_THRESHOLD                     0xA0B4
+#define GEN6_RC6_THRESHOLD                      0xA0B8
+#define GEN6_RC6p_THRESHOLD                     0xA0BC
+#define GEN6_RC6pp_THRESHOLD                    0xA0C0
+#define GEN6_PMINTRMSK                          0xA168
+#define GEN6_PMISR                              0x44020
+#define GEN6_PMIMR                              0x44024
+#define GEN6_PMIIR                              0x44028
+#define GEN6_PMIER                              0x4402C
+#define  GEN6_PM_MBOX_EVENT                     (1<<25)
+#define  GEN6_PM_THERMAL_EVENT                  (1<<24)
+#define  GEN6_PM_RP_DOWN_TIMEOUT                (1<<6)
+#define  GEN6_PM_RP_UP_THRESHOLD                (1<<5)
+#define  GEN6_PM_RP_DOWN_THRESHOLD              (1<<4)
+#define  GEN6_PM_RP_UP_EI_EXPIRED               (1<<2)
+#define  GEN6_PM_RP_DOWN_EI_EXPIRED             (1<<1)
+#define GEN6_PCODE_MAILBOX                      0x138124
+#define   GEN6_PCODE_READY                      (1<<31)
+#define   GEN6_PCODE_WRITE_MIN_FREQ_TABLE       0x9
+#define GEN6_PCODE_DATA                         0x138128
 #endif /* _I915_REG_H_ */
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 454c064f8ef7..410772466fa7 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -235,10 +235,21 @@ static void i915_restore_vga(struct drm_device *dev)
 static void i915_save_modeset_reg(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        int i;
        if (drm_core_check_feature(dev, DRIVER_MODESET))
                return;
+        /* Cursor state */
+        dev_priv->saveCURACNTR = I915_READ(CURACNTR);
+        dev_priv->saveCURAPOS = I915_READ(CURAPOS);
+        dev_priv->saveCURABASE = I915_READ(CURABASE);
+        dev_priv->saveCURBCNTR = I915_READ(CURBCNTR);
+        dev_priv->saveCURBPOS = I915_READ(CURBPOS);
+        dev_priv->saveCURBBASE = I915_READ(CURBBASE);
+        if (IS_GEN2(dev))
+                dev_priv->saveCURSIZE = I915_READ(CURSIZE);
        if (HAS_PCH_SPLIT(dev)) {
                dev_priv->savePCH_DREF_CONTROL = I915_READ(PCH_DREF_CONTROL);
                dev_priv->saveDISP_ARB_CTL = I915_READ(DISP_ARB_CTL);
@@ -357,6 +368,28 @@ static void i915_save_modeset_reg(struct drm_device *dev)
        }
        i915_save_palette(dev, PIPE_B);
        dev_priv->savePIPEBSTAT = I915_READ(PIPEBSTAT);
+        /* Fences */
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_SANDYBRIDGE_0 + (i * 8));
+                break;
+        case 5:
+        case 4:
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
+                break;
+        case 3:
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        case 2:
+                for (i = 0; i < 8; i++)
+                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+                break;
+        }
        return;
 }
@@ -365,10 +398,33 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        int dpll_a_reg, fpa0_reg, fpa1_reg;
        int dpll_b_reg, fpb0_reg, fpb1_reg;
+        int i;
        if (drm_core_check_feature(dev, DRIVER_MODESET))
                return;
+        /* Fences */
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + (i * 8), dev_priv->saveFENCE[i]);
+                break;
+        case 5:
+        case 4:
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
+                break;
+        case 3:
+        case 2:
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
+                for (i = 0; i < 8; i++)
+                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                break;
+        }
        if (HAS_PCH_SPLIT(dev)) {
                dpll_a_reg = PCH_DPLL_A;
                dpll_b_reg = PCH_DPLL_B;
@@ -529,6 +585,16 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
        I915_WRITE(DSPBCNTR, dev_priv->saveDSPBCNTR);
        I915_WRITE(DSPBADDR, I915_READ(DSPBADDR));
+        /* Cursor state */
+        I915_WRITE(CURAPOS, dev_priv->saveCURAPOS);
+        I915_WRITE(CURACNTR, dev_priv->saveCURACNTR);
+        I915_WRITE(CURABASE, dev_priv->saveCURABASE);
+        I915_WRITE(CURBPOS, dev_priv->saveCURBPOS);
+        I915_WRITE(CURBCNTR, dev_priv->saveCURBCNTR);
+        I915_WRITE(CURBBASE, dev_priv->saveCURBBASE);
+        if (IS_GEN2(dev))
+                I915_WRITE(CURSIZE, dev_priv->saveCURSIZE);
        return;
 }
@@ -543,16 +609,6 @@ void i915_save_display(struct drm_device *dev)
        /* Don't save them in KMS mode */
        i915_save_modeset_reg(dev);
-        /* Cursor state */
-        dev_priv->saveCURACNTR = I915_READ(CURACNTR);
-        dev_priv->saveCURAPOS = I915_READ(CURAPOS);
-        dev_priv->saveCURABASE = I915_READ(CURABASE);
-        dev_priv->saveCURBCNTR = I915_READ(CURBCNTR);
-        dev_priv->saveCURBPOS = I915_READ(CURBPOS);
-        dev_priv->saveCURBBASE = I915_READ(CURBBASE);
-        if (IS_GEN2(dev))
-                dev_priv->saveCURSIZE = I915_READ(CURSIZE);
        /* CRT state */
        if (HAS_PCH_SPLIT(dev)) {
                dev_priv->saveADPA = I915_READ(PCH_ADPA);
@@ -657,16 +713,6 @@ void i915_restore_display(struct drm_device *dev)
        /* Don't restore them in KMS mode */
        i915_restore_modeset_reg(dev);
-        /* Cursor state */
-        I915_WRITE(CURAPOS, dev_priv->saveCURAPOS);
-        I915_WRITE(CURACNTR, dev_priv->saveCURACNTR);
-        I915_WRITE(CURABASE, dev_priv->saveCURABASE);
-        I915_WRITE(CURBPOS, dev_priv->saveCURBPOS);
-        I915_WRITE(CURBCNTR, dev_priv->saveCURBCNTR);
-        I915_WRITE(CURBBASE, dev_priv->saveCURBBASE);
-        if (IS_GEN2(dev))
-                I915_WRITE(CURSIZE, dev_priv->saveCURSIZE);
        /* CRT state */
        if (HAS_PCH_SPLIT(dev))
                I915_WRITE(PCH_ADPA, dev_priv->saveADPA);
@@ -771,8 +817,14 @@ int i915_save_state(struct drm_device *dev)
                dev_priv->saveIMR = I915_READ(IMR);
        }
-        if (HAS_PCH_SPLIT(dev))
+        if (IS_IRONLAKE_M(dev))
                ironlake_disable_drps(dev);
+        if (IS_GEN6(dev))
+                gen6_disable_rps(dev);
+        /* XXX disabling the clock gating breaks suspend on gm45
+        intel_disable_clock_gating(dev);
+         */
        /* Cache mode state */
        dev_priv->saveCACHE_MODE_0 = I915_READ(CACHE_MODE_0);
@@ -788,28 +840,6 @@ int i915_save_state(struct drm_device *dev)
        for (i = 0; i < 3; i++)
                dev_priv->saveSWF2[i] = I915_READ(SWF30 + (i << 2));
-        /* Fences */
-        switch (INTEL_INFO(dev)->gen) {
-        case 6:
-                for (i = 0; i < 16; i++)
-                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_SANDYBRIDGE_0 + (i * 8));
-                break;
-        case 5:
-        case 4:
-                for (i = 0; i < 16; i++)
-                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
-                break;
-        case 3:
-                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
-                        for (i = 0; i < 8; i++)
-                                dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
-        case 2:
-                for (i = 0; i < 8; i++)
-                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
-                break;
-        }
        return 0;
 }
@@ -823,27 +853,6 @@ int i915_restore_state(struct drm_device *dev)
        /* Hardware status page */
        I915_WRITE(HWS_PGA, dev_priv->saveHWS);
-        /* Fences */
-        switch (INTEL_INFO(dev)->gen) {
-        case 6:
-                for (i = 0; i < 16; i++)
-                        I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + (i * 8), dev_priv->saveFENCE[i]);
-                break;
-        case 5:
-        case 4:
-                for (i = 0; i < 16; i++)
-                        I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
-                break;
-        case 3:
-        case 2:
-                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
-                        for (i = 0; i < 8; i++)
-                                I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
-                for (i = 0; i < 8; i++)
-                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
-                break;
-        }
        i915_restore_display(dev);
        /* Interrupt state */
@@ -860,13 +869,16 @@ int i915_restore_state(struct drm_device *dev)
        }
        /* Clock gating state */
-        intel_init_clock_gating(dev);
+        intel_enable_clock_gating(dev);
-        if (HAS_PCH_SPLIT(dev)) {
+        if (IS_IRONLAKE_M(dev)) {
                ironlake_enable_drps(dev);
                intel_init_emon(dev);
        }
+        if (IS_GEN6(dev))
+                gen6_enable_rps(dev_priv);
        /* Cache mode state */
        I915_WRITE (CACHE_MODE_0, dev_priv->saveCACHE_MODE_0 | 0xffff0000);
diff --git a/drivers/gpu/drm/i915/i915_trace.h b/drivers/gpu/drm/i915/i915_trace.h
index fea97a21cc14..7f0fc3ed61aa 100644
--- a/drivers/gpu/drm/i915/i915_trace.h
+++ b/drivers/gpu/drm/i915/i915_trace.h
@@ -6,6 +6,7 @@
 #include <linux/tracepoint.h>
 #include <drm/drmP.h>
+#include "i915_drv.h"
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM i915
@@ -16,18 +17,18 @@
 TRACE_EVENT(i915_gem_object_create,
-            TP_PROTO(struct drm_gem_object *obj),
+            TP_PROTO(struct drm_i915_gem_object *obj),
            TP_ARGS(obj),
            TP_STRUCT__entry(
-                             __field(struct drm_gem_object *, obj)
+                             __field(struct drm_i915_gem_object *, obj)
                             __field(u32, size)
                             ),
            TP_fast_assign(
                           __entry->obj = obj;
-                           __entry->size = obj->size;
+                           __entry->size = obj->base.size;
                           ),
            TP_printk("obj=%p, size=%u", __entry->obj, __entry->size)
@@ -35,40 +36,43 @@ TRACE_EVENT(i915_gem_object_create,
 TRACE_EVENT(i915_gem_object_bind,
-            TP_PROTO(struct drm_gem_object *obj, u32 gtt_offset),
+            TP_PROTO(struct drm_i915_gem_object *obj, u32 gtt_offset, bool mappable),
-            TP_ARGS(obj, gtt_offset),
+            TP_ARGS(obj, gtt_offset, mappable),
            TP_STRUCT__entry(
-                             __field(struct drm_gem_object *, obj)
+                             __field(struct drm_i915_gem_object *, obj)
                             __field(u32, gtt_offset)
+                             __field(bool, mappable)
                             ),
            TP_fast_assign(
                           __entry->obj = obj;
                           __entry->gtt_offset = gtt_offset;
+                           __entry->mappable = mappable;
                           ),
-            TP_printk("obj=%p, gtt_offset=%08x",
+            TP_printk("obj=%p, gtt_offset=%08x%s",
-                      __entry->obj, __entry->gtt_offset)
+                      __entry->obj, __entry->gtt_offset,
+                      __entry->mappable ? ", mappable" : "")
 );
 TRACE_EVENT(i915_gem_object_change_domain,
-            TP_PROTO(struct drm_gem_object *obj, uint32_t old_read_domains, uint32_t old_write_domain),
+            TP_PROTO(struct drm_i915_gem_object *obj, uint32_t old_read_domains, uint32_t old_write_domain),
            TP_ARGS(obj, old_read_domains, old_write_domain),
            TP_STRUCT__entry(
-                             __field(struct drm_gem_object *, obj)
+                             __field(struct drm_i915_gem_object *, obj)
                             __field(u32, read_domains)
                             __field(u32, write_domain)
                             ),
            TP_fast_assign(
                           __entry->obj = obj;
-                           __entry->read_domains = obj->read_domains | (old_read_domains << 16);
+                           __entry->read_domains = obj->base.read_domains | (old_read_domains << 16);
-                           __entry->write_domain = obj->write_domain | (old_write_domain << 16);
+                           __entry->write_domain = obj->base.write_domain | (old_write_domain << 16);
                           ),
            TP_printk("obj=%p, read=%04x, write=%04x",
@@ -76,36 +80,14 @@ TRACE_EVENT(i915_gem_object_change_domain,
                      __entry->read_domains, __entry->write_domain)
 );
-TRACE_EVENT(i915_gem_object_get_fence,
-            TP_PROTO(struct drm_gem_object *obj, int fence, int tiling_mode),
-            TP_ARGS(obj, fence, tiling_mode),
-            TP_STRUCT__entry(
-                             __field(struct drm_gem_object *, obj)
-                             __field(int, fence)
-                             __field(int, tiling_mode)
-                             ),
-            TP_fast_assign(
-                           __entry->obj = obj;
-                           __entry->fence = fence;
-                           __entry->tiling_mode = tiling_mode;
-                           ),
-            TP_printk("obj=%p, fence=%d, tiling=%d",
-                      __entry->obj, __entry->fence, __entry->tiling_mode)
-);
 DECLARE_EVENT_CLASS(i915_gem_object,
-            TP_PROTO(struct drm_gem_object *obj),
+            TP_PROTO(struct drm_i915_gem_object *obj),
            TP_ARGS(obj),
            TP_STRUCT__entry(
-                             __field(struct drm_gem_object *, obj)
+                             __field(struct drm_i915_gem_object *, obj)
                             ),
            TP_fast_assign(
@@ -117,21 +99,21 @@ DECLARE_EVENT_CLASS(i915_gem_object,
 DEFINE_EVENT(i915_gem_object, i915_gem_object_clflush,
-            TP_PROTO(struct drm_gem_object *obj),
+            TP_PROTO(struct drm_i915_gem_object *obj),
            TP_ARGS(obj)
 );
 DEFINE_EVENT(i915_gem_object, i915_gem_object_unbind,
-            TP_PROTO(struct drm_gem_object *obj),
+            TP_PROTO(struct drm_i915_gem_object *obj),
            TP_ARGS(obj)
 );
 DEFINE_EVENT(i915_gem_object, i915_gem_object_destroy,
-            TP_PROTO(struct drm_gem_object *obj),
+            TP_PROTO(struct drm_i915_gem_object *obj),
            TP_ARGS(obj)
 );
@@ -263,13 +245,13 @@ DEFINE_EVENT(i915_ring, i915_ring_wait_end,
 );
 TRACE_EVENT(i915_flip_request,
-            TP_PROTO(int plane, struct drm_gem_object *obj),
+            TP_PROTO(int plane, struct drm_i915_gem_object *obj),
            TP_ARGS(plane, obj),
            TP_STRUCT__entry(
                    __field(int, plane)
-                    __field(struct drm_gem_object *, obj)
+                    __field(struct drm_i915_gem_object *, obj)
                    ),
            TP_fast_assign(
@@ -281,13 +263,13 @@ TRACE_EVENT(i915_flip_request,
 );
 TRACE_EVENT(i915_flip_complete,
-            TP_PROTO(int plane, struct drm_gem_object *obj),
+            TP_PROTO(int plane, struct drm_i915_gem_object *obj),
            TP_ARGS(plane, obj),
            TP_STRUCT__entry(
                    __field(int, plane)
-                    __field(struct drm_gem_object *, obj)
+                    __field(struct drm_i915_gem_object *, obj)
                    ),
            TP_fast_assign(
@@ -298,6 +280,29 @@ TRACE_EVENT(i915_flip_complete,
            TP_printk("plane=%d, obj=%p", __entry->plane, __entry->obj)
 );
+TRACE_EVENT(i915_reg_rw,
+           TP_PROTO(int cmd, uint32_t reg, uint64_t val, int len),
+           TP_ARGS(cmd, reg, val, len),
+           TP_STRUCT__entry(
+                   __field(int, cmd)
+                   __field(uint32_t, reg)
+                   __field(uint64_t, val)
+                   __field(int, len)
+                   ),
+           TP_fast_assign(
+                   __entry->cmd = cmd;
+                   __entry->reg = reg;
+                   __entry->val = (uint64_t)val;
+                   __entry->len = len;
+                   ),
+           TP_printk("cmd=%c, reg=0x%x, val=0x%llx, len=%d",
+                     __entry->cmd, __entry->reg, __entry->val, __entry->len)
+);
 #endif /* _I915_TRACE_H_ */
 /* This part must be outside protection */
diff --git a/drivers/gpu/drm/i915/intel_acpi.c b/drivers/gpu/drm/i915/intel_acpi.c
index 65c88f9ba12c..2cb8e0b9f1ee 100644
--- a/drivers/gpu/drm/i915/intel_acpi.c
+++ b/drivers/gpu/drm/i915/intel_acpi.c
@@ -190,37 +190,6 @@ out:
        kfree(output.pointer);
 }
-static int intel_dsm_switchto(enum vga_switcheroo_client_id id)
-{
-        return 0;
-}
-static int intel_dsm_power_state(enum vga_switcheroo_client_id id,
-                                 enum vga_switcheroo_state state)
-{
-        return 0;
-}
-static int intel_dsm_init(void)
-{
-        return 0;
-}
-static int intel_dsm_get_client_id(struct pci_dev *pdev)
-{
-        if (intel_dsm_priv.dhandle == DEVICE_ACPI_HANDLE(&pdev->dev))
-                return VGA_SWITCHEROO_IGD;
-        else
-                return VGA_SWITCHEROO_DIS;
-}
-static struct vga_switcheroo_handler intel_dsm_handler = {
-        .switchto = intel_dsm_switchto,
-        .power_state = intel_dsm_power_state,
-        .init = intel_dsm_init,
-        .get_client_id = intel_dsm_get_client_id,
-};
 static bool intel_dsm_pci_probe(struct pci_dev *pdev)
 {
        acpi_handle dhandle, intel_handle;
@@ -276,11 +245,8 @@ void intel_register_dsm_handler(void)
 {
        if (!intel_dsm_detect())
                return;
-        vga_switcheroo_register_handler(&intel_dsm_handler);
 }
 void intel_unregister_dsm_handler(void)
 {
-        vga_switcheroo_unregister_handler();
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index bee24b1a58e8..880659680d0a 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -642,26 +642,23 @@ static const intel_limit_t intel_limits_ironlake_display_port = {
        .find_pll = intel_find_pll_ironlake_dp,
 };
-static const intel_limit_t *intel_ironlake_limit(struct drm_crtc *crtc)
+static const intel_limit_t *intel_ironlake_limit(struct drm_crtc *crtc,
+                                                int refclk)
 {
        struct drm_device *dev = crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        const intel_limit_t *limit;
-        int refclk = 120;
        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
-                if (dev_priv->lvds_use_ssc && dev_priv->lvds_ssc_freq == 100)
-                        refclk = 100;
                if ((I915_READ(PCH_LVDS) & LVDS_CLKB_POWER_MASK) ==
                    LVDS_CLKB_POWER_UP) {
                        /* LVDS dual channel */
-                        if (refclk == 100)
+                        if (refclk == 100000)
                                limit = &intel_limits_ironlake_dual_lvds_100m;
                        else
                                limit = &intel_limits_ironlake_dual_lvds;
                } else {
-                        if (refclk == 100)
+                        if (refclk == 100000)
                                limit = &intel_limits_ironlake_single_lvds_100m;
                        else
                                limit = &intel_limits_ironlake_single_lvds;
@@ -702,13 +699,13 @@ static const intel_limit_t *intel_g4x_limit(struct drm_crtc *crtc)
        return limit;
 }
-static const intel_limit_t *intel_limit(struct drm_crtc *crtc)
+static const intel_limit_t *intel_limit(struct drm_crtc *crtc, int refclk)
 {
        struct drm_device *dev = crtc->dev;
        const intel_limit_t *limit;
        if (HAS_PCH_SPLIT(dev))
-                limit = intel_ironlake_limit(crtc);
+                limit = intel_ironlake_limit(crtc, refclk);
        else if (IS_G4X(dev)) {
                limit = intel_g4x_limit(crtc);
        } else if (IS_PINEVIEW(dev)) {
@@ -773,11 +770,10 @@ bool intel_pipe_has_type(struct drm_crtc *crtc, int type)
 * the given connectors.
 */
-static bool intel_PLL_is_valid(struct drm_crtc *crtc, intel_clock_t *clock)
+static bool intel_PLL_is_valid(struct drm_device *dev,
+                               const intel_limit_t *limit,
+                               const intel_clock_t *clock)
 {
-        const intel_limit_t *limit = intel_limit (crtc);
-        struct drm_device *dev = crtc->dev;
        if (clock->p1  < limit->p1.min  || limit->p1.max  < clock->p1)
                INTELPllInvalid ("p1 out of range\n");
        if (clock->p   < limit->p.min   || limit->p.max   < clock->p)
@@ -849,8 +845,8 @@ intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
                                        int this_err;
                                        intel_clock(dev, refclk, &clock);
+                                        if (!intel_PLL_is_valid(dev, limit,
-                                        if (!intel_PLL_is_valid(crtc, &clock))
+                                                                &clock))
                                                continue;
                                        this_err = abs(clock.dot - target);
@@ -912,9 +908,11 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
                                        int this_err;
                                        intel_clock(dev, refclk, &clock);
-                                        if (!intel_PLL_is_valid(crtc, &clock))
+                                        if (!intel_PLL_is_valid(dev, limit,
+                                                                &clock))
                                                continue;
-                                        this_err = abs(clock.dot - target) ;
+                                        this_err = abs(clock.dot - target);
                                        if (this_err < err_most) {
                                                *best_clock = clock;
                                                err_most = this_err;
@@ -1066,13 +1064,13 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_framebuffer *fb = crtc->fb;
        struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(intel_fb->obj);
+        struct drm_i915_gem_object *obj = intel_fb->obj;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        int plane, i;
        u32 fbc_ctl, fbc_ctl2;
        if (fb->pitch == dev_priv->cfb_pitch &&
-            obj_priv->fence_reg == dev_priv->cfb_fence &&
+            obj->fence_reg == dev_priv->cfb_fence &&
            intel_crtc->plane == dev_priv->cfb_plane &&
            I915_READ(FBC_CONTROL) & FBC_CTL_EN)
                return;
@@ -1086,7 +1084,7 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        /* FBC_CTL wants 64B units */
        dev_priv->cfb_pitch = (dev_priv->cfb_pitch / 64) - 1;
-        dev_priv->cfb_fence = obj_priv->fence_reg;
+        dev_priv->cfb_fence = obj->fence_reg;
        dev_priv->cfb_plane = intel_crtc->plane;
        plane = dev_priv->cfb_plane == 0 ? FBC_CTL_PLANEA : FBC_CTL_PLANEB;
@@ -1096,7 +1094,7 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        /* Set it up... */
        fbc_ctl2 = FBC_CTL_FENCE_DBL | FBC_CTL_IDLE_IMM | plane;
-        if (obj_priv->tiling_mode != I915_TILING_NONE)
+        if (obj->tiling_mode != I915_TILING_NONE)
                fbc_ctl2 |= FBC_CTL_CPU_FENCE;
        I915_WRITE(FBC_CONTROL2, fbc_ctl2);
        I915_WRITE(FBC_FENCE_OFF, crtc->y);
@@ -1107,7 +1105,7 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
                fbc_ctl |= FBC_CTL_C3_IDLE; /* 945 needs special SR handling */
        fbc_ctl |= (dev_priv->cfb_pitch & 0xff) << FBC_CTL_STRIDE_SHIFT;
        fbc_ctl |= (interval & 0x2fff) << FBC_CTL_INTERVAL_SHIFT;
-        if (obj_priv->tiling_mode != I915_TILING_NONE)
+        if (obj->tiling_mode != I915_TILING_NONE)
                fbc_ctl |= dev_priv->cfb_fence;
        I915_WRITE(FBC_CONTROL, fbc_ctl);
@@ -1150,7 +1148,7 @@ static void g4x_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_framebuffer *fb = crtc->fb;
        struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(intel_fb->obj);
+        struct drm_i915_gem_object *obj = intel_fb->obj;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        int plane = intel_crtc->plane == 0 ? DPFC_CTL_PLANEA : DPFC_CTL_PLANEB;
        unsigned long stall_watermark = 200;
@@ -1159,7 +1157,7 @@ static void g4x_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        dpfc_ctl = I915_READ(DPFC_CONTROL);
        if (dpfc_ctl & DPFC_CTL_EN) {
                if (dev_priv->cfb_pitch == dev_priv->cfb_pitch / 64 - 1 &&
-                    dev_priv->cfb_fence == obj_priv->fence_reg &&
+                    dev_priv->cfb_fence == obj->fence_reg &&
                    dev_priv->cfb_plane == intel_crtc->plane &&
                    dev_priv->cfb_y == crtc->y)
                        return;
@@ -1170,12 +1168,12 @@ static void g4x_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        }
        dev_priv->cfb_pitch = (dev_priv->cfb_pitch / 64) - 1;
-        dev_priv->cfb_fence = obj_priv->fence_reg;
+        dev_priv->cfb_fence = obj->fence_reg;
        dev_priv->cfb_plane = intel_crtc->plane;
        dev_priv->cfb_y = crtc->y;
        dpfc_ctl = plane | DPFC_SR_EN | DPFC_CTL_LIMIT_1X;
-        if (obj_priv->tiling_mode != I915_TILING_NONE) {
+        if (obj->tiling_mode != I915_TILING_NONE) {
                dpfc_ctl |= DPFC_CTL_FENCE_EN | dev_priv->cfb_fence;
                I915_WRITE(DPFC_CHICKEN, DPFC_HT_MODIFY);
        } else {
@@ -1221,7 +1219,7 @@ static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_framebuffer *fb = crtc->fb;
        struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(intel_fb->obj);
+        struct drm_i915_gem_object *obj = intel_fb->obj;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        int plane = intel_crtc->plane == 0 ? DPFC_CTL_PLANEA : DPFC_CTL_PLANEB;
        unsigned long stall_watermark = 200;
@@ -1230,9 +1228,9 @@ static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        dpfc_ctl = I915_READ(ILK_DPFC_CONTROL);
        if (dpfc_ctl & DPFC_CTL_EN) {
                if (dev_priv->cfb_pitch == dev_priv->cfb_pitch / 64 - 1 &&
-                    dev_priv->cfb_fence == obj_priv->fence_reg &&
+                    dev_priv->cfb_fence == obj->fence_reg &&
                    dev_priv->cfb_plane == intel_crtc->plane &&
-                    dev_priv->cfb_offset == obj_priv->gtt_offset &&
+                    dev_priv->cfb_offset == obj->gtt_offset &&
                    dev_priv->cfb_y == crtc->y)
                        return;
@@ -1242,14 +1240,14 @@ static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
        }
        dev_priv->cfb_pitch = (dev_priv->cfb_pitch / 64) - 1;
-        dev_priv->cfb_fence = obj_priv->fence_reg;
+        dev_priv->cfb_fence = obj->fence_reg;
        dev_priv->cfb_plane = intel_crtc->plane;
-        dev_priv->cfb_offset = obj_priv->gtt_offset;
+        dev_priv->cfb_offset = obj->gtt_offset;
        dev_priv->cfb_y = crtc->y;
        dpfc_ctl &= DPFC_RESERVED;
        dpfc_ctl |= (plane | DPFC_CTL_LIMIT_1X);
-        if (obj_priv->tiling_mode != I915_TILING_NONE) {
+        if (obj->tiling_mode != I915_TILING_NONE) {
                dpfc_ctl |= (DPFC_CTL_FENCE_EN | dev_priv->cfb_fence);
                I915_WRITE(ILK_DPFC_CHICKEN, DPFC_HT_MODIFY);
        } else {
@@ -1260,10 +1258,16 @@ static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
                   (stall_watermark << DPFC_RECOMP_STALL_WM_SHIFT) |
                   (interval << DPFC_RECOMP_TIMER_COUNT_SHIFT));
        I915_WRITE(ILK_DPFC_FENCE_YOFF, crtc->y);
-        I915_WRITE(ILK_FBC_RT_BASE, obj_priv->gtt_offset | ILK_FBC_RT_VALID);
+        I915_WRITE(ILK_FBC_RT_BASE, obj->gtt_offset | ILK_FBC_RT_VALID);
        /* enable it... */
        I915_WRITE(ILK_DPFC_CONTROL, dpfc_ctl | DPFC_CTL_EN);
+        if (IS_GEN6(dev)) {
+                I915_WRITE(SNB_DPFC_CTL_SA,
+                           SNB_CPU_FENCE_ENABLE | dev_priv->cfb_fence);
+                I915_WRITE(DPFC_CPU_FENCE_OFFSET, crtc->y);
+        }
        DRM_DEBUG_KMS("enabled fbc on plane %d\n", intel_crtc->plane);
 }
@@ -1345,7 +1349,7 @@ static void intel_update_fbc(struct drm_device *dev)
        struct intel_crtc *intel_crtc;
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        DRM_DEBUG_KMS("\n");
@@ -1384,9 +1388,9 @@ static void intel_update_fbc(struct drm_device *dev)
        intel_crtc = to_intel_crtc(crtc);
        fb = crtc->fb;
        intel_fb = to_intel_framebuffer(fb);
-        obj_priv = to_intel_bo(intel_fb->obj);
+        obj = intel_fb->obj;
-        if (intel_fb->obj->size > dev_priv->cfb_size) {
+        if (intel_fb->obj->base.size > dev_priv->cfb_size) {
                DRM_DEBUG_KMS("framebuffer too large, disabling "
                              "compression\n");
                dev_priv->no_fbc_reason = FBC_STOLEN_TOO_SMALL;
@@ -1410,7 +1414,7 @@ static void intel_update_fbc(struct drm_device *dev)
                dev_priv->no_fbc_reason = FBC_BAD_PLANE;
                goto out_disable;
        }
-        if (obj_priv->tiling_mode != I915_TILING_X) {
+        if (obj->tiling_mode != I915_TILING_X) {
                DRM_DEBUG_KMS("framebuffer not tiled, disabling compression\n");
                dev_priv->no_fbc_reason = FBC_NOT_TILED;
                goto out_disable;
@@ -1433,14 +1437,13 @@ out_disable:
 int
 intel_pin_and_fence_fb_obj(struct drm_device *dev,
-                           struct drm_gem_object *obj,
+                           struct drm_i915_gem_object *obj,
-                           bool pipelined)
+                           struct intel_ring_buffer *pipelined)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        u32 alignment;
        int ret;
-        switch (obj_priv->tiling_mode) {
+        switch (obj->tiling_mode) {
        case I915_TILING_NONE:
                if (IS_BROADWATER(dev) || IS_CRESTLINE(dev))
                        alignment = 128 * 1024;
@@ -1461,7 +1464,7 @@ intel_pin_and_fence_fb_obj(struct drm_device *dev,
                BUG();
        }
-        ret = i915_gem_object_pin(obj, alignment);
+        ret = i915_gem_object_pin(obj, alignment, true);
        if (ret)
                return ret;
@@ -1474,9 +1477,8 @@ intel_pin_and_fence_fb_obj(struct drm_device *dev,
         * framebuffer compression.  For simplicity, we always install
         * a fence as the cost is not that onerous.
         */
-        if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+        if (obj->tiling_mode != I915_TILING_NONE) {
-            obj_priv->tiling_mode != I915_TILING_NONE) {
+                ret = i915_gem_object_get_fence(obj, pipelined, false);
-                ret = i915_gem_object_get_fence_reg(obj, false);
                if (ret)
                        goto err_unpin;
        }
@@ -1497,8 +1499,7 @@ intel_pipe_set_base_atomic(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct intel_framebuffer *intel_fb;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
-        struct drm_gem_object *obj;
        int plane = intel_crtc->plane;
        unsigned long Start, Offset;
        u32 dspcntr;
@@ -1515,7 +1516,6 @@ intel_pipe_set_base_atomic(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        intel_fb = to_intel_framebuffer(fb);
        obj = intel_fb->obj;
-        obj_priv = to_intel_bo(obj);
        reg = DSPCNTR(plane);
        dspcntr = I915_READ(reg);
@@ -1540,7 +1540,7 @@ intel_pipe_set_base_atomic(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                return -EINVAL;
        }
        if (INTEL_INFO(dev)->gen >= 4) {
-                if (obj_priv->tiling_mode != I915_TILING_NONE)
+                if (obj->tiling_mode != I915_TILING_NONE)
                        dspcntr |= DISPPLANE_TILED;
                else
                        dspcntr &= ~DISPPLANE_TILED;
@@ -1552,7 +1552,7 @@ intel_pipe_set_base_atomic(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        I915_WRITE(reg, dspcntr);
-        Start = obj_priv->gtt_offset;
+        Start = obj->gtt_offset;
        Offset = y * fb->pitch + x * (fb->bits_per_pixel / 8);
        DRM_DEBUG_KMS("Writing base %08lX %08lX %d %d %d\n",
@@ -1598,7 +1598,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
        mutex_lock(&dev->struct_mutex);
        ret = intel_pin_and_fence_fb_obj(dev,
                                         to_intel_framebuffer(crtc->fb)->obj,
-                                         false);
+                                         NULL);
        if (ret != 0) {
                mutex_unlock(&dev->struct_mutex);
                return ret;
@@ -1606,18 +1606,17 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
        if (old_fb) {
                struct drm_i915_private *dev_priv = dev->dev_private;
-                struct drm_gem_object *obj = to_intel_framebuffer(old_fb)->obj;
+                struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj;
-                struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
                wait_event(dev_priv->pending_flip_queue,
-                           atomic_read(&obj_priv->pending_flip) == 0);
+                           atomic_read(&obj->pending_flip) == 0);
                /* Big Hammer, we also need to ensure that any pending
                 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
                 * current scanout is retired before unpinning the old
                 * framebuffer.
                 */
-                ret = i915_gem_object_flush_gpu(obj_priv, false);
+                ret = i915_gem_object_flush_gpu(obj, false);
                if (ret) {
                        i915_gem_object_unpin(to_intel_framebuffer(crtc->fb)->obj);
                        mutex_unlock(&dev->struct_mutex);
@@ -1633,8 +1632,10 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                return ret;
        }
-        if (old_fb)
+        if (old_fb) {
+                intel_wait_for_vblank(dev, intel_crtc->pipe);
                i915_gem_object_unpin(to_intel_framebuffer(old_fb)->obj);
+        }
        mutex_unlock(&dev->struct_mutex);
@@ -1996,31 +1997,31 @@ static void intel_flush_display_plane(struct drm_device *dev,
 static void intel_clear_scanline_wait(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring;
        u32 tmp;
        if (IS_GEN2(dev))
                /* Can't break the hang on i8xx */
                return;
-        tmp = I915_READ(PRB0_CTL);
+        ring = LP_RING(dev_priv);
-        if (tmp & RING_WAIT) {
+        tmp = I915_READ_CTL(ring);
-                I915_WRITE(PRB0_CTL, tmp);
+        if (tmp & RING_WAIT)
-                POSTING_READ(PRB0_CTL);
+                I915_WRITE_CTL(ring, tmp);
-        }
 }
 static void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
 {
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        struct drm_i915_private *dev_priv;
        if (crtc->fb == NULL)
                return;
-        obj_priv = to_intel_bo(to_intel_framebuffer(crtc->fb)->obj);
+        obj = to_intel_framebuffer(crtc->fb)->obj;
        dev_priv = crtc->dev->dev_private;
        wait_event(dev_priv->pending_flip_queue,
-                   atomic_read(&obj_priv->pending_flip) == 0);
+                   atomic_read(&obj->pending_flip) == 0);
 }
 static void ironlake_crtc_enable(struct drm_crtc *crtc)
@@ -2120,9 +2121,11 @@ static void ironlake_crtc_enable(struct drm_crtc *crtc)
                reg = TRANS_DP_CTL(pipe);
                temp = I915_READ(reg);
                temp &= ~(TRANS_DP_PORT_SEL_MASK |
-                          TRANS_DP_SYNC_MASK);
+                          TRANS_DP_SYNC_MASK |
+                          TRANS_DP_BPC_MASK);
                temp |= (TRANS_DP_OUTPUT_ENABLE |
                         TRANS_DP_ENH_FRAMING);
+                temp |= TRANS_DP_8BPC;
                if (crtc->mode.flags & DRM_MODE_FLAG_PHSYNC)
                        temp |= TRANS_DP_HSYNC_ACTIVE_HIGH;
@@ -2712,27 +2715,19 @@ fdi_reduce_ratio(u32 *num, u32 *den)
        }
 }
-#define DATA_N 0x800000
-#define LINK_N 0x80000
 static void
 ironlake_compute_m_n(int bits_per_pixel, int nlanes, int pixel_clock,
                     int link_clock, struct fdi_m_n *m_n)
 {
-        u64 temp;
        m_n->tu = 64; /* default size */
-        temp = (u64) DATA_N * pixel_clock;
+        /* BUG_ON(pixel_clock > INT_MAX / 36); */
-        temp = div_u64(temp, link_clock);
+        m_n->gmch_m = bits_per_pixel * pixel_clock;
-        m_n->gmch_m = div_u64(temp * bits_per_pixel, nlanes);
+        m_n->gmch_n = link_clock * nlanes * 8;
-        m_n->gmch_m >>= 3; /* convert to bytes_per_pixel */
-        m_n->gmch_n = DATA_N;
        fdi_reduce_ratio(&m_n->gmch_m, &m_n->gmch_n);
-        temp = (u64) LINK_N * pixel_clock;
+        m_n->link_m = pixel_clock;
-        m_n->link_m = div_u64(temp, link_clock);
+        m_n->link_n = link_clock;
-        m_n->link_n = LINK_N;
        fdi_reduce_ratio(&m_n->link_m, &m_n->link_n);
 }
@@ -2856,6 +2851,39 @@ static struct intel_watermark_params ironlake_cursor_srwm_info = {
        ILK_FIFO_LINE_SIZE
 };
+static struct intel_watermark_params sandybridge_display_wm_info = {
+        SNB_DISPLAY_FIFO,
+        SNB_DISPLAY_MAXWM,
+        SNB_DISPLAY_DFTWM,
+        2,
+        SNB_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params sandybridge_cursor_wm_info = {
+        SNB_CURSOR_FIFO,
+        SNB_CURSOR_MAXWM,
+        SNB_CURSOR_DFTWM,
+        2,
+        SNB_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params sandybridge_display_srwm_info = {
+        SNB_DISPLAY_SR_FIFO,
+        SNB_DISPLAY_MAX_SRWM,
+        SNB_DISPLAY_DFT_SRWM,
+        2,
+        SNB_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params sandybridge_cursor_srwm_info = {
+        SNB_CURSOR_SR_FIFO,
+        SNB_CURSOR_MAX_SRWM,
+        SNB_CURSOR_DFT_SRWM,
+        2,
+        SNB_FIFO_LINE_SIZE
+};
 /**
 * intel_calculate_wm - calculate watermark level
 * @clock_in_khz: pixel clock
@@ -3389,6 +3417,10 @@ static void i830_update_wm(struct drm_device *dev, int planea_clock, int unused,
 static bool ironlake_compute_wm0(struct drm_device *dev,
                                 int pipe,
+                                 const struct intel_watermark_params *display,
+                                 int display_latency,
+                                 const struct intel_watermark_params *cursor,
+                                 int cursor_latency,
                                 int *plane_wm,
                                 int *cursor_wm)
 {
@@ -3406,22 +3438,20 @@ static bool ironlake_compute_wm0(struct drm_device *dev,
        pixel_size = crtc->fb->bits_per_pixel / 8;
        /* Use the small buffer method to calculate plane watermark */
-        entries = ((clock * pixel_size / 1000) * ILK_LP0_PLANE_LATENCY) / 1000;
+        entries = ((clock * pixel_size / 1000) * display_latency * 100) / 1000;
-        entries = DIV_ROUND_UP(entries,
+        entries = DIV_ROUND_UP(entries, display->cacheline_size);
-                               ironlake_display_wm_info.cacheline_size);
+        *plane_wm = entries + display->guard_size;
-        *plane_wm = entries + ironlake_display_wm_info.guard_size;
+        if (*plane_wm > (int)display->max_wm)
-        if (*plane_wm > (int)ironlake_display_wm_info.max_wm)
+                *plane_wm = display->max_wm;
-                *plane_wm = ironlake_display_wm_info.max_wm;
        /* Use the large buffer method to calculate cursor watermark */
        line_time_us = ((htotal * 1000) / clock);
-        line_count = (ILK_LP0_CURSOR_LATENCY / line_time_us + 1000) / 1000;
+        line_count = (cursor_latency * 100 / line_time_us + 1000) / 1000;
        entries = line_count * 64 * pixel_size;
-        entries = DIV_ROUND_UP(entries,
+        entries = DIV_ROUND_UP(entries, cursor->cacheline_size);
-                               ironlake_cursor_wm_info.cacheline_size);
+        *cursor_wm = entries + cursor->guard_size;
-        *cursor_wm = entries + ironlake_cursor_wm_info.guard_size;
+        if (*cursor_wm > (int)cursor->max_wm)
-        if (*cursor_wm > ironlake_cursor_wm_info.max_wm)
+                *cursor_wm = (int)cursor->max_wm;
-                *cursor_wm = ironlake_cursor_wm_info.max_wm;
        return true;
 }
@@ -3436,7 +3466,12 @@ static void ironlake_update_wm(struct drm_device *dev,
        int tmp;
        enabled = 0;
-        if (ironlake_compute_wm0(dev, 0, &plane_wm, &cursor_wm)) {
+        if (ironlake_compute_wm0(dev, 0,
+                                 &ironlake_display_wm_info,
+                                 ILK_LP0_PLANE_LATENCY,
+                                 &ironlake_cursor_wm_info,
+                                 ILK_LP0_CURSOR_LATENCY,
+                                 &plane_wm, &cursor_wm)) {
                I915_WRITE(WM0_PIPEA_ILK,
                           (plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm);
                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
@@ -3445,7 +3480,12 @@ static void ironlake_update_wm(struct drm_device *dev,
                enabled++;
        }
-        if (ironlake_compute_wm0(dev, 1, &plane_wm, &cursor_wm)) {
+        if (ironlake_compute_wm0(dev, 1,
+                                 &ironlake_display_wm_info,
+                                 ILK_LP0_PLANE_LATENCY,
+                                 &ironlake_cursor_wm_info,
+                                 ILK_LP0_CURSOR_LATENCY,
+                                 &plane_wm, &cursor_wm)) {
                I915_WRITE(WM0_PIPEB_ILK,
                           (plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm);
                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
@@ -3459,7 +3499,7 @@ static void ironlake_update_wm(struct drm_device *dev,
         * display plane is used.
         */
        tmp = 0;
-        if (enabled == 1 && /* XXX disabled due to buggy implmentation? */ 0) {
+        if (enabled == 1) {
                unsigned long line_time_us;
                int small, large, plane_fbc;
                int sr_clock, entries;
@@ -3511,6 +3551,197 @@ static void ironlake_update_wm(struct drm_device *dev,
        /* XXX setup WM2 and WM3 */
 }
+/*
+ * Check the wm result.
+ *
+ * If any calculated watermark values is larger than the maximum value that
+ * can be programmed into the associated watermark register, that watermark
+ * must be disabled.
+ *
+ * Also return true if all of those watermark values is 0, which is set by
+ * sandybridge_compute_srwm, to indicate the latency is ZERO.
+ */
+static bool sandybridge_check_srwm(struct drm_device *dev, int level,
+                                   int fbc_wm, int display_wm, int cursor_wm)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        DRM_DEBUG_KMS("watermark %d: display plane %d, fbc lines %d,"
+                      " cursor %d\n", level, display_wm, fbc_wm, cursor_wm);
+        if (fbc_wm > SNB_FBC_MAX_SRWM) {
+                DRM_DEBUG_KMS("fbc watermark(%d) is too large(%d), disabling wm%d+\n",
+                                fbc_wm, SNB_FBC_MAX_SRWM, level);
+                /* fbc has it's own way to disable FBC WM */
+                I915_WRITE(DISP_ARB_CTL,
+                           I915_READ(DISP_ARB_CTL) | DISP_FBC_WM_DIS);
+                return false;
+        }
+        if (display_wm > SNB_DISPLAY_MAX_SRWM) {
+                DRM_DEBUG_KMS("display watermark(%d) is too large(%d), disabling wm%d+\n",
+                                display_wm, SNB_DISPLAY_MAX_SRWM, level);
+                return false;
+        }
+        if (cursor_wm > SNB_CURSOR_MAX_SRWM) {
+                DRM_DEBUG_KMS("cursor watermark(%d) is too large(%d), disabling wm%d+\n",
+                                cursor_wm, SNB_CURSOR_MAX_SRWM, level);
+                return false;
+        }
+        if (!(fbc_wm || display_wm || cursor_wm)) {
+                DRM_DEBUG_KMS("latency %d is 0, disabling wm%d+\n", level, level);
+                return false;
+        }
+        return true;
+}
+/*
+ * Compute watermark values of WM[1-3],
+ */
+static bool sandybridge_compute_srwm(struct drm_device *dev, int level,
+                                     int hdisplay, int htotal, int pixel_size,
+                                     int clock, int latency_ns, int *fbc_wm,
+                                     int *display_wm, int *cursor_wm)
+{
+        unsigned long line_time_us;
+        int small, large;
+        int entries;
+        int line_count, line_size;
+        if (!latency_ns) {
+                *fbc_wm = *display_wm = *cursor_wm = 0;
+                return false;
+        }
+        line_time_us = (htotal * 1000) / clock;
+        line_count = (latency_ns / line_time_us + 1000) / 1000;
+        line_size = hdisplay * pixel_size;
+        /* Use the minimum of the small and large buffer method for primary */
+        small = ((clock * pixel_size / 1000) * latency_ns) / 1000;
+        large = line_count * line_size;
+        entries = DIV_ROUND_UP(min(small, large),
+                                sandybridge_display_srwm_info.cacheline_size);
+        *display_wm = entries + sandybridge_display_srwm_info.guard_size;
+        /*
+         * Spec said:
+         * FBC WM = ((Final Primary WM * 64) / number of bytes per line) + 2
+         */
+        *fbc_wm = DIV_ROUND_UP(*display_wm * 64, line_size) + 2;
+        /* calculate the self-refresh watermark for display cursor */
+        entries = line_count * pixel_size * 64;
+        entries = DIV_ROUND_UP(entries,
+                               sandybridge_cursor_srwm_info.cacheline_size);
+        *cursor_wm = entries + sandybridge_cursor_srwm_info.guard_size;
+        return sandybridge_check_srwm(dev, level,
+                                      *fbc_wm, *display_wm, *cursor_wm);
+}
+static void sandybridge_update_wm(struct drm_device *dev,
+                               int planea_clock, int planeb_clock,
+                               int hdisplay, int htotal,
+                               int pixel_size)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int latency = SNB_READ_WM0_LATENCY();
+        int fbc_wm, plane_wm, cursor_wm, enabled;
+        int clock;
+        enabled = 0;
+        if (ironlake_compute_wm0(dev, 0,
+                                 &sandybridge_display_wm_info, latency,
+                                 &sandybridge_cursor_wm_info, latency,
+                                 &plane_wm, &cursor_wm)) {
+                I915_WRITE(WM0_PIPEA_ILK,
+                           (plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm);
+                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
+                              " plane %d, " "cursor: %d\n",
+                              plane_wm, cursor_wm);
+                enabled++;
+        }
+        if (ironlake_compute_wm0(dev, 1,
+                                 &sandybridge_display_wm_info, latency,
+                                 &sandybridge_cursor_wm_info, latency,
+                                 &plane_wm, &cursor_wm)) {
+                I915_WRITE(WM0_PIPEB_ILK,
+                           (plane_wm << WM0_PIPE_PLANE_SHIFT) | cursor_wm);
+                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
+                              " plane %d, cursor: %d\n",
+                              plane_wm, cursor_wm);
+                enabled++;
+        }
+        /*
+         * Calculate and update the self-refresh watermark only when one
+         * display plane is used.
+         *
+         * SNB support 3 levels of watermark.
+         *
+         * WM1/WM2/WM2 watermarks have to be enabled in the ascending order,
+         * and disabled in the descending order
+         *
+         */
+        I915_WRITE(WM3_LP_ILK, 0);
+        I915_WRITE(WM2_LP_ILK, 0);
+        I915_WRITE(WM1_LP_ILK, 0);
+        if (enabled != 1)
+                return;
+        clock = planea_clock ? planea_clock : planeb_clock;
+        /* WM1 */
+        if (!sandybridge_compute_srwm(dev, 1, hdisplay, htotal, pixel_size,
+                                      clock, SNB_READ_WM1_LATENCY() * 500,
+                                      &fbc_wm, &plane_wm, &cursor_wm))
+                return;
+        I915_WRITE(WM1_LP_ILK,
+                   WM1_LP_SR_EN |
+                   (SNB_READ_WM1_LATENCY() << WM1_LP_LATENCY_SHIFT) |
+                   (fbc_wm << WM1_LP_FBC_SHIFT) |
+                   (plane_wm << WM1_LP_SR_SHIFT) |
+                   cursor_wm);
+        /* WM2 */
+        if (!sandybridge_compute_srwm(dev, 2,
+                                      hdisplay, htotal, pixel_size,
+                                      clock, SNB_READ_WM2_LATENCY() * 500,
+                                      &fbc_wm, &plane_wm, &cursor_wm))
+                return;
+        I915_WRITE(WM2_LP_ILK,
+                   WM2_LP_EN |
+                   (SNB_READ_WM2_LATENCY() << WM1_LP_LATENCY_SHIFT) |
+                   (fbc_wm << WM1_LP_FBC_SHIFT) |
+                   (plane_wm << WM1_LP_SR_SHIFT) |
+                   cursor_wm);
+        /* WM3 */
+        if (!sandybridge_compute_srwm(dev, 3,
+                                      hdisplay, htotal, pixel_size,
+                                      clock, SNB_READ_WM3_LATENCY() * 500,
+                                      &fbc_wm, &plane_wm, &cursor_wm))
+                return;
+        I915_WRITE(WM3_LP_ILK,
+                   WM3_LP_EN |
+                   (SNB_READ_WM3_LATENCY() << WM1_LP_LATENCY_SHIFT) |
+                   (fbc_wm << WM1_LP_FBC_SHIFT) |
+                   (plane_wm << WM1_LP_SR_SHIFT) |
+                   cursor_wm);
+}
 /**
 * intel_update_watermarks - update FIFO watermark values based on current modes
 *
@@ -3666,7 +3897,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
         * refclk, or FALSE.  The returned values represent the clock equation:
         * reflck * (5 * (m1 + 2) + (m2 + 2)) / (n + 2) / p1 / p2.
         */
-        limit = intel_limit(crtc);
+        limit = intel_limit(crtc, refclk);
        ok = limit->find_pll(limit, crtc, adjusted_mode->clock, refclk, &clock);
        if (!ok) {
                DRM_ERROR("Couldn't find PLL settings for mode!\n");
@@ -3716,6 +3947,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
        /* FDI link */
        if (HAS_PCH_SPLIT(dev)) {
+                int pixel_multiplier = intel_mode_get_pixel_multiplier(adjusted_mode);
                int lane = 0, link_bw, bpp;
                /* CPU eDP doesn't require FDI link, so just set DP M/N
                   according to current link config */
@@ -3799,6 +4031,8 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                intel_crtc->fdi_lanes = lane;
+                if (pixel_multiplier > 1)
+                        link_bw *= pixel_multiplier;
                ironlake_compute_m_n(bpp, lane, target_clock, link_bw, &m_n);
        }
@@ -3860,6 +4094,22 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                                reduced_clock.m2;
        }
+        /* Enable autotuning of the PLL clock (if permissible) */
+        if (HAS_PCH_SPLIT(dev)) {
+                int factor = 21;
+                if (is_lvds) {
+                        if ((dev_priv->lvds_use_ssc &&
+                             dev_priv->lvds_ssc_freq == 100) ||
+                            (I915_READ(PCH_LVDS) & LVDS_CLKB_POWER_MASK) == LVDS_CLKB_POWER_UP)
+                                factor = 25;
+                } else if (is_sdvo && is_tv)
+                        factor = 20;
+                if (clock.m1 < factor * clock.n)
+                        fp |= FP_CB_TUNE;
+        }
        dpll = 0;
        if (!HAS_PCH_SPLIT(dev))
                dpll = DPLL_VGA_MODE_DIS;
@@ -4074,7 +4324,6 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
        }
        if (!has_edp_encoder || intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
-                I915_WRITE(fp_reg, fp);
                I915_WRITE(dpll_reg, dpll);
                /* Wait for the clocks to stabilize. */
@@ -4092,13 +4341,13 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                        }
                        I915_WRITE(DPLL_MD(pipe), temp);
                } else {
-                        /* write it again -- the BIOS does, after all */
+                        /* The pixel multiplier can only be updated once the
+                         * DPLL is enabled and the clocks are stable.
+                         *
+                         * So write it again.
+                         */
                        I915_WRITE(dpll_reg, dpll);
                }
-                /* Wait for the clocks to stabilize. */
-                POSTING_READ(dpll_reg);
-                udelay(150);
        }
        intel_crtc->lowfreq_avail = false;
@@ -4334,15 +4583,14 @@ static void intel_crtc_update_cursor(struct drm_crtc *crtc,
 }
 static int intel_crtc_cursor_set(struct drm_crtc *crtc,
-                                 struct drm_file *file_priv,
+                                 struct drm_file *file,
                                 uint32_t handle,
                                 uint32_t width, uint32_t height)
 {
        struct drm_device *dev = crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        struct drm_gem_object *bo;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        uint32_t addr;
        int ret;
@@ -4352,7 +4600,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        if (!handle) {
                DRM_DEBUG_KMS("cursor off\n");
                addr = 0;
-                bo = NULL;
+                obj = NULL;
                mutex_lock(&dev->struct_mutex);
                goto finish;
        }
@@ -4363,13 +4611,11 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                return -EINVAL;
        }
-        bo = drm_gem_object_lookup(dev, file_priv, handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, file, handle));
-        if (!bo)
+        if (!obj)
                return -ENOENT;
-        obj_priv = to_intel_bo(bo);
+        if (obj->base.size < width * height * 4) {
-        if (bo->size < width * height * 4) {
                DRM_ERROR("buffer is to small\n");
                ret = -ENOMEM;
                goto fail;
@@ -4378,29 +4624,41 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        /* we only need to pin inside GTT if cursor is non-phy */
        mutex_lock(&dev->struct_mutex);
        if (!dev_priv->info->cursor_needs_physical) {
-                ret = i915_gem_object_pin(bo, PAGE_SIZE);
+                if (obj->tiling_mode) {
+                        DRM_ERROR("cursor cannot be tiled\n");
+                        ret = -EINVAL;
+                        goto fail_locked;
+                }
+                ret = i915_gem_object_pin(obj, PAGE_SIZE, true);
                if (ret) {
                        DRM_ERROR("failed to pin cursor bo\n");
                        goto fail_locked;
                }
-                ret = i915_gem_object_set_to_gtt_domain(bo, 0);
+                ret = i915_gem_object_set_to_gtt_domain(obj, 0);
                if (ret) {
                        DRM_ERROR("failed to move cursor bo into the GTT\n");
                        goto fail_unpin;
                }
-                addr = obj_priv->gtt_offset;
+                ret = i915_gem_object_put_fence(obj);
+                if (ret) {
+                        DRM_ERROR("failed to move cursor bo into the GTT\n");
+                        goto fail_unpin;
+                }
+                addr = obj->gtt_offset;
        } else {
                int align = IS_I830(dev) ? 16 * 1024 : 256;
-                ret = i915_gem_attach_phys_object(dev, bo,
+                ret = i915_gem_attach_phys_object(dev, obj,
                                                  (intel_crtc->pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1,
                                                  align);
                if (ret) {
                        DRM_ERROR("failed to attach phys object\n");
                        goto fail_locked;
                }
-                addr = obj_priv->phys_obj->handle->busaddr;
+                addr = obj->phys_obj->handle->busaddr;
        }
        if (IS_GEN2(dev))
@@ -4409,17 +4667,17 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 finish:
        if (intel_crtc->cursor_bo) {
                if (dev_priv->info->cursor_needs_physical) {
-                        if (intel_crtc->cursor_bo != bo)
+                        if (intel_crtc->cursor_bo != obj)
                                i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
                } else
                        i915_gem_object_unpin(intel_crtc->cursor_bo);
-                drm_gem_object_unreference(intel_crtc->cursor_bo);
+                drm_gem_object_unreference(&intel_crtc->cursor_bo->base);
        }
        mutex_unlock(&dev->struct_mutex);
        intel_crtc->cursor_addr = addr;
-        intel_crtc->cursor_bo = bo;
+        intel_crtc->cursor_bo = obj;
        intel_crtc->cursor_width = width;
        intel_crtc->cursor_height = height;
@@ -4427,11 +4685,11 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        return 0;
 fail_unpin:
-        i915_gem_object_unpin(bo);
+        i915_gem_object_unpin(obj);
 fail_locked:
        mutex_unlock(&dev->struct_mutex);
 fail:
-        drm_gem_object_unreference_unlocked(bo);
+        drm_gem_object_unreference_unlocked(&obj->base);
        return ret;
 }
@@ -4742,8 +5000,14 @@ static void intel_gpu_idle_timer(unsigned long arg)
        struct drm_device *dev = (struct drm_device *)arg;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        dev_priv->busy = false;
+        if (!list_empty(&dev_priv->mm.active_list)) {
+                /* Still processing requests, so just re-arm the timer. */
+                mod_timer(&dev_priv->idle_timer, jiffies +
+                          msecs_to_jiffies(GPU_IDLE_TIMEOUT));
+                return;
+        }
+        dev_priv->busy = false;
        queue_work(dev_priv->wq, &dev_priv->idle_work);
 }
@@ -4754,9 +5018,17 @@ static void intel_crtc_idle_timer(unsigned long arg)
        struct intel_crtc *intel_crtc = (struct intel_crtc *)arg;
        struct drm_crtc *crtc = &intel_crtc->base;
        drm_i915_private_t *dev_priv = crtc->dev->dev_private;
+        struct intel_framebuffer *intel_fb;
-        intel_crtc->busy = false;
+        intel_fb = to_intel_framebuffer(crtc->fb);
+        if (intel_fb && intel_fb->obj->active) {
+                /* The framebuffer is still being accessed by the GPU. */
+                mod_timer(&intel_crtc->idle_timer, jiffies +
+                          msecs_to_jiffies(CRTC_IDLE_TIMEOUT));
+                return;
+        }
+        intel_crtc->busy = false;
        queue_work(dev_priv->wq, &dev_priv->idle_work);
 }
@@ -4891,7 +5163,7 @@ static void intel_idle_update(struct work_struct *work)
 * buffer), we'll also mark the display as busy, so we know to increase its
 * clock frequency.
 */
-void intel_mark_busy(struct drm_device *dev, struct drm_gem_object *obj)
+void intel_mark_busy(struct drm_device *dev, struct drm_i915_gem_object *obj)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_crtc *crtc = NULL;
@@ -4972,8 +5244,9 @@ static void intel_unpin_work_fn(struct work_struct *__work)
        mutex_lock(&work->dev->struct_mutex);
        i915_gem_object_unpin(work->old_fb_obj);
-        drm_gem_object_unreference(work->pending_flip_obj);
+        drm_gem_object_unreference(&work->pending_flip_obj->base);
-        drm_gem_object_unreference(work->old_fb_obj);
+        drm_gem_object_unreference(&work->old_fb_obj->base);
        mutex_unlock(&work->dev->struct_mutex);
        kfree(work);
 }
@@ -4984,15 +5257,17 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct intel_unpin_work *work;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
        struct drm_pending_vblank_event *e;
-        struct timeval now;
+        struct timeval tnow, tvbl;
        unsigned long flags;
        /* Ignore early vblank irqs */
        if (intel_crtc == NULL)
                return;
+        do_gettimeofday(&tnow);
        spin_lock_irqsave(&dev->event_lock, flags);
        work = intel_crtc->unpin_work;
        if (work == NULL || !work->pending) {
@@ -5001,26 +5276,49 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
        }
        intel_crtc->unpin_work = NULL;
-        drm_vblank_put(dev, intel_crtc->pipe);
        if (work->event) {
                e = work->event;
-                do_gettimeofday(&now);
+                e->event.sequence = drm_vblank_count_and_time(dev, intel_crtc->pipe, &tvbl);
-                e->event.sequence = drm_vblank_count(dev, intel_crtc->pipe);
-                e->event.tv_sec = now.tv_sec;
+                /* Called before vblank count and timestamps have
-                e->event.tv_usec = now.tv_usec;
+                 * been updated for the vblank interval of flip
+                 * completion? Need to increment vblank count and
+                 * add one videorefresh duration to returned timestamp
+                 * to account for this. We assume this happened if we
+                 * get called over 0.9 frame durations after the last
+                 * timestamped vblank.
+                 *
+                 * This calculation can not be used with vrefresh rates
+                 * below 5Hz (10Hz to be on the safe side) without
+                 * promoting to 64 integers.
+                 */
+                if (10 * (timeval_to_ns(&tnow) - timeval_to_ns(&tvbl)) >
+                    9 * crtc->framedur_ns) {
+                        e->event.sequence++;
+                        tvbl = ns_to_timeval(timeval_to_ns(&tvbl) +
+                                             crtc->framedur_ns);
+                }
+                e->event.tv_sec = tvbl.tv_sec;
+                e->event.tv_usec = tvbl.tv_usec;
                list_add_tail(&e->base.link,
                              &e->base.file_priv->event_list);
                wake_up_interruptible(&e->base.file_priv->event_wait);
        }
+        drm_vblank_put(dev, intel_crtc->pipe);
        spin_unlock_irqrestore(&dev->event_lock, flags);
-        obj_priv = to_intel_bo(work->old_fb_obj);
+        obj = work->old_fb_obj;
        atomic_clear_mask(1 << intel_crtc->plane,
-                          &obj_priv->pending_flip.counter);
+                          &obj->pending_flip.counter);
-        if (atomic_read(&obj_priv->pending_flip) == 0)
+        if (atomic_read(&obj->pending_flip) == 0)
                wake_up(&dev_priv->pending_flip_queue);
        schedule_work(&work->work);
        trace_i915_flip_complete(intel_crtc->plane, work->pending_flip_obj);
@@ -5066,8 +5364,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        struct drm_device *dev = crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_framebuffer *intel_fb;
-        struct drm_i915_gem_object *obj_priv;
+        struct drm_i915_gem_object *obj;
-        struct drm_gem_object *obj;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct intel_unpin_work *work;
        unsigned long flags, offset;
@@ -5101,13 +5398,13 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        obj = intel_fb->obj;
        mutex_lock(&dev->struct_mutex);
-        ret = intel_pin_and_fence_fb_obj(dev, obj, true);
+        ret = intel_pin_and_fence_fb_obj(dev, obj, LP_RING(dev_priv));
        if (ret)
                goto cleanup_work;
        /* Reference the objects for the scheduled work. */
-        drm_gem_object_reference(work->old_fb_obj);
+        drm_gem_object_reference(&work->old_fb_obj->base);
-        drm_gem_object_reference(obj);
+        drm_gem_object_reference(&obj->base);
        crtc->fb = fb;
@@ -5115,22 +5412,16 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        if (ret)
                goto cleanup_objs;
-        /* Block clients from rendering to the new back buffer until
-         * the flip occurs and the object is no longer visible.
-         */
-        atomic_add(1 << intel_crtc->plane,
-                   &to_intel_bo(work->old_fb_obj)->pending_flip);
-        work->pending_flip_obj = obj;
-        obj_priv = to_intel_bo(obj);
        if (IS_GEN3(dev) || IS_GEN2(dev)) {
                u32 flip_mask;
                /* Can't queue multiple flips, so wait for the previous
                 * one to finish before executing the next.
                 */
-                BEGIN_LP_RING(2);
+                ret = BEGIN_LP_RING(2);
+                if (ret)
+                        goto cleanup_objs;
                if (intel_crtc->plane)
                        flip_mask = MI_WAIT_FOR_PLANE_B_FLIP;
                else
@@ -5140,18 +5431,28 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
                ADVANCE_LP_RING();
        }
+        work->pending_flip_obj = obj;
        work->enable_stall_check = true;
        /* Offset into the new buffer for cases of shared fbs between CRTCs */
        offset = crtc->y * fb->pitch + crtc->x * fb->bits_per_pixel/8;
-        BEGIN_LP_RING(4);
+        ret = BEGIN_LP_RING(4);
-        switch(INTEL_INFO(dev)->gen) {
+        if (ret)
+                goto cleanup_objs;
+        /* Block clients from rendering to the new back buffer until
+         * the flip occurs and the object is no longer visible.
+         */
+        atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
+        switch (INTEL_INFO(dev)->gen) {
        case 2:
                OUT_RING(MI_DISPLAY_FLIP |
                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
                OUT_RING(fb->pitch);
-                OUT_RING(obj_priv->gtt_offset + offset);
+                OUT_RING(obj->gtt_offset + offset);
                OUT_RING(MI_NOOP);
                break;
@@ -5159,7 +5460,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
                OUT_RING(MI_DISPLAY_FLIP_I915 |
                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
                OUT_RING(fb->pitch);
-                OUT_RING(obj_priv->gtt_offset + offset);
+                OUT_RING(obj->gtt_offset + offset);
                OUT_RING(MI_NOOP);
                break;
@@ -5172,7 +5473,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
                OUT_RING(MI_DISPLAY_FLIP |
                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
                OUT_RING(fb->pitch);
-                OUT_RING(obj_priv->gtt_offset | obj_priv->tiling_mode);
+                OUT_RING(obj->gtt_offset | obj->tiling_mode);
                /* XXX Enabling the panel-fitter across page-flip is so far
                 * untested on non-native modes, so ignore it for now.
@@ -5186,8 +5487,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        case 6:
                OUT_RING(MI_DISPLAY_FLIP |
                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
-                OUT_RING(fb->pitch | obj_priv->tiling_mode);
+                OUT_RING(fb->pitch | obj->tiling_mode);
-                OUT_RING(obj_priv->gtt_offset);
+                OUT_RING(obj->gtt_offset);
                pf = I915_READ(pipe == 0 ? PFA_CTL_1 : PFB_CTL_1) & PF_ENABLE;
                pipesrc = I915_READ(pipe == 0 ? PIPEASRC : PIPEBSRC) & 0x0fff0fff;
@@ -5203,8 +5504,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        return 0;
 cleanup_objs:
-        drm_gem_object_unreference(work->old_fb_obj);
+        drm_gem_object_unreference(&work->old_fb_obj->base);
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 cleanup_work:
        mutex_unlock(&dev->struct_mutex);
@@ -5236,6 +5537,55 @@ static const struct drm_crtc_funcs intel_crtc_funcs = {
        .page_flip = intel_crtc_page_flip,
 };
+static void intel_sanitize_modesetting(struct drm_device *dev,
+                                       int pipe, int plane)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 reg, val;
+        if (HAS_PCH_SPLIT(dev))
+                return;
+        /* Who knows what state these registers were left in by the BIOS or
+         * grub?
+         *
+         * If we leave the registers in a conflicting state (e.g. with the
+         * display plane reading from the other pipe than the one we intend
+         * to use) then when we attempt to teardown the active mode, we will
+         * not disable the pipes and planes in the correct order -- leaving
+         * a plane reading from a disabled pipe and possibly leading to
+         * undefined behaviour.
+         */
+        reg = DSPCNTR(plane);
+        val = I915_READ(reg);
+        if ((val & DISPLAY_PLANE_ENABLE) == 0)
+                return;
+        if (!!(val & DISPPLANE_SEL_PIPE_MASK) == pipe)
+                return;
+        /* This display plane is active and attached to the other CPU pipe. */
+        pipe = !pipe;
+        /* Disable the plane and wait for it to stop reading from the pipe. */
+        I915_WRITE(reg, val & ~DISPLAY_PLANE_ENABLE);
+        intel_flush_display_plane(dev, plane);
+        if (IS_GEN2(dev))
+                intel_wait_for_vblank(dev, pipe);
+        if (pipe == 0 && (dev_priv->quirks & QUIRK_PIPEA_FORCE))
+                return;
+        /* Switch off the pipe. */
+        reg = PIPECONF(pipe);
+        val = I915_READ(reg);
+        if (val & PIPECONF_ENABLE) {
+                I915_WRITE(reg, val & ~PIPECONF_ENABLE);
+                intel_wait_for_pipe_off(dev, pipe);
+        }
+}
 static void intel_crtc_init(struct drm_device *dev, int pipe)
 {
@@ -5287,10 +5637,12 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
        setup_timer(&intel_crtc->idle_timer, intel_crtc_idle_timer,
                    (unsigned long)intel_crtc);
+        intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
 }
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
-                                struct drm_file *file_priv)
+                                struct drm_file *file)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_get_pipe_from_crtc_id *pipe_from_crtc_id = data;
@@ -5336,9 +5688,14 @@ static void intel_setup_outputs(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_encoder *encoder;
        bool dpd_is_edp = false;
+        bool has_lvds = false;
        if (IS_MOBILE(dev) && !IS_I830(dev))
-                intel_lvds_init(dev);
+                has_lvds = intel_lvds_init(dev);
+        if (!has_lvds && !HAS_PCH_SPLIT(dev)) {
+                /* disable the panel fitter on everything but LVDS */
+                I915_WRITE(PFIT_CONTROL, 0);
+        }
        if (HAS_PCH_SPLIT(dev)) {
                dpd_is_edp = intel_dpd_is_edp(dev);
@@ -5435,19 +5792,19 @@ static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb)
        struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
        drm_framebuffer_cleanup(fb);
-        drm_gem_object_unreference_unlocked(intel_fb->obj);
+        drm_gem_object_unreference_unlocked(&intel_fb->obj->base);
        kfree(intel_fb);
 }
 static int intel_user_framebuffer_create_handle(struct drm_framebuffer *fb,
-                                                struct drm_file *file_priv,
+                                                struct drm_file *file,
                                                unsigned int *handle)
 {
        struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
-        struct drm_gem_object *object = intel_fb->obj;
+        struct drm_i915_gem_object *obj = intel_fb->obj;
-        return drm_gem_handle_create(file_priv, object, handle);
+        return drm_gem_handle_create(file, &obj->base, handle);
 }
 static const struct drm_framebuffer_funcs intel_fb_funcs = {
@@ -5458,12 +5815,11 @@ static const struct drm_framebuffer_funcs intel_fb_funcs = {
 int intel_framebuffer_init(struct drm_device *dev,
                           struct intel_framebuffer *intel_fb,
                           struct drm_mode_fb_cmd *mode_cmd,
-                           struct drm_gem_object *obj)
+                           struct drm_i915_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        int ret;
-        if (obj_priv->tiling_mode == I915_TILING_Y)
+        if (obj->tiling_mode == I915_TILING_Y)
                return -EINVAL;
        if (mode_cmd->pitch & 63)
@@ -5495,11 +5851,11 @@ intel_user_framebuffer_create(struct drm_device *dev,
                              struct drm_file *filp,
                              struct drm_mode_fb_cmd *mode_cmd)
 {
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
        struct intel_framebuffer *intel_fb;
        int ret;
-        obj = drm_gem_object_lookup(dev, filp, mode_cmd->handle);
+        obj = to_intel_bo(drm_gem_object_lookup(dev, filp, mode_cmd->handle));
        if (!obj)
                return ERR_PTR(-ENOENT);
@@ -5507,10 +5863,9 @@ intel_user_framebuffer_create(struct drm_device *dev,
        if (!intel_fb)
                return ERR_PTR(-ENOMEM);
-        ret = intel_framebuffer_init(dev, intel_fb,
+        ret = intel_framebuffer_init(dev, intel_fb, mode_cmd, obj);
-                                     mode_cmd, obj);
        if (ret) {
-                drm_gem_object_unreference_unlocked(obj);
+                drm_gem_object_unreference_unlocked(&obj->base);
                kfree(intel_fb);
                return ERR_PTR(ret);
        }
@@ -5523,10 +5878,10 @@ static const struct drm_mode_config_funcs intel_mode_funcs = {
        .output_poll_changed = intel_fb_output_poll_changed,
 };
-static struct drm_gem_object *
+static struct drm_i915_gem_object *
 intel_alloc_context_page(struct drm_device *dev)
 {
-        struct drm_gem_object *ctx;
+        struct drm_i915_gem_object *ctx;
        int ret;
        ctx = i915_gem_alloc_object(dev, 4096);
@@ -5536,7 +5891,7 @@ intel_alloc_context_page(struct drm_device *dev)
        }
        mutex_lock(&dev->struct_mutex);
-        ret = i915_gem_object_pin(ctx, 4096);
+        ret = i915_gem_object_pin(ctx, 4096, true);
        if (ret) {
                DRM_ERROR("failed to pin power context: %d\n", ret);
                goto err_unref;
@@ -5554,7 +5909,7 @@ intel_alloc_context_page(struct drm_device *dev)
 err_unpin:
        i915_gem_object_unpin(ctx);
 err_unref:
-        drm_gem_object_unreference(ctx);
+        drm_gem_object_unreference(&ctx->base);
        mutex_unlock(&dev->struct_mutex);
        return NULL;
 }
@@ -5666,6 +6021,25 @@ void ironlake_disable_drps(struct drm_device *dev)
 }
+void gen6_set_rps(struct drm_device *dev, u8 val)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 swreq;
+        swreq = (val & 0x3ff) << 25;
+        I915_WRITE(GEN6_RPNSWREQ, swreq);
+}
+void gen6_disable_rps(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        I915_WRITE(GEN6_RPNSWREQ, 1 << 31);
+        I915_WRITE(GEN6_PMINTRMSK, 0xffffffff);
+        I915_WRITE(GEN6_PMIER, 0);
+        I915_WRITE(GEN6_PMIIR, I915_READ(GEN6_PMIIR));
+}
 static unsigned long intel_pxfreq(u32 vidfreq)
 {
        unsigned long freq;
@@ -5752,7 +6126,96 @@ void intel_init_emon(struct drm_device *dev)
        dev_priv->corr = (lcfuse & LCFUSE_HIV_MASK);
 }
-void intel_init_clock_gating(struct drm_device *dev)
+void gen6_enable_rps(struct drm_i915_private *dev_priv)
+{
+        int i;
+        /* Here begins a magic sequence of register writes to enable
+         * auto-downclocking.
+         *
+         * Perhaps there might be some value in exposing these to
+         * userspace...
+         */
+        I915_WRITE(GEN6_RC_STATE, 0);
+        __gen6_force_wake_get(dev_priv);
+        /* disable the counters and set deterministic thresholds */
+        I915_WRITE(GEN6_RC_CONTROL, 0);
+        I915_WRITE(GEN6_RC1_WAKE_RATE_LIMIT, 1000 << 16);
+        I915_WRITE(GEN6_RC6_WAKE_RATE_LIMIT, 40 << 16 | 30);
+        I915_WRITE(GEN6_RC6pp_WAKE_RATE_LIMIT, 30);
+        I915_WRITE(GEN6_RC_EVALUATION_INTERVAL, 125000);
+        I915_WRITE(GEN6_RC_IDLE_HYSTERSIS, 25);
+        for (i = 0; i < I915_NUM_RINGS; i++)
+                I915_WRITE(RING_MAX_IDLE(dev_priv->ring[i].mmio_base), 10);
+        I915_WRITE(GEN6_RC_SLEEP, 0);
+        I915_WRITE(GEN6_RC1e_THRESHOLD, 1000);
+        I915_WRITE(GEN6_RC6_THRESHOLD, 50000);
+        I915_WRITE(GEN6_RC6p_THRESHOLD, 100000);
+        I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
+        I915_WRITE(GEN6_RC_CONTROL,
+                   GEN6_RC_CTL_RC6p_ENABLE |
+                   GEN6_RC_CTL_RC6_ENABLE |
+                   GEN6_RC_CTL_EI_MODE(1) |
+                   GEN6_RC_CTL_HW_ENABLE);
+        I915_WRITE(GEN6_RPNSWREQ,
+                   GEN6_FREQUENCY(10) |
+                   GEN6_OFFSET(0) |
+                   GEN6_AGGRESSIVE_TURBO);
+        I915_WRITE(GEN6_RC_VIDEO_FREQ,
+                   GEN6_FREQUENCY(12));
+        I915_WRITE(GEN6_RP_DOWN_TIMEOUT, 1000000);
+        I915_WRITE(GEN6_RP_INTERRUPT_LIMITS,
+                   18 << 24 |
+                   6 << 16);
+        I915_WRITE(GEN6_RP_UP_THRESHOLD, 90000);
+        I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 100000);
+        I915_WRITE(GEN6_RP_UP_EI, 100000);
+        I915_WRITE(GEN6_RP_DOWN_EI, 300000);
+        I915_WRITE(GEN6_RP_IDLE_HYSTERSIS, 10);
+        I915_WRITE(GEN6_RP_CONTROL,
+                   GEN6_RP_MEDIA_TURBO |
+                   GEN6_RP_USE_NORMAL_FREQ |
+                   GEN6_RP_MEDIA_IS_GFX |
+                   GEN6_RP_ENABLE |
+                   GEN6_RP_UP_BUSY_MAX |
+                   GEN6_RP_DOWN_BUSY_MIN);
+        if (wait_for((I915_READ(GEN6_PCODE_MAILBOX) & GEN6_PCODE_READY) == 0,
+                     500))
+                DRM_ERROR("timeout waiting for pcode mailbox to become idle\n");
+        I915_WRITE(GEN6_PCODE_DATA, 0);
+        I915_WRITE(GEN6_PCODE_MAILBOX,
+                   GEN6_PCODE_READY |
+                   GEN6_PCODE_WRITE_MIN_FREQ_TABLE);
+        if (wait_for((I915_READ(GEN6_PCODE_MAILBOX) & GEN6_PCODE_READY) == 0,
+                     500))
+                DRM_ERROR("timeout waiting for pcode mailbox to finish\n");
+        /* requires MSI enabled */
+        I915_WRITE(GEN6_PMIER,
+                   GEN6_PM_MBOX_EVENT |
+                   GEN6_PM_THERMAL_EVENT |
+                   GEN6_PM_RP_DOWN_TIMEOUT |
+                   GEN6_PM_RP_UP_THRESHOLD |
+                   GEN6_PM_RP_DOWN_THRESHOLD |
+                   GEN6_PM_RP_UP_EI_EXPIRED |
+                   GEN6_PM_RP_DOWN_EI_EXPIRED);
+        I915_WRITE(GEN6_PMIMR, 0);
+        /* enable all PM interrupts */
+        I915_WRITE(GEN6_PMINTRMSK, 0);
+        __gen6_force_wake_put(dev_priv);
+}
+void intel_enable_clock_gating(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -5800,9 +6263,9 @@ void intel_init_clock_gating(struct drm_device *dev)
                        I915_WRITE(DISP_ARB_CTL,
                                        (I915_READ(DISP_ARB_CTL) |
                                                DISP_FBC_WM_DIS));
-                I915_WRITE(WM3_LP_ILK, 0);
+                        I915_WRITE(WM3_LP_ILK, 0);
-                I915_WRITE(WM2_LP_ILK, 0);
+                        I915_WRITE(WM2_LP_ILK, 0);
-                I915_WRITE(WM1_LP_ILK, 0);
+                        I915_WRITE(WM1_LP_ILK, 0);
                }
                /*
                 * Based on the document from hardware guys the following bits
@@ -5824,7 +6287,49 @@ void intel_init_clock_gating(struct drm_device *dev)
                                   ILK_DPFC_DIS2 |
                                   ILK_CLK_FBC);
                }
-                return;
+                I915_WRITE(ILK_DISPLAY_CHICKEN2,
+                           I915_READ(ILK_DISPLAY_CHICKEN2) |
+                           ILK_ELPIN_409_SELECT);
+                if (IS_GEN5(dev)) {
+                        I915_WRITE(_3D_CHICKEN2,
+                                   _3D_CHICKEN2_WM_READ_PIPELINED << 16 |
+                                   _3D_CHICKEN2_WM_READ_PIPELINED);
+                }
+                if (IS_GEN6(dev)) {
+                        I915_WRITE(WM3_LP_ILK, 0);
+                        I915_WRITE(WM2_LP_ILK, 0);
+                        I915_WRITE(WM1_LP_ILK, 0);
+                        /*
+                         * According to the spec the following bits should be
+                         * set in order to enable memory self-refresh and fbc:
+                         * The bit21 and bit22 of 0x42000
+                         * The bit21 and bit22 of 0x42004
+                         * The bit5 and bit7 of 0x42020
+                         * The bit14 of 0x70180
+                         * The bit14 of 0x71180
+                         */
+                        I915_WRITE(ILK_DISPLAY_CHICKEN1,
+                                   I915_READ(ILK_DISPLAY_CHICKEN1) |
+                                   ILK_FBCQ_DIS | ILK_PABSTRETCH_DIS);
+                        I915_WRITE(ILK_DISPLAY_CHICKEN2,
+                                   I915_READ(ILK_DISPLAY_CHICKEN2) |
+                                   ILK_DPARB_GATE | ILK_VSDPFD_FULL);
+                        I915_WRITE(ILK_DSPCLK_GATE,
+                                   I915_READ(ILK_DSPCLK_GATE) |
+                                   ILK_DPARB_CLK_GATE  |
+                                   ILK_DPFD_CLK_GATE);
+                        I915_WRITE(DSPACNTR,
+                                   I915_READ(DSPACNTR) |
+                                   DISPPLANE_TRICKLE_FEED_DISABLE);
+                        I915_WRITE(DSPBCNTR,
+                                   I915_READ(DSPBCNTR) |
+                                   DISPPLANE_TRICKLE_FEED_DISABLE);
+                }
        } else if (IS_G4X(dev)) {
                uint32_t dspclk_gate;
                I915_WRITE(RENCLK_GATE_D1, 0);
@@ -5867,20 +6372,18 @@ void intel_init_clock_gating(struct drm_device *dev)
         * GPU can automatically power down the render unit if given a page
         * to save state.
         */
-        if (IS_IRONLAKE_M(dev)) {
+        if (IS_IRONLAKE_M(dev) && 0) { /* XXX causes a failure during suspend */
                if (dev_priv->renderctx == NULL)
                        dev_priv->renderctx = intel_alloc_context_page(dev);
                if (dev_priv->renderctx) {
-                        struct drm_i915_gem_object *obj_priv;
+                        struct drm_i915_gem_object *obj = dev_priv->renderctx;
-                        obj_priv = to_intel_bo(dev_priv->renderctx);
+                        if (BEGIN_LP_RING(4) == 0) {
-                        if (obj_priv) {
-                                BEGIN_LP_RING(4);
                                OUT_RING(MI_SET_CONTEXT);
-                                OUT_RING(obj_priv->gtt_offset |
+                                OUT_RING(obj->gtt_offset |
-                                                MI_MM_SPACE_GTT |
+                                         MI_MM_SPACE_GTT |
-                                                MI_SAVE_EXT_STATE_EN |
+                                         MI_SAVE_EXT_STATE_EN |
-                                                MI_RESTORE_EXT_STATE_EN |
+                                         MI_RESTORE_EXT_STATE_EN |
-                                                MI_RESTORE_INHIBIT);
+                                         MI_RESTORE_INHIBIT);
                                OUT_RING(MI_NOOP);
                                OUT_RING(MI_FLUSH);
                                ADVANCE_LP_RING();
@@ -5890,29 +6393,45 @@ void intel_init_clock_gating(struct drm_device *dev)
                                       "Disable RC6\n");
        }
-        if (I915_HAS_RC6(dev) && drm_core_check_feature(dev, DRIVER_MODESET)) {
+        if (IS_GEN4(dev) && IS_MOBILE(dev)) {
-                struct drm_i915_gem_object *obj_priv = NULL;
+                if (dev_priv->pwrctx == NULL)
+                        dev_priv->pwrctx = intel_alloc_context_page(dev);
                if (dev_priv->pwrctx) {
-                        obj_priv = to_intel_bo(dev_priv->pwrctx);
+                        struct drm_i915_gem_object *obj = dev_priv->pwrctx;
-                } else {
+                        I915_WRITE(PWRCTXA, obj->gtt_offset | PWRCTX_EN);
-                        struct drm_gem_object *pwrctx;
-                        pwrctx = intel_alloc_context_page(dev);
-                        if (pwrctx) {
-                                dev_priv->pwrctx = pwrctx;
-                                obj_priv = to_intel_bo(pwrctx);
-                        }
-                }
-                if (obj_priv) {
-                        I915_WRITE(PWRCTXA, obj_priv->gtt_offset | PWRCTX_EN);
                        I915_WRITE(MCHBAR_RENDER_STANDBY,
                                   I915_READ(MCHBAR_RENDER_STANDBY) & ~RCX_SW_EXIT);
                }
        }
 }
+void intel_disable_clock_gating(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (dev_priv->renderctx) {
+                struct drm_i915_gem_object *obj = dev_priv->renderctx;
+                I915_WRITE(CCID, 0);
+                POSTING_READ(CCID);
+                i915_gem_object_unpin(obj);
+                drm_gem_object_unreference(&obj->base);
+                dev_priv->renderctx = NULL;
+        }
+        if (dev_priv->pwrctx) {
+                struct drm_i915_gem_object *obj = dev_priv->pwrctx;
+                I915_WRITE(PWRCTXA, 0);
+                POSTING_READ(PWRCTXA);
+                i915_gem_object_unpin(obj);
+                drm_gem_object_unreference(&obj->base);
+                dev_priv->pwrctx = NULL;
+        }
+}
 /* Set up chip specific display functions */
 static void intel_init_display(struct drm_device *dev)
 {
@@ -5925,7 +6444,7 @@ static void intel_init_display(struct drm_device *dev)
                dev_priv->display.dpms = i9xx_crtc_dpms;
        if (I915_HAS_FBC(dev)) {
-                if (IS_IRONLAKE_M(dev)) {
+                if (HAS_PCH_SPLIT(dev)) {
                        dev_priv->display.fbc_enabled = ironlake_fbc_enabled;
                        dev_priv->display.enable_fbc = ironlake_enable_fbc;
                        dev_priv->display.disable_fbc = ironlake_disable_fbc;
@@ -5974,6 +6493,14 @@ static void intel_init_display(struct drm_device *dev)
                                              "Disable CxSR\n");
                                dev_priv->display.update_wm = NULL;
                        }
+                } else if (IS_GEN6(dev)) {
+                        if (SNB_READ_WM0_LATENCY()) {
+                                dev_priv->display.update_wm = sandybridge_update_wm;
+                        } else {
+                                DRM_DEBUG_KMS("Failed to read display plane latency. "
+                                              "Disable CxSR\n");
+                                dev_priv->display.update_wm = NULL;
+                        }
                } else
                        dev_priv->display.update_wm = NULL;
        } else if (IS_PINEVIEW(dev)) {
@@ -6139,7 +6666,7 @@ void intel_modeset_init(struct drm_device *dev)
        intel_setup_outputs(dev);
-        intel_init_clock_gating(dev);
+        intel_enable_clock_gating(dev);
        /* Just disable it once at startup */
        i915_disable_vga(dev);
@@ -6149,6 +6676,9 @@ void intel_modeset_init(struct drm_device *dev)
                intel_init_emon(dev);
        }
+        if (IS_GEN6(dev))
+                gen6_enable_rps(dev_priv);
        INIT_WORK(&dev_priv->idle_work, intel_idle_update);
        setup_timer(&dev_priv->idle_timer, intel_gpu_idle_timer,
                    (unsigned long)dev);
@@ -6180,28 +6710,12 @@ void intel_modeset_cleanup(struct drm_device *dev)
        if (dev_priv->display.disable_fbc)
                dev_priv->display.disable_fbc(dev);
-        if (dev_priv->renderctx) {
-                struct drm_i915_gem_object *obj_priv;
-                obj_priv = to_intel_bo(dev_priv->renderctx);
-                I915_WRITE(CCID, obj_priv->gtt_offset &~ CCID_EN);
-                I915_READ(CCID);
-                i915_gem_object_unpin(dev_priv->renderctx);
-                drm_gem_object_unreference(dev_priv->renderctx);
-        }
-        if (dev_priv->pwrctx) {
-                struct drm_i915_gem_object *obj_priv;
-                obj_priv = to_intel_bo(dev_priv->pwrctx);
-                I915_WRITE(PWRCTXA, obj_priv->gtt_offset &~ PWRCTX_EN);
-                I915_READ(PWRCTXA);
-                i915_gem_object_unpin(dev_priv->pwrctx);
-                drm_gem_object_unreference(dev_priv->pwrctx);
-        }
        if (IS_IRONLAKE_M(dev))
                ironlake_disable_drps(dev);
+        if (IS_GEN6(dev))
+                gen6_disable_rps(dev);
+        intel_disable_clock_gating(dev);
        mutex_unlock(&dev->struct_mutex);
@@ -6253,3 +6767,113 @@ int intel_modeset_vga_set_state(struct drm_device *dev, bool state)
        pci_write_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, gmch_ctrl);
        return 0;
 }
+#ifdef CONFIG_DEBUG_FS
+#include <linux/seq_file.h>
+struct intel_display_error_state {
+        struct intel_cursor_error_state {
+                u32 control;
+                u32 position;
+                u32 base;
+                u32 size;
+        } cursor[2];
+        struct intel_pipe_error_state {
+                u32 conf;
+                u32 source;
+                u32 htotal;
+                u32 hblank;
+                u32 hsync;
+                u32 vtotal;
+                u32 vblank;
+                u32 vsync;
+        } pipe[2];
+        struct intel_plane_error_state {
+                u32 control;
+                u32 stride;
+                u32 size;
+                u32 pos;
+                u32 addr;
+                u32 surface;
+                u32 tile_offset;
+        } plane[2];
+};
+struct intel_display_error_state *
+intel_display_capture_error_state(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_display_error_state *error;
+        int i;
+        error = kmalloc(sizeof(*error), GFP_ATOMIC);
+        if (error == NULL)
+                return NULL;
+        for (i = 0; i < 2; i++) {
+                error->cursor[i].control = I915_READ(CURCNTR(i));
+                error->cursor[i].position = I915_READ(CURPOS(i));
+                error->cursor[i].base = I915_READ(CURBASE(i));
+                error->plane[i].control = I915_READ(DSPCNTR(i));
+                error->plane[i].stride = I915_READ(DSPSTRIDE(i));
+                error->plane[i].size = I915_READ(DSPSIZE(i));
+                error->plane[i].pos= I915_READ(DSPPOS(i));
+                error->plane[i].addr = I915_READ(DSPADDR(i));
+                if (INTEL_INFO(dev)->gen >= 4) {
+                        error->plane[i].surface = I915_READ(DSPSURF(i));
+                        error->plane[i].tile_offset = I915_READ(DSPTILEOFF(i));
+                }
+                error->pipe[i].conf = I915_READ(PIPECONF(i));
+                error->pipe[i].source = I915_READ(PIPESRC(i));
+                error->pipe[i].htotal = I915_READ(HTOTAL(i));
+                error->pipe[i].hblank = I915_READ(HBLANK(i));
+                error->pipe[i].hsync = I915_READ(HSYNC(i));
+                error->pipe[i].vtotal = I915_READ(VTOTAL(i));
+                error->pipe[i].vblank = I915_READ(VBLANK(i));
+                error->pipe[i].vsync = I915_READ(VSYNC(i));
+        }
+        return error;
+}
+void
+intel_display_print_error_state(struct seq_file *m,
+                                struct drm_device *dev,
+                                struct intel_display_error_state *error)
+{
+        int i;
+        for (i = 0; i < 2; i++) {
+                seq_printf(m, "Pipe [%d]:\n", i);
+                seq_printf(m, "  CONF: %08x\n", error->pipe[i].conf);
+                seq_printf(m, "  SRC: %08x\n", error->pipe[i].source);
+                seq_printf(m, "  HTOTAL: %08x\n", error->pipe[i].htotal);
+                seq_printf(m, "  HBLANK: %08x\n", error->pipe[i].hblank);
+                seq_printf(m, "  HSYNC: %08x\n", error->pipe[i].hsync);
+                seq_printf(m, "  VTOTAL: %08x\n", error->pipe[i].vtotal);
+                seq_printf(m, "  VBLANK: %08x\n", error->pipe[i].vblank);
+                seq_printf(m, "  VSYNC: %08x\n", error->pipe[i].vsync);
+                seq_printf(m, "Plane [%d]:\n", i);
+                seq_printf(m, "  CNTR: %08x\n", error->plane[i].control);
+                seq_printf(m, "  STRIDE: %08x\n", error->plane[i].stride);
+                seq_printf(m, "  SIZE: %08x\n", error->plane[i].size);
+                seq_printf(m, "  POS: %08x\n", error->plane[i].pos);
+                seq_printf(m, "  ADDR: %08x\n", error->plane[i].addr);
+                if (INTEL_INFO(dev)->gen >= 4) {
+                        seq_printf(m, "  SURF: %08x\n", error->plane[i].surface);
+                        seq_printf(m, "  TILEOFF: %08x\n", error->plane[i].tile_offset);
+                }
+                seq_printf(m, "Cursor [%d]:\n", i);
+                seq_printf(m, "  CNTR: %08x\n", error->cursor[i].control);
+                seq_printf(m, "  POS: %08x\n", error->cursor[i].position);
+                seq_printf(m, "  BASE: %08x\n", error->cursor[i].base);
+        }
+}
+#endif
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index c8e005553310..1dc60408d5b8 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -479,6 +479,7 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
        uint16_t address = algo_data->address;
        uint8_t msg[5];
        uint8_t reply[2];
+        unsigned retry;
        int msg_bytes;
        int reply_bytes;
        int ret;
@@ -513,14 +514,33 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                break;
        }
-        for (;;) {
+        for (retry = 0; retry < 5; retry++) {
-          ret = intel_dp_aux_ch(intel_dp,
+                ret = intel_dp_aux_ch(intel_dp,
-                                msg, msg_bytes,
+                                      msg, msg_bytes,
-                                reply, reply_bytes);
+                                      reply, reply_bytes);
                if (ret < 0) {
                        DRM_DEBUG_KMS("aux_ch failed %d\n", ret);
                        return ret;
                }
+                switch (reply[0] & AUX_NATIVE_REPLY_MASK) {
+                case AUX_NATIVE_REPLY_ACK:
+                        /* I2C-over-AUX Reply field is only valid
+                         * when paired with AUX ACK.
+                         */
+                        break;
+                case AUX_NATIVE_REPLY_NACK:
+                        DRM_DEBUG_KMS("aux_ch native nack\n");
+                        return -EREMOTEIO;
+                case AUX_NATIVE_REPLY_DEFER:
+                        udelay(100);
+                        continue;
+                default:
+                        DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
+                                  reply[0]);
+                        return -EREMOTEIO;
+                }
                switch (reply[0] & AUX_I2C_REPLY_MASK) {
                case AUX_I2C_REPLY_ACK:
                        if (mode == MODE_I2C_READ) {
@@ -528,17 +548,20 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                        }
                        return reply_bytes - 1;
                case AUX_I2C_REPLY_NACK:
-                        DRM_DEBUG_KMS("aux_ch nack\n");
+                        DRM_DEBUG_KMS("aux_i2c nack\n");
                        return -EREMOTEIO;
                case AUX_I2C_REPLY_DEFER:
-                        DRM_DEBUG_KMS("aux_ch defer\n");
+                        DRM_DEBUG_KMS("aux_i2c defer\n");
                        udelay(100);
                        break;
                default:
-                        DRM_ERROR("aux_ch invalid reply 0x%02x\n", reply[0]);
+                        DRM_ERROR("aux_i2c invalid reply 0x%02x\n", reply[0]);
                        return -EREMOTEIO;
                }
        }
+        DRM_ERROR("too many retries, giving up\n");
+        return -EREMOTEIO;
 }
 static int
@@ -584,17 +607,6 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                mode->clock = dev_priv->panel_fixed_mode->clock;
        }
-        /* Just use VBT values for eDP */
-        if (is_edp(intel_dp)) {
-                intel_dp->lane_count = dev_priv->edp.lanes;
-                intel_dp->link_bw = dev_priv->edp.rate;
-                adjusted_mode->clock = intel_dp_link_clock(intel_dp->link_bw);
-                DRM_DEBUG_KMS("eDP link bw %02x lane count %d clock %d\n",
-                              intel_dp->link_bw, intel_dp->lane_count,
-                              adjusted_mode->clock);
-                return true;
-        }
        for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
                for (clock = 0; clock <= max_clock; clock++) {
                        int link_avail = intel_dp_max_data_rate(intel_dp_link_clock(bws[clock]), lane_count);
@@ -613,6 +625,19 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                }
        }
+        if (is_edp(intel_dp)) {
+                /* okay we failed just pick the highest */
+                intel_dp->lane_count = max_lane_count;
+                intel_dp->link_bw = bws[max_clock];
+                adjusted_mode->clock = intel_dp_link_clock(intel_dp->link_bw);
+                DRM_DEBUG_KMS("Force picking display port link bw %02x lane "
+                              "count %d clock %d\n",
+                              intel_dp->link_bw, intel_dp->lane_count,
+                              adjusted_mode->clock);
+                return true;
+        }
        return false;
 }
@@ -1087,21 +1112,11 @@ intel_get_adjust_train(struct intel_dp *intel_dp)
 }
 static uint32_t
-intel_dp_signal_levels(struct intel_dp *intel_dp)
+intel_dp_signal_levels(uint8_t train_set, int lane_count)
 {
-        struct drm_device *dev = intel_dp->base.base.dev;
+        uint32_t        signal_levels = 0;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t signal_levels = 0;
-        u8 train_set = intel_dp->train_set[0];
-        u32 vswing = train_set & DP_TRAIN_VOLTAGE_SWING_MASK;
-        u32 preemphasis = train_set & DP_TRAIN_PRE_EMPHASIS_MASK;
-        if (is_edp(intel_dp)) {
+        switch (train_set & DP_TRAIN_VOLTAGE_SWING_MASK) {
-                vswing = dev_priv->edp.vswing;
-                preemphasis = dev_priv->edp.preemphasis;
-        }
-        switch (vswing) {
        case DP_TRAIN_VOLTAGE_SWING_400:
        default:
                signal_levels |= DP_VOLTAGE_0_4;
@@ -1116,7 +1131,7 @@ intel_dp_signal_levels(struct intel_dp *intel_dp)
                signal_levels |= DP_VOLTAGE_1_2;
                break;
        }
-        switch (preemphasis) {
+        switch (train_set & DP_TRAIN_PRE_EMPHASIS_MASK) {
        case DP_TRAIN_PRE_EMPHASIS_0:
        default:
                signal_levels |= DP_PRE_EMPHASIS_0;
@@ -1203,18 +1218,6 @@ intel_channel_eq_ok(struct intel_dp *intel_dp)
 }
 static bool
-intel_dp_aux_handshake_required(struct intel_dp *intel_dp)
-{
-        struct drm_device *dev = intel_dp->base.base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        if (is_edp(intel_dp) && dev_priv->no_aux_handshake)
-                return false;
-        return true;
-}
-static bool
 intel_dp_set_link_train(struct intel_dp *intel_dp,
                        uint32_t dp_reg_value,
                        uint8_t dp_train_pat)
@@ -1226,9 +1229,6 @@ intel_dp_set_link_train(struct intel_dp *intel_dp,
        I915_WRITE(intel_dp->output_reg, dp_reg_value);
        POSTING_READ(intel_dp->output_reg);
-        if (!intel_dp_aux_handshake_required(intel_dp))
-                return true;
        intel_dp_aux_native_write_1(intel_dp,
                                    DP_TRAINING_PATTERN_SET,
                                    dp_train_pat);
@@ -1261,11 +1261,10 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
        POSTING_READ(intel_dp->output_reg);
        intel_wait_for_vblank(dev, intel_crtc->pipe);
-        if (intel_dp_aux_handshake_required(intel_dp))
+        /* Write the link configuration data */
-                /* Write the link configuration data */
+        intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
-                intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
+                                  intel_dp->link_configuration,
-                                          intel_dp->link_configuration,
+                                  DP_LINK_CONFIGURATION_SIZE);
-                                          DP_LINK_CONFIGURATION_SIZE);
        DP |= DP_PORT_EN;
        if (HAS_PCH_CPT(dev) && !is_edp(intel_dp))
@@ -1283,7 +1282,7 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                        signal_levels = intel_gen6_edp_signal_levels(intel_dp->train_set[0]);
                        DP = (DP & ~EDP_LINK_TRAIN_VOL_EMP_MASK_SNB) | signal_levels;
                } else {
-                        signal_levels = intel_dp_signal_levels(intel_dp);
+                        signal_levels = intel_dp_signal_levels(intel_dp->train_set[0], intel_dp->lane_count);
                        DP = (DP & ~(DP_VOLTAGE_MASK|DP_PRE_EMPHASIS_MASK)) | signal_levels;
                }
@@ -1297,37 +1296,33 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                        break;
                /* Set training pattern 1 */
-                udelay(500);
+                udelay(100);
-                if (intel_dp_aux_handshake_required(intel_dp)) {
+                if (!intel_dp_get_link_status(intel_dp))
                        break;
-                } else {
-                        if (!intel_dp_get_link_status(intel_dp))
-                                break;
-                        if (intel_clock_recovery_ok(intel_dp->link_status, intel_dp->lane_count)) {
+                if (intel_clock_recovery_ok(intel_dp->link_status, intel_dp->lane_count)) {
-                                clock_recovery = true;
+                        clock_recovery = true;
-                                break;
+                        break;
-                        }
+                }
-                        /* Check to see if we've tried the max voltage */
+                /* Check to see if we've tried the max voltage */
-                        for (i = 0; i < intel_dp->lane_count; i++)
+                for (i = 0; i < intel_dp->lane_count; i++)
-                                if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
+                        if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
-                                        break;
-                        if (i == intel_dp->lane_count)
                                break;
+                if (i == intel_dp->lane_count)
+                        break;
-                        /* Check to see if we've tried the same voltage 5 times */
+                /* Check to see if we've tried the same voltage 5 times */
-                        if ((intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK) == voltage) {
+                if ((intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK) == voltage) {
-                                ++tries;
+                        ++tries;
-                                if (tries == 5)
+                        if (tries == 5)
-                                        break;
+                                break;
-                        } else
+                } else
-                                tries = 0;
+                        tries = 0;
-                        voltage = intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
+                voltage = intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
-                        /* Compute new intel_dp->train_set as requested by target */
+                /* Compute new intel_dp->train_set as requested by target */
-                        intel_get_adjust_train(intel_dp);
+                intel_get_adjust_train(intel_dp);
-                }
        }
        intel_dp->DP = DP;
@@ -1354,7 +1349,7 @@ intel_dp_complete_link_train(struct intel_dp *intel_dp)
                        signal_levels = intel_gen6_edp_signal_levels(intel_dp->train_set[0]);
                        DP = (DP & ~EDP_LINK_TRAIN_VOL_EMP_MASK_SNB) | signal_levels;
                } else {
-                        signal_levels = intel_dp_signal_levels(intel_dp);
+                        signal_levels = intel_dp_signal_levels(intel_dp->train_set[0], intel_dp->lane_count);
                        DP = (DP & ~(DP_VOLTAGE_MASK|DP_PRE_EMPHASIS_MASK)) | signal_levels;
                }
@@ -1368,28 +1363,24 @@ intel_dp_complete_link_train(struct intel_dp *intel_dp)
                                             DP_TRAINING_PATTERN_2))
                        break;
-                udelay(500);
+                udelay(400);
+                if (!intel_dp_get_link_status(intel_dp))
-                if (!intel_dp_aux_handshake_required(intel_dp)) {
                        break;
-                } else {
-                        if (!intel_dp_get_link_status(intel_dp))
-                                break;
-                        if (intel_channel_eq_ok(intel_dp)) {
+                if (intel_channel_eq_ok(intel_dp)) {
-                                channel_eq = true;
+                        channel_eq = true;
-                                break;
+                        break;
-                        }
+                }
-                        /* Try 5 times */
+                /* Try 5 times */
-                        if (tries > 5)
+                if (tries > 5)
-                                break;
+                        break;
-                        /* Compute new intel_dp->train_set as requested by target */
+                /* Compute new intel_dp->train_set as requested by target */
-                        intel_get_adjust_train(intel_dp);
+                intel_get_adjust_train(intel_dp);
-                        ++tries;
+                ++tries;
-                }
        }
        if (HAS_PCH_CPT(dev) && !is_edp(intel_dp))
                reg = DP | DP_LINK_TRAIN_OFF_CPT;
        else
@@ -1408,6 +1399,9 @@ intel_dp_link_down(struct intel_dp *intel_dp)
        struct drm_i915_private *dev_priv = dev->dev_private;
        uint32_t DP = intel_dp->DP;
+        if ((I915_READ(intel_dp->output_reg) & DP_PORT_EN) == 0)
+                return;
        DRM_DEBUG_KMS("\n");
        if (is_edp(intel_dp)) {
@@ -1430,6 +1424,27 @@ intel_dp_link_down(struct intel_dp *intel_dp)
        if (is_edp(intel_dp))
                DP |= DP_LINK_TRAIN_OFF;
+        if (!HAS_PCH_CPT(dev) &&
+            I915_READ(intel_dp->output_reg) & DP_PIPEB_SELECT) {
+                struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.base.crtc);
+                /* Hardware workaround: leaving our transcoder select
+                 * set to transcoder B while it's off will prevent the
+                 * corresponding HDMI output on transcoder A.
+                 *
+                 * Combine this with another hardware workaround:
+                 * transcoder select bit can only be cleared while the
+                 * port is enabled.
+                 */
+                DP &= ~DP_PIPEB_SELECT;
+                I915_WRITE(intel_dp->output_reg, DP);
+                /* Changes to enable or select take place the vblank
+                 * after being written.
+                 */
+                intel_wait_for_vblank(dev, intel_crtc->pipe);
+        }
        I915_WRITE(intel_dp->output_reg, DP & ~DP_PORT_EN);
        POSTING_READ(intel_dp->output_reg);
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 21551fe74541..d782ad9fd6db 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -127,7 +127,7 @@ intel_mode_get_pixel_multiplier(const struct drm_display_mode *mode)
 struct intel_framebuffer {
        struct drm_framebuffer base;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
 };
 struct intel_fbdev {
@@ -166,7 +166,7 @@ struct intel_crtc {
        struct intel_unpin_work *unpin_work;
        int fdi_lanes;
-        struct drm_gem_object *cursor_bo;
+        struct drm_i915_gem_object *cursor_bo;
        uint32_t cursor_addr;
        int16_t cursor_x, cursor_y;
        int16_t cursor_width, cursor_height;
@@ -220,8 +220,8 @@ intel_get_crtc_for_pipe(struct drm_device *dev, int pipe)
 struct intel_unpin_work {
        struct work_struct work;
        struct drm_device *dev;
-        struct drm_gem_object *old_fb_obj;
+        struct drm_i915_gem_object *old_fb_obj;
-        struct drm_gem_object *pending_flip_obj;
+        struct drm_i915_gem_object *pending_flip_obj;
        struct drm_pending_vblank_event *event;
        int pending;
        bool enable_stall_check;
@@ -236,8 +236,9 @@ void intel_dip_infoframe_csum(struct dip_infoframe *avi_if);
 extern bool intel_sdvo_init(struct drm_device *dev, int output_device);
 extern void intel_dvo_init(struct drm_device *dev);
 extern void intel_tv_init(struct drm_device *dev);
-extern void intel_mark_busy(struct drm_device *dev, struct drm_gem_object *obj);
+extern void intel_mark_busy(struct drm_device *dev,
-extern void intel_lvds_init(struct drm_device *dev);
+                            struct drm_i915_gem_object *obj);
+extern bool intel_lvds_init(struct drm_device *dev);
 extern void intel_dp_init(struct drm_device *dev, int dp_reg);
 void
 intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
@@ -293,19 +294,22 @@ extern void intel_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                    u16 blue, int regno);
 extern void intel_crtc_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
                                    u16 *blue, int regno);
-extern void intel_init_clock_gating(struct drm_device *dev);
+extern void intel_enable_clock_gating(struct drm_device *dev);
+extern void intel_disable_clock_gating(struct drm_device *dev);
 extern void ironlake_enable_drps(struct drm_device *dev);
 extern void ironlake_disable_drps(struct drm_device *dev);
+extern void gen6_enable_rps(struct drm_i915_private *dev_priv);
+extern void gen6_disable_rps(struct drm_device *dev);
 extern void intel_init_emon(struct drm_device *dev);
 extern int intel_pin_and_fence_fb_obj(struct drm_device *dev,
-                                      struct drm_gem_object *obj,
+                                      struct drm_i915_gem_object *obj,
-                                      bool pipelined);
+                                      struct intel_ring_buffer *pipelined);
 extern int intel_framebuffer_init(struct drm_device *dev,
                                  struct intel_framebuffer *ifb,
                                  struct drm_mode_fb_cmd *mode_cmd,
-                                  struct drm_gem_object *obj);
+                                  struct drm_i915_gem_object *obj);
 extern int intel_fbdev_init(struct drm_device *dev);
 extern void intel_fbdev_fini(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index ced3eef8da07..67738f32dfd4 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -65,8 +65,7 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
        struct fb_info *info;
        struct drm_framebuffer *fb;
        struct drm_mode_fb_cmd mode_cmd;
-        struct drm_gem_object *fbo = NULL;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        struct device *device = &dev->pdev->dev;
        int size, ret;
@@ -83,18 +82,17 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
        size = mode_cmd.pitch * mode_cmd.height;
        size = ALIGN(size, PAGE_SIZE);
-        fbo = i915_gem_alloc_object(dev, size);
+        obj = i915_gem_alloc_object(dev, size);
-        if (!fbo) {
+        if (!obj) {
                DRM_ERROR("failed to allocate framebuffer\n");
                ret = -ENOMEM;
                goto out;
        }
-        obj_priv = to_intel_bo(fbo);
        mutex_lock(&dev->struct_mutex);
        /* Flush everything out, we'll be doing GTT only from now on */
-        ret = intel_pin_and_fence_fb_obj(dev, fbo, false);
+        ret = intel_pin_and_fence_fb_obj(dev, obj, false);
        if (ret) {
                DRM_ERROR("failed to pin fb: %d\n", ret);
                goto out_unref;
@@ -108,7 +106,7 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
        info->par = ifbdev;
-        ret = intel_framebuffer_init(dev, &ifbdev->ifb, &mode_cmd, fbo);
+        ret = intel_framebuffer_init(dev, &ifbdev->ifb, &mode_cmd, obj);
        if (ret)
                goto out_unpin;
@@ -134,11 +132,10 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
        else
                info->apertures->ranges[0].size = pci_resource_len(dev->pdev, 0);
-        info->fix.smem_start = dev->mode_config.fb_base + obj_priv->gtt_offset;
+        info->fix.smem_start = dev->mode_config.fb_base + obj->gtt_offset;
        info->fix.smem_len = size;
-        info->screen_base = ioremap_wc(dev->agp->base + obj_priv->gtt_offset,
+        info->screen_base = ioremap_wc(dev->agp->base + obj->gtt_offset, size);
-                                       size);
        if (!info->screen_base) {
                ret = -ENOSPC;
                goto out_unpin;
@@ -164,7 +161,7 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
        DRM_DEBUG_KMS("allocated %dx%d fb: 0x%08x, bo %p\n",
                      fb->width, fb->height,
-                      obj_priv->gtt_offset, fbo);
+                      obj->gtt_offset, obj);
        mutex_unlock(&dev->struct_mutex);
@@ -172,9 +169,9 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
        return 0;
 out_unpin:
-        i915_gem_object_unpin(fbo);
+        i915_gem_object_unpin(obj);
 out_unref:
-        drm_gem_object_unreference(fbo);
+        drm_gem_object_unreference(&obj->base);
        mutex_unlock(&dev->struct_mutex);
 out:
        return ret;
@@ -221,7 +218,7 @@ static void intel_fbdev_destroy(struct drm_device *dev,
        drm_framebuffer_cleanup(&ifb->base);
        if (ifb->obj) {
-                drm_gem_object_unreference_unlocked(ifb->obj);
+                drm_gem_object_unreference_unlocked(&ifb->obj->base);
                ifb->obj = NULL;
        }
 }
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 3dba086e7eea..58040f68ed7a 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -85,8 +85,9 @@ static u32 get_reserved(struct intel_gpio *gpio)
        /* On most chips, these bits must be preserved in software. */
        if (!IS_I830(dev) && !IS_845G(dev))
-                reserved = I915_READ(gpio->reg) & (GPIO_DATA_PULLUP_DISABLE |
+                reserved = I915_READ_NOTRACE(gpio->reg) &
-                                                   GPIO_CLOCK_PULLUP_DISABLE);
+                                             (GPIO_DATA_PULLUP_DISABLE |
+                                              GPIO_CLOCK_PULLUP_DISABLE);
        return reserved;
 }
@@ -96,9 +97,9 @@ static int get_clock(void *data)
        struct intel_gpio *gpio = data;
        struct drm_i915_private *dev_priv = gpio->dev_priv;
        u32 reserved = get_reserved(gpio);
-        I915_WRITE(gpio->reg, reserved | GPIO_CLOCK_DIR_MASK);
+        I915_WRITE_NOTRACE(gpio->reg, reserved | GPIO_CLOCK_DIR_MASK);
-        I915_WRITE(gpio->reg, reserved);
+        I915_WRITE_NOTRACE(gpio->reg, reserved);
-        return (I915_READ(gpio->reg) & GPIO_CLOCK_VAL_IN) != 0;
+        return (I915_READ_NOTRACE(gpio->reg) & GPIO_CLOCK_VAL_IN) != 0;
 }
 static int get_data(void *data)
@@ -106,9 +107,9 @@ static int get_data(void *data)
        struct intel_gpio *gpio = data;
        struct drm_i915_private *dev_priv = gpio->dev_priv;
        u32 reserved = get_reserved(gpio);
-        I915_WRITE(gpio->reg, reserved | GPIO_DATA_DIR_MASK);
+        I915_WRITE_NOTRACE(gpio->reg, reserved | GPIO_DATA_DIR_MASK);
-        I915_WRITE(gpio->reg, reserved);
+        I915_WRITE_NOTRACE(gpio->reg, reserved);
-        return (I915_READ(gpio->reg) & GPIO_DATA_VAL_IN) != 0;
+        return (I915_READ_NOTRACE(gpio->reg) & GPIO_DATA_VAL_IN) != 0;
 }
 static void set_clock(void *data, int state_high)
@@ -124,7 +125,7 @@ static void set_clock(void *data, int state_high)
                clock_bits = GPIO_CLOCK_DIR_OUT | GPIO_CLOCK_DIR_MASK |
                        GPIO_CLOCK_VAL_MASK;
-        I915_WRITE(gpio->reg, reserved | clock_bits);
+        I915_WRITE_NOTRACE(gpio->reg, reserved | clock_bits);
        POSTING_READ(gpio->reg);
 }
@@ -141,7 +142,7 @@ static void set_data(void *data, int state_high)
                data_bits = GPIO_DATA_DIR_OUT | GPIO_DATA_DIR_MASK |
                        GPIO_DATA_VAL_MASK;
-        I915_WRITE(gpio->reg, reserved | data_bits);
+        I915_WRITE_NOTRACE(gpio->reg, reserved | data_bits);
        POSTING_READ(gpio->reg);
 }
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 4324a326f98e..aa2307080be2 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -68,7 +68,7 @@ static struct intel_lvds *intel_attached_lvds(struct drm_connector *connector)
 /**
 * Sets the power state for the panel.
 */
-static void intel_lvds_set_power(struct intel_lvds *intel_lvds, bool on)
+static void intel_lvds_enable(struct intel_lvds *intel_lvds)
 {
        struct drm_device *dev = intel_lvds->base.base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -82,26 +82,61 @@ static void intel_lvds_set_power(struct intel_lvds *intel_lvds, bool on)
                lvds_reg = LVDS;
        }
-        if (on) {
+        I915_WRITE(lvds_reg, I915_READ(lvds_reg) | LVDS_PORT_EN);
-                I915_WRITE(lvds_reg, I915_READ(lvds_reg) | LVDS_PORT_EN);
-                I915_WRITE(ctl_reg, I915_READ(ctl_reg) | POWER_TARGET_ON);
-                intel_panel_set_backlight(dev, dev_priv->backlight_level);
-        } else {
-                dev_priv->backlight_level = intel_panel_get_backlight(dev);
-                intel_panel_set_backlight(dev, 0);
-                I915_WRITE(ctl_reg, I915_READ(ctl_reg) & ~POWER_TARGET_ON);
-                if (intel_lvds->pfit_control) {
+        if (intel_lvds->pfit_dirty) {
-                        if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000))
+                /*
-                                DRM_ERROR("timed out waiting for panel to power off\n");
+                 * Enable automatic panel scaling so that non-native modes
-                        I915_WRITE(PFIT_CONTROL, 0);
+                 * fill the screen.  The panel fitter should only be
-                        intel_lvds->pfit_control = 0;
+                 * adjusted whilst the pipe is disabled, according to
+                 * register description and PRM.
+                 */
+                DRM_DEBUG_KMS("applying panel-fitter: %x, %x\n",
+                              intel_lvds->pfit_control,
+                              intel_lvds->pfit_pgm_ratios);
+                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000)) {
+                        DRM_ERROR("timed out waiting for panel to power off\n");
+                } else {
+                        I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
+                        I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
                        intel_lvds->pfit_dirty = false;
                }
+        }
+        I915_WRITE(ctl_reg, I915_READ(ctl_reg) | POWER_TARGET_ON);
+        POSTING_READ(lvds_reg);
-                I915_WRITE(lvds_reg, I915_READ(lvds_reg) & ~LVDS_PORT_EN);
+        intel_panel_set_backlight(dev, dev_priv->backlight_level);
+}
+static void intel_lvds_disable(struct intel_lvds *intel_lvds)
+{
+        struct drm_device *dev = intel_lvds->base.base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 ctl_reg, lvds_reg;
+        if (HAS_PCH_SPLIT(dev)) {
+                ctl_reg = PCH_PP_CONTROL;
+                lvds_reg = PCH_LVDS;
+        } else {
+                ctl_reg = PP_CONTROL;
+                lvds_reg = LVDS;
        }
+        dev_priv->backlight_level = intel_panel_get_backlight(dev);
+        intel_panel_set_backlight(dev, 0);
+        I915_WRITE(ctl_reg, I915_READ(ctl_reg) & ~POWER_TARGET_ON);
+        if (intel_lvds->pfit_control) {
+                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000))
+                        DRM_ERROR("timed out waiting for panel to power off\n");
+                I915_WRITE(PFIT_CONTROL, 0);
+                intel_lvds->pfit_dirty = true;
+        }
+        I915_WRITE(lvds_reg, I915_READ(lvds_reg) & ~LVDS_PORT_EN);
        POSTING_READ(lvds_reg);
 }
@@ -110,9 +145,9 @@ static void intel_lvds_dpms(struct drm_encoder *encoder, int mode)
        struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
        if (mode == DRM_MODE_DPMS_ON)
-                intel_lvds_set_power(intel_lvds, true);
+                intel_lvds_enable(intel_lvds);
        else
-                intel_lvds_set_power(intel_lvds, false);
+                intel_lvds_disable(intel_lvds);
        /* XXX: We never power down the LVDS pairs. */
 }
@@ -269,14 +304,13 @@ static bool intel_lvds_mode_fixup(struct drm_encoder *encoder,
                        u32 scaled_width = adjusted_mode->hdisplay * mode->vdisplay;
                        u32 scaled_height = mode->hdisplay * adjusted_mode->vdisplay;
-                        pfit_control |= PFIT_ENABLE;
                        /* 965+ is easy, it does everything in hw */
                        if (scaled_width > scaled_height)
-                                pfit_control |= PFIT_SCALING_PILLAR;
+                                pfit_control |= PFIT_ENABLE | PFIT_SCALING_PILLAR;
                        else if (scaled_width < scaled_height)
-                                pfit_control |= PFIT_SCALING_LETTER;
+                                pfit_control |= PFIT_ENABLE | PFIT_SCALING_LETTER;
-                        else
+                        else if (adjusted_mode->hdisplay != mode->hdisplay)
-                                pfit_control |= PFIT_SCALING_AUTO;
+                                pfit_control |= PFIT_ENABLE | PFIT_SCALING_AUTO;
                } else {
                        u32 scaled_width = adjusted_mode->hdisplay * mode->vdisplay;
                        u32 scaled_height = mode->hdisplay * adjusted_mode->vdisplay;
@@ -323,13 +357,17 @@ static bool intel_lvds_mode_fixup(struct drm_encoder *encoder,
                 * Full scaling, even if it changes the aspect ratio.
                 * Fortunately this is all done for us in hw.
                 */
-                pfit_control |= PFIT_ENABLE;
+                if (mode->vdisplay != adjusted_mode->vdisplay ||
-                if (INTEL_INFO(dev)->gen >= 4)
+                    mode->hdisplay != adjusted_mode->hdisplay) {
-                        pfit_control |= PFIT_SCALING_AUTO;
+                        pfit_control |= PFIT_ENABLE;
-                else
+                        if (INTEL_INFO(dev)->gen >= 4)
-                        pfit_control |= (VERT_AUTO_SCALE | HORIZ_AUTO_SCALE |
+                                pfit_control |= PFIT_SCALING_AUTO;
-                                         VERT_INTERP_BILINEAR |
+                        else
-                                         HORIZ_INTERP_BILINEAR);
+                                pfit_control |= (VERT_AUTO_SCALE |
+                                                 VERT_INTERP_BILINEAR |
+                                                 HORIZ_AUTO_SCALE |
+                                                 HORIZ_INTERP_BILINEAR);
+                }
                break;
        default:
@@ -411,43 +449,18 @@ static void intel_lvds_commit(struct drm_encoder *encoder)
        /* Always do a full power on as we do not know what state
         * we were left in.
         */
-        intel_lvds_set_power(intel_lvds, true);
+        intel_lvds_enable(intel_lvds);
 }
 static void intel_lvds_mode_set(struct drm_encoder *encoder,
                                struct drm_display_mode *mode,
                                struct drm_display_mode *adjusted_mode)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
        /*
         * The LVDS pin pair will already have been turned on in the
         * intel_crtc_mode_set since it has a large impact on the DPLL
         * settings.
         */
-        if (HAS_PCH_SPLIT(dev))
-                return;
-        if (!intel_lvds->pfit_dirty)
-                return;
-        /*
-         * Enable automatic panel scaling so that non-native modes fill the
-         * screen.  Should be enabled before the pipe is enabled, according to
-         * register description and PRM.
-         */
-        DRM_DEBUG_KMS("applying panel-fitter: %x, %x\n",
-                      intel_lvds->pfit_control,
-                      intel_lvds->pfit_pgm_ratios);
-        if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000))
-                DRM_ERROR("timed out waiting for panel to power off\n");
-        I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
-        I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
-        intel_lvds->pfit_dirty = false;
 }
 /**
@@ -837,7 +850,7 @@ static bool intel_lvds_ddc_probe(struct drm_device *dev, u8 pin)
 * Create the connector, register the LVDS DDC bus, and try to figure out what
 * modes we can display on the LVDS panel (if present).
 */
-void intel_lvds_init(struct drm_device *dev)
+bool intel_lvds_init(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_lvds *intel_lvds;
@@ -853,37 +866,37 @@ void intel_lvds_init(struct drm_device *dev)
        /* Skip init on machines we know falsely report LVDS */
        if (dmi_check_system(intel_no_lvds))
-                return;
+                return false;
        pin = GMBUS_PORT_PANEL;
        if (!lvds_is_present_in_vbt(dev, &pin)) {
                DRM_DEBUG_KMS("LVDS is not present in VBT\n");
-                return;
+                return false;
        }
        if (HAS_PCH_SPLIT(dev)) {
                if ((I915_READ(PCH_LVDS) & LVDS_DETECTED) == 0)
-                        return;
+                        return false;
                if (dev_priv->edp.support) {
                        DRM_DEBUG_KMS("disable LVDS for eDP support\n");
-                        return;
+                        return false;
                }
        }
        if (!intel_lvds_ddc_probe(dev, pin)) {
                DRM_DEBUG_KMS("LVDS did not respond to DDC probe\n");
-                return;
+                return false;
        }
        intel_lvds = kzalloc(sizeof(struct intel_lvds), GFP_KERNEL);
        if (!intel_lvds) {
-                return;
+                return false;
        }
        intel_connector = kzalloc(sizeof(struct intel_connector), GFP_KERNEL);
        if (!intel_connector) {
                kfree(intel_lvds);
-                return;
+                return false;
        }
        if (!HAS_PCH_SPLIT(dev)) {
@@ -904,6 +917,8 @@ void intel_lvds_init(struct drm_device *dev)
        intel_encoder->clone_mask = (1 << INTEL_LVDS_CLONE_BIT);
        intel_encoder->crtc_mask = (1 << 1);
+        if (INTEL_INFO(dev)->gen >= 5)
+                intel_encoder->crtc_mask |= (1 << 0);
        drm_encoder_helper_add(encoder, &intel_lvds_helper_funcs);
        drm_connector_helper_add(connector, &intel_lvds_connector_helper_funcs);
        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
@@ -1009,10 +1024,18 @@ void intel_lvds_init(struct drm_device *dev)
 out:
        if (HAS_PCH_SPLIT(dev)) {
                u32 pwm;
-                /* make sure PWM is enabled */
+                pipe = (I915_READ(PCH_LVDS) & LVDS_PIPEB_SELECT) ? 1 : 0;
+                /* make sure PWM is enabled and locked to the LVDS pipe */
                pwm = I915_READ(BLC_PWM_CPU_CTL2);
-                pwm |= (PWM_ENABLE | PWM_PIPE_B);
+                if (pipe == 0 && (pwm & PWM_PIPE_B))
-                I915_WRITE(BLC_PWM_CPU_CTL2, pwm);
+                        I915_WRITE(BLC_PWM_CPU_CTL2, pwm & ~PWM_ENABLE);
+                if (pipe)
+                        pwm |= PWM_PIPE_B;
+                else
+                        pwm &= ~PWM_PIPE_B;
+                I915_WRITE(BLC_PWM_CPU_CTL2, pwm | PWM_ENABLE);
                pwm = I915_READ(BLC_PWM_PCH_CTL1);
                pwm |= PWM_PCH_ENABLE;
@@ -1026,7 +1049,7 @@ out:
        /* keep the LVDS connector */
        dev_priv->int_lvds_connector = connector;
        drm_sysfs_connector_add(connector);
-        return;
+        return true;
 failed:
        DRM_DEBUG_KMS("No LVDS modes found, disabling.\n");
@@ -1034,4 +1057,5 @@ failed:
        drm_encoder_cleanup(encoder);
        kfree(intel_lvds);
        kfree(intel_connector);
+        return false;
 }
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index 9b0d9a867aea..f295a7aaadf9 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -273,14 +273,8 @@ void intel_opregion_enable_asle(struct drm_device *dev)
        struct opregion_asle *asle = dev_priv->opregion.asle;
        if (asle) {
-                if (IS_MOBILE(dev)) {
+                if (IS_MOBILE(dev))
-                        unsigned long irqflags;
-                        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
                        intel_enable_asle(dev);
-                        spin_unlock_irqrestore(&dev_priv->user_irq_lock,
-                                               irqflags);
-                }
                asle->tche = ASLE_ALS_EN | ASLE_BLC_EN | ASLE_PFIT_EN |
                        ASLE_PFMB_EN;
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index 02ff0a481f47..3fbb98b948d6 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -221,15 +221,16 @@ static int intel_overlay_do_wait_request(struct intel_overlay *overlay,
        int ret;
        BUG_ON(overlay->last_flip_req);
-        overlay->last_flip_req =
+        ret = i915_add_request(dev, NULL, request, LP_RING(dev_priv));
-                i915_add_request(dev, NULL, request, &dev_priv->render_ring);
+        if (ret) {
-        if (overlay->last_flip_req == 0)
+            kfree(request);
-                return -ENOMEM;
+            return ret;
+        }
+        overlay->last_flip_req = request->seqno;
        overlay->flip_tail = tail;
        ret = i915_do_wait_request(dev,
                                   overlay->last_flip_req, true,
-                                   &dev_priv->render_ring);
+                                   LP_RING(dev_priv));
        if (ret)
                return ret;
@@ -289,6 +290,7 @@ i830_deactivate_pipe_a(struct drm_device *dev)
 static int intel_overlay_on(struct intel_overlay *overlay)
 {
        struct drm_device *dev = overlay->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_request *request;
        int pipe_a_quirk = 0;
        int ret;
@@ -308,7 +310,12 @@ static int intel_overlay_on(struct intel_overlay *overlay)
                goto out;
        }
-        BEGIN_LP_RING(4);
+        ret = BEGIN_LP_RING(4);
+        if (ret) {
+                kfree(request);
+                goto out;
+        }
        OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_ON);
        OUT_RING(overlay->flip_addr | OFC_UPDATE);
        OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
@@ -332,6 +339,7 @@ static int intel_overlay_continue(struct intel_overlay *overlay,
        struct drm_i915_gem_request *request;
        u32 flip_addr = overlay->flip_addr;
        u32 tmp;
+        int ret;
        BUG_ON(!overlay->active);
@@ -347,36 +355,44 @@ static int intel_overlay_continue(struct intel_overlay *overlay,
        if (tmp & (1 << 17))
                DRM_DEBUG("overlay underrun, DOVSTA: %x\n", tmp);
-        BEGIN_LP_RING(2);
+        ret = BEGIN_LP_RING(2);
+        if (ret) {
+                kfree(request);
+                return ret;
+        }
        OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
        OUT_RING(flip_addr);
        ADVANCE_LP_RING();
-        overlay->last_flip_req =
+        ret = i915_add_request(dev, NULL, request, LP_RING(dev_priv));
-                i915_add_request(dev, NULL, request, &dev_priv->render_ring);
+        if (ret) {
+                kfree(request);
+                return ret;
+        }
+        overlay->last_flip_req = request->seqno;
        return 0;
 }
 static void intel_overlay_release_old_vid_tail(struct intel_overlay *overlay)
 {
-        struct drm_gem_object *obj = &overlay->old_vid_bo->base;
+        struct drm_i915_gem_object *obj = overlay->old_vid_bo;
        i915_gem_object_unpin(obj);
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
        overlay->old_vid_bo = NULL;
 }
 static void intel_overlay_off_tail(struct intel_overlay *overlay)
 {
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj = overlay->vid_bo;
        /* never have the overlay hw on without showing a frame */
        BUG_ON(!overlay->vid_bo);
-        obj = &overlay->vid_bo->base;
        i915_gem_object_unpin(obj);
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
        overlay->vid_bo = NULL;
        overlay->crtc->overlay = NULL;
@@ -389,8 +405,10 @@ static int intel_overlay_off(struct intel_overlay *overlay,
                             bool interruptible)
 {
        struct drm_device *dev = overlay->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 flip_addr = overlay->flip_addr;
        struct drm_i915_gem_request *request;
+        int ret;
        BUG_ON(!overlay->active);
@@ -404,7 +422,11 @@ static int intel_overlay_off(struct intel_overlay *overlay,
         * of the hw. Do it in both cases */
        flip_addr |= OFC_UPDATE;
-        BEGIN_LP_RING(6);
+        ret = BEGIN_LP_RING(6);
+        if (ret) {
+                kfree(request);
+                return ret;
+        }
        /* wait for overlay to go idle */
        OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
        OUT_RING(flip_addr);
@@ -432,7 +454,7 @@ static int intel_overlay_recover_from_interrupt(struct intel_overlay *overlay,
                return 0;
        ret = i915_do_wait_request(dev, overlay->last_flip_req,
-                                   interruptible, &dev_priv->render_ring);
+                                   interruptible, LP_RING(dev_priv));
        if (ret)
                return ret;
@@ -467,7 +489,12 @@ static int intel_overlay_release_old_vid(struct intel_overlay *overlay)
                if (request == NULL)
                        return -ENOMEM;
-                BEGIN_LP_RING(2);
+                ret = BEGIN_LP_RING(2);
+                if (ret) {
+                        kfree(request);
+                        return ret;
+                }
                OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
                OUT_RING(MI_NOOP);
                ADVANCE_LP_RING();
@@ -736,13 +763,12 @@ static u32 overlay_cmd_reg(struct put_image_params *params)
 }
 static int intel_overlay_do_put_image(struct intel_overlay *overlay,
-                                      struct drm_gem_object *new_bo,
+                                      struct drm_i915_gem_object *new_bo,
                                      struct put_image_params *params)
 {
        int ret, tmp_width;
        struct overlay_registers *regs;
        bool scale_changed = false;
-        struct drm_i915_gem_object *bo_priv = to_intel_bo(new_bo);
        struct drm_device *dev = overlay->dev;
        BUG_ON(!mutex_is_locked(&dev->struct_mutex));
@@ -753,7 +779,7 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
        if (ret != 0)
                return ret;
-        ret = i915_gem_object_pin(new_bo, PAGE_SIZE);
+        ret = i915_gem_object_pin(new_bo, PAGE_SIZE, true);
        if (ret != 0)
                return ret;
@@ -761,6 +787,10 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
        if (ret != 0)
                goto out_unpin;
+        ret = i915_gem_object_put_fence(new_bo);
+        if (ret)
+                goto out_unpin;
        if (!overlay->active) {
                regs = intel_overlay_map_regs(overlay);
                if (!regs) {
@@ -797,7 +827,7 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
        regs->SWIDTHSW = calc_swidthsw(overlay->dev,
                                       params->offset_Y, tmp_width);
        regs->SHEIGHT = params->src_h;
-        regs->OBUF_0Y = bo_priv->gtt_offset + params-> offset_Y;
+        regs->OBUF_0Y = new_bo->gtt_offset + params-> offset_Y;
        regs->OSTRIDE = params->stride_Y;
        if (params->format & I915_OVERLAY_YUV_PLANAR) {
@@ -811,8 +841,8 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
                                      params->src_w/uv_hscale);
                regs->SWIDTHSW |= max_t(u32, tmp_U, tmp_V) << 16;
                regs->SHEIGHT |= (params->src_h/uv_vscale) << 16;
-                regs->OBUF_0U = bo_priv->gtt_offset + params->offset_U;
+                regs->OBUF_0U = new_bo->gtt_offset + params->offset_U;
-                regs->OBUF_0V = bo_priv->gtt_offset + params->offset_V;
+                regs->OBUF_0V = new_bo->gtt_offset + params->offset_V;
                regs->OSTRIDE |= params->stride_UV << 16;
        }
@@ -829,7 +859,7 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
                goto out_unpin;
        overlay->old_vid_bo = overlay->vid_bo;
-        overlay->vid_bo = to_intel_bo(new_bo);
+        overlay->vid_bo = new_bo;
        return 0;
@@ -942,7 +972,7 @@ static int check_overlay_scaling(struct put_image_params *rec)
 static int check_overlay_src(struct drm_device *dev,
                             struct drm_intel_overlay_put_image *rec,
-                             struct drm_gem_object *new_bo)
+                             struct drm_i915_gem_object *new_bo)
 {
        int uv_hscale = uv_hsubsampling(rec->flags);
        int uv_vscale = uv_vsubsampling(rec->flags);
@@ -1027,7 +1057,7 @@ static int check_overlay_src(struct drm_device *dev,
                        return -EINVAL;
                tmp = rec->stride_Y*rec->src_height;
-                if (rec->offset_Y + tmp > new_bo->size)
+                if (rec->offset_Y + tmp > new_bo->base.size)
                        return -EINVAL;
                break;
@@ -1038,12 +1068,12 @@ static int check_overlay_src(struct drm_device *dev,
                        return -EINVAL;
                tmp = rec->stride_Y * rec->src_height;
-                if (rec->offset_Y + tmp > new_bo->size)
+                if (rec->offset_Y + tmp > new_bo->base.size)
                        return -EINVAL;
                tmp = rec->stride_UV * (rec->src_height / uv_vscale);
-                if (rec->offset_U + tmp > new_bo->size ||
+                if (rec->offset_U + tmp > new_bo->base.size ||
-                    rec->offset_V + tmp > new_bo->size)
+                    rec->offset_V + tmp > new_bo->base.size)
                        return -EINVAL;
                break;
        }
@@ -1086,7 +1116,7 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
        struct intel_overlay *overlay;
        struct drm_mode_object *drmmode_obj;
        struct intel_crtc *crtc;
-        struct drm_gem_object *new_bo;
+        struct drm_i915_gem_object *new_bo;
        struct put_image_params *params;
        int ret;
@@ -1125,8 +1155,8 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
        }
        crtc = to_intel_crtc(obj_to_crtc(drmmode_obj));
-        new_bo = drm_gem_object_lookup(dev, file_priv,
+        new_bo = to_intel_bo(drm_gem_object_lookup(dev, file_priv,
-                                       put_image_rec->bo_handle);
+                                                   put_image_rec->bo_handle));
        if (!new_bo) {
                ret = -ENOENT;
                goto out_free;
@@ -1135,6 +1165,12 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
        mutex_lock(&dev->mode_config.mutex);
        mutex_lock(&dev->struct_mutex);
+        if (new_bo->tiling_mode) {
+                DRM_ERROR("buffer used for overlay image can not be tiled\n");
+                ret = -EINVAL;
+                goto out_unlock;
+        }
        ret = intel_overlay_recover_from_interrupt(overlay, true);
        if (ret != 0)
                goto out_unlock;
@@ -1217,7 +1253,7 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
 out_unlock:
        mutex_unlock(&dev->struct_mutex);
        mutex_unlock(&dev->mode_config.mutex);
-        drm_gem_object_unreference_unlocked(new_bo);
+        drm_gem_object_unreference_unlocked(&new_bo->base);
 out_free:
        kfree(params);
@@ -1370,7 +1406,7 @@ void intel_setup_overlay(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct intel_overlay *overlay;
-        struct drm_gem_object *reg_bo;
+        struct drm_i915_gem_object *reg_bo;
        struct overlay_registers *regs;
        int ret;
@@ -1385,7 +1421,7 @@ void intel_setup_overlay(struct drm_device *dev)
        reg_bo = i915_gem_alloc_object(dev, PAGE_SIZE);
        if (!reg_bo)
                goto out_free;
-        overlay->reg_bo = to_intel_bo(reg_bo);
+        overlay->reg_bo = reg_bo;
        if (OVERLAY_NEEDS_PHYSICAL(dev)) {
                ret = i915_gem_attach_phys_object(dev, reg_bo,
@@ -1395,14 +1431,14 @@ void intel_setup_overlay(struct drm_device *dev)
                        DRM_ERROR("failed to attach phys overlay regs\n");
                        goto out_free_bo;
                }
-                overlay->flip_addr = overlay->reg_bo->phys_obj->handle->busaddr;
+                overlay->flip_addr = reg_bo->phys_obj->handle->busaddr;
        } else {
-                ret = i915_gem_object_pin(reg_bo, PAGE_SIZE);
+                ret = i915_gem_object_pin(reg_bo, PAGE_SIZE, true);
                if (ret) {
                        DRM_ERROR("failed to pin overlay register bo\n");
                        goto out_free_bo;
                }
-                overlay->flip_addr = overlay->reg_bo->gtt_offset;
+                overlay->flip_addr = reg_bo->gtt_offset;
                ret = i915_gem_object_set_to_gtt_domain(reg_bo, true);
                if (ret) {
@@ -1434,7 +1470,7 @@ void intel_setup_overlay(struct drm_device *dev)
 out_unpin_bo:
        i915_gem_object_unpin(reg_bo);
 out_free_bo:
-        drm_gem_object_unreference(reg_bo);
+        drm_gem_object_unreference(&reg_bo->base);
 out_free:
        kfree(overlay);
        return;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 92ff8f385278..7350ec2515c6 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -125,15 +125,55 @@ static int is_backlight_combination_mode(struct drm_device *dev)
        return 0;
 }
+static u32 i915_read_blc_pwm_ctl(struct drm_i915_private *dev_priv)
+{
+        u32 val;
+        /* Restore the CTL value if it lost, e.g. GPU reset */
+        if (HAS_PCH_SPLIT(dev_priv->dev)) {
+                val = I915_READ(BLC_PWM_PCH_CTL2);
+                if (dev_priv->saveBLC_PWM_CTL2 == 0) {
+                        dev_priv->saveBLC_PWM_CTL2 = val;
+                } else if (val == 0) {
+                        I915_WRITE(BLC_PWM_PCH_CTL2,
+                                   dev_priv->saveBLC_PWM_CTL);
+                        val = dev_priv->saveBLC_PWM_CTL;
+                }
+        } else {
+                val = I915_READ(BLC_PWM_CTL);
+                if (dev_priv->saveBLC_PWM_CTL == 0) {
+                        dev_priv->saveBLC_PWM_CTL = val;
+                        dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_CTL2);
+                } else if (val == 0) {
+                        I915_WRITE(BLC_PWM_CTL,
+                                   dev_priv->saveBLC_PWM_CTL);
+                        I915_WRITE(BLC_PWM_CTL2,
+                                   dev_priv->saveBLC_PWM_CTL2);
+                        val = dev_priv->saveBLC_PWM_CTL;
+                }
+        }
+        return val;
+}
 u32 intel_panel_get_max_backlight(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 max;
+        max = i915_read_blc_pwm_ctl(dev_priv);
+        if (max == 0) {
+                /* XXX add code here to query mode clock or hardware clock
+                 * and program max PWM appropriately.
+                 */
+                printk_once(KERN_WARNING "fixme: max PWM is zero.\n");
+                return 1;
+        }
        if (HAS_PCH_SPLIT(dev)) {
-                max = I915_READ(BLC_PWM_PCH_CTL2) >> 16;
+                max >>= 16;
        } else {
-                max = I915_READ(BLC_PWM_CTL);
                if (IS_PINEVIEW(dev)) {
                        max >>= 17;
                } else {
@@ -146,14 +186,6 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
                        max *= 0xff;
        }
-        if (max == 0) {
-                /* XXX add code here to query mode clock or hardware clock
-                 * and program max PWM appropriately.
-                 */
-                DRM_ERROR("fixme: max PWM is zero.\n");
-                max = 1;
-        }
        DRM_DEBUG_DRIVER("max backlight PWM = %d\n", max);
        return max;
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b83306f9244b..56bc95c056dd 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -49,11 +49,11 @@ static u32 i915_gem_get_seqno(struct drm_device *dev)
 }
 static void
-render_ring_flush(struct drm_device *dev,
+render_ring_flush(struct intel_ring_buffer *ring,
-                  struct intel_ring_buffer *ring,
                  u32   invalidate_domains,
                  u32   flush_domains)
 {
+        struct drm_device *dev = ring->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
        u32 cmd;
@@ -109,79 +109,83 @@ render_ring_flush(struct drm_device *dev,
                if (invalidate_domains & I915_GEM_DOMAIN_INSTRUCTION)
                        cmd |= MI_EXE_FLUSH;
+                if (invalidate_domains & I915_GEM_DOMAIN_COMMAND &&
+                    (IS_G4X(dev) || IS_GEN5(dev)))
+                        cmd |= MI_INVALIDATE_ISP;
 #if WATCH_EXEC
                DRM_INFO("%s: queue flush %08x to ring\n", __func__, cmd);
 #endif
-                intel_ring_begin(dev, ring, 2);
+                if (intel_ring_begin(ring, 2) == 0) {
-                intel_ring_emit(dev, ring, cmd);
+                        intel_ring_emit(ring, cmd);
-                intel_ring_emit(dev, ring, MI_NOOP);
+                        intel_ring_emit(ring, MI_NOOP);
-                intel_ring_advance(dev, ring);
+                        intel_ring_advance(ring);
+                }
        }
 }
-static void ring_write_tail(struct drm_device *dev,
+static void ring_write_tail(struct intel_ring_buffer *ring,
-                            struct intel_ring_buffer *ring,
                            u32 value)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        drm_i915_private_t *dev_priv = ring->dev->dev_private;
        I915_WRITE_TAIL(ring, value);
 }
-u32 intel_ring_get_active_head(struct drm_device *dev,
+u32 intel_ring_get_active_head(struct intel_ring_buffer *ring)
-                               struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        drm_i915_private_t *dev_priv = ring->dev->dev_private;
-        u32 acthd_reg = INTEL_INFO(dev)->gen >= 4 ?
+        u32 acthd_reg = INTEL_INFO(ring->dev)->gen >= 4 ?
                        RING_ACTHD(ring->mmio_base) : ACTHD;
        return I915_READ(acthd_reg);
 }
-static int init_ring_common(struct drm_device *dev,
+static int init_ring_common(struct intel_ring_buffer *ring)
-                            struct intel_ring_buffer *ring)
 {
+        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_i915_gem_object *obj = ring->obj;
        u32 head;
-        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv;
-        obj_priv = to_intel_bo(ring->gem_object);
        /* Stop the ring if it's running. */
        I915_WRITE_CTL(ring, 0);
        I915_WRITE_HEAD(ring, 0);
-        ring->write_tail(dev, ring, 0);
+        ring->write_tail(ring, 0);
        /* Initialize the ring. */
-        I915_WRITE_START(ring, obj_priv->gtt_offset);
+        I915_WRITE_START(ring, obj->gtt_offset);
        head = I915_READ_HEAD(ring) & HEAD_ADDR;
        /* G45 ring initialization fails to reset head to zero */
        if (head != 0) {
-                DRM_ERROR("%s head not reset to zero "
+                DRM_DEBUG_KMS("%s head not reset to zero "
-                                "ctl %08x head %08x tail %08x start %08x\n",
+                              "ctl %08x head %08x tail %08x start %08x\n",
-                                ring->name,
+                              ring->name,
-                                I915_READ_CTL(ring),
+                              I915_READ_CTL(ring),
-                                I915_READ_HEAD(ring),
+                              I915_READ_HEAD(ring),
-                                I915_READ_TAIL(ring),
+                              I915_READ_TAIL(ring),
-                                I915_READ_START(ring));
+                              I915_READ_START(ring));
                I915_WRITE_HEAD(ring, 0);
-                DRM_ERROR("%s head forced to zero "
+                if (I915_READ_HEAD(ring) & HEAD_ADDR) {
-                                "ctl %08x head %08x tail %08x start %08x\n",
+                        DRM_ERROR("failed to set %s head to zero "
-                                ring->name,
+                                  "ctl %08x head %08x tail %08x start %08x\n",
-                                I915_READ_CTL(ring),
+                                  ring->name,
-                                I915_READ_HEAD(ring),
+                                  I915_READ_CTL(ring),
-                                I915_READ_TAIL(ring),
+                                  I915_READ_HEAD(ring),
-                                I915_READ_START(ring));
+                                  I915_READ_TAIL(ring),
+                                  I915_READ_START(ring));
+                }
        }
        I915_WRITE_CTL(ring,
-                        ((ring->gem_object->size - PAGE_SIZE) & RING_NR_PAGES)
+                        ((ring->size - PAGE_SIZE) & RING_NR_PAGES)
                        | RING_REPORT_64K | RING_VALID);
-        head = I915_READ_HEAD(ring) & HEAD_ADDR;
        /* If the head is still not zero, the ring is dead */
-        if (head != 0) {
+        if ((I915_READ_CTL(ring) & RING_VALID) == 0 ||
+            I915_READ_START(ring) != obj->gtt_offset ||
+            (I915_READ_HEAD(ring) & HEAD_ADDR) != 0) {
                DRM_ERROR("%s initialization failed "
                                "ctl %08x head %08x tail %08x start %08x\n",
                                ring->name,
@@ -192,8 +196,8 @@ static int init_ring_common(struct drm_device *dev,
                return -EIO;
        }
-        if (!drm_core_check_feature(dev, DRIVER_MODESET))
+        if (!drm_core_check_feature(ring->dev, DRIVER_MODESET))
-                i915_kernel_lost_context(dev);
+                i915_kernel_lost_context(ring->dev);
        else {
                ring->head = I915_READ_HEAD(ring) & HEAD_ADDR;
                ring->tail = I915_READ_TAIL(ring) & TAIL_ADDR;
@@ -201,335 +205,500 @@ static int init_ring_common(struct drm_device *dev,
                if (ring->space < 0)
                        ring->space += ring->size;
        }
        return 0;
 }
-static int init_render_ring(struct drm_device *dev,
+/*
-                            struct intel_ring_buffer *ring)
+ * 965+ support PIPE_CONTROL commands, which provide finer grained control
+ * over cache flushing.
+ */
+struct pipe_control {
+        struct drm_i915_gem_object *obj;
+        volatile u32 *cpu_page;
+        u32 gtt_offset;
+};
+static int
+init_pipe_control(struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct pipe_control *pc;
-        int ret = init_ring_common(dev, ring);
+        struct drm_i915_gem_object *obj;
-        int mode;
+        int ret;
+        if (ring->private)
+                return 0;
+        pc = kmalloc(sizeof(*pc), GFP_KERNEL);
+        if (!pc)
+                return -ENOMEM;
+        obj = i915_gem_alloc_object(ring->dev, 4096);
+        if (obj == NULL) {
+                DRM_ERROR("Failed to allocate seqno page\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+        obj->agp_type = AGP_USER_CACHED_MEMORY;
+        ret = i915_gem_object_pin(obj, 4096, true);
+        if (ret)
+                goto err_unref;
+        pc->gtt_offset = obj->gtt_offset;
+        pc->cpu_page =  kmap(obj->pages[0]);
+        if (pc->cpu_page == NULL)
+                goto err_unpin;
+        pc->obj = obj;
+        ring->private = pc;
+        return 0;
+err_unpin:
+        i915_gem_object_unpin(obj);
+err_unref:
+        drm_gem_object_unreference(&obj->base);
+err:
+        kfree(pc);
+        return ret;
+}
+static void
+cleanup_pipe_control(struct intel_ring_buffer *ring)
+{
+        struct pipe_control *pc = ring->private;
+        struct drm_i915_gem_object *obj;
+        if (!ring->private)
+                return;
+        obj = pc->obj;
+        kunmap(obj->pages[0]);
+        i915_gem_object_unpin(obj);
+        drm_gem_object_unreference(&obj->base);
+        kfree(pc);
+        ring->private = NULL;
+}
+static int init_render_ring(struct intel_ring_buffer *ring)
+{
+        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int ret = init_ring_common(ring);
        if (INTEL_INFO(dev)->gen > 3) {
-                mode = VS_TIMER_DISPATCH << 16 | VS_TIMER_DISPATCH;
+                int mode = VS_TIMER_DISPATCH << 16 | VS_TIMER_DISPATCH;
                if (IS_GEN6(dev))
                        mode |= MI_FLUSH_ENABLE << 16 | MI_FLUSH_ENABLE;
                I915_WRITE(MI_MODE, mode);
        }
+        if (INTEL_INFO(dev)->gen >= 6) {
+        } else if (IS_GEN5(dev)) {
+                ret = init_pipe_control(ring);
+                if (ret)
+                        return ret;
+        }
        return ret;
 }
-#define PIPE_CONTROL_FLUSH(addr)                                        \
+static void render_ring_cleanup(struct intel_ring_buffer *ring)
+{
+        if (!ring->private)
+                return;
+        cleanup_pipe_control(ring);
+}
+static void
+update_semaphore(struct intel_ring_buffer *ring, int i, u32 seqno)
+{
+        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int id;
+        /*
+         * cs -> 1 = vcs, 0 = bcs
+         * vcs -> 1 = bcs, 0 = cs,
+         * bcs -> 1 = cs, 0 = vcs.
+         */
+        id = ring - dev_priv->ring;
+        id += 2 - i;
+        id %= 3;
+        intel_ring_emit(ring,
+                        MI_SEMAPHORE_MBOX |
+                        MI_SEMAPHORE_REGISTER |
+                        MI_SEMAPHORE_UPDATE);
+        intel_ring_emit(ring, seqno);
+        intel_ring_emit(ring,
+                        RING_SYNC_0(dev_priv->ring[id].mmio_base) + 4*i);
+}
+static int
+gen6_add_request(struct intel_ring_buffer *ring,
+                 u32 *result)
+{
+        u32 seqno;
+        int ret;
+        ret = intel_ring_begin(ring, 10);
+        if (ret)
+                return ret;
+        seqno = i915_gem_get_seqno(ring->dev);
+        update_semaphore(ring, 0, seqno);
+        update_semaphore(ring, 1, seqno);
+        intel_ring_emit(ring, MI_STORE_DWORD_INDEX);
+        intel_ring_emit(ring, I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+        intel_ring_emit(ring, seqno);
+        intel_ring_emit(ring, MI_USER_INTERRUPT);
+        intel_ring_advance(ring);
+        *result = seqno;
+        return 0;
+}
+int
+intel_ring_sync(struct intel_ring_buffer *ring,
+                struct intel_ring_buffer *to,
+                u32 seqno)
+{
+        int ret;
+        ret = intel_ring_begin(ring, 4);
+        if (ret)
+                return ret;
+        intel_ring_emit(ring,
+                        MI_SEMAPHORE_MBOX |
+                        MI_SEMAPHORE_REGISTER |
+                        intel_ring_sync_index(ring, to) << 17 |
+                        MI_SEMAPHORE_COMPARE);
+        intel_ring_emit(ring, seqno);
+        intel_ring_emit(ring, 0);
+        intel_ring_emit(ring, MI_NOOP);
+        intel_ring_advance(ring);
+        return 0;
+}
+#define PIPE_CONTROL_FLUSH(ring__, addr__)                                      \
 do {                                                                    \
-        OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |          \
+        intel_ring_emit(ring__, GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |           \
                 PIPE_CONTROL_DEPTH_STALL | 2);                         \
-        OUT_RING(addr | PIPE_CONTROL_GLOBAL_GTT);                       \
+        intel_ring_emit(ring__, (addr__) | PIPE_CONTROL_GLOBAL_GTT);                    \
-        OUT_RING(0);                                                    \
+        intel_ring_emit(ring__, 0);                                                     \
-        OUT_RING(0);                                                    \
+        intel_ring_emit(ring__, 0);                                                     \
 } while (0)
-/**
+static int
- * Creates a new sequence number, emitting a write of it to the status page
+pc_render_add_request(struct intel_ring_buffer *ring,
- * plus an interrupt, which will trigger i915_user_interrupt_handler.
+                      u32 *result)
- *
- * Must be called with struct_lock held.
- *
- * Returned sequence numbers are nonzero on success.
- */
-static u32
-render_ring_add_request(struct drm_device *dev,
-                        struct intel_ring_buffer *ring,
-                        u32 flush_domains)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_device *dev = ring->dev;
-        u32 seqno;
+        u32 seqno = i915_gem_get_seqno(dev);
+        struct pipe_control *pc = ring->private;
+        u32 scratch_addr = pc->gtt_offset + 128;
+        int ret;
-        seqno = i915_gem_get_seqno(dev);
+        /* For Ironlake, MI_USER_INTERRUPT was deprecated and apparently
+         * incoherent with writes to memory, i.e. completely fubar,
-        if (IS_GEN6(dev)) {
+         * so we need to use PIPE_NOTIFY instead.
-                BEGIN_LP_RING(6);
+         *
-                OUT_RING(GFX_OP_PIPE_CONTROL | 3);
+         * However, we also need to workaround the qword write
-                OUT_RING(PIPE_CONTROL_QW_WRITE |
+         * incoherence by flushing the 6 PIPE_NOTIFY buffers out to
-                         PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_IS_FLUSH |
+         * memory before requesting an interrupt.
-                         PIPE_CONTROL_NOTIFY);
+         */
-                OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
+        ret = intel_ring_begin(ring, 32);
-                OUT_RING(seqno);
+        if (ret)
-                OUT_RING(0);
+                return ret;
-                OUT_RING(0);
-                ADVANCE_LP_RING();
+        intel_ring_emit(ring, GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
-        } else if (HAS_PIPE_CONTROL(dev)) {
+                        PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH);
-                u32 scratch_addr = dev_priv->seqno_gfx_addr + 128;
+        intel_ring_emit(ring, pc->gtt_offset | PIPE_CONTROL_GLOBAL_GTT);
+        intel_ring_emit(ring, seqno);
+        intel_ring_emit(ring, 0);
+        PIPE_CONTROL_FLUSH(ring, scratch_addr);
+        scratch_addr += 128; /* write to separate cachelines */
+        PIPE_CONTROL_FLUSH(ring, scratch_addr);
+        scratch_addr += 128;
+        PIPE_CONTROL_FLUSH(ring, scratch_addr);
+        scratch_addr += 128;
+        PIPE_CONTROL_FLUSH(ring, scratch_addr);
+        scratch_addr += 128;
+        PIPE_CONTROL_FLUSH(ring, scratch_addr);
+        scratch_addr += 128;
+        PIPE_CONTROL_FLUSH(ring, scratch_addr);
+        intel_ring_emit(ring, GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
+                        PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH |
+                        PIPE_CONTROL_NOTIFY);
+        intel_ring_emit(ring, pc->gtt_offset | PIPE_CONTROL_GLOBAL_GTT);
+        intel_ring_emit(ring, seqno);
+        intel_ring_emit(ring, 0);
+        intel_ring_advance(ring);
+        *result = seqno;
+        return 0;
+}
-                /*
+static int
-                 * Workaround qword write incoherence by flushing the
+render_ring_add_request(struct intel_ring_buffer *ring,
-                 * PIPE_NOTIFY buffers out to memory before requesting
+                        u32 *result)
-                 * an interrupt.
+{
-                 */
+        struct drm_device *dev = ring->dev;
-                BEGIN_LP_RING(32);
+        u32 seqno = i915_gem_get_seqno(dev);
-                OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
+        int ret;
-                         PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH);
-                OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
-                OUT_RING(seqno);
-                OUT_RING(0);
-                PIPE_CONTROL_FLUSH(scratch_addr);
-                scratch_addr += 128; /* write to separate cachelines */
-                PIPE_CONTROL_FLUSH(scratch_addr);
-                scratch_addr += 128;
-                PIPE_CONTROL_FLUSH(scratch_addr);
-                scratch_addr += 128;
-                PIPE_CONTROL_FLUSH(scratch_addr);
-                scratch_addr += 128;
-                PIPE_CONTROL_FLUSH(scratch_addr);
-                scratch_addr += 128;
-                PIPE_CONTROL_FLUSH(scratch_addr);
-                OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
-                         PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH |
-                         PIPE_CONTROL_NOTIFY);
-                OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
-                OUT_RING(seqno);
-                OUT_RING(0);
-                ADVANCE_LP_RING();
-        } else {
-                BEGIN_LP_RING(4);
-                OUT_RING(MI_STORE_DWORD_INDEX);
-                OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-                OUT_RING(seqno);
-                OUT_RING(MI_USER_INTERRUPT);
+        ret = intel_ring_begin(ring, 4);
-                ADVANCE_LP_RING();
+        if (ret)
-        }
+                return ret;
-        return seqno;
+        intel_ring_emit(ring, MI_STORE_DWORD_INDEX);
+        intel_ring_emit(ring, I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+        intel_ring_emit(ring, seqno);
+        intel_ring_emit(ring, MI_USER_INTERRUPT);
+        intel_ring_advance(ring);
+        *result = seqno;
+        return 0;
 }
 static u32
-render_ring_get_seqno(struct drm_device *dev,
+ring_get_seqno(struct intel_ring_buffer *ring)
-                      struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
-        if (HAS_PIPE_CONTROL(dev))
-                return ((volatile u32 *)(dev_priv->seqno_page))[0];
-        else
-                return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
 }
-static void
+static u32
-render_ring_get_user_irq(struct drm_device *dev,
+pc_render_get_seqno(struct intel_ring_buffer *ring)
-                         struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct pipe_control *pc = ring->private;
-        unsigned long irqflags;
+        return pc->cpu_page[0];
+}
+static bool
+render_ring_get_irq(struct intel_ring_buffer *ring)
+{
+        struct drm_device *dev = ring->dev;
+        if (!dev->irq_enabled)
+                return false;
-        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+        if (atomic_inc_return(&ring->irq_refcount) == 1) {
-        if (dev->irq_enabled && (++ring->user_irq_refcount == 1)) {
+                drm_i915_private_t *dev_priv = dev->dev_private;
+                unsigned long irqflags;
+                spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
                if (HAS_PCH_SPLIT(dev))
-                        ironlake_enable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
+                        ironlake_enable_graphics_irq(dev_priv,
+                                                     GT_PIPE_NOTIFY | GT_USER_INTERRUPT);
                else
                        i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
+                spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
        }
-        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+        return true;
 }
 static void
-render_ring_put_user_irq(struct drm_device *dev,
+render_ring_put_irq(struct intel_ring_buffer *ring)
-                         struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        struct drm_device *dev = ring->dev;
-        unsigned long irqflags;
-        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+        if (atomic_dec_and_test(&ring->irq_refcount)) {
-        BUG_ON(dev->irq_enabled && ring->user_irq_refcount <= 0);
+                drm_i915_private_t *dev_priv = dev->dev_private;
-        if (dev->irq_enabled && (--ring->user_irq_refcount == 0)) {
+                unsigned long irqflags;
+                spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
                if (HAS_PCH_SPLIT(dev))
-                        ironlake_disable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
+                        ironlake_disable_graphics_irq(dev_priv,
+                                                      GT_USER_INTERRUPT |
+                                                      GT_PIPE_NOTIFY);
                else
                        i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
+                spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
        }
-        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
 }
-void intel_ring_setup_status_page(struct drm_device *dev,
+void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
-                                  struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        drm_i915_private_t *dev_priv = ring->dev->dev_private;
-        if (IS_GEN6(dev)) {
+        u32 mmio = IS_GEN6(ring->dev) ?
-                I915_WRITE(RING_HWS_PGA_GEN6(ring->mmio_base),
+                RING_HWS_PGA_GEN6(ring->mmio_base) :
-                           ring->status_page.gfx_addr);
+                RING_HWS_PGA(ring->mmio_base);
-                I915_READ(RING_HWS_PGA_GEN6(ring->mmio_base)); /* posting read */
+        I915_WRITE(mmio, (u32)ring->status_page.gfx_addr);
-        } else {
+        POSTING_READ(mmio);
-                I915_WRITE(RING_HWS_PGA(ring->mmio_base),
-                           ring->status_page.gfx_addr);
-                I915_READ(RING_HWS_PGA(ring->mmio_base)); /* posting read */
-        }
 }
 static void
-bsd_ring_flush(struct drm_device *dev,
+bsd_ring_flush(struct intel_ring_buffer *ring,
-                struct intel_ring_buffer *ring,
+               u32     invalidate_domains,
-                u32     invalidate_domains,
+               u32     flush_domains)
-                u32     flush_domains)
 {
-        intel_ring_begin(dev, ring, 2);
+        if ((flush_domains & I915_GEM_DOMAIN_RENDER) == 0)
-        intel_ring_emit(dev, ring, MI_FLUSH);
+                return;
-        intel_ring_emit(dev, ring, MI_NOOP);
-        intel_ring_advance(dev, ring);
-}
-static int init_bsd_ring(struct drm_device *dev,
+        if (intel_ring_begin(ring, 2) == 0) {
-                         struct intel_ring_buffer *ring)
+                intel_ring_emit(ring, MI_FLUSH);
-{
+                intel_ring_emit(ring, MI_NOOP);
-        return init_ring_common(dev, ring);
+                intel_ring_advance(ring);
+        }
 }
-static u32
+static int
-ring_add_request(struct drm_device *dev,
+ring_add_request(struct intel_ring_buffer *ring,
-                 struct intel_ring_buffer *ring,
+                 u32 *result)
-                 u32 flush_domains)
 {
        u32 seqno;
+        int ret;
-        seqno = i915_gem_get_seqno(dev);
+        ret = intel_ring_begin(ring, 4);
+        if (ret)
+                return ret;
-        intel_ring_begin(dev, ring, 4);
+        seqno = i915_gem_get_seqno(ring->dev);
-        intel_ring_emit(dev, ring, MI_STORE_DWORD_INDEX);
-        intel_ring_emit(dev, ring,
-                        I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-        intel_ring_emit(dev, ring, seqno);
-        intel_ring_emit(dev, ring, MI_USER_INTERRUPT);
-        intel_ring_advance(dev, ring);
-        DRM_DEBUG_DRIVER("%s %d\n", ring->name, seqno);
+        intel_ring_emit(ring, MI_STORE_DWORD_INDEX);
+        intel_ring_emit(ring, I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+        intel_ring_emit(ring, seqno);
+        intel_ring_emit(ring, MI_USER_INTERRUPT);
+        intel_ring_advance(ring);
-        return seqno;
+        DRM_DEBUG_DRIVER("%s %d\n", ring->name, seqno);
+        *result = seqno;
+        return 0;
 }
-static void
+static bool
-bsd_ring_get_user_irq(struct drm_device *dev,
+ring_get_irq(struct intel_ring_buffer *ring, u32 flag)
-                      struct intel_ring_buffer *ring)
 {
-        /* do nothing */
+        struct drm_device *dev = ring->dev;
+        if (!dev->irq_enabled)
+               return false;
+        if (atomic_inc_return(&ring->irq_refcount) == 1) {
+                drm_i915_private_t *dev_priv = dev->dev_private;
+                unsigned long irqflags;
+                spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
+                ironlake_enable_graphics_irq(dev_priv, flag);
+                spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+        }
+        return true;
 }
 static void
-bsd_ring_put_user_irq(struct drm_device *dev,
+ring_put_irq(struct intel_ring_buffer *ring, u32 flag)
-                      struct intel_ring_buffer *ring)
 {
-        /* do nothing */
+        struct drm_device *dev = ring->dev;
+        if (atomic_dec_and_test(&ring->irq_refcount)) {
+                drm_i915_private_t *dev_priv = dev->dev_private;
+                unsigned long irqflags;
+                spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
+                ironlake_disable_graphics_irq(dev_priv, flag);
+                spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+        }
 }
-static u32
+static bool
-ring_status_page_get_seqno(struct drm_device *dev,
+bsd_ring_get_irq(struct intel_ring_buffer *ring)
-                           struct intel_ring_buffer *ring)
 {
-        return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
+        return ring_get_irq(ring, GT_BSD_USER_INTERRUPT);
+}
+static void
+bsd_ring_put_irq(struct intel_ring_buffer *ring)
+{
+        ring_put_irq(ring, GT_BSD_USER_INTERRUPT);
 }
 static int
-ring_dispatch_gem_execbuffer(struct drm_device *dev,
+ring_dispatch_execbuffer(struct intel_ring_buffer *ring, u32 offset, u32 length)
-                             struct intel_ring_buffer *ring,
-                             struct drm_i915_gem_execbuffer2 *exec,
-                             struct drm_clip_rect *cliprects,
-                             uint64_t exec_offset)
 {
-        uint32_t exec_start;
+        int ret;
-        exec_start = (uint32_t) exec_offset + exec->batch_start_offset;
-        intel_ring_begin(dev, ring, 2);
+        ret = intel_ring_begin(ring, 2);
-        intel_ring_emit(dev, ring, MI_BATCH_BUFFER_START |
+        if (ret)
-                        (2 << 6) | MI_BATCH_NON_SECURE_I965);
+                return ret;
-        intel_ring_emit(dev, ring, exec_start);
-        intel_ring_advance(dev, ring);
+        intel_ring_emit(ring,
+                        MI_BATCH_BUFFER_START | (2 << 6) |
+                        MI_BATCH_NON_SECURE_I965);
+        intel_ring_emit(ring, offset);
+        intel_ring_advance(ring);
        return 0;
 }
 static int
-render_ring_dispatch_gem_execbuffer(struct drm_device *dev,
+render_ring_dispatch_execbuffer(struct intel_ring_buffer *ring,
-                                    struct intel_ring_buffer *ring,
+                                u32 offset, u32 len)
-                                    struct drm_i915_gem_execbuffer2 *exec,
-                                    struct drm_clip_rect *cliprects,
-                                    uint64_t exec_offset)
 {
+        struct drm_device *dev = ring->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        int nbox = exec->num_cliprects;
+        int ret;
-        int i = 0, count;
-        uint32_t exec_start, exec_len;
-        exec_start = (uint32_t) exec_offset + exec->batch_start_offset;
-        exec_len = (uint32_t) exec->batch_len;
        trace_i915_gem_request_submit(dev, dev_priv->next_seqno + 1);
-        count = nbox ? nbox : 1;
+        if (IS_I830(dev) || IS_845G(dev)) {
+                ret = intel_ring_begin(ring, 4);
+                if (ret)
+                        return ret;
-        for (i = 0; i < count; i++) {
+                intel_ring_emit(ring, MI_BATCH_BUFFER);
-                if (i < nbox) {
+                intel_ring_emit(ring, offset | MI_BATCH_NON_SECURE);
-                        int ret = i915_emit_box(dev, cliprects, i,
+                intel_ring_emit(ring, offset + len - 8);
-                                                exec->DR1, exec->DR4);
+                intel_ring_emit(ring, 0);
-                        if (ret)
+        } else {
-                                return ret;
+                ret = intel_ring_begin(ring, 2);
-                }
+                if (ret)
+                        return ret;
-                if (IS_I830(dev) || IS_845G(dev)) {
+                if (INTEL_INFO(dev)->gen >= 4) {
-                        intel_ring_begin(dev, ring, 4);
+                        intel_ring_emit(ring,
-                        intel_ring_emit(dev, ring, MI_BATCH_BUFFER);
+                                        MI_BATCH_BUFFER_START | (2 << 6) |
-                        intel_ring_emit(dev, ring,
+                                        MI_BATCH_NON_SECURE_I965);
-                                        exec_start | MI_BATCH_NON_SECURE);
+                        intel_ring_emit(ring, offset);
-                        intel_ring_emit(dev, ring, exec_start + exec_len - 4);
-                        intel_ring_emit(dev, ring, 0);
                } else {
-                        intel_ring_begin(dev, ring, 2);
+                        intel_ring_emit(ring,
-                        if (INTEL_INFO(dev)->gen >= 4) {
+                                        MI_BATCH_BUFFER_START | (2 << 6));
-                                intel_ring_emit(dev, ring,
+                        intel_ring_emit(ring, offset | MI_BATCH_NON_SECURE);
-                                                MI_BATCH_BUFFER_START | (2 << 6)
-                                                | MI_BATCH_NON_SECURE_I965);
-                                intel_ring_emit(dev, ring, exec_start);
-                        } else {
-                                intel_ring_emit(dev, ring, MI_BATCH_BUFFER_START
-                                                | (2 << 6));
-                                intel_ring_emit(dev, ring, exec_start |
-                                                MI_BATCH_NON_SECURE);
-                        }
                }
-                intel_ring_advance(dev, ring);
        }
+        intel_ring_advance(ring);
-        if (IS_G4X(dev) || IS_GEN5(dev)) {
-                intel_ring_begin(dev, ring, 2);
-                intel_ring_emit(dev, ring, MI_FLUSH |
-                                MI_NO_WRITE_FLUSH |
-                                MI_INVALIDATE_ISP );
-                intel_ring_emit(dev, ring, MI_NOOP);
-                intel_ring_advance(dev, ring);
-        }
-        /* XXX breadcrumb */
        return 0;
 }
-static void cleanup_status_page(struct drm_device *dev,
+static void cleanup_status_page(struct intel_ring_buffer *ring)
-                                struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
+        drm_i915_private_t *dev_priv = ring->dev->dev_private;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        obj = ring->status_page.obj;
        if (obj == NULL)
                return;
-        obj_priv = to_intel_bo(obj);
-        kunmap(obj_priv->pages[0]);
+        kunmap(obj->pages[0]);
        i915_gem_object_unpin(obj);
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
        ring->status_page.obj = NULL;
        memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
 }
-static int init_status_page(struct drm_device *dev,
+static int init_status_page(struct intel_ring_buffer *ring)
-                            struct intel_ring_buffer *ring)
 {
+        struct drm_device *dev = ring->dev;
        drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
        int ret;
        obj = i915_gem_alloc_object(dev, 4096);
@@ -538,16 +707,15 @@ static int init_status_page(struct drm_device *dev,
                ret = -ENOMEM;
                goto err;
        }
-        obj_priv = to_intel_bo(obj);
+        obj->agp_type = AGP_USER_CACHED_MEMORY;
-        obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
-        ret = i915_gem_object_pin(obj, 4096);
+        ret = i915_gem_object_pin(obj, 4096, true);
        if (ret != 0) {
                goto err_unref;
        }
-        ring->status_page.gfx_addr = obj_priv->gtt_offset;
+        ring->status_page.gfx_addr = obj->gtt_offset;
-        ring->status_page.page_addr = kmap(obj_priv->pages[0]);
+        ring->status_page.page_addr = kmap(obj->pages[0]);
        if (ring->status_page.page_addr == NULL) {
                memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
                goto err_unpin;
@@ -555,7 +723,7 @@ static int init_status_page(struct drm_device *dev,
        ring->status_page.obj = obj;
        memset(ring->status_page.page_addr, 0, PAGE_SIZE);
-        intel_ring_setup_status_page(dev, ring);
+        intel_ring_setup_status_page(ring);
        DRM_DEBUG_DRIVER("%s hws offset: 0x%08x\n",
                        ring->name, ring->status_page.gfx_addr);
@@ -564,7 +732,7 @@ static int init_status_page(struct drm_device *dev,
 err_unpin:
        i915_gem_object_unpin(obj);
 err_unref:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
 err:
        return ret;
 }
@@ -572,9 +740,7 @@ err:
 int intel_init_ring_buffer(struct drm_device *dev,
                           struct intel_ring_buffer *ring)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj;
-        struct drm_i915_gem_object *obj_priv;
-        struct drm_gem_object *obj;
        int ret;
        ring->dev = dev;
@@ -583,7 +749,7 @@ int intel_init_ring_buffer(struct drm_device *dev,
        INIT_LIST_HEAD(&ring->gpu_write_list);
        if (I915_NEED_GFX_HWS(dev)) {
-                ret = init_status_page(dev, ring);
+                ret = init_status_page(ring);
                if (ret)
                        return ret;
        }
@@ -595,15 +761,14 @@ int intel_init_ring_buffer(struct drm_device *dev,
                goto err_hws;
        }
-        ring->gem_object = obj;
+        ring->obj = obj;
-        ret = i915_gem_object_pin(obj, PAGE_SIZE);
+        ret = i915_gem_object_pin(obj, PAGE_SIZE, true);
        if (ret)
                goto err_unref;
-        obj_priv = to_intel_bo(obj);
        ring->map.size = ring->size;
-        ring->map.offset = dev->agp->base + obj_priv->gtt_offset;
+        ring->map.offset = dev->agp->base + obj->gtt_offset;
        ring->map.type = 0;
        ring->map.flags = 0;
        ring->map.mtrr = 0;
@@ -616,60 +781,57 @@ int intel_init_ring_buffer(struct drm_device *dev,
        }
        ring->virtual_start = ring->map.handle;
-        ret = ring->init(dev, ring);
+        ret = ring->init(ring);
        if (ret)
                goto err_unmap;
-        if (!drm_core_check_feature(dev, DRIVER_MODESET))
+        return 0;
-                i915_kernel_lost_context(dev);
-        else {
-                ring->head = I915_READ_HEAD(ring) & HEAD_ADDR;
-                ring->tail = I915_READ_TAIL(ring) & TAIL_ADDR;
-                ring->space = ring->head - (ring->tail + 8);
-                if (ring->space < 0)
-                        ring->space += ring->size;
-        }
-        return ret;
 err_unmap:
        drm_core_ioremapfree(&ring->map, dev);
 err_unpin:
        i915_gem_object_unpin(obj);
 err_unref:
-        drm_gem_object_unreference(obj);
+        drm_gem_object_unreference(&obj->base);
-        ring->gem_object = NULL;
+        ring->obj = NULL;
 err_hws:
-        cleanup_status_page(dev, ring);
+        cleanup_status_page(ring);
        return ret;
 }
-void intel_cleanup_ring_buffer(struct drm_device *dev,
+void intel_cleanup_ring_buffer(struct intel_ring_buffer *ring)
-                               struct intel_ring_buffer *ring)
 {
-        if (ring->gem_object == NULL)
+        struct drm_i915_private *dev_priv;
+        int ret;
+        if (ring->obj == NULL)
                return;
-        drm_core_ioremapfree(&ring->map, dev);
+        /* Disable the ring buffer. The ring must be idle at this point */
+        dev_priv = ring->dev->dev_private;
+        ret = intel_wait_ring_buffer(ring, ring->size - 8);
+        I915_WRITE_CTL(ring, 0);
-        i915_gem_object_unpin(ring->gem_object);
+        drm_core_ioremapfree(&ring->map, ring->dev);
-        drm_gem_object_unreference(ring->gem_object);
-        ring->gem_object = NULL;
+        i915_gem_object_unpin(ring->obj);
+        drm_gem_object_unreference(&ring->obj->base);
+        ring->obj = NULL;
        if (ring->cleanup)
                ring->cleanup(ring);
-        cleanup_status_page(dev, ring);
+        cleanup_status_page(ring);
 }
-static int intel_wrap_ring_buffer(struct drm_device *dev,
+static int intel_wrap_ring_buffer(struct intel_ring_buffer *ring)
-                                  struct intel_ring_buffer *ring)
 {
        unsigned int *virt;
        int rem;
        rem = ring->size - ring->tail;
        if (ring->space < rem) {
-                int ret = intel_wait_ring_buffer(dev, ring, rem);
+                int ret = intel_wait_ring_buffer(ring, rem);
                if (ret)
                        return ret;
        }
@@ -687,32 +849,29 @@ static int intel_wrap_ring_buffer(struct drm_device *dev,
        return 0;
 }
-int intel_wait_ring_buffer(struct drm_device *dev,
+int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n)
-                           struct intel_ring_buffer *ring, int n)
 {
+        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long end;
-        drm_i915_private_t *dev_priv = dev->dev_private;
        u32 head;
-        head = intel_read_status_page(ring, 4);
-        if (head) {
-                ring->head = head & HEAD_ADDR;
-                ring->space = ring->head - (ring->tail + 8);
-                if (ring->space < 0)
-                        ring->space += ring->size;
-                if (ring->space >= n)
-                        return 0;
-        }
        trace_i915_ring_wait_begin (dev);
        end = jiffies + 3 * HZ;
        do {
-                ring->head = I915_READ_HEAD(ring) & HEAD_ADDR;
+                /* If the reported head position has wrapped or hasn't advanced,
+                 * fallback to the slow and accurate path.
+                 */
+                head = intel_read_status_page(ring, 4);
+                if (head < ring->actual_head)
+                        head = I915_READ_HEAD(ring);
+                ring->actual_head = head;
+                ring->head = head & HEAD_ADDR;
                ring->space = ring->head - (ring->tail + 8);
                if (ring->space < 0)
                        ring->space += ring->size;
                if (ring->space >= n) {
-                        trace_i915_ring_wait_end (dev);
+                        trace_i915_ring_wait_end(dev);
                        return 0;
                }
@@ -723,29 +882,39 @@ int intel_wait_ring_buffer(struct drm_device *dev,
                }
                msleep(1);
+                if (atomic_read(&dev_priv->mm.wedged))
+                        return -EAGAIN;
        } while (!time_after(jiffies, end));
        trace_i915_ring_wait_end (dev);
        return -EBUSY;
 }
-void intel_ring_begin(struct drm_device *dev,
+int intel_ring_begin(struct intel_ring_buffer *ring,
-                      struct intel_ring_buffer *ring,
+                     int num_dwords)
-                      int num_dwords)
 {
        int n = 4*num_dwords;
-        if (unlikely(ring->tail + n > ring->size))
+        int ret;
-                intel_wrap_ring_buffer(dev, ring);
-        if (unlikely(ring->space < n))
+        if (unlikely(ring->tail + n > ring->size)) {
-                intel_wait_ring_buffer(dev, ring, n);
+                ret = intel_wrap_ring_buffer(ring);
+                if (unlikely(ret))
+                        return ret;
+        }
+        if (unlikely(ring->space < n)) {
+                ret = intel_wait_ring_buffer(ring, n);
+                if (unlikely(ret))
+                        return ret;
+        }
        ring->space -= n;
+        return 0;
 }
-void intel_ring_advance(struct drm_device *dev,
+void intel_ring_advance(struct intel_ring_buffer *ring)
-                        struct intel_ring_buffer *ring)
 {
        ring->tail &= ring->size - 1;
-        ring->write_tail(dev, ring, ring->tail);
+        ring->write_tail(ring, ring->tail);
 }
 static const struct intel_ring_buffer render_ring = {
@@ -757,10 +926,11 @@ static const struct intel_ring_buffer render_ring = {
        .write_tail             = ring_write_tail,
        .flush                  = render_ring_flush,
        .add_request            = render_ring_add_request,
-        .get_seqno              = render_ring_get_seqno,
+        .get_seqno              = ring_get_seqno,
-        .user_irq_get           = render_ring_get_user_irq,
+        .irq_get                = render_ring_get_irq,
-        .user_irq_put           = render_ring_put_user_irq,
+        .irq_put                = render_ring_put_irq,
-        .dispatch_gem_execbuffer = render_ring_dispatch_gem_execbuffer,
+        .dispatch_execbuffer    = render_ring_dispatch_execbuffer,
+       .cleanup                 = render_ring_cleanup,
 };
 /* ring buffer for bit-stream decoder */
@@ -770,22 +940,21 @@ static const struct intel_ring_buffer bsd_ring = {
        .id                     = RING_BSD,
        .mmio_base              = BSD_RING_BASE,
        .size                   = 32 * PAGE_SIZE,
-        .init                   = init_bsd_ring,
+        .init                   = init_ring_common,
        .write_tail             = ring_write_tail,
        .flush                  = bsd_ring_flush,
        .add_request            = ring_add_request,
-        .get_seqno              = ring_status_page_get_seqno,
+        .get_seqno              = ring_get_seqno,
-        .user_irq_get           = bsd_ring_get_user_irq,
+        .irq_get                = bsd_ring_get_irq,
-        .user_irq_put           = bsd_ring_put_user_irq,
+        .irq_put                = bsd_ring_put_irq,
-        .dispatch_gem_execbuffer = ring_dispatch_gem_execbuffer,
+        .dispatch_execbuffer    = ring_dispatch_execbuffer,
 };
-static void gen6_bsd_ring_write_tail(struct drm_device *dev,
+static void gen6_bsd_ring_write_tail(struct intel_ring_buffer *ring,
-                                     struct intel_ring_buffer *ring,
                                     u32 value)
 {
-       drm_i915_private_t *dev_priv = dev->dev_private;
+       drm_i915_private_t *dev_priv = ring->dev->dev_private;
       /* Every tail move must follow the sequence below */
       I915_WRITE(GEN6_BSD_SLEEP_PSMI_CONTROL,
@@ -804,69 +973,80 @@ static void gen6_bsd_ring_write_tail(struct drm_device *dev,
               GEN6_BSD_SLEEP_PSMI_CONTROL_RC_ILDL_MESSAGE_ENABLE);
 }
-static void gen6_ring_flush(struct drm_device *dev,
+static void gen6_ring_flush(struct intel_ring_buffer *ring,
-                            struct intel_ring_buffer *ring,
                            u32 invalidate_domains,
                            u32 flush_domains)
 {
-       intel_ring_begin(dev, ring, 4);
+        if ((flush_domains & I915_GEM_DOMAIN_RENDER) == 0)
-       intel_ring_emit(dev, ring, MI_FLUSH_DW);
+                return;
-       intel_ring_emit(dev, ring, 0);
-       intel_ring_emit(dev, ring, 0);
+        if (intel_ring_begin(ring, 4) == 0) {
-       intel_ring_emit(dev, ring, 0);
+                intel_ring_emit(ring, MI_FLUSH_DW);
-       intel_ring_advance(dev, ring);
+                intel_ring_emit(ring, 0);
+                intel_ring_emit(ring, 0);
+                intel_ring_emit(ring, 0);
+                intel_ring_advance(ring);
+        }
 }
 static int
-gen6_ring_dispatch_gem_execbuffer(struct drm_device *dev,
+gen6_ring_dispatch_execbuffer(struct intel_ring_buffer *ring,
-                                  struct intel_ring_buffer *ring,
+                              u32 offset, u32 len)
-                                  struct drm_i915_gem_execbuffer2 *exec,
-                                  struct drm_clip_rect *cliprects,
-                                  uint64_t exec_offset)
 {
-       uint32_t exec_start;
+       int ret;
-       exec_start = (uint32_t) exec_offset + exec->batch_start_offset;
+       ret = intel_ring_begin(ring, 2);
+       if (ret)
+               return ret;
-       intel_ring_begin(dev, ring, 2);
+       intel_ring_emit(ring, MI_BATCH_BUFFER_START | MI_BATCH_NON_SECURE_I965);
-       intel_ring_emit(dev, ring,
-                       MI_BATCH_BUFFER_START | MI_BATCH_NON_SECURE_I965);
       /* bit0-7 is the length on GEN6+ */
-       intel_ring_emit(dev, ring, exec_start);
+       intel_ring_emit(ring, offset);
-       intel_ring_advance(dev, ring);
+       intel_ring_advance(ring);
       return 0;
 }
+static bool
+gen6_bsd_ring_get_irq(struct intel_ring_buffer *ring)
+{
+        return ring_get_irq(ring, GT_GEN6_BSD_USER_INTERRUPT);
+}
+static void
+gen6_bsd_ring_put_irq(struct intel_ring_buffer *ring)
+{
+        ring_put_irq(ring, GT_GEN6_BSD_USER_INTERRUPT);
+}
 /* ring buffer for Video Codec for Gen6+ */
 static const struct intel_ring_buffer gen6_bsd_ring = {
-       .name                    = "gen6 bsd ring",
+        .name                   = "gen6 bsd ring",
-       .id                      = RING_BSD,
+        .id                     = RING_BSD,
-       .mmio_base               = GEN6_BSD_RING_BASE,
+        .mmio_base              = GEN6_BSD_RING_BASE,
-       .size                    = 32 * PAGE_SIZE,
+        .size                   = 32 * PAGE_SIZE,
-       .init                    = init_bsd_ring,
+        .init                   = init_ring_common,
-       .write_tail              = gen6_bsd_ring_write_tail,
+        .write_tail             = gen6_bsd_ring_write_tail,
-       .flush                   = gen6_ring_flush,
+        .flush                  = gen6_ring_flush,
-       .add_request             = ring_add_request,
+        .add_request            = gen6_add_request,
-       .get_seqno               = ring_status_page_get_seqno,
+        .get_seqno              = ring_get_seqno,
-       .user_irq_get            = bsd_ring_get_user_irq,
+        .irq_get                = gen6_bsd_ring_get_irq,
-       .user_irq_put            = bsd_ring_put_user_irq,
+        .irq_put                = gen6_bsd_ring_put_irq,
-       .dispatch_gem_execbuffer = gen6_ring_dispatch_gem_execbuffer,
+        .dispatch_execbuffer    = gen6_ring_dispatch_execbuffer,
 };
 /* Blitter support (SandyBridge+) */
-static void
+static bool
-blt_ring_get_user_irq(struct drm_device *dev,
+blt_ring_get_irq(struct intel_ring_buffer *ring)
-                      struct intel_ring_buffer *ring)
 {
-        /* do nothing */
+        return ring_get_irq(ring, GT_BLT_USER_INTERRUPT);
 }
 static void
-blt_ring_put_user_irq(struct drm_device *dev,
+blt_ring_put_irq(struct intel_ring_buffer *ring)
-                      struct intel_ring_buffer *ring)
 {
-        /* do nothing */
+        ring_put_irq(ring, GT_BLT_USER_INTERRUPT);
 }
@@ -884,32 +1064,31 @@ to_blt_workaround(struct intel_ring_buffer *ring)
        return ring->private;
 }
-static int blt_ring_init(struct drm_device *dev,
+static int blt_ring_init(struct intel_ring_buffer *ring)
-                         struct intel_ring_buffer *ring)
 {
-        if (NEED_BLT_WORKAROUND(dev)) {
+        if (NEED_BLT_WORKAROUND(ring->dev)) {
                struct drm_i915_gem_object *obj;
-                u32 __iomem *ptr;
+                u32 *ptr;
                int ret;
-                obj = to_intel_bo(i915_gem_alloc_object(dev, 4096));
+                obj = i915_gem_alloc_object(ring->dev, 4096);
                if (obj == NULL)
                        return -ENOMEM;
-                ret = i915_gem_object_pin(&obj->base, 4096);
+                ret = i915_gem_object_pin(obj, 4096, true);
                if (ret) {
                        drm_gem_object_unreference(&obj->base);
                        return ret;
                }
                ptr = kmap(obj->pages[0]);
-                iowrite32(MI_BATCH_BUFFER_END, ptr);
+                *ptr++ = MI_BATCH_BUFFER_END;
-                iowrite32(MI_NOOP, ptr+1);
+                *ptr++ = MI_NOOP;
                kunmap(obj->pages[0]);
-                ret = i915_gem_object_set_to_gtt_domain(&obj->base, false);
+                ret = i915_gem_object_set_to_gtt_domain(obj, false);
                if (ret) {
-                        i915_gem_object_unpin(&obj->base);
+                        i915_gem_object_unpin(obj);
                        drm_gem_object_unreference(&obj->base);
                        return ret;
                }
@@ -917,51 +1096,39 @@ static int blt_ring_init(struct drm_device *dev,
                ring->private = obj;
        }
-        return init_ring_common(dev, ring);
+        return init_ring_common(ring);
 }
-static void blt_ring_begin(struct drm_device *dev,
+static int blt_ring_begin(struct intel_ring_buffer *ring,
-                           struct intel_ring_buffer *ring,
                          int num_dwords)
 {
        if (ring->private) {
-                intel_ring_begin(dev, ring, num_dwords+2);
+                int ret = intel_ring_begin(ring, num_dwords+2);
-                intel_ring_emit(dev, ring, MI_BATCH_BUFFER_START);
+                if (ret)
-                intel_ring_emit(dev, ring, to_blt_workaround(ring)->gtt_offset);
+                        return ret;
+                intel_ring_emit(ring, MI_BATCH_BUFFER_START);
+                intel_ring_emit(ring, to_blt_workaround(ring)->gtt_offset);
+                return 0;
        } else
-                intel_ring_begin(dev, ring, 4);
+                return intel_ring_begin(ring, 4);
 }
-static void blt_ring_flush(struct drm_device *dev,
+static void blt_ring_flush(struct intel_ring_buffer *ring,
-                           struct intel_ring_buffer *ring,
                           u32 invalidate_domains,
                           u32 flush_domains)
 {
-        blt_ring_begin(dev, ring, 4);
+        if ((flush_domains & I915_GEM_DOMAIN_RENDER) == 0)
-        intel_ring_emit(dev, ring, MI_FLUSH_DW);
+                return;
-        intel_ring_emit(dev, ring, 0);
-        intel_ring_emit(dev, ring, 0);
-        intel_ring_emit(dev, ring, 0);
-        intel_ring_advance(dev, ring);
-}
-static u32
-blt_ring_add_request(struct drm_device *dev,
-                     struct intel_ring_buffer *ring,
-                     u32 flush_domains)
-{
-        u32 seqno = i915_gem_get_seqno(dev);
-        blt_ring_begin(dev, ring, 4);
-        intel_ring_emit(dev, ring, MI_STORE_DWORD_INDEX);
-        intel_ring_emit(dev, ring,
-                        I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-        intel_ring_emit(dev, ring, seqno);
-        intel_ring_emit(dev, ring, MI_USER_INTERRUPT);
-        intel_ring_advance(dev, ring);
-        DRM_DEBUG_DRIVER("%s %d\n", ring->name, seqno);
+        if (blt_ring_begin(ring, 4) == 0) {
-        return seqno;
+                intel_ring_emit(ring, MI_FLUSH_DW);
+                intel_ring_emit(ring, 0);
+                intel_ring_emit(ring, 0);
+                intel_ring_emit(ring, 0);
+                intel_ring_advance(ring);
+        }
 }
 static void blt_ring_cleanup(struct intel_ring_buffer *ring)
@@ -982,47 +1149,54 @@ static const struct intel_ring_buffer gen6_blt_ring = {
       .init                    = blt_ring_init,
       .write_tail              = ring_write_tail,
       .flush                   = blt_ring_flush,
-       .add_request             = blt_ring_add_request,
+       .add_request             = gen6_add_request,
-       .get_seqno               = ring_status_page_get_seqno,
+       .get_seqno               = ring_get_seqno,
-       .user_irq_get            = blt_ring_get_user_irq,
+       .irq_get                 = blt_ring_get_irq,
-       .user_irq_put            = blt_ring_put_user_irq,
+       .irq_put                 = blt_ring_put_irq,
-       .dispatch_gem_execbuffer = gen6_ring_dispatch_gem_execbuffer,
+       .dispatch_execbuffer     = gen6_ring_dispatch_execbuffer,
       .cleanup                 = blt_ring_cleanup,
 };
 int intel_init_render_ring_buffer(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
-        dev_priv->render_ring = render_ring;
+        *ring = render_ring;
+        if (INTEL_INFO(dev)->gen >= 6) {
+                ring->add_request = gen6_add_request;
+        } else if (IS_GEN5(dev)) {
+                ring->add_request = pc_render_add_request;
+                ring->get_seqno = pc_render_get_seqno;
+        }
        if (!I915_NEED_GFX_HWS(dev)) {
-                dev_priv->render_ring.status_page.page_addr
+                ring->status_page.page_addr = dev_priv->status_page_dmah->vaddr;
-                        = dev_priv->status_page_dmah->vaddr;
+                memset(ring->status_page.page_addr, 0, PAGE_SIZE);
-                memset(dev_priv->render_ring.status_page.page_addr,
-                                0, PAGE_SIZE);
        }
-        return intel_init_ring_buffer(dev, &dev_priv->render_ring);
+        return intel_init_ring_buffer(dev, ring);
 }
 int intel_init_bsd_ring_buffer(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring = &dev_priv->ring[VCS];
        if (IS_GEN6(dev))
-                dev_priv->bsd_ring = gen6_bsd_ring;
+                *ring = gen6_bsd_ring;
        else
-                dev_priv->bsd_ring = bsd_ring;
+                *ring = bsd_ring;
-        return intel_init_ring_buffer(dev, &dev_priv->bsd_ring);
+        return intel_init_ring_buffer(dev, ring);
 }
 int intel_init_blt_ring_buffer(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring = &dev_priv->ring[BCS];
-        dev_priv->blt_ring = gen6_blt_ring;
+        *ring = gen6_blt_ring;
-        return intel_init_ring_buffer(dev, &dev_priv->blt_ring);
+        return intel_init_ring_buffer(dev, ring);
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 3126c2681983..8e2e357ad6ee 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -1,22 +1,37 @@
 #ifndef _INTEL_RINGBUFFER_H_
 #define _INTEL_RINGBUFFER_H_
+enum {
+    RCS = 0x0,
+    VCS,
+    BCS,
+    I915_NUM_RINGS,
+};
 struct  intel_hw_status_page {
-        void            *page_addr;
+        u32     __iomem *page_addr;
        unsigned int    gfx_addr;
-        struct          drm_gem_object *obj;
+        struct          drm_i915_gem_object *obj;
 };
-#define I915_READ_TAIL(ring) I915_READ(RING_TAIL(ring->mmio_base))
+#define I915_RING_READ(reg) i915_safe_read(dev_priv, reg)
+#define I915_READ_TAIL(ring) I915_RING_READ(RING_TAIL(ring->mmio_base))
 #define I915_WRITE_TAIL(ring, val) I915_WRITE(RING_TAIL(ring->mmio_base), val)
-#define I915_READ_START(ring) I915_READ(RING_START(ring->mmio_base))
+#define I915_READ_START(ring) I915_RING_READ(RING_START(ring->mmio_base))
 #define I915_WRITE_START(ring, val) I915_WRITE(RING_START(ring->mmio_base), val)
-#define I915_READ_HEAD(ring) I915_READ(RING_HEAD(ring->mmio_base))
+#define I915_READ_HEAD(ring)  I915_RING_READ(RING_HEAD(ring->mmio_base))
 #define I915_WRITE_HEAD(ring, val) I915_WRITE(RING_HEAD(ring->mmio_base), val)
-#define I915_READ_CTL(ring) I915_READ(RING_CTL(ring->mmio_base))
+#define I915_READ_CTL(ring) I915_RING_READ(RING_CTL(ring->mmio_base))
 #define I915_WRITE_CTL(ring, val) I915_WRITE(RING_CTL(ring->mmio_base), val)
-struct drm_i915_gem_execbuffer2;
+#define I915_READ_NOPID(ring) I915_RING_READ(RING_NOPID(ring->mmio_base))
+#define I915_READ_SYNC_0(ring) I915_RING_READ(RING_SYNC_0(ring->mmio_base))
+#define I915_READ_SYNC_1(ring) I915_RING_READ(RING_SYNC_1(ring->mmio_base))
 struct  intel_ring_buffer {
        const char      *name;
        enum intel_ring_id {
@@ -25,44 +40,36 @@ struct  intel_ring_buffer {
                RING_BLT = 0x4,
        } id;
        u32             mmio_base;
-        unsigned long   size;
        void            *virtual_start;
        struct          drm_device *dev;
-        struct          drm_gem_object *gem_object;
+        struct          drm_i915_gem_object *obj;
-        unsigned int    head;
+        u32             actual_head;
-        unsigned int    tail;
+        u32             head;
+        u32             tail;
        int             space;
+        int             size;
        struct intel_hw_status_page status_page;
-        u32             irq_gem_seqno;          /* last seq seem at irq time */
+        u32             irq_seqno;              /* last seq seem at irq time */
-        u32             waiting_gem_seqno;
+        u32             waiting_seqno;
-        int             user_irq_refcount;
+        u32             sync_seqno[I915_NUM_RINGS-1];
-        void            (*user_irq_get)(struct drm_device *dev,
+        atomic_t        irq_refcount;
-                        struct intel_ring_buffer *ring);
+        bool __must_check (*irq_get)(struct intel_ring_buffer *ring);
-        void            (*user_irq_put)(struct drm_device *dev,
+        void            (*irq_put)(struct intel_ring_buffer *ring);
-                        struct intel_ring_buffer *ring);
-        int             (*init)(struct drm_device *dev,
+        int             (*init)(struct intel_ring_buffer *ring);
-                        struct intel_ring_buffer *ring);
-        void            (*write_tail)(struct drm_device *dev,
+        void            (*write_tail)(struct intel_ring_buffer *ring,
-                                      struct intel_ring_buffer *ring,
                                      u32 value);
-        void            (*flush)(struct drm_device *dev,
+        void            (*flush)(struct intel_ring_buffer *ring,
-                        struct intel_ring_buffer *ring,
+                                 u32    invalidate_domains,
-                        u32     invalidate_domains,
+                                 u32    flush_domains);
-                        u32     flush_domains);
+        int             (*add_request)(struct intel_ring_buffer *ring,
-        u32             (*add_request)(struct drm_device *dev,
+                                       u32 *seqno);
-                        struct intel_ring_buffer *ring,
+        u32             (*get_seqno)(struct intel_ring_buffer *ring);
-                        u32 flush_domains);
+        int             (*dispatch_execbuffer)(struct intel_ring_buffer *ring,
-        u32             (*get_seqno)(struct drm_device *dev,
+                                               u32 offset, u32 length);
-                                     struct intel_ring_buffer *ring);
-        int             (*dispatch_gem_execbuffer)(struct drm_device *dev,
-                        struct intel_ring_buffer *ring,
-                        struct drm_i915_gem_execbuffer2 *exec,
-                        struct drm_clip_rect *cliprects,
-                        uint64_t exec_offset);
        void            (*cleanup)(struct intel_ring_buffer *ring);
        /**
@@ -95,7 +102,7 @@ struct  intel_ring_buffer {
        /**
         * Do we have some not yet emitted requests outstanding?
         */
-        bool outstanding_lazy_request;
+        u32 outstanding_lazy_request;
        wait_queue_head_t irq_queue;
        drm_local_map_t map;
@@ -104,44 +111,54 @@ struct  intel_ring_buffer {
 };
 static inline u32
+intel_ring_sync_index(struct intel_ring_buffer *ring,
+                      struct intel_ring_buffer *other)
+{
+        int idx;
+        /*
+         * cs -> 0 = vcs, 1 = bcs
+         * vcs -> 0 = bcs, 1 = cs,
+         * bcs -> 0 = cs, 1 = vcs.
+         */
+        idx = (other - ring) - 1;
+        if (idx < 0)
+                idx += I915_NUM_RINGS;
+        return idx;
+}
+static inline u32
 intel_read_status_page(struct intel_ring_buffer *ring,
-                int reg)
+                       int reg)
 {
-        u32 *regs = ring->status_page.page_addr;
+        return ioread32(ring->status_page.page_addr + reg);
-        return regs[reg];
 }
-int intel_init_ring_buffer(struct drm_device *dev,
+void intel_cleanup_ring_buffer(struct intel_ring_buffer *ring);
-                           struct intel_ring_buffer *ring);
+int __must_check intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n);
-void intel_cleanup_ring_buffer(struct drm_device *dev,
+int __must_check intel_ring_begin(struct intel_ring_buffer *ring, int n);
-                               struct intel_ring_buffer *ring);
-int intel_wait_ring_buffer(struct drm_device *dev,
+static inline void intel_ring_emit(struct intel_ring_buffer *ring,
-                           struct intel_ring_buffer *ring, int n);
+                                   u32 data)
-void intel_ring_begin(struct drm_device *dev,
-                      struct intel_ring_buffer *ring, int n);
-static inline void intel_ring_emit(struct drm_device *dev,
-                                   struct intel_ring_buffer *ring,
-                                   unsigned int data)
 {
-        unsigned int *virt = ring->virtual_start + ring->tail;
+        iowrite32(data, ring->virtual_start + ring->tail);
-        *virt = data;
        ring->tail += 4;
 }
-void intel_ring_advance(struct drm_device *dev,
+void intel_ring_advance(struct intel_ring_buffer *ring);
-                struct intel_ring_buffer *ring);
-u32 intel_ring_get_seqno(struct drm_device *dev,
+u32 intel_ring_get_seqno(struct intel_ring_buffer *ring);
-                struct intel_ring_buffer *ring);
+int intel_ring_sync(struct intel_ring_buffer *ring,
+                    struct intel_ring_buffer *to,
+                    u32 seqno);
 int intel_init_render_ring_buffer(struct drm_device *dev);
 int intel_init_bsd_ring_buffer(struct drm_device *dev);
 int intel_init_blt_ring_buffer(struct drm_device *dev);
-u32 intel_ring_get_active_head(struct drm_device *dev,
+u32 intel_ring_get_active_head(struct intel_ring_buffer *ring);
-                               struct intel_ring_buffer *ring);
+void intel_ring_setup_status_page(struct intel_ring_buffer *ring);
-void intel_ring_setup_status_page(struct drm_device *dev,
-                                  struct intel_ring_buffer *ring);
 #endif /* _INTEL_RINGBUFFER_H_ */
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index de158b76bcd5..6c0bb18a26e8 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -107,7 +107,8 @@ struct intel_sdvo {
         * This is set if we treat the device as HDMI, instead of DVI.
         */
        bool is_hdmi;
-        bool has_audio;
+        bool has_hdmi_monitor;
+        bool has_hdmi_audio;
        /**
         * This is set if we detect output of sdvo device as LVDS and
@@ -1023,7 +1024,7 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
        if (!intel_sdvo_set_target_input(intel_sdvo))
                return;
-        if (intel_sdvo->is_hdmi &&
+        if (intel_sdvo->has_hdmi_monitor &&
            !intel_sdvo_set_avi_infoframe(intel_sdvo))
                return;
@@ -1044,7 +1045,9 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
        /* Set the SDVO control regs. */
        if (INTEL_INFO(dev)->gen >= 4) {
-                sdvox = SDVO_BORDER_ENABLE;
+                sdvox = 0;
+                if (INTEL_INFO(dev)->gen < 5)
+                        sdvox |= SDVO_BORDER_ENABLE;
                if (adjusted_mode->flags & DRM_MODE_FLAG_PVSYNC)
                        sdvox |= SDVO_VSYNC_ACTIVE_HIGH;
                if (adjusted_mode->flags & DRM_MODE_FLAG_PHSYNC)
@@ -1063,7 +1066,7 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
        }
        if (intel_crtc->pipe == 1)
                sdvox |= SDVO_PIPE_B_SELECT;
-        if (intel_sdvo->has_audio)
+        if (intel_sdvo->has_hdmi_audio)
                sdvox |= SDVO_AUDIO_ENABLE;
        if (INTEL_INFO(dev)->gen >= 4) {
@@ -1074,7 +1077,8 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
                sdvox |= (pixel_multiplier - 1) << SDVO_PORT_MULTIPLY_SHIFT;
        }
-        if (input_dtd.part2.sdvo_flags & SDVO_NEED_TO_STALL)
+        if (input_dtd.part2.sdvo_flags & SDVO_NEED_TO_STALL &&
+            INTEL_INFO(dev)->gen < 5)
                sdvox |= SDVO_STALL_SELECT;
        intel_sdvo_write_sdvox(intel_sdvo, sdvox);
 }
@@ -1295,55 +1299,14 @@ intel_sdvo_get_edid(struct drm_connector *connector)
        return drm_get_edid(connector, &sdvo->ddc);
 }
-static struct drm_connector *
-intel_find_analog_connector(struct drm_device *dev)
-{
-        struct drm_connector *connector;
-        struct intel_sdvo *encoder;
-        list_for_each_entry(encoder,
-                            &dev->mode_config.encoder_list,
-                            base.base.head) {
-                if (encoder->base.type == INTEL_OUTPUT_ANALOG) {
-                        list_for_each_entry(connector,
-                                            &dev->mode_config.connector_list,
-                                            head) {
-                                if (&encoder->base ==
-                                    intel_attached_encoder(connector))
-                                        return connector;
-                        }
-                }
-        }
-        return NULL;
-}
-static int
-intel_analog_is_connected(struct drm_device *dev)
-{
-        struct drm_connector *analog_connector;
-        analog_connector = intel_find_analog_connector(dev);
-        if (!analog_connector)
-                return false;
-        if (analog_connector->funcs->detect(analog_connector, false) ==
-                        connector_status_disconnected)
-                return false;
-        return true;
-}
 /* Mac mini hack -- use the same DDC as the analog connector */
 static struct edid *
 intel_sdvo_get_analog_edid(struct drm_connector *connector)
 {
        struct drm_i915_private *dev_priv = connector->dev->dev_private;
-        if (!intel_analog_is_connected(connector->dev))
+        return drm_get_edid(connector,
-                return NULL;
+                            &dev_priv->gmbus[dev_priv->crt_ddc_pin].adapter);
-        return drm_get_edid(connector, &dev_priv->gmbus[dev_priv->crt_ddc_pin].adapter);
 }
 enum drm_connector_status
@@ -1388,8 +1351,10 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
                /* DDC bus is shared, match EDID to connector type */
                if (edid->input & DRM_EDID_INPUT_DIGITAL) {
                        status = connector_status_connected;
-                        intel_sdvo->is_hdmi = drm_detect_hdmi_monitor(edid);
+                        if (intel_sdvo->is_hdmi) {
-                        intel_sdvo->has_audio = drm_detect_monitor_audio(edid);
+                                intel_sdvo->has_hdmi_monitor = drm_detect_hdmi_monitor(edid);
+                                intel_sdvo->has_hdmi_audio = drm_detect_monitor_audio(edid);
+                        }
                }
                connector->display_info.raw_edid = NULL;
                kfree(edid);
@@ -1398,7 +1363,7 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
        if (status == connector_status_connected) {
                struct intel_sdvo_connector *intel_sdvo_connector = to_intel_sdvo_connector(connector);
                if (intel_sdvo_connector->force_audio)
-                        intel_sdvo->has_audio = intel_sdvo_connector->force_audio > 0;
+                        intel_sdvo->has_hdmi_audio = intel_sdvo_connector->force_audio > 0;
        }
        return status;
@@ -1415,10 +1380,12 @@ intel_sdvo_detect(struct drm_connector *connector, bool force)
        if (!intel_sdvo_write_cmd(intel_sdvo,
                                  SDVO_CMD_GET_ATTACHED_DISPLAYS, NULL, 0))
                return connector_status_unknown;
-        if (intel_sdvo->is_tv) {
-                /* add 30ms delay when the output type is SDVO-TV */
+        /* add 30ms delay when the output type might be TV */
+        if (intel_sdvo->caps.output_flags &
+            (SDVO_OUTPUT_SVID0 | SDVO_OUTPUT_CVBS0))
                mdelay(30);
-        }
        if (!intel_sdvo_read_response(intel_sdvo, &response, 2))
                return connector_status_unknown;
@@ -1472,8 +1439,10 @@ static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
                edid = intel_sdvo_get_analog_edid(connector);
        if (edid != NULL) {
-                drm_mode_connector_update_edid_property(connector, edid);
+                if (edid->input & DRM_EDID_INPUT_DIGITAL) {
-                drm_add_edid_modes(connector, edid);
+                        drm_mode_connector_update_edid_property(connector, edid);
+                        drm_add_edid_modes(connector, edid);
+                }
                connector->display_info.raw_edid = NULL;
                kfree(edid);
        }
@@ -1713,12 +1682,12 @@ intel_sdvo_set_property(struct drm_connector *connector,
                intel_sdvo_connector->force_audio = val;
-                if (val > 0 && intel_sdvo->has_audio)
+                if (val > 0 && intel_sdvo->has_hdmi_audio)
                        return 0;
-                if (val < 0 && !intel_sdvo->has_audio)
+                if (val < 0 && !intel_sdvo->has_hdmi_audio)
                        return 0;
-                intel_sdvo->has_audio = val > 0;
+                intel_sdvo->has_hdmi_audio = val > 0;
                goto done;
        }
@@ -1942,9 +1911,12 @@ intel_sdvo_select_i2c_bus(struct drm_i915_private *dev_priv,
                speed = mapping->i2c_speed;
        }
-        sdvo->i2c = &dev_priv->gmbus[pin].adapter;
+        if (pin < GMBUS_NUM_PORTS) {
-        intel_gmbus_set_speed(sdvo->i2c, speed);
+                sdvo->i2c = &dev_priv->gmbus[pin].adapter;
-        intel_gmbus_force_bit(sdvo->i2c, true);
+                intel_gmbus_set_speed(sdvo->i2c, speed);
+                intel_gmbus_force_bit(sdvo->i2c, true);
+        } else
+                sdvo->i2c = &dev_priv->gmbus[GMBUS_PORT_DPB].adapter;
 }
 static bool
@@ -2070,6 +2042,8 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
                intel_sdvo_set_colorimetry(intel_sdvo,
                                           SDVO_COLORIMETRY_RGB256);
                connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
+                intel_sdvo_add_hdmi_properties(intel_sdvo_connector);
                intel_sdvo->is_hdmi = true;
        }
        intel_sdvo->base.clone_mask = ((1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
@@ -2077,8 +2051,6 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
        intel_sdvo_connector_init(intel_sdvo_connector, intel_sdvo);
-        intel_sdvo_add_hdmi_properties(intel_sdvo_connector);
        return true;
 }
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 2f7681989316..93206e4eaa6f 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1245,10 +1245,11 @@ intel_tv_detect_type (struct intel_tv *intel_tv)
        int type;
        /* Disable TV interrupts around load detect or we'll recurse */
-        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-        i915_disable_pipestat(dev_priv, 0, PIPE_HOTPLUG_INTERRUPT_ENABLE |
+        i915_disable_pipestat(dev_priv, 0,
+                              PIPE_HOTPLUG_INTERRUPT_ENABLE |
                              PIPE_HOTPLUG_TV_INTERRUPT_ENABLE);
-        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
        save_tv_dac = tv_dac = I915_READ(TV_DAC);
        save_tv_ctl = tv_ctl = I915_READ(TV_CTL);
@@ -1301,10 +1302,11 @@ intel_tv_detect_type (struct intel_tv *intel_tv)
        I915_WRITE(TV_CTL, save_tv_ctl);
        /* Restore interrupt config */
-        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
+        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-        i915_enable_pipestat(dev_priv, 0, PIPE_HOTPLUG_INTERRUPT_ENABLE |
+        i915_enable_pipestat(dev_priv, 0,
+                             PIPE_HOTPLUG_INTERRUPT_ENABLE |
                             PIPE_HOTPLUG_TV_INTERRUPT_ENABLE);
-        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
+        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
        return type;
 }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 9b0773b75e86..258fa5e7a2d9 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -112,6 +112,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                        base += 3;
                        break;
                case ATOM_IIO_WRITE:
+                        (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
                        ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
                        base += 3;
                        break;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 53bfe3afb0fa..c6a37e036f11 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1198,8 +1198,10 @@ static void r600_vram_gtt_location(struct radeon_device *rdev, struct radeon_mc
                                mc->vram_end, mc->real_vram_size >> 20);
        } else {
                u64 base = 0;
-                if (rdev->flags & RADEON_IS_IGP)
+                if (rdev->flags & RADEON_IS_IGP) {
-                        base = (RREG32(MC_VM_FB_LOCATION) & 0xFFFF) << 24;
+                        base = RREG32(MC_VM_FB_LOCATION) & 0xFFFF;
+                        base <<= 24;
+                }
                radeon_vram_location(rdev, &rdev->mc, base);
                rdev->mc.gtt_base_align = 0;
                radeon_gtt_location(rdev, mc);
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 9bebac1ec006..0f90fc3482ce 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -315,7 +315,7 @@ static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
                if (array_mode == V_0280A0_ARRAY_LINEAR_GENERAL) {
                        /* the initial DDX does bad things with the CB size occasionally */
                        /* it rounds up height too far for slice tile max but the BO is smaller */
-                        tmp = (height - 7) * pitch * bpe;
+                        tmp = (height - 7) * 8 * bpe;
                        if ((tmp + track->cb_color_bo_offset[i]) > radeon_bo_size(track->cb_color_bo[i])) {
                                dev_warn(p->dev, "%s offset[%d] %d %d %lu too big\n", __func__, i, track->cb_color_bo_offset[i], tmp, radeon_bo_size(track->cb_color_bo[i]));
                                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/r600_reg.h b/drivers/gpu/drm/radeon/r600_reg.h
index d84612ae47e0..33cda016b083 100644
--- a/drivers/gpu/drm/radeon/r600_reg.h
+++ b/drivers/gpu/drm/radeon/r600_reg.h
@@ -86,6 +86,7 @@
 #define R600_HDP_NONSURFACE_BASE                                0x2c04
 #define R600_BUS_CNTL                                           0x5420
+#       define R600_BIOS_ROM_DIS                                (1 << 1)
 #define R600_CONFIG_CNTL                                        0x5424
 #define R600_CONFIG_MEMSIZE                                     0x5428
 #define R600_CONFIG_F0_BASE                                     0x542C
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index d6c611eee204..45bc750e9ae2 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -98,6 +98,14 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_i2c_gpio(struct radeon_dev
                                }
                        }
+                        /* some DCE3 boards have bad data for this entry */
+                        if (ASIC_IS_DCE3(rdev)) {
+                                if ((i == 4) &&
+                                    (gpio->usClkMaskRegisterIndex == 0x1fda) &&
+                                    (gpio->sucI2cId.ucAccess == 0x94))
+                                        gpio->sucI2cId.ucAccess = 0x14;
+                        }
                        if (gpio->sucI2cId.ucAccess == id) {
                                i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;
                                i2c.mask_data_reg = le16_to_cpu(gpio->usDataMaskRegisterIndex) * 4;
@@ -174,6 +182,14 @@ void radeon_atombios_i2c_init(struct radeon_device *rdev)
                                }
                        }
+                        /* some DCE3 boards have bad data for this entry */
+                        if (ASIC_IS_DCE3(rdev)) {
+                                if ((i == 4) &&
+                                    (gpio->usClkMaskRegisterIndex == 0x1fda) &&
+                                    (gpio->sucI2cId.ucAccess == 0x94))
+                                        gpio->sucI2cId.ucAccess = 0x14;
+                        }
                        i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;
                        i2c.mask_data_reg = le16_to_cpu(gpio->usDataMaskRegisterIndex) * 4;
                        i2c.en_clk_reg = le16_to_cpu(gpio->usClkEnRegisterIndex) * 4;
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 654787ec43f4..8f2c7b50dcf5 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -130,6 +130,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
        }
        return true;
 }
 static bool r700_read_disabled_bios(struct radeon_device *rdev)
 {
        uint32_t viph_control;
@@ -143,7 +144,7 @@ static bool r700_read_disabled_bios(struct radeon_device *rdev)
        bool r;
        viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        bus_cntl = RREG32(R600_BUS_CNTL);
        d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
        d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
        vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
@@ -152,7 +153,7 @@ static bool r700_read_disabled_bios(struct radeon_device *rdev)
        /* disable VIP */
        WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
        /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        WREG32(R600_BUS_CNTL, (bus_cntl & ~R600_BIOS_ROM_DIS));
        /* Disable VGA mode */
        WREG32(AVIVO_D1VGA_CONTROL,
               (d1vga_control & ~(AVIVO_DVGA_CONTROL_MODE_ENABLE |
@@ -191,7 +192,7 @@ static bool r700_read_disabled_bios(struct radeon_device *rdev)
                        cg_spll_status = RREG32(R600_CG_SPLL_STATUS);
        }
        WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        WREG32(R600_BUS_CNTL, bus_cntl);
        WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
        WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
        WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
@@ -216,7 +217,7 @@ static bool r600_read_disabled_bios(struct radeon_device *rdev)
        bool r;
        viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        bus_cntl = RREG32(R600_BUS_CNTL);
        d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
        d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
        vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
@@ -231,7 +232,7 @@ static bool r600_read_disabled_bios(struct radeon_device *rdev)
        /* disable VIP */
        WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
        /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        WREG32(R600_BUS_CNTL, (bus_cntl & ~R600_BIOS_ROM_DIS));
        /* Disable VGA mode */
        WREG32(AVIVO_D1VGA_CONTROL,
               (d1vga_control & ~(AVIVO_DVGA_CONTROL_MODE_ENABLE |
@@ -262,7 +263,7 @@ static bool r600_read_disabled_bios(struct radeon_device *rdev)
        /* restore regs */
        WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        WREG32(R600_BUS_CNTL, bus_cntl);
        WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
        WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
        WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 111a844c1ecb..591fcae8f224 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -730,7 +730,7 @@ void radeon_combios_i2c_init(struct radeon_device *rdev)
                                        clk = RBIOS8(offset + 3 + (i * 5) + 3);
                                        data = RBIOS8(offset + 3 + (i * 5) + 4);
                                        i2c = combios_setup_i2c_bus(rdev, DDC_MONID,
-                                                                    clk, data);
+                                                                    (1 << clk), (1 << data));
                                        rdev->i2c_bus[4] = radeon_i2c_create(dev, &i2c, "GPIOPAD_MASK");
                                        break;
                                }
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index f3ba066ded20..5b00f92a50a2 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1178,6 +1178,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                /* no HPD on analog connectors */
                radeon_connector->hpd.hpd = RADEON_HPD_NONE;
                connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                break;
        case DRM_MODE_CONNECTOR_DVIA:
                drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
@@ -1193,6 +1195,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                                              1);
                /* no HPD on analog connectors */
                radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                break;
        case DRM_MODE_CONNECTOR_DVII:
        case DRM_MODE_CONNECTOR_DVID:
@@ -1229,6 +1233,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                      rdev->mode_info.load_detect_property,
                                                      1);
                }
+                connector->interlace_allowed = true;
+                if (connector_type == DRM_MODE_CONNECTOR_DVII)
+                        connector->doublescan_allowed = true;
+                else
+                        connector->doublescan_allowed = false;
                break;
        case DRM_MODE_CONNECTOR_HDMIA:
        case DRM_MODE_CONNECTOR_HDMIB:
@@ -1259,6 +1268,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                      0);
                }
                subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = true;
+                if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
+                        connector->doublescan_allowed = true;
+                else
+                        connector->doublescan_allowed = false;
                break;
        case DRM_MODE_CONNECTOR_DisplayPort:
        case DRM_MODE_CONNECTOR_eDP:
@@ -1296,6 +1310,9 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                      rdev->mode_info.underscan_vborder_property,
                                                      0);
                }
+                connector->interlace_allowed = true;
+                /* in theory with a DP to VGA converter... */
+                connector->doublescan_allowed = false;
                break;
        case DRM_MODE_CONNECTOR_SVIDEO:
        case DRM_MODE_CONNECTOR_Composite:
@@ -1311,6 +1328,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                                              radeon_atombios_get_tv_info(rdev));
                /* no HPD on analog connectors */
                radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                break;
        case DRM_MODE_CONNECTOR_LVDS:
                radeon_dig_connector = kzalloc(sizeof(struct radeon_connector_atom_dig), GFP_KERNEL);
@@ -1329,6 +1348,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                                              dev->mode_config.scaling_mode_property,
                                              DRM_MODE_SCALE_FULLSCREEN);
                subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                break;
        }
@@ -1406,6 +1427,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                /* no HPD on analog connectors */
                radeon_connector->hpd.hpd = RADEON_HPD_NONE;
                connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                break;
        case DRM_MODE_CONNECTOR_DVIA:
                drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
@@ -1421,6 +1444,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                              1);
                /* no HPD on analog connectors */
                radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                break;
        case DRM_MODE_CONNECTOR_DVII:
        case DRM_MODE_CONNECTOR_DVID:
@@ -1438,6 +1463,11 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                                      1);
                }
                subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = true;
+                if (connector_type == DRM_MODE_CONNECTOR_DVII)
+                        connector->doublescan_allowed = true;
+                else
+                        connector->doublescan_allowed = false;
                break;
        case DRM_MODE_CONNECTOR_SVIDEO:
        case DRM_MODE_CONNECTOR_Composite:
@@ -1460,6 +1490,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                              radeon_combios_get_tv_info(rdev));
                /* no HPD on analog connectors */
                radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                break;
        case DRM_MODE_CONNECTOR_LVDS:
                drm_connector_init(dev, &radeon_connector->base, &radeon_lvds_connector_funcs, connector_type);
@@ -1473,6 +1505,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                              dev->mode_config.scaling_mode_property,
                                              DRM_MODE_SCALE_FULLSCREEN);
                subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                break;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 3952cf3d0ee9..86660cb425ab 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -287,7 +287,7 @@ void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *mc, u64
                mc->mc_vram_size = mc->aper_size;
        }
        mc->vram_end = mc->vram_start + mc->mc_vram_size - 1;
-        dev_info(rdev->dev, "VRAM: %lluM 0x%08llX - 0x%08llX (%lluM used)\n",
+        dev_info(rdev->dev, "VRAM: %lluM 0x%016llX - 0x%016llX (%lluM used)\n",
                        mc->mc_vram_size >> 20, mc->vram_start,
                        mc->vram_end, mc->real_vram_size >> 20);
 }
@@ -324,7 +324,7 @@ void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
                mc->gtt_start = (mc->vram_end + 1 + mc->gtt_base_align) & ~mc->gtt_base_align;
        }
        mc->gtt_end = mc->gtt_start + mc->gtt_size - 1;
-        dev_info(rdev->dev, "GTT: %lluM 0x%08llX - 0x%08llX\n",
+        dev_info(rdev->dev, "GTT: %lluM 0x%016llX - 0x%016llX\n",
                        mc->gtt_size >> 20, mc->gtt_start, mc->gtt_end);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 8bdf0ba2983a..7d6b8e88f746 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -70,7 +70,7 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
        u32 c = 0;
        rbo->placement.fpfn = 0;
-        rbo->placement.lpfn = rbo->rdev->mc.active_vram_size >> PAGE_SHIFT;
+        rbo->placement.lpfn = 0;
        rbo->placement.placement = rbo->placements;
        rbo->placement.busy_placement = rbo->placements;
        if (domain & RADEON_GEM_DOMAIN_VRAM)
@@ -92,7 +92,8 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
 {
        struct radeon_bo *bo;
        enum ttm_bo_type type;
-        int page_align = roundup(byte_align, PAGE_SIZE) >> PAGE_SHIFT;
+        unsigned long page_align = roundup(byte_align, PAGE_SIZE) >> PAGE_SHIFT;
+        unsigned long max_size = 0;
        int r;
        if (unlikely(rdev->mman.bdev.dev_mapping == NULL)) {
@@ -105,6 +106,14 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
        }
        *bo_ptr = NULL;
+        /* maximun bo size is the minimun btw visible vram and gtt size */
+        max_size = min(rdev->mc.visible_vram_size, rdev->mc.gtt_size);
+        if ((page_align << PAGE_SHIFT) >= max_size) {
+                printk(KERN_WARNING "%s:%d alloc size %ldM bigger than %ldMb limit\n",
+                        __func__, __LINE__, page_align  >> (20 - PAGE_SHIFT), max_size >> 20);
+                return -ENOMEM;
+        }
 retry:
        bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
        if (bo == NULL)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 515345b11ac9..88cb04e7962b 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1386,6 +1386,7 @@ static const struct hid_device_id hid_blacklist[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb651) },
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb653) },
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
diff --git a/drivers/hid/hid-egalax.c b/drivers/hid/hid-egalax.c
index 54b017ad258d..5a1b52e0eb85 100644
--- a/drivers/hid/hid-egalax.c
+++ b/drivers/hid/hid-egalax.c
@@ -221,7 +221,7 @@ static int egalax_probe(struct hid_device *hdev, const struct hid_device_id *id)
        struct egalax_data *td;
        struct hid_report *report;
-        td = kmalloc(sizeof(struct egalax_data), GFP_KERNEL);
+        td = kzalloc(sizeof(struct egalax_data), GFP_KERNEL);
        if (!td) {
                dev_err(&hdev->dev, "cannot allocate eGalax data\n");
                return -ENOMEM;
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index bb0b3659437b..d8d372bae3cc 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -174,7 +174,7 @@ static int hidinput_setkeycode(struct input_dev *dev,
                clear_bit(*old_keycode, dev->keybit);
                set_bit(usage->code, dev->keybit);
-                dbg_hid(KERN_DEBUG "Assigned keycode %d to HID usage code %x\n",
+                dbg_hid("Assigned keycode %d to HID usage code %x\n",
                        usage->code, usage->hid);
                /*
@@ -203,8 +203,8 @@ static int hidinput_setkeycode(struct input_dev *dev,
 *
 * as seen in the HID specification v1.11 6.2.2.7 Global Items.
 *
- * Only exponent 1 length units are processed. Centimeters are converted to
+ * Only exponent 1 length units are processed. Centimeters and inches are
- * inches. Degrees are converted to radians.
+ * converted to millimeters. Degrees are converted to radians.
 */
 static __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code)
 {
@@ -225,13 +225,16 @@ static __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code)
         */
        if (code == ABS_X || code == ABS_Y || code == ABS_Z) {
                if (field->unit == 0x11) {              /* If centimeters */
-                        /* Convert to inches */
+                        /* Convert to millimeters */
-                        prev = logical_extents;
+                        unit_exponent += 1;
-                        logical_extents *= 254;
+                } else if (field->unit == 0x13) {       /* If inches */
-                        if (logical_extents < prev)
+                        /* Convert to millimeters */
+                        prev = physical_extents;
+                        physical_extents *= 254;
+                        if (physical_extents < prev)
                                return 0;
-                        unit_exponent += 2;
+                        unit_exponent -= 1;
-                } else if (field->unit != 0x13) {       /* If not inches */
+                } else {
                        return 0;
                }
        } else if (code == ABS_RX || code == ABS_RY || code == ABS_RZ) {
diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
index 15434c814793..25be4e1461bd 100644
--- a/drivers/hid/hid-tmff.c
+++ b/drivers/hid/hid-tmff.c
@@ -256,6 +256,8 @@ static const struct hid_device_id tm_devices[] = {
                .driver_data = (unsigned long)ff_joystick },
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654),   /* FGT Force Feedback Wheel */
                .driver_data = (unsigned long)ff_joystick },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a),   /* F430 Force Feedback Wheel */
+                .driver_data = (unsigned long)ff_joystick },
        { }
 };
 MODULE_DEVICE_TABLE(hid, tm_devices);
diff --git a/drivers/hwmon/i5k_amb.c b/drivers/hwmon/i5k_amb.c
index 937983407e2a..c4c40be0edbf 100644
--- a/drivers/hwmon/i5k_amb.c
+++ b/drivers/hwmon/i5k_amb.c
@@ -497,12 +497,14 @@ static unsigned long chipset_ids[] = {
        0
 };
+#ifdef MODULE
 static struct pci_device_id i5k_amb_ids[] __devinitdata = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5000_ERR) },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR) },
        { 0, }
 };
 MODULE_DEVICE_TABLE(pci, i5k_amb_ids);
+#endif
 static int __devinit i5k_amb_probe(struct platform_device *pdev)
 {
diff --git a/drivers/hwmon/lis3lv02d_i2c.c b/drivers/hwmon/lis3lv02d_i2c.c
index 9f4bae07f719..8853afce85ce 100644
--- a/drivers/hwmon/lis3lv02d_i2c.c
+++ b/drivers/hwmon/lis3lv02d_i2c.c
@@ -186,7 +186,7 @@ static int __devexit lis3lv02d_i2c_remove(struct i2c_client *client)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int lis3lv02d_i2c_suspend(struct device *dev)
 {
        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
@@ -213,12 +213,9 @@ static int lis3lv02d_i2c_resume(struct device *dev)
        return 0;
 }
-#else
+#endif /* CONFIG_PM_SLEEP */
-#define lis3lv02d_i2c_suspend   NULL
-#define lis3lv02d_i2c_resume    NULL
-#define lis3lv02d_i2c_shutdown  NULL
-#endif
+#ifdef CONFIG_PM_RUNTIME
 static int lis3_i2c_runtime_suspend(struct device *dev)
 {
        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
@@ -236,6 +233,7 @@ static int lis3_i2c_runtime_resume(struct device *dev)
        lis3lv02d_poweron(lis3);
        return 0;
 }
+#endif /* CONFIG_PM_RUNTIME */
 static const struct i2c_device_id lis3lv02d_id[] = {
        {"lis3lv02d", 0 },
diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig
index b923074b2cbe..30f06e956bfb 100644
--- a/drivers/i2c/Kconfig
+++ b/drivers/i2c/Kconfig
@@ -75,8 +75,7 @@ config I2C_HELPER_AUTO
          In doubt, say Y.
 config I2C_SMBUS
-        tristate
+        tristate "SMBus-specific protocols" if !I2C_HELPER_AUTO
-        prompt "SMBus-specific protocols" if !I2C_HELPER_AUTO
        help
          Say Y here if you want support for SMBus extensions to the I2C
          specification. At the moment, the only supported extension is
diff --git a/drivers/i2c/algos/Kconfig b/drivers/i2c/algos/Kconfig
index 3998dd620a03..f1cfe7e5508b 100644
--- a/drivers/i2c/algos/Kconfig
+++ b/drivers/i2c/algos/Kconfig
@@ -3,7 +3,7 @@
 #
 menu "I2C Algorithms"
-        depends on !I2C_HELPER_AUTO
+        visible if !I2C_HELPER_AUTO
 config I2C_ALGOBIT
        tristate "I2C bit-banging interfaces"
@@ -15,15 +15,3 @@ config I2C_ALGOPCA
        tristate "I2C PCA 9564 interfaces"
 endmenu
-# In automatic configuration mode, we still have to define the
-# symbols to avoid unmet dependencies.
-if I2C_HELPER_AUTO
-config I2C_ALGOBIT
-        tristate
-config I2C_ALGOPCF
-        tristate
-config I2C_ALGOPCA
-        tristate
-endif
diff --git a/drivers/infiniband/core/ud_header.c b/drivers/infiniband/core/ud_header.c
index bb7e19280821..9b737ff133e2 100644
--- a/drivers/infiniband/core/ud_header.c
+++ b/drivers/infiniband/core/ud_header.c
@@ -278,36 +278,6 @@ void ib_ud_header_init(int     		    payload_bytes,
 EXPORT_SYMBOL(ib_ud_header_init);
 /**
- * ib_lrh_header_pack - Pack LRH header struct into wire format
- * @lrh:unpacked LRH header struct
- * @buf:Buffer to pack into
- *
- * ib_lrh_header_pack() packs the LRH header structure @lrh into
- * wire format in the buffer @buf.
- */
-int ib_lrh_header_pack(struct ib_unpacked_lrh *lrh, void *buf)
-{
-        ib_pack(lrh_table, ARRAY_SIZE(lrh_table), lrh, buf);
-        return 0;
-}
-EXPORT_SYMBOL(ib_lrh_header_pack);
-/**
- * ib_lrh_header_unpack - Unpack LRH structure from wire format
- * @lrh:unpacked LRH header struct
- * @buf:Buffer to pack into
- *
- * ib_lrh_header_unpack() unpacks the LRH header structure from
- * wire format (in buf) into @lrh.
- */
-int ib_lrh_header_unpack(void *buf, struct ib_unpacked_lrh *lrh)
-{
-        ib_unpack(lrh_table, ARRAY_SIZE(lrh_table), buf, lrh);
-        return 0;
-}
-EXPORT_SYMBOL(ib_lrh_header_unpack);
-/**
 * ib_ud_header_pack - Pack UD header struct into wire format
 * @header:UD header struct
 * @buf:Buffer to pack into
diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
index 5440da0e59b4..1b1146f87124 100644
--- a/drivers/infiniband/core/uverbs_marshall.c
+++ b/drivers/infiniband/core/uverbs_marshall.c
@@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_uverbs_ah_attr *dst,
        dst->grh.sgid_index        = src->grh.sgid_index;
        dst->grh.hop_limit         = src->grh.hop_limit;
        dst->grh.traffic_class     = src->grh.traffic_class;
+        memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
        dst->dlid                  = src->dlid;
        dst->sl                    = src->sl;
        dst->src_path_bits         = src->src_path_bits;
        dst->static_rate           = src->static_rate;
        dst->is_global             = src->ah_flags & IB_AH_GRH ? 1 : 0;
        dst->port_num              = src->port_num;
+        dst->reserved              = 0;
 }
 EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
 void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
                             struct ib_qp_attr *src)
 {
+        dst->qp_state           = src->qp_state;
        dst->cur_qp_state       = src->cur_qp_state;
        dst->path_mtu           = src->path_mtu;
        dst->path_mig_state     = src->path_mig_state;
@@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
        dst->rnr_retry          = src->rnr_retry;
        dst->alt_port_num       = src->alt_port_num;
        dst->alt_timeout        = src->alt_timeout;
+        memset(dst->reserved, 0, sizeof(dst->reserved));
 }
 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index bf3e20cd0298..30e09caf0da9 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -219,7 +219,7 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port,
        struct net_device *ndev;
        enum ib_mtu tmp;
-        props->active_width     = IB_WIDTH_4X;
+        props->active_width     = IB_WIDTH_1X;
        props->active_speed     = 4;
        props->port_cap_flags   = IB_PORT_CM_SUP;
        props->gid_tbl_len      = to_mdev(ibdev)->dev->caps.gid_table_len[port];
@@ -242,7 +242,7 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port,
        tmp = iboe_get_mtu(ndev->mtu);
        props->active_mtu = tmp ? min(props->max_mtu, tmp) : IB_MTU_256;
-        props->state            = netif_running(ndev) &&  netif_oper_up(ndev) ?
+        props->state            = (netif_running(ndev) && netif_carrier_ok(ndev)) ?
                                        IB_PORT_ACTIVE : IB_PORT_DOWN;
        props->phys_state       = state_to_phys_state(props->state);
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 9a7794ac34c1..2001f20a4361 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1816,6 +1816,11 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                ctrl->fence_size = (wr->send_flags & IB_SEND_FENCE ?
                                    MLX4_WQE_CTRL_FENCE : 0) | size;
+                if (be16_to_cpu(vlan) < 0x1000) {
+                        ctrl->ins_vlan = 1 << 6;
+                        ctrl->vlan_tag = vlan;
+                }
                /*
                 * Make sure descriptor is fully written before
                 * setting ownership bit (because HW can start
@@ -1831,11 +1836,6 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                ctrl->owner_opcode = mlx4_ib_opcode[wr->opcode] |
                        (ind & qp->sq.wqe_cnt ? cpu_to_be32(1 << 31) : 0) | blh;
-                if (be16_to_cpu(vlan) < 0x1000) {
-                        ctrl->ins_vlan = 1 << 6;
-                        ctrl->vlan_tag = vlan;
-                }
                stamp = ind + qp->sq_spare_wqes;
                ind += DIV_ROUND_UP(size * 16, 1U << qp->sq.wqe_shift);
diff --git a/drivers/input/joystick/turbografx.c b/drivers/input/joystick/turbografx.c
index d53b9e900234..27b6a3ce18ca 100644
--- a/drivers/input/joystick/turbografx.c
+++ b/drivers/input/joystick/turbografx.c
@@ -245,6 +245,7 @@ static struct tgfx __init *tgfx_probe(int parport, int *n_buttons, int n_devs)
                goto err_free_tgfx;
        }
+        parport_put_port(pp);
        return tgfx;
 err_free_dev:
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index b8c51b9781db..3a87f3ba5f75 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -179,6 +179,22 @@ config KEYBOARD_GPIO
          To compile this driver as a module, choose M here: the
          module will be called gpio_keys.
+config KEYBOARD_GPIO_POLLED
+        tristate "Polled GPIO buttons"
+        depends on GENERIC_GPIO
+        select INPUT_POLLDEV
+        help
+          This driver implements support for buttons connected
+          to GPIO pins that are not capable of generating interrupts.
+          Say Y here if your device has buttons connected
+          directly to such GPIO pins.  Your board-specific
+          setup logic must also provide a platform device,
+          with configuration data saying which GPIOs are used.
+          To compile this driver as a module, choose M here: the
+          module will be called gpio_keys_polled.
 config KEYBOARD_TCA6416
        tristate "TCA6416 Keypad Support"
        depends on I2C
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index a34452e8ebe2..622de73a445d 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_KEYBOARD_BFIN)		+= bf54x-keys.o
 obj-$(CONFIG_KEYBOARD_DAVINCI)          += davinci_keyscan.o
 obj-$(CONFIG_KEYBOARD_EP93XX)           += ep93xx_keypad.o
 obj-$(CONFIG_KEYBOARD_GPIO)             += gpio_keys.o
+obj-$(CONFIG_KEYBOARD_GPIO_POLLED)      += gpio_keys_polled.o
 obj-$(CONFIG_KEYBOARD_TCA6416)          += tca6416-keypad.o
 obj-$(CONFIG_KEYBOARD_HIL)              += hil_kbd.o
 obj-$(CONFIG_KEYBOARD_HIL_OLD)          += hilkbd.o
diff --git a/drivers/input/keyboard/gpio_keys_polled.c b/drivers/input/keyboard/gpio_keys_polled.c
new file mode 100644
index 000000000000..4c17aff20657
--- /dev/null
+++ b/drivers/input/keyboard/gpio_keys_polled.c
@@ -0,0 +1,261 @@
+/*
+ *  Driver for buttons on GPIO lines not capable of generating interrupts
+ *
+ *  Copyright (C) 2007-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2010 Nuno Goncalves <nunojpg@gmail.com>
+ *
+ *  This file was based on: /drivers/input/misc/cobalt_btns.c
+ *      Copyright (C) 2007 Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *
+ *  also was based on: /drivers/input/keyboard/gpio_keys.c
+ *      Copyright 2005 Phil Blundell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/input.h>
+#include <linux/input-polldev.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+#include <linux/gpio_keys.h>
+#define DRV_NAME        "gpio-keys-polled"
+struct gpio_keys_button_data {
+        int last_state;
+        int count;
+        int threshold;
+        int can_sleep;
+};
+struct gpio_keys_polled_dev {
+        struct input_polled_dev *poll_dev;
+        struct device *dev;
+        struct gpio_keys_platform_data *pdata;
+        struct gpio_keys_button_data data[0];
+};
+static void gpio_keys_polled_check_state(struct input_dev *input,
+                                         struct gpio_keys_button *button,
+                                         struct gpio_keys_button_data *bdata)
+{
+        int state;
+        if (bdata->can_sleep)
+                state = !!gpio_get_value_cansleep(button->gpio);
+        else
+                state = !!gpio_get_value(button->gpio);
+        if (state != bdata->last_state) {
+                unsigned int type = button->type ?: EV_KEY;
+                input_event(input, type, button->code,
+                            !!(state ^ button->active_low));
+                input_sync(input);
+                bdata->count = 0;
+                bdata->last_state = state;
+        }
+}
+static void gpio_keys_polled_poll(struct input_polled_dev *dev)
+{
+        struct gpio_keys_polled_dev *bdev = dev->private;
+        struct gpio_keys_platform_data *pdata = bdev->pdata;
+        struct input_dev *input = dev->input;
+        int i;
+        for (i = 0; i < bdev->pdata->nbuttons; i++) {
+                struct gpio_keys_button_data *bdata = &bdev->data[i];
+                if (bdata->count < bdata->threshold)
+                        bdata->count++;
+                else
+                        gpio_keys_polled_check_state(input, &pdata->buttons[i],
+                                                     bdata);
+        }
+}
+static void gpio_keys_polled_open(struct input_polled_dev *dev)
+{
+        struct gpio_keys_polled_dev *bdev = dev->private;
+        struct gpio_keys_platform_data *pdata = bdev->pdata;
+        if (pdata->enable)
+                pdata->enable(bdev->dev);
+}
+static void gpio_keys_polled_close(struct input_polled_dev *dev)
+{
+        struct gpio_keys_polled_dev *bdev = dev->private;
+        struct gpio_keys_platform_data *pdata = bdev->pdata;
+        if (pdata->disable)
+                pdata->disable(bdev->dev);
+}
+static int __devinit gpio_keys_polled_probe(struct platform_device *pdev)
+{
+        struct gpio_keys_platform_data *pdata = pdev->dev.platform_data;
+        struct device *dev = &pdev->dev;
+        struct gpio_keys_polled_dev *bdev;
+        struct input_polled_dev *poll_dev;
+        struct input_dev *input;
+        int error;
+        int i;
+        if (!pdata || !pdata->poll_interval)
+                return -EINVAL;
+        bdev = kzalloc(sizeof(struct gpio_keys_polled_dev) +
+                       pdata->nbuttons * sizeof(struct gpio_keys_button_data),
+                       GFP_KERNEL);
+        if (!bdev) {
+                dev_err(dev, "no memory for private data\n");
+                return -ENOMEM;
+        }
+        poll_dev = input_allocate_polled_device();
+        if (!poll_dev) {
+                dev_err(dev, "no memory for polled device\n");
+                error = -ENOMEM;
+                goto err_free_bdev;
+        }
+        poll_dev->private = bdev;
+        poll_dev->poll = gpio_keys_polled_poll;
+        poll_dev->poll_interval = pdata->poll_interval;
+        poll_dev->open = gpio_keys_polled_open;
+        poll_dev->close = gpio_keys_polled_close;
+        input = poll_dev->input;
+        input->evbit[0] = BIT(EV_KEY);
+        input->name = pdev->name;
+        input->phys = DRV_NAME"/input0";
+        input->dev.parent = &pdev->dev;
+        input->id.bustype = BUS_HOST;
+        input->id.vendor = 0x0001;
+        input->id.product = 0x0001;
+        input->id.version = 0x0100;
+        for (i = 0; i < pdata->nbuttons; i++) {
+                struct gpio_keys_button *button = &pdata->buttons[i];
+                struct gpio_keys_button_data *bdata = &bdev->data[i];
+                unsigned int gpio = button->gpio;
+                unsigned int type = button->type ?: EV_KEY;
+                if (button->wakeup) {
+                        dev_err(dev, DRV_NAME " does not support wakeup\n");
+                        error = -EINVAL;
+                        goto err_free_gpio;
+                }
+                error = gpio_request(gpio,
+                                     button->desc ? button->desc : DRV_NAME);
+                if (error) {
+                        dev_err(dev, "unable to claim gpio %u, err=%d\n",
+                                gpio, error);
+                        goto err_free_gpio;
+                }
+                error = gpio_direction_input(gpio);
+                if (error) {
+                        dev_err(dev,
+                                "unable to set direction on gpio %u, err=%d\n",
+                                gpio, error);
+                        goto err_free_gpio;
+                }
+                bdata->can_sleep = gpio_cansleep(gpio);
+                bdata->last_state = -1;
+                bdata->threshold = DIV_ROUND_UP(button->debounce_interval,
+                                                pdata->poll_interval);
+                input_set_capability(input, type, button->code);
+        }
+        bdev->poll_dev = poll_dev;
+        bdev->dev = dev;
+        bdev->pdata = pdata;
+        platform_set_drvdata(pdev, bdev);
+        error = input_register_polled_device(poll_dev);
+        if (error) {
+                dev_err(dev, "unable to register polled device, err=%d\n",
+                        error);
+                goto err_free_gpio;
+        }
+        /* report initial state of the buttons */
+        for (i = 0; i < pdata->nbuttons; i++)
+                gpio_keys_polled_check_state(input, &pdata->buttons[i],
+                                         &bdev->data[i]);
+        return 0;
+err_free_gpio:
+        while (--i >= 0)
+                gpio_free(pdata->buttons[i].gpio);
+        input_free_polled_device(poll_dev);
+err_free_bdev:
+        kfree(bdev);
+        platform_set_drvdata(pdev, NULL);
+        return error;
+}
+static int __devexit gpio_keys_polled_remove(struct platform_device *pdev)
+{
+        struct gpio_keys_polled_dev *bdev = platform_get_drvdata(pdev);
+        struct gpio_keys_platform_data *pdata = bdev->pdata;
+        int i;
+        input_unregister_polled_device(bdev->poll_dev);
+        for (i = 0; i < pdata->nbuttons; i++)
+                gpio_free(pdata->buttons[i].gpio);
+        input_free_polled_device(bdev->poll_dev);
+        kfree(bdev);
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+static struct platform_driver gpio_keys_polled_driver = {
+        .probe  = gpio_keys_polled_probe,
+        .remove = __devexit_p(gpio_keys_polled_remove),
+        .driver = {
+                .name   = DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+};
+static int __init gpio_keys_polled_init(void)
+{
+        return platform_driver_register(&gpio_keys_polled_driver);
+}
+static void __exit gpio_keys_polled_exit(void)
+{
+        platform_driver_unregister(&gpio_keys_polled_driver);
+}
+module_init(gpio_keys_polled_init);
+module_exit(gpio_keys_polled_exit);
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
+MODULE_DESCRIPTION("Polled GPIO Buttons driver");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index 613a3652f98f..0aefaa885871 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -51,7 +51,8 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
-#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100100)
+#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100000) /* 1-button ClickPad */
+#define SYN_CAP_CLICKPAD2BTN(ex0c)      ((ex0c) & 0x000100) /* 2-button ClickPad */
 #define SYN_CAP_MAX_DIMENSIONS(ex0c)    ((ex0c) & 0x020000)
 /* synaptics modes query bits */
diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
index 3c287dd879d3..4225f5d6b15f 100644
--- a/drivers/input/serio/gscps2.c
+++ b/drivers/input/serio/gscps2.c
@@ -358,7 +358,7 @@ static int __devinit gscps2_probe(struct parisc_device *dev)
        gscps2_reset(ps2port);
        ps2port->id = readb(ps2port->addr + GSC_ID) & 0x0f;
-        snprintf(serio->name, sizeof(serio->name), "GSC PS/2 %s",
+        snprintf(serio->name, sizeof(serio->name), "gsc-ps2-%s",
                 (ps2port->id == GSC_ID_KEYBOARD) ? "keyboard" : "mouse");
        strlcpy(serio->phys, dev_name(&dev->dev), sizeof(serio->phys));
        serio->id.type          = SERIO_8042;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index b3252ef1e279..4852b440960a 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1436,6 +1436,12 @@ static struct wacom_features wacom_features_0xD2 =
        { "Wacom Bamboo Craft",   WACOM_PKGLEN_BBFUN,     14720,  9200, 1023, 63, BAMBOO_PT };
 static struct wacom_features wacom_features_0xD3 =
        { "Wacom Bamboo 2FG 6x8", WACOM_PKGLEN_BBFUN,     21648, 13530, 1023, 63, BAMBOO_PT };
+static struct wacom_features wacom_features_0xD8 =
+        { "Wacom Bamboo Comic 2FG", WACOM_PKGLEN_BBFUN,   21648, 13530, 1023, 63, BAMBOO_PT };
+static struct wacom_features wacom_features_0xDA =
+        { "Wacom Bamboo 2FG 4x5 SE", WACOM_PKGLEN_BBFUN,  14720,  9200, 1023, 63, BAMBOO_PT };
+static struct wacom_features wacom_features_0xDB =
+        { "Wacom Bamboo 2FG 6x8 SE", WACOM_PKGLEN_BBFUN,  21648, 13530, 1023, 63, BAMBOO_PT };
 #define USB_DEVICE_WACOM(prod)                                  \
        USB_DEVICE(USB_VENDOR_ID_WACOM, prod),                  \
@@ -1504,6 +1510,9 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0xD1) },
        { USB_DEVICE_WACOM(0xD2) },
        { USB_DEVICE_WACOM(0xD3) },
+        { USB_DEVICE_WACOM(0xD8) },
+        { USB_DEVICE_WACOM(0xDA) },
+        { USB_DEVICE_WACOM(0xDB) },
        { USB_DEVICE_WACOM(0xF0) },
        { USB_DEVICE_WACOM(0xCC) },
        { USB_DEVICE_WACOM(0x90) },
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index f45f80f6d336..73fd6642b681 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -178,6 +178,7 @@ static const struct usb_device_id usbtouch_devices[] = {
 #ifdef CONFIG_TOUCHSCREEN_USB_ITM
        {USB_DEVICE(0x0403, 0xf9e9), .driver_info = DEVTYPE_ITM},
+        {USB_DEVICE(0x16e3, 0xf9e9), .driver_info = DEVTYPE_ITM},
 #endif
 #ifdef CONFIG_TOUCHSCREEN_USB_ETURBO
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 2e847a90bad0..f2b5bab5e6a1 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1627,7 +1627,7 @@ __setup("icn=", icn_setup);
 static int __init icn_init(void)
 {
        char *p;
-        char rev[10];
+        char rev[20];
        memset(&dev, 0, sizeof(icn_dev));
        dev.memaddr = (membase & 0x0ffc000);
@@ -1637,9 +1637,10 @@ static int __init icn_init(void)
        spin_lock_init(&dev.devlock);
        if ((p = strchr(revision, ':'))) {
-                strcpy(rev, p + 1);
+                strncpy(rev, p + 1, 20);
                p = strchr(rev, '$');
-                *p = 0;
+                if (p)
+                        *p = 0;
        } else
                strcpy(rev, " ??? ");
        printk(KERN_NOTICE "ICN-ISDN-driver Rev%smem=0x%08lx\n", rev,
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 77b8fd20cd90..6f190f4cdbc0 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -7,20 +7,20 @@ menuconfig NEW_LEDS
          This is not related to standard keyboard LEDs which are controlled
          via the input system.
-if NEW_LEDS
 config LEDS_CLASS
        bool "LED Class Support"
+        depends on NEW_LEDS
        help
          This option enables the led sysfs class in /sys/class/leds.  You'll
          need this to do anything useful with LEDs.  If unsure, say N.
-if LEDS_CLASS
+if NEW_LEDS
 comment "LED drivers"
 config LEDS_88PM860X
        tristate "LED Support for Marvell 88PM860x PMIC"
+        depends on LEDS_CLASS
        depends on MFD_88PM860X
        help
          This option enables support for on-chip LED drivers found on Marvell
@@ -28,6 +28,7 @@ config LEDS_88PM860X
 config LEDS_ATMEL_PWM
        tristate "LED Support using Atmel PWM outputs"
+        depends on LEDS_CLASS
        depends on ATMEL_PWM
        help
          This option enables support for LEDs driven using outputs
@@ -35,6 +36,7 @@ config LEDS_ATMEL_PWM
 config LEDS_LOCOMO
        tristate "LED Support for Locomo device"
+        depends on LEDS_CLASS
        depends on SHARP_LOCOMO
        help
          This option enables support for the LEDs on Sharp Locomo.
@@ -42,6 +44,7 @@ config LEDS_LOCOMO
 config LEDS_MIKROTIK_RB532
        tristate "LED Support for Mikrotik Routerboard 532"
+        depends on LEDS_CLASS
        depends on MIKROTIK_RB532
        help
          This option enables support for the so called "User LED" of
@@ -49,6 +52,7 @@ config LEDS_MIKROTIK_RB532
 config LEDS_S3C24XX
        tristate "LED Support for Samsung S3C24XX GPIO LEDs"
+        depends on LEDS_CLASS
        depends on ARCH_S3C2410
        help
          This option enables support for LEDs connected to GPIO lines
@@ -56,12 +60,14 @@ config LEDS_S3C24XX
 config LEDS_AMS_DELTA
        tristate "LED Support for the Amstrad Delta (E3)"
+        depends on LEDS_CLASS
        depends on MACH_AMS_DELTA
        help
          This option enables support for the LEDs on Amstrad Delta (E3).
 config LEDS_NET48XX
        tristate "LED Support for Soekris net48xx series Error LED"
+        depends on LEDS_CLASS
        depends on SCx200_GPIO
        help
          This option enables support for the Soekris net4801 and net4826 error
@@ -79,18 +85,21 @@ config LEDS_NET5501
 config LEDS_FSG
        tristate "LED Support for the Freecom FSG-3"
+        depends on LEDS_CLASS
        depends on MACH_FSG
        help
          This option enables support for the LEDs on the Freecom FSG-3.
 config LEDS_WRAP
        tristate "LED Support for the WRAP series LEDs"
+        depends on LEDS_CLASS
        depends on SCx200_GPIO
        help
          This option enables support for the PCEngines WRAP programmable LEDs.
 config LEDS_ALIX2
        tristate "LED Support for ALIX.2 and ALIX.3 series"
+        depends on LEDS_CLASS
        depends on X86 && !GPIO_CS5535 && !CS5535_GPIO
        help
          This option enables support for the PCEngines ALIX.2 and ALIX.3 LEDs.
@@ -98,12 +107,14 @@ config LEDS_ALIX2
 config LEDS_H1940
        tristate "LED Support for iPAQ H1940 device"
+        depends on LEDS_CLASS
        depends on ARCH_H1940
        help
          This option enables support for the LEDs on the h1940.
 config LEDS_COBALT_QUBE
        tristate "LED Support for the Cobalt Qube series front LED"
+        depends on LEDS_CLASS
        depends on MIPS_COBALT
        help
          This option enables support for the front LED on Cobalt Qube series
@@ -117,6 +128,7 @@ config LEDS_COBALT_RAQ
 config LEDS_SUNFIRE
        tristate "LED support for SunFire servers."
+        depends on LEDS_CLASS
        depends on SPARC64
        select LEDS_TRIGGERS
        help
@@ -125,6 +137,7 @@ config LEDS_SUNFIRE
 config LEDS_HP6XX
        tristate "LED Support for the HP Jornada 6xx"
+        depends on LEDS_CLASS
        depends on SH_HP6XX
        help
          This option enables LED support for the handheld
@@ -132,6 +145,7 @@ config LEDS_HP6XX
 config LEDS_PCA9532
        tristate "LED driver for PCA9532 dimmer"
+        depends on LEDS_CLASS
        depends on I2C && INPUT && EXPERIMENTAL
        help
          This option enables support for NXP pca9532
@@ -140,6 +154,7 @@ config LEDS_PCA9532
 config LEDS_GPIO
        tristate "LED Support for GPIO connected LEDs"
+        depends on LEDS_CLASS
        depends on GENERIC_GPIO
        help
          This option enables support for the LEDs connected to GPIO
@@ -167,6 +182,7 @@ config LEDS_GPIO_OF
 config LEDS_LP3944
        tristate "LED Support for N.S. LP3944 (Fun Light) I2C chip"
+        depends on LEDS_CLASS
        depends on I2C
        help
          This option enables support for LEDs connected to the National
@@ -196,6 +212,7 @@ config LEDS_LP5523
 config LEDS_CLEVO_MAIL
        tristate "Mail LED on Clevo notebook"
+        depends on LEDS_CLASS
        depends on X86 && SERIO_I8042 && DMI
        help
          This driver makes the mail LED accessible from userspace
@@ -226,6 +243,7 @@ config LEDS_CLEVO_MAIL
 config LEDS_PCA955X
        tristate "LED Support for PCA955x I2C chips"
+        depends on LEDS_CLASS
        depends on I2C
        help
          This option enables support for LEDs connected to PCA955x
@@ -234,6 +252,7 @@ config LEDS_PCA955X
 config LEDS_WM831X_STATUS
        tristate "LED support for status LEDs on WM831x PMICs"
+        depends on LEDS_CLASS
        depends on MFD_WM831X
        help
          This option enables support for the status LEDs of the WM831x
@@ -241,6 +260,7 @@ config LEDS_WM831X_STATUS
 config LEDS_WM8350
        tristate "LED Support for WM8350 AudioPlus PMIC"
+        depends on LEDS_CLASS
        depends on MFD_WM8350
        help
          This option enables support for LEDs driven by the Wolfson
@@ -248,6 +268,7 @@ config LEDS_WM8350
 config LEDS_DA903X
        tristate "LED Support for DA9030/DA9034 PMIC"
+        depends on LEDS_CLASS
        depends on PMIC_DA903X
        help
          This option enables support for on-chip LED drivers found
@@ -255,6 +276,7 @@ config LEDS_DA903X
 config LEDS_DAC124S085
        tristate "LED Support for DAC124S085 SPI DAC"
+        depends on LEDS_CLASS
        depends on SPI
        help
          This option enables support for DAC124S085 SPI DAC from NatSemi,
@@ -262,18 +284,21 @@ config LEDS_DAC124S085
 config LEDS_PWM
        tristate "PWM driven LED Support"
+        depends on LEDS_CLASS
        depends on HAVE_PWM
        help
          This option enables support for pwm driven LEDs
 config LEDS_REGULATOR
        tristate "REGULATOR driven LED support"
+        depends on LEDS_CLASS
        depends on REGULATOR
        help
          This option enables support for regulator driven LEDs.
 config LEDS_BD2802
        tristate "LED driver for BD2802 RGB LED"
+        depends on LEDS_CLASS
        depends on I2C
        help
          This option enables support for BD2802GU RGB LED driver chips
@@ -281,6 +306,7 @@ config LEDS_BD2802
 config LEDS_INTEL_SS4200
        tristate "LED driver for Intel NAS SS4200 series"
+        depends on LEDS_CLASS
        depends on PCI && DMI
        help
          This option enables support for the Intel SS4200 series of
@@ -290,6 +316,7 @@ config LEDS_INTEL_SS4200
 config LEDS_LT3593
        tristate "LED driver for LT3593 controllers"
+        depends on LEDS_CLASS
        depends on GENERIC_GPIO
        help
          This option enables support for LEDs driven by a Linear Technology
@@ -298,6 +325,7 @@ config LEDS_LT3593
 config LEDS_ADP5520
        tristate "LED Support for ADP5520/ADP5501 PMIC"
+        depends on LEDS_CLASS
        depends on PMIC_ADP5520
        help
          This option enables support for on-chip LED drivers found
@@ -308,6 +336,7 @@ config LEDS_ADP5520
 config LEDS_DELL_NETBOOKS
        tristate "External LED on Dell Business Netbooks"
+        depends on LEDS_CLASS
        depends on X86 && ACPI_WMI
        help
          This adds support for the Latitude 2100 and similar
@@ -315,6 +344,7 @@ config LEDS_DELL_NETBOOKS
 config LEDS_MC13783
        tristate "LED Support for MC13783 PMIC"
+        depends on LEDS_CLASS
        depends on MFD_MC13783
        help
          This option enable support for on-chip LED drivers found
@@ -322,6 +352,7 @@ config LEDS_MC13783
 config LEDS_NS2
        tristate "LED support for Network Space v2 GPIO LEDs"
+        depends on LEDS_CLASS
        depends on MACH_NETSPACE_V2 || MACH_INETSPACE_V2 || MACH_NETSPACE_MAX_V2 || D2NET_V2
        default y
        help
@@ -340,17 +371,17 @@ config LEDS_NETXBIG
 config LEDS_TRIGGERS
        bool "LED Trigger support"
+        depends on LEDS_CLASS
        help
          This option enables trigger support for the leds class.
          These triggers allow kernel events to drive the LEDs and can
          be configured via sysfs. If unsure, say Y.
-if LEDS_TRIGGERS
 comment "LED Triggers"
 config LEDS_TRIGGER_TIMER
        tristate "LED Timer Trigger"
+        depends on LEDS_TRIGGERS
        help
          This allows LEDs to be controlled by a programmable timer
          via sysfs. Some LED hardware can be programmed to start
@@ -362,12 +393,14 @@ config LEDS_TRIGGER_TIMER
 config LEDS_TRIGGER_IDE_DISK
        bool "LED IDE Disk Trigger"
        depends on IDE_GD_ATA
+        depends on LEDS_TRIGGERS
        help
          This allows LEDs to be controlled by IDE disk activity.
          If unsure, say Y.
 config LEDS_TRIGGER_HEARTBEAT
        tristate "LED Heartbeat Trigger"
+        depends on LEDS_TRIGGERS
        help
          This allows LEDs to be controlled by a CPU load average.
          The flash frequency is a hyperbolic function of the 1-minute
@@ -376,6 +409,7 @@ config LEDS_TRIGGER_HEARTBEAT
 config LEDS_TRIGGER_BACKLIGHT
        tristate "LED backlight Trigger"
+        depends on LEDS_TRIGGERS
        help
          This allows LEDs to be controlled as a backlight device: they
          turn off and on when the display is blanked and unblanked.
@@ -384,6 +418,7 @@ config LEDS_TRIGGER_BACKLIGHT
 config LEDS_TRIGGER_GPIO
        tristate "LED GPIO Trigger"
+        depends on LEDS_TRIGGERS
        depends on GPIOLIB
        help
          This allows LEDs to be controlled by gpio events. It's good
@@ -396,6 +431,7 @@ config LEDS_TRIGGER_GPIO
 config LEDS_TRIGGER_DEFAULT_ON
        tristate "LED Default ON Trigger"
+        depends on LEDS_TRIGGERS
        help
          This allows LEDs to be initialised in the ON state.
          If unsure, say Y.
@@ -403,8 +439,4 @@ config LEDS_TRIGGER_DEFAULT_ON
 comment "iptables trigger is under Netfilter config (LED target)"
        depends on LEDS_TRIGGERS
-endif # LEDS_TRIGGERS
-endif # LEDS_CLASS
 endif # NEW_LEDS
diff --git a/drivers/leds/leds-lp5521.c b/drivers/leds/leds-lp5521.c
index 3782f31f06d2..33facd0c45d1 100644
--- a/drivers/leds/leds-lp5521.c
+++ b/drivers/leds/leds-lp5521.c
@@ -125,11 +125,22 @@ struct lp5521_chip {
        u8                      num_leds;
 };
-#define cdev_to_led(c)          container_of(c, struct lp5521_led, cdev)
+static inline struct lp5521_led *cdev_to_led(struct led_classdev *cdev)
-#define engine_to_lp5521(eng)   container_of((eng), struct lp5521_chip, \
+{
-                                                engines[(eng)->id - 1])
+        return container_of(cdev, struct lp5521_led, cdev);
-#define led_to_lp5521(led)      container_of((led), struct lp5521_chip, \
+}
-                                                leds[(led)->id])
+static inline struct lp5521_chip *engine_to_lp5521(struct lp5521_engine *engine)
+{
+        return container_of(engine, struct lp5521_chip,
+                            engines[engine->id - 1]);
+}
+static inline struct lp5521_chip *led_to_lp5521(struct lp5521_led *led)
+{
+        return container_of(led, struct lp5521_chip,
+                            leds[led->id]);
+}
 static void lp5521_led_brightness_work(struct work_struct *work);
@@ -185,14 +196,17 @@ static int lp5521_load_program(struct lp5521_engine *eng, const u8 *pattern)
        /* move current engine to direct mode and remember the state */
        ret = lp5521_set_engine_mode(eng, LP5521_CMD_DIRECT);
-        usleep_range(1000, 10000);
+        /* Mode change requires min 500 us delay. 1 - 2 ms  with margin */
+        usleep_range(1000, 2000);
        ret |= lp5521_read(client, LP5521_REG_OP_MODE, &mode);
        /* For loading, all the engines to load mode */
        lp5521_write(client, LP5521_REG_OP_MODE, LP5521_CMD_DIRECT);
-        usleep_range(1000, 10000);
+        /* Mode change requires min 500 us delay. 1 - 2 ms  with margin */
+        usleep_range(1000, 2000);
        lp5521_write(client, LP5521_REG_OP_MODE, LP5521_CMD_LOAD);
-        usleep_range(1000, 10000);
+        /* Mode change requires min 500 us delay. 1 - 2 ms  with margin */
+        usleep_range(1000, 2000);
        addr = LP5521_PROG_MEM_BASE + eng->prog_page * LP5521_PROG_MEM_SIZE;
        i2c_smbus_write_i2c_block_data(client,
@@ -231,10 +245,6 @@ static int lp5521_configure(struct i2c_client *client,
        lp5521_init_engine(chip, attr_group);
-        lp5521_write(client, LP5521_REG_RESET, 0xff);
-        usleep_range(10000, 20000);
        /* Set all PWMs to direct control mode */
        ret = lp5521_write(client, LP5521_REG_OP_MODE, 0x3F);
@@ -251,8 +261,8 @@ static int lp5521_configure(struct i2c_client *client,
        ret |= lp5521_write(client, LP5521_REG_ENABLE,
                        LP5521_MASTER_ENABLE | LP5521_LOGARITHMIC_PWM |
                        LP5521_EXEC_RUN);
-        /* enable takes 500us */
+        /* enable takes 500us. 1 - 2 ms leaves some margin */
-        usleep_range(500, 20000);
+        usleep_range(1000, 2000);
        return ret;
 }
@@ -305,7 +315,8 @@ static int lp5521_detect(struct i2c_client *client)
                        LP5521_MASTER_ENABLE | LP5521_LOGARITHMIC_PWM);
        if (ret)
                return ret;
-        usleep_range(1000, 10000);
+        /* enable takes 500us. 1 - 2 ms leaves some margin */
+        usleep_range(1000, 2000);
        ret = lp5521_read(client, LP5521_REG_ENABLE, &buf);
        if (ret)
                return ret;
@@ -693,11 +704,16 @@ static int lp5521_probe(struct i2c_client *client,
        if (pdata->enable) {
                pdata->enable(0);
-                usleep_range(1000, 10000);
+                usleep_range(1000, 2000); /* Keep enable down at least 1ms */
                pdata->enable(1);
-                usleep_range(1000, 10000); /* Spec says min 500us */
+                usleep_range(1000, 2000); /* 500us abs min. */
        }
+        lp5521_write(client, LP5521_REG_RESET, 0xff);
+        usleep_range(10000, 20000); /*
+                                     * Exact value is not available. 10 - 20ms
+                                     * appears to be enough for reset.
+                                     */
        ret = lp5521_detect(client);
        if (ret) {
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index 1e11fcc08b28..0cc4ead2fd8b 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -134,15 +134,18 @@ struct lp5523_chip {
        u8                      num_leds;
 };
-#define cdev_to_led(c)          container_of(c, struct lp5523_led, cdev)
+static inline struct lp5523_led *cdev_to_led(struct led_classdev *cdev)
+{
+        return container_of(cdev, struct lp5523_led, cdev);
+}
-static struct lp5523_chip *engine_to_lp5523(struct lp5523_engine *engine)
+static inline struct lp5523_chip *engine_to_lp5523(struct lp5523_engine *engine)
 {
        return container_of(engine, struct lp5523_chip,
                            engines[engine->id - 1]);
 }
-static struct lp5523_chip *led_to_lp5523(struct lp5523_led *led)
+static inline struct lp5523_chip *led_to_lp5523(struct lp5523_led *led)
 {
        return container_of(led, struct lp5523_chip,
                            leds[led->id]);
@@ -200,13 +203,9 @@ static int lp5523_configure(struct i2c_client *client)
                { 0x9c, 0x50, 0x9c, 0xd0, 0x9d, 0x80, 0xd8, 0x00, 0},
        };
-        lp5523_write(client, LP5523_REG_RESET, 0xff);
-        usleep_range(10000, 100000);
        ret |= lp5523_write(client, LP5523_REG_ENABLE, LP5523_ENABLE);
-        /* Chip startup time after reset is 500 us */
+        /* Chip startup time is 500 us, 1 - 2 ms gives some margin */
-        usleep_range(1000, 10000);
+        usleep_range(1000, 2000);
        ret |= lp5523_write(client, LP5523_REG_CONFIG,
                            LP5523_AUTO_INC | LP5523_PWR_SAVE |
@@ -243,8 +242,8 @@ static int lp5523_configure(struct i2c_client *client)
                return -1;
        }
-        /* Wait 3ms and check the engine status */
+        /* Let the programs run for couple of ms and check the engine status */
-        usleep_range(3000, 20000);
+        usleep_range(3000, 6000);
        lp5523_read(client, LP5523_REG_STATUS, &status);
        status &= LP5523_ENG_STATUS_MASK;
@@ -449,10 +448,10 @@ static ssize_t lp5523_selftest(struct device *dev,
        /* Measure VDD (i.e. VBAT) first (channel 16 corresponds to VDD) */
        lp5523_write(chip->client, LP5523_REG_LED_TEST_CTRL,
                                    LP5523_EN_LEDTEST | 16);
-        usleep_range(3000, 10000);
+        usleep_range(3000, 6000); /* ADC conversion time is typically 2.7 ms */
        ret = lp5523_read(chip->client, LP5523_REG_STATUS, &status);
        if (!(status & LP5523_LEDTEST_DONE))
-                usleep_range(3000, 10000);
+                usleep_range(3000, 6000); /* Was not ready. Wait little bit */
        ret |= lp5523_read(chip->client, LP5523_REG_LED_TEST_ADC, &vdd);
        vdd--;  /* There may be some fluctuation in measurement */
@@ -468,16 +467,16 @@ static ssize_t lp5523_selftest(struct device *dev,
                        chip->pdata->led_config[i].led_current);
                lp5523_write(chip->client, LP5523_REG_LED_PWM_BASE + i, 0xff);
-                /* let current stabilize 2ms before measurements start */
+                /* let current stabilize 2 - 4ms before measurements start */
-                usleep_range(2000, 10000);
+                usleep_range(2000, 4000);
                lp5523_write(chip->client,
                             LP5523_REG_LED_TEST_CTRL,
                             LP5523_EN_LEDTEST | i);
-                /* ledtest takes 2.7ms */
+                /* ADC conversion time is 2.7 ms typically */
-                usleep_range(3000, 10000);
+                usleep_range(3000, 6000);
                ret = lp5523_read(chip->client, LP5523_REG_STATUS, &status);
                if (!(status & LP5523_LEDTEST_DONE))
-                        usleep_range(3000, 10000);
+                        usleep_range(3000, 6000);/* Was not ready. Wait. */
                ret |= lp5523_read(chip->client, LP5523_REG_LED_TEST_ADC, &adc);
                if (adc >= vdd || adc < LP5523_ADC_SHORTCIRC_LIM)
@@ -930,11 +929,16 @@ static int lp5523_probe(struct i2c_client *client,
        if (pdata->enable) {
                pdata->enable(0);
-                usleep_range(1000, 10000);
+                usleep_range(1000, 2000); /* Keep enable down at least 1ms */
                pdata->enable(1);
-                usleep_range(1000, 10000); /* Spec says min 500us */
+                usleep_range(1000, 2000); /* 500us abs min. */
        }
+        lp5523_write(client, LP5523_REG_RESET, 0xff);
+        usleep_range(10000, 20000); /*
+                                     * Exact value is not available. 10 - 20ms
+                                     * appears to be enough for reset.
+                                     */
        ret = lp5523_detect(client);
        if (ret)
                goto fail2;
diff --git a/drivers/leds/leds-ss4200.c b/drivers/leds/leds-ss4200.c
index a688293abd0b..614ebebaaa28 100644
--- a/drivers/leds/leds-ss4200.c
+++ b/drivers/leds/leds-ss4200.c
@@ -102,6 +102,7 @@ static struct dmi_system_id __initdata nas_led_whitelist[] = {
                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.00.00")
                }
        },
+        {}
 };
 /*
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index 3d7355ff7308..fa51af11c6f1 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -102,6 +102,7 @@ config ADB_PMU_LED
 config ADB_PMU_LED_IDE
        bool "Use front LED as IDE LED by default"
        depends on ADB_PMU_LED
+        depends on LEDS_CLASS
        select LEDS_TRIGGERS
        select LEDS_TRIGGER_IDE_DISK
        help
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 324a3663fcda..84c46a161927 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1337,7 +1337,7 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
        md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
                       rdev->sb_page);
        md_super_wait(rdev->mddev);
-        return num_sectors / 2; /* kB for sysfs */
+        return num_sectors;
 }
@@ -1704,7 +1704,7 @@ super_1_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
        md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
                       rdev->sb_page);
        md_super_wait(rdev->mddev);
-        return num_sectors / 2; /* kB for sysfs */
+        return num_sectors;
 }
 static struct super_type super_types[] = {
@@ -4338,6 +4338,8 @@ static int md_alloc(dev_t dev, char *name)
        if (mddev->kobj.sd &&
            sysfs_create_group(&mddev->kobj, &md_bitmap_group))
                printk(KERN_DEBUG "pointless warning\n");
+        blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA);
 abort:
        mutex_unlock(&disks_mutex);
        if (!error && mddev->kobj.sd) {
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 45f8324196ec..845cf95b612c 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1161,6 +1161,7 @@ static int raid1_remove_disk(mddev_t *mddev, int number)
                 * is not possible.
                 */
                if (!test_bit(Faulty, &rdev->flags) &&
+                    !mddev->recovery_disabled &&
                    mddev->degraded < conf->raid_disks) {
                        err = -EBUSY;
                        goto abort;
diff --git a/drivers/media/common/tuners/Kconfig b/drivers/media/common/tuners/Kconfig
index 2385e6cca635..78b089526e02 100644
--- a/drivers/media/common/tuners/Kconfig
+++ b/drivers/media/common/tuners/Kconfig
@@ -31,7 +31,7 @@ config MEDIA_TUNER
        select MEDIA_TUNER_TDA9887 if !MEDIA_TUNER_CUSTOMISE
        select MEDIA_TUNER_MC44S803 if !MEDIA_TUNER_CUSTOMISE
-menuconfig MEDIA_TUNER_CUSTOMISE
+config MEDIA_TUNER_CUSTOMISE
        bool "Customize analog and hybrid tuner modules to build"
        depends on MEDIA_TUNER
        default y if EMBEDDED
@@ -44,7 +44,8 @@ menuconfig MEDIA_TUNER_CUSTOMISE
          If unsure say N.
-if MEDIA_TUNER_CUSTOMISE
+menu "Customize TV tuners"
+        visible if MEDIA_TUNER_CUSTOMISE
 config MEDIA_TUNER_SIMPLE
        tristate "Simple tuner support"
@@ -185,5 +186,4 @@ config MEDIA_TUNER_TDA18218
        default m if MEDIA_TUNER_CUSTOMISE
        help
          NXP TDA18218 silicon tuner driver.
+endmenu
-endif # MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index e9062b08a485..96b27016670e 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -12,9 +12,8 @@ config DVB_FE_CUSTOMISE
          If unsure say N.
-if DVB_FE_CUSTOMISE
 menu "Customise DVB Frontends"
+        visible if DVB_FE_CUSTOMISE
 comment "Multistandard (satellite) frontends"
        depends on DVB_CORE
@@ -619,5 +618,3 @@ config DVB_DUMMY_FE
        tristate "Dummy frontend driver"
        default n
 endmenu
-endif
diff --git a/drivers/media/radio/radio-si4713.c b/drivers/media/radio/radio-si4713.c
index 6a435786b63d..03829e6818bd 100644
--- a/drivers/media/radio/radio-si4713.c
+++ b/drivers/media/radio/radio-si4713.c
@@ -291,7 +291,7 @@ static int radio_si4713_pdriver_probe(struct platform_device *pdev)
                goto unregister_v4l2_dev;
        }
-        sd = v4l2_i2c_new_subdev_board(&rsdev->v4l2_dev, adapter, NULL,
+        sd = v4l2_i2c_new_subdev_board(&rsdev->v4l2_dev, adapter,
                                        pdata->subdev_board_info, NULL);
        if (!sd) {
                dev_err(&pdev->dev, "Cannot get v4l2 subdevice\n");
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index ac16e815e275..6830d2848bd7 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -112,7 +112,7 @@ config VIDEO_IR_I2C
 #
 menu "Encoders/decoders and other helper chips"
-        depends on !VIDEO_HELPER_CHIPS_AUTO
+        visible if !VIDEO_HELPER_CHIPS_AUTO
 comment "Audio decoders"
diff --git a/drivers/media/video/au0828/au0828-cards.c b/drivers/media/video/au0828/au0828-cards.c
index 0453816d4ec3..01be89fa5c78 100644
--- a/drivers/media/video/au0828/au0828-cards.c
+++ b/drivers/media/video/au0828/au0828-cards.c
@@ -212,7 +212,7 @@ void au0828_card_setup(struct au0828_dev *dev)
                   be abstracted out if we ever need to support a different
                   demod) */
                sd = v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                                NULL, "au8522", 0x8e >> 1, NULL);
+                                "au8522", 0x8e >> 1, NULL);
                if (sd == NULL)
                        printk(KERN_ERR "analog subdev registration failed\n");
        }
@@ -221,7 +221,7 @@ void au0828_card_setup(struct au0828_dev *dev)
        if (dev->board.tuner_type != TUNER_ABSENT) {
                /* Load the tuner module, which does the attach */
                sd = v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                                NULL, "tuner", dev->board.tuner_addr, NULL);
+                                "tuner", dev->board.tuner_addr, NULL);
                if (sd == NULL)
                        printk(KERN_ERR "tuner subdev registration fail\n");
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index 87d8b006ef77..49efcf660ba6 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -3529,7 +3529,7 @@ void __devinit bttv_init_card2(struct bttv *btv)
                struct v4l2_subdev *sd;
                sd = v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                        &btv->c.i2c_adap, NULL, "saa6588", 0, addrs);
+                        &btv->c.i2c_adap, "saa6588", 0, addrs);
                btv->has_saa6588 = (sd != NULL);
        }
@@ -3554,7 +3554,7 @@ void __devinit bttv_init_card2(struct bttv *btv)
                };
                btv->sd_msp34xx = v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                        &btv->c.i2c_adap, NULL, "msp3400", 0, addrs);
+                        &btv->c.i2c_adap, "msp3400", 0, addrs);
                if (btv->sd_msp34xx)
                        return;
                goto no_audio;
@@ -3568,7 +3568,7 @@ void __devinit bttv_init_card2(struct bttv *btv)
                };
                if (v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, NULL, "tda7432", 0, addrs))
+                                &btv->c.i2c_adap, "tda7432", 0, addrs))
                        return;
                goto no_audio;
        }
@@ -3576,7 +3576,7 @@ void __devinit bttv_init_card2(struct bttv *btv)
        case 3: {
                /* The user specified that we should probe for tvaudio */
                btv->sd_tvaudio = v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                        &btv->c.i2c_adap, NULL, "tvaudio", 0, tvaudio_addrs());
+                        &btv->c.i2c_adap, "tvaudio", 0, tvaudio_addrs());
                if (btv->sd_tvaudio)
                        return;
                goto no_audio;
@@ -3596,11 +3596,11 @@ void __devinit bttv_init_card2(struct bttv *btv)
           found is really something else (e.g. a tea6300). */
        if (!bttv_tvcards[btv->c.type].no_msp34xx) {
                btv->sd_msp34xx = v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                        &btv->c.i2c_adap, NULL, "msp3400",
+                        &btv->c.i2c_adap, "msp3400",
                        0, I2C_ADDRS(I2C_ADDR_MSP3400 >> 1));
        } else if (bttv_tvcards[btv->c.type].msp34xx_alt) {
                btv->sd_msp34xx = v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                        &btv->c.i2c_adap, NULL, "msp3400",
+                        &btv->c.i2c_adap, "msp3400",
                        0, I2C_ADDRS(I2C_ADDR_MSP3400_ALT >> 1));
        }
@@ -3616,13 +3616,13 @@ void __devinit bttv_init_card2(struct bttv *btv)
                };
                if (v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, NULL, "tda7432", 0, addrs))
+                                &btv->c.i2c_adap, "tda7432", 0, addrs))
                        return;
        }
        /* Now see if we can find one of the tvaudio devices. */
        btv->sd_tvaudio = v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                &btv->c.i2c_adap, NULL, "tvaudio", 0, tvaudio_addrs());
+                &btv->c.i2c_adap, "tvaudio", 0, tvaudio_addrs());
        if (btv->sd_tvaudio)
                return;
@@ -3646,13 +3646,13 @@ void __devinit bttv_init_tuner(struct bttv *btv)
                /* Load tuner module before issuing tuner config call! */
                if (bttv_tvcards[btv->c.type].has_radio)
                        v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, NULL, "tuner",
+                                &btv->c.i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(ADDRS_RADIO));
                v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, NULL, "tuner",
+                                &btv->c.i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
                v4l2_i2c_new_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, NULL, "tuner",
+                                &btv->c.i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(ADDRS_TV_WITH_DEMOD));
                tun_setup.mode_mask = T_ANALOG_TV | T_DIGITAL_TV;
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index 7bc36670071a..260c666ce931 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -2066,8 +2066,7 @@ static int cafe_pci_probe(struct pci_dev *pdev,
        cam->sensor_addr = 0x42;
        cam->sensor = v4l2_i2c_new_subdev_cfg(&cam->v4l2_dev, &cam->i2c_adapter,
-                        "ov7670", "ov7670", 0, &sensor_cfg, cam->sensor_addr,
+                        "ov7670", 0, &sensor_cfg, cam->sensor_addr, NULL);
-                        NULL);
        if (cam->sensor == NULL) {
                ret = -ENODEV;
                goto out_smbus;
diff --git a/drivers/media/video/cx18/cx18-i2c.c b/drivers/media/video/cx18/cx18-i2c.c
index a09caf883170..e71a026f3419 100644
--- a/drivers/media/video/cx18/cx18-i2c.c
+++ b/drivers/media/video/cx18/cx18-i2c.c
@@ -122,15 +122,15 @@ int cx18_i2c_register(struct cx18 *cx, unsigned idx)
        if (hw == CX18_HW_TUNER) {
                /* special tuner group handling */
                sd = v4l2_i2c_new_subdev(&cx->v4l2_dev,
-                                adap, NULL, type, 0, cx->card_i2c->radio);
+                                adap, type, 0, cx->card_i2c->radio);
                if (sd != NULL)
                        sd->grp_id = hw;
                sd = v4l2_i2c_new_subdev(&cx->v4l2_dev,
-                                adap, NULL, type, 0, cx->card_i2c->demod);
+                                adap, type, 0, cx->card_i2c->demod);
                if (sd != NULL)
                        sd->grp_id = hw;
                sd = v4l2_i2c_new_subdev(&cx->v4l2_dev,
-                                adap, NULL, type, 0, cx->card_i2c->tv);
+                                adap, type, 0, cx->card_i2c->tv);
                if (sd != NULL)
                        sd->grp_id = hw;
                return sd != NULL ? 0 : -1;
@@ -144,7 +144,7 @@ int cx18_i2c_register(struct cx18 *cx, unsigned idx)
                return -1;
        /* It's an I2C device other than an analog tuner or IR chip */
-        sd = v4l2_i2c_new_subdev(&cx->v4l2_dev, adap, NULL, type, hw_addrs[idx],
+        sd = v4l2_i2c_new_subdev(&cx->v4l2_dev, adap, type, hw_addrs[idx],
                                 NULL);
        if (sd != NULL)
                sd->grp_id = hw;
diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c
index 56c2d8195ac6..2c78d188bb06 100644
--- a/drivers/media/video/cx231xx/cx231xx-cards.c
+++ b/drivers/media/video/cx231xx/cx231xx-cards.c
@@ -560,7 +560,7 @@ void cx231xx_card_setup(struct cx231xx *dev)
        if (dev->board.decoder == CX231XX_AVDECODER) {
                dev->sd_cx25840 = v4l2_i2c_new_subdev(&dev->v4l2_dev,
                                        &dev->i2c_bus[0].i2c_adap,
-                                        NULL, "cx25840", 0x88 >> 1, NULL);
+                                        "cx25840", 0x88 >> 1, NULL);
                if (dev->sd_cx25840 == NULL)
                        cx231xx_info("cx25840 subdev registration failure\n");
                cx25840_call(dev, core, load_fw);
@@ -571,7 +571,7 @@ void cx231xx_card_setup(struct cx231xx *dev)
        if (dev->board.tuner_type != TUNER_ABSENT) {
                dev->sd_tuner = v4l2_i2c_new_subdev(&dev->v4l2_dev,
                                                    &dev->i2c_bus[dev->board.tuner_i2c_master].i2c_adap,
-                                                    NULL, "tuner",
+                                                    "tuner",
                                                    dev->tuner_addr, NULL);
                if (dev->sd_tuner == NULL)
                        cx231xx_info("tuner subdev registration failure\n");
diff --git a/drivers/media/video/cx23885/cx23885-cards.c b/drivers/media/video/cx23885/cx23885-cards.c
index db054004e462..8861309268b1 100644
--- a/drivers/media/video/cx23885/cx23885-cards.c
+++ b/drivers/media/video/cx23885/cx23885-cards.c
@@ -1247,7 +1247,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
        case CX23885_BOARD_LEADTEK_WINFAST_PXTV1200:
                dev->sd_cx25840 = v4l2_i2c_new_subdev(&dev->v4l2_dev,
                                &dev->i2c_bus[2].i2c_adap,
-                                NULL, "cx25840", 0x88 >> 1, NULL);
+                                "cx25840", 0x88 >> 1, NULL);
                if (dev->sd_cx25840) {
                        dev->sd_cx25840->grp_id = CX23885_HW_AV_CORE;
                        v4l2_subdev_call(dev->sd_cx25840, core, load_fw);
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index 3cc9f462d08d..8b2fb8a4375c 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -1507,10 +1507,10 @@ int cx23885_video_register(struct cx23885_dev *dev)
                if (dev->tuner_addr)
                        sd = v4l2_i2c_new_subdev(&dev->v4l2_dev,
                                &dev->i2c_bus[1].i2c_adap,
-                                NULL, "tuner", dev->tuner_addr, NULL);
+                                "tuner", dev->tuner_addr, NULL);
                else
                        sd = v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_bus[1].i2c_adap, NULL,
+                                &dev->i2c_bus[1].i2c_adap,
                                "tuner", 0, v4l2_i2c_tuner_addrs(ADDRS_TV));
                if (sd) {
                        struct tuner_setup tun_setup;
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index b26fcba8600c..9b9e169cce90 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -3515,19 +3515,18 @@ struct cx88_core *cx88_core_create(struct pci_dev *pci, int nr)
                   later code configures a tea5767.
                 */
                v4l2_i2c_new_subdev(&core->v4l2_dev, &core->i2c_adap,
-                                NULL, "tuner",
+                                "tuner", 0, v4l2_i2c_tuner_addrs(ADDRS_RADIO));
-                                0, v4l2_i2c_tuner_addrs(ADDRS_RADIO));
                if (has_demod)
                        v4l2_i2c_new_subdev(&core->v4l2_dev,
-                                &core->i2c_adap, NULL, "tuner",
+                                &core->i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
                if (core->board.tuner_addr == ADDR_UNSET) {
                        v4l2_i2c_new_subdev(&core->v4l2_dev,
-                                &core->i2c_adap, NULL, "tuner",
+                                &core->i2c_adap, "tuner",
                                0, has_demod ? tv_addrs + 4 : tv_addrs);
                } else {
                        v4l2_i2c_new_subdev(&core->v4l2_dev, &core->i2c_adap,
-                                NULL, "tuner", core->board.tuner_addr, NULL);
+                                "tuner", core->board.tuner_addr, NULL);
                }
        }
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index 88b51194f917..62cea9549404 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -1895,14 +1895,13 @@ static int __devinit cx8800_initdev(struct pci_dev *pci_dev,
        if (core->board.audio_chip == V4L2_IDENT_WM8775)
                v4l2_i2c_new_subdev(&core->v4l2_dev, &core->i2c_adap,
-                                NULL, "wm8775", 0x36 >> 1, NULL);
+                                "wm8775", 0x36 >> 1, NULL);
        if (core->board.audio_chip == V4L2_IDENT_TVAUDIO) {
                /* This probes for a tda9874 as is used on some
                   Pixelview Ultra boards. */
-                v4l2_i2c_new_subdev(&core->v4l2_dev,
+                v4l2_i2c_new_subdev(&core->v4l2_dev, &core->i2c_adap,
-                                &core->i2c_adap,
+                                "tvaudio", 0, I2C_ADDRS(0xb0 >> 1));
-                                NULL, "tvaudio", 0, I2C_ADDRS(0xb0 >> 1));
        }
        switch (core->boardnr) {
diff --git a/drivers/media/video/davinci/vpfe_capture.c b/drivers/media/video/davinci/vpfe_capture.c
index d8e38cc4ec40..7333a9bb2549 100644
--- a/drivers/media/video/davinci/vpfe_capture.c
+++ b/drivers/media/video/davinci/vpfe_capture.c
@@ -1986,7 +1986,6 @@ static __init int vpfe_probe(struct platform_device *pdev)
                vpfe_dev->sd[i] =
                        v4l2_i2c_new_subdev_board(&vpfe_dev->v4l2_dev,
                                                  i2c_adap,
-                                                  NULL,
                                                  &sdinfo->board_info,
                                                  NULL);
                if (vpfe_dev->sd[i]) {
diff --git a/drivers/media/video/davinci/vpif_capture.c b/drivers/media/video/davinci/vpif_capture.c
index 6ac6acd16352..193abab6b355 100644
--- a/drivers/media/video/davinci/vpif_capture.c
+++ b/drivers/media/video/davinci/vpif_capture.c
@@ -2013,7 +2013,6 @@ static __init int vpif_probe(struct platform_device *pdev)
                vpif_obj.sd[i] =
                        v4l2_i2c_new_subdev_board(&vpif_obj.v4l2_dev,
                                                  i2c_adap,
-                                                  NULL,
                                                  &subdevdata->board_info,
                                                  NULL);
diff --git a/drivers/media/video/davinci/vpif_display.c b/drivers/media/video/davinci/vpif_display.c
index 685f6a6ee603..412c65d54fe1 100644
--- a/drivers/media/video/davinci/vpif_display.c
+++ b/drivers/media/video/davinci/vpif_display.c
@@ -1553,7 +1553,7 @@ static __init int vpif_probe(struct platform_device *pdev)
        for (i = 0; i < subdev_count; i++) {
                vpif_obj.sd[i] = v4l2_i2c_new_subdev_board(&vpif_obj.v4l2_dev,
-                                                i2c_adap, NULL,
+                                                i2c_adap,
                                                &subdevdata[i].board_info,
                                                NULL);
                if (!vpif_obj.sd[i]) {
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 54859233f311..f7e9168157a5 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -2554,39 +2554,39 @@ void em28xx_card_setup(struct em28xx *dev)
        /* request some modules */
        if (dev->board.has_msp34xx)
                v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                        NULL, "msp3400", 0, msp3400_addrs);
+                        "msp3400", 0, msp3400_addrs);
        if (dev->board.decoder == EM28XX_SAA711X)
                v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                        NULL, "saa7115_auto", 0, saa711x_addrs);
+                        "saa7115_auto", 0, saa711x_addrs);
        if (dev->board.decoder == EM28XX_TVP5150)
                v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                        NULL, "tvp5150", 0, tvp5150_addrs);
+                        "tvp5150", 0, tvp5150_addrs);
        if (dev->em28xx_sensor == EM28XX_MT9V011) {
                struct v4l2_subdev *sd;
                sd = v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                         &dev->i2c_adap, NULL, "mt9v011", 0, mt9v011_addrs);
+                         &dev->i2c_adap, "mt9v011", 0, mt9v011_addrs);
                v4l2_subdev_call(sd, core, s_config, 0, &dev->sensor_xtal);
        }
        if (dev->board.adecoder == EM28XX_TVAUDIO)
                v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                        NULL, "tvaudio", dev->board.tvaudio_addr, NULL);
+                        "tvaudio", dev->board.tvaudio_addr, NULL);
        if (dev->board.tuner_type != TUNER_ABSENT) {
                int has_demod = (dev->tda9887_conf & TDA9887_PRESENT);
                if (dev->board.radio.type)
                        v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                                NULL, "tuner", dev->board.radio_addr, NULL);
+                                "tuner", dev->board.radio_addr, NULL);
                if (has_demod)
                        v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_adap, NULL, "tuner",
+                                &dev->i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
                if (dev->tuner_addr == 0) {
                        enum v4l2_i2c_tuner_type type =
@@ -2594,14 +2594,14 @@ void em28xx_card_setup(struct em28xx *dev)
                        struct v4l2_subdev *sd;
                        sd = v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_adap, NULL, "tuner",
+                                &dev->i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(type));
                        if (sd)
                                dev->tuner_addr = v4l2_i2c_subdev_addr(sd);
                } else {
                        v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                                NULL, "tuner", dev->tuner_addr, NULL);
+                                "tuner", dev->tuner_addr, NULL);
                }
        }
diff --git a/drivers/media/video/fsl-viu.c b/drivers/media/video/fsl-viu.c
index 9a075d83dd1f..b8faff2dd711 100644
--- a/drivers/media/video/fsl-viu.c
+++ b/drivers/media/video/fsl-viu.c
@@ -1486,7 +1486,7 @@ static int __devinit viu_of_probe(struct platform_device *op,
        ad = i2c_get_adapter(0);
        viu_dev->decoder = v4l2_i2c_new_subdev(&viu_dev->v4l2_dev, ad,
-                        NULL, "saa7113", VIU_VIDEO_DECODER_ADDR, NULL);
+                        "saa7113", VIU_VIDEO_DECODER_ADDR, NULL);
        viu_dev->vidq.timeout.function = viu_vid_timeout;
        viu_dev->vidq.timeout.data     = (unsigned long)viu_dev;
diff --git a/drivers/media/video/ivtv/ivtv-i2c.c b/drivers/media/video/ivtv/ivtv-i2c.c
index 9e8039ac909e..665191c9b407 100644
--- a/drivers/media/video/ivtv/ivtv-i2c.c
+++ b/drivers/media/video/ivtv/ivtv-i2c.c
@@ -239,19 +239,16 @@ int ivtv_i2c_register(struct ivtv *itv, unsigned idx)
                return -1;
        if (hw == IVTV_HW_TUNER) {
                /* special tuner handling */
-                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev,
+                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev, adap, type, 0,
-                                adap, NULL, type,
+                                itv->card_i2c->radio);
-                                0, itv->card_i2c->radio);
                if (sd)
                        sd->grp_id = 1 << idx;
-                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev,
+                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev, adap, type, 0,
-                                adap, NULL, type,
+                                itv->card_i2c->demod);
-                                0, itv->card_i2c->demod);
                if (sd)
                        sd->grp_id = 1 << idx;
-                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev,
+                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev, adap, type, 0,
-                                adap, NULL, type,
+                                itv->card_i2c->tv);
-                                0, itv->card_i2c->tv);
                if (sd)
                        sd->grp_id = 1 << idx;
                return sd ? 0 : -1;
@@ -267,17 +264,16 @@ int ivtv_i2c_register(struct ivtv *itv, unsigned idx)
        /* It's an I2C device other than an analog tuner or IR chip */
        if (hw == IVTV_HW_UPD64031A || hw == IVTV_HW_UPD6408X) {
                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev,
-                                adap, NULL, type, 0, I2C_ADDRS(hw_addrs[idx]));
+                                adap, type, 0, I2C_ADDRS(hw_addrs[idx]));
        } else if (hw == IVTV_HW_CX25840) {
                struct cx25840_platform_data pdata;
                pdata.pvr150_workaround = itv->pvr150_workaround;
                sd = v4l2_i2c_new_subdev_cfg(&itv->v4l2_dev,
-                                adap, NULL, type, 0, &pdata, hw_addrs[idx],
+                                adap, type, 0, &pdata, hw_addrs[idx], NULL);
-                                NULL);
        } else {
                sd = v4l2_i2c_new_subdev(&itv->v4l2_dev,
-                                adap, NULL, type, hw_addrs[idx], NULL);
+                                adap, type, hw_addrs[idx], NULL);
        }
        if (sd)
                sd->grp_id = 1 << idx;
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c
index 94ba698d0ad4..4e8fd965f151 100644
--- a/drivers/media/video/mxb.c
+++ b/drivers/media/video/mxb.c
@@ -185,17 +185,17 @@ static int mxb_probe(struct saa7146_dev *dev)
        }
        mxb->saa7111a = v4l2_i2c_new_subdev(&dev->v4l2_dev, &mxb->i2c_adapter,
-                        NULL, "saa7111", I2C_SAA7111A, NULL);
+                        "saa7111", I2C_SAA7111A, NULL);
        mxb->tea6420_1 = v4l2_i2c_new_subdev(&dev->v4l2_dev, &mxb->i2c_adapter,
-                        NULL, "tea6420", I2C_TEA6420_1, NULL);
+                        "tea6420", I2C_TEA6420_1, NULL);
        mxb->tea6420_2 = v4l2_i2c_new_subdev(&dev->v4l2_dev, &mxb->i2c_adapter,
-                        NULL, "tea6420", I2C_TEA6420_2, NULL);
+                        "tea6420", I2C_TEA6420_2, NULL);
        mxb->tea6415c = v4l2_i2c_new_subdev(&dev->v4l2_dev, &mxb->i2c_adapter,
-                        NULL, "tea6415c", I2C_TEA6415C, NULL);
+                        "tea6415c", I2C_TEA6415C, NULL);
        mxb->tda9840 = v4l2_i2c_new_subdev(&dev->v4l2_dev, &mxb->i2c_adapter,
-                        NULL, "tda9840", I2C_TDA9840, NULL);
+                        "tda9840", I2C_TDA9840, NULL);
        mxb->tuner = v4l2_i2c_new_subdev(&dev->v4l2_dev, &mxb->i2c_adapter,
-                        NULL, "tuner", I2C_TUNER, NULL);
+                        "tuner", I2C_TUNER, NULL);
        /* check if all devices are present */
        if (!mxb->tea6420_1 || !mxb->tea6420_2 || !mxb->tea6415c ||
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
index bef202752cc8..66ad516bdfd9 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -2088,16 +2088,14 @@ static int pvr2_hdw_load_subdev(struct pvr2_hdw *hdw,
                           " Setting up with specified i2c address 0x%x",
                           mid, i2caddr[0]);
                sd = v4l2_i2c_new_subdev(&hdw->v4l2_dev, &hdw->i2c_adap,
-                                         NULL, fname,
+                                         fname, i2caddr[0], NULL);
-                                         i2caddr[0], NULL);
        } else {
                pvr2_trace(PVR2_TRACE_INIT,
                           "Module ID %u:"
                           " Setting up with address probe list",
                           mid);
                sd = v4l2_i2c_new_subdev(&hdw->v4l2_dev, &hdw->i2c_adap,
-                                                NULL, fname,
+                                         fname, 0, i2caddr);
-                                                0, i2caddr);
        }
        if (!sd) {
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index e8f13d3e2df1..1b93207c89e8 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -44,7 +44,7 @@ static struct v4l2_subdev *fimc_subdev_register(struct fimc_dev *fimc,
                return ERR_PTR(-ENOMEM);
        sd = v4l2_i2c_new_subdev_board(&vid_cap->v4l2_dev, i2c_adap,
-                                       MODULE_NAME, isp_info->board_info, NULL);
+                                       isp_info->board_info, NULL);
        if (!sd) {
                v4l2_err(&vid_cap->v4l2_dev, "failed to acquire subdev\n");
                return NULL;
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 0911cb580e18..1d4d0a49ea52 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -7551,22 +7551,22 @@ int saa7134_board_init2(struct saa7134_dev *dev)
                   so we do not need to probe for a radio tuner device. */
                if (dev->radio_type != UNSET)
                        v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_adap, NULL, "tuner",
+                                &dev->i2c_adap, "tuner",
                                dev->radio_addr, NULL);
                if (has_demod)
                        v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_adap, NULL, "tuner",
+                                &dev->i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
                if (dev->tuner_addr == ADDR_UNSET) {
                        enum v4l2_i2c_tuner_type type =
                                has_demod ? ADDRS_TV_WITH_DEMOD : ADDRS_TV;
                        v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_adap, NULL, "tuner",
+                                &dev->i2c_adap, "tuner",
                                0, v4l2_i2c_tuner_addrs(type));
                } else {
                        v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_adap, NULL, "tuner",
+                                &dev->i2c_adap, "tuner",
                                dev->tuner_addr, NULL);
                }
        }
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index 764d7d219fed..756a27812260 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -991,7 +991,7 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
        if (card_is_empress(dev)) {
                struct v4l2_subdev *sd =
                        v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                                NULL, "saa6752hs",
+                                "saa6752hs",
                                saa7134_boards[dev->board].empress_addr, NULL);
                if (sd)
@@ -1002,7 +1002,7 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
                struct v4l2_subdev *sd;
                sd = v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                                &dev->i2c_adap, NULL, "saa6588",
+                                &dev->i2c_adap, "saa6588",
                                0, I2C_ADDRS(saa7134_boards[dev->board].rds_addr));
                if (sd) {
                        printk(KERN_INFO "%s: found RDS decoder\n", dev->name);
diff --git a/drivers/media/video/sh_vou.c b/drivers/media/video/sh_vou.c
index 0f4906136b8f..4e5a8cf76ded 100644
--- a/drivers/media/video/sh_vou.c
+++ b/drivers/media/video/sh_vou.c
@@ -1406,7 +1406,7 @@ static int __devinit sh_vou_probe(struct platform_device *pdev)
                goto ereset;
        subdev = v4l2_i2c_new_subdev_board(&vou_dev->v4l2_dev, i2c_adap,
-                        NULL, vou_pdata->board_info, NULL);
+                        vou_pdata->board_info, NULL);
        if (!subdev) {
                ret = -ENOMEM;
                goto ei2cnd;
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 43848a751d11..335120c2021b 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -896,7 +896,7 @@ static int soc_camera_init_i2c(struct soc_camera_device *icd,
        icl->board_info->platform_data = icd;
        subdev = v4l2_i2c_new_subdev_board(&ici->v4l2_dev, adap,
-                                NULL, icl->board_info, NULL);
+                                icl->board_info, NULL);
        if (!subdev)
                goto ei2cnd;
diff --git a/drivers/media/video/usbvision/usbvision-i2c.c b/drivers/media/video/usbvision/usbvision-i2c.c
index e3bbae26e3ce..81dd53bb5267 100644
--- a/drivers/media/video/usbvision/usbvision-i2c.c
+++ b/drivers/media/video/usbvision/usbvision-i2c.c
@@ -251,7 +251,7 @@ int usbvision_i2c_register(struct usb_usbvision *usbvision)
                   hit-and-miss. */
                mdelay(10);
                v4l2_i2c_new_subdev(&usbvision->v4l2_dev,
-                                &usbvision->i2c_adap, NULL,
+                                &usbvision->i2c_adap,
                                "saa7115_auto", 0, saa711x_addrs);
                break;
        }
@@ -261,14 +261,14 @@ int usbvision_i2c_register(struct usb_usbvision *usbvision)
                struct tuner_setup tun_setup;
                sd = v4l2_i2c_new_subdev(&usbvision->v4l2_dev,
-                                &usbvision->i2c_adap, NULL,
+                                &usbvision->i2c_adap,
                                "tuner", 0, v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
                /* depending on whether we found a demod or not, select
                   the tuner type. */
                type = sd ? ADDRS_TV_WITH_DEMOD : ADDRS_TV;
                sd = v4l2_i2c_new_subdev(&usbvision->v4l2_dev,
-                                &usbvision->i2c_adap, NULL,
+                                &usbvision->i2c_adap,
                                "tuner", 0, v4l2_i2c_tuner_addrs(type));
                if (sd == NULL)
diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index 9294282b5add..b5eb1f3950b1 100644
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -368,18 +368,15 @@ EXPORT_SYMBOL_GPL(v4l2_i2c_subdev_init);
 /* Load an i2c sub-device. */
 struct v4l2_subdev *v4l2_i2c_new_subdev_board(struct v4l2_device *v4l2_dev,
-                struct i2c_adapter *adapter, const char *module_name,
+                struct i2c_adapter *adapter, struct i2c_board_info *info,
-                struct i2c_board_info *info, const unsigned short *probe_addrs)
+                const unsigned short *probe_addrs)
 {
        struct v4l2_subdev *sd = NULL;
        struct i2c_client *client;
        BUG_ON(!v4l2_dev);
-        if (module_name)
+        request_module(I2C_MODULE_PREFIX "%s", info->type);
-                request_module(module_name);
-        else
-                request_module(I2C_MODULE_PREFIX "%s", info->type);
        /* Create the i2c client */
        if (info->addr == 0 && probe_addrs)
@@ -432,8 +429,7 @@ error:
 EXPORT_SYMBOL_GPL(v4l2_i2c_new_subdev_board);
 struct v4l2_subdev *v4l2_i2c_new_subdev_cfg(struct v4l2_device *v4l2_dev,
-                struct i2c_adapter *adapter,
+                struct i2c_adapter *adapter, const char *client_type,
-                const char *module_name, const char *client_type,
                int irq, void *platform_data,
                u8 addr, const unsigned short *probe_addrs)
 {
@@ -447,8 +443,7 @@ struct v4l2_subdev *v4l2_i2c_new_subdev_cfg(struct v4l2_device *v4l2_dev,
        info.irq = irq;
        info.platform_data = platform_data;
-        return v4l2_i2c_new_subdev_board(v4l2_dev, adapter, module_name,
+        return v4l2_i2c_new_subdev_board(v4l2_dev, adapter, &info, probe_addrs);
-                        &info, probe_addrs);
 }
 EXPORT_SYMBOL_GPL(v4l2_i2c_new_subdev_cfg);
diff --git a/drivers/media/video/via-camera.c b/drivers/media/video/via-camera.c
index 02a21bccae18..9eda7cc03121 100644
--- a/drivers/media/video/via-camera.c
+++ b/drivers/media/video/via-camera.c
@@ -1360,7 +1360,7 @@ static __devinit int viacam_probe(struct platform_device *pdev)
         */
        sensor_adapter = viafb_find_i2c_adapter(VIA_PORT_31);
        cam->sensor = v4l2_i2c_new_subdev(&cam->v4l2_dev, sensor_adapter,
-                        "ov7670", "ov7670", 0x42 >> 1, NULL);
+                        "ov7670", 0x42 >> 1, NULL);
        if (cam->sensor == NULL) {
                dev_err(&pdev->dev, "Unable to find the sensor!\n");
                ret = -ENODEV;
diff --git a/drivers/media/video/vino.c b/drivers/media/video/vino.c
index e5e005dc1554..7e7eec48f8b1 100644
--- a/drivers/media/video/vino.c
+++ b/drivers/media/video/vino.c
@@ -4334,10 +4334,10 @@ static int __init vino_module_init(void)
        vino_drvdata->decoder =
                v4l2_i2c_new_subdev(&vino_drvdata->v4l2_dev, &vino_i2c_adapter,
-                               NULL, "saa7191", 0, I2C_ADDRS(0x45));
+                               "saa7191", 0, I2C_ADDRS(0x45));
        vino_drvdata->camera =
                v4l2_i2c_new_subdev(&vino_drvdata->v4l2_dev, &vino_i2c_adapter,
-                               NULL, "indycam", 0, I2C_ADDRS(0x2b));
+                               "indycam", 0, I2C_ADDRS(0x2b));
        dprintk("init complete!\n");
diff --git a/drivers/media/video/zoran/zoran_card.c b/drivers/media/video/zoran/zoran_card.c
index 7e6d62467eaa..e520abf9f4c3 100644
--- a/drivers/media/video/zoran/zoran_card.c
+++ b/drivers/media/video/zoran/zoran_card.c
@@ -1343,13 +1343,12 @@ static int __devinit zoran_probe(struct pci_dev *pdev,
        }
        zr->decoder = v4l2_i2c_new_subdev(&zr->v4l2_dev,
-                &zr->i2c_adapter, NULL, zr->card.i2c_decoder,
+                &zr->i2c_adapter, zr->card.i2c_decoder,
                0, zr->card.addrs_decoder);
        if (zr->card.i2c_encoder)
                zr->encoder = v4l2_i2c_new_subdev(&zr->v4l2_dev,
-                        &zr->i2c_adapter,
+                        &zr->i2c_adapter, zr->card.i2c_encoder,
-                        NULL, zr->card.i2c_encoder,
                        0, zr->card.addrs_encoder);
        dprintk(2,
diff --git a/drivers/misc/isl29020.c b/drivers/misc/isl29020.c
index ca47e6285075..307aada5fffe 100644
--- a/drivers/misc/isl29020.c
+++ b/drivers/misc/isl29020.c
@@ -183,9 +183,7 @@ static int  isl29020_probe(struct i2c_client *client,
 static int isl29020_remove(struct i2c_client *client)
 {
-        struct als_data *data = i2c_get_clientdata(client);
        sysfs_remove_group(&client->dev.kobj, &m_als_gr);
-        kfree(data);
        return 0;
 }
@@ -245,6 +243,6 @@ static void  __exit sensor_isl29020_exit(void)
 module_init(sensor_isl29020_init);
 module_exit(sensor_isl29020_exit);
-MODULE_AUTHOR("Kalhan Trisal <kalhan.trisal@intel.com");
+MODULE_AUTHOR("Kalhan Trisal <kalhan.trisal@intel.com>");
 MODULE_DESCRIPTION("Intersil isl29020 ALS Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index d551f09ccb79..6956f7e7d439 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -439,18 +439,23 @@ xpc_discovery(void)
         * nodes that can comprise an access protection grouping. The access
         * protection is in regards to memory, IOI and IPI.
         */
-        max_regions = 64;
        region_size = xp_region_size;
-        switch (region_size) {
+        if (is_uv())
-        case 128:
+                max_regions = 256;
-                max_regions *= 2;
+        else {
-        case 64:
+                max_regions = 64;
-                max_regions *= 2;
-        case 32:
+                switch (region_size) {
-                max_regions *= 2;
+                case 128:
-                region_size = 16;
+                        max_regions *= 2;
-                DBUG_ON(!is_shub2());
+                case 64:
+                        max_regions *= 2;
+                case 32:
+                        max_regions *= 2;
+                        region_size = 16;
+                        DBUG_ON(!is_shub2());
+                }
        }
        for (region = 0; region < max_regions; region++) {
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 8f86d702e46e..31ae07a36576 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1559,7 +1559,7 @@ void mmc_stop_host(struct mmc_host *host)
        if (host->caps & MMC_CAP_DISABLE)
                cancel_delayed_work(&host->disable);
-        cancel_delayed_work(&host->detect);
+        cancel_delayed_work_sync(&host->detect);
        mmc_flush_scheduled_work();
        /* clear pm flags now and let card drivers set them as needed */
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 995261f7fd70..77f93c3b8808 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -375,7 +375,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
        struct mmc_card *oldcard)
 {
        struct mmc_card *card;
-        int err, ddr = MMC_SDR_MODE;
+        int err, ddr = 0;
        u32 cid[4];
        unsigned int max_dtr;
@@ -562,7 +562,11 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                               1 << bus_width, ddr);
                        err = 0;
                } else {
-                        mmc_card_set_ddr_mode(card);
+                        if (ddr)
+                                mmc_card_set_ddr_mode(card);
+                        else
+                                ddr = MMC_SDR_MODE;
                        mmc_set_bus_width_ddr(card->host, bus_width, ddr);
                }
        }
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index c3ad1058cd31..efef5f94ac42 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -547,9 +547,11 @@ static void mmc_sdio_detect(struct mmc_host *host)
        BUG_ON(!host->card);
        /* Make sure card is powered before detecting it */
-        err = pm_runtime_get_sync(&host->card->dev);
+        if (host->caps & MMC_CAP_POWER_OFF_CARD) {
-        if (err < 0)
+                err = pm_runtime_get_sync(&host->card->dev);
-                goto out;
+                if (err < 0)
+                        goto out;
+        }
        mmc_claim_host(host);
@@ -560,6 +562,20 @@ static void mmc_sdio_detect(struct mmc_host *host)
        mmc_release_host(host);
+        /*
+         * Tell PM core it's OK to power off the card now.
+         *
+         * The _sync variant is used in order to ensure that the card
+         * is left powered off in case an error occurred, and the card
+         * is going to be removed.
+         *
+         * Since there is no specific reason to believe a new user
+         * is about to show up at this point, the _sync variant is
+         * desirable anyway.
+         */
+        if (host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_sync(&host->card->dev);
 out:
        if (err) {
                mmc_sdio_remove(host);
@@ -568,9 +584,6 @@ out:
                mmc_detach_bus(host);
                mmc_release_host(host);
        }
-        /* Tell PM core that we're done */
-        pm_runtime_put(&host->card->dev);
 }
 /*
@@ -718,16 +731,21 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
        card = host->card;
        /*
-         * Let runtime PM core know our card is active
+         * Enable runtime PM only if supported by host+card+board
         */
-        err = pm_runtime_set_active(&card->dev);
+        if (host->caps & MMC_CAP_POWER_OFF_CARD) {
-        if (err)
+                /*
-                goto remove;
+                 * Let runtime PM core know our card is active
+                 */
+                err = pm_runtime_set_active(&card->dev);
+                if (err)
+                        goto remove;
-        /*
+                /*
-         * Enable runtime PM for this card
+                 * Enable runtime PM for this card
-         */
+                 */
-        pm_runtime_enable(&card->dev);
+                pm_runtime_enable(&card->dev);
+        }
        /*
         * The number of functions on the card is encoded inside
@@ -745,9 +763,10 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
                        goto remove;
                /*
-                 * Enable Runtime PM for this func
+                 * Enable Runtime PM for this func (if supported)
                 */
-                pm_runtime_enable(&card->sdio_func[i]->dev);
+                if (host->caps & MMC_CAP_POWER_OFF_CARD)
+                        pm_runtime_enable(&card->sdio_func[i]->dev);
        }
        mmc_release_host(host);
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index 2716c7ab6bbf..203da443e339 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -17,6 +17,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
 #include <linux/mmc/sdio_func.h>
 #include "sdio_cis.h"
@@ -132,9 +133,11 @@ static int sdio_bus_probe(struct device *dev)
         * it should call pm_runtime_put_noidle() in its probe routine and
         * pm_runtime_get_noresume() in its remove routine.
         */
-        ret = pm_runtime_get_sync(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD) {
-        if (ret < 0)
+                ret = pm_runtime_get_sync(dev);
-                goto out;
+                if (ret < 0)
+                        goto out;
+        }
        /* Set the default block size so the driver is sure it's something
         * sensible. */
@@ -151,7 +154,8 @@ static int sdio_bus_probe(struct device *dev)
        return 0;
 disable_runtimepm:
-        pm_runtime_put_noidle(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_noidle(dev);
 out:
        return ret;
 }
@@ -160,12 +164,14 @@ static int sdio_bus_remove(struct device *dev)
 {
        struct sdio_driver *drv = to_sdio_driver(dev->driver);
        struct sdio_func *func = dev_to_sdio_func(dev);
-        int ret;
+        int ret = 0;
        /* Make sure card is powered before invoking ->remove() */
-        ret = pm_runtime_get_sync(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD) {
-        if (ret < 0)
+                ret = pm_runtime_get_sync(dev);
-                goto out;
+                if (ret < 0)
+                        goto out;
+        }
        drv->remove(func);
@@ -178,10 +184,12 @@ static int sdio_bus_remove(struct device *dev)
        }
        /* First, undo the increment made directly above */
-        pm_runtime_put_noidle(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_noidle(dev);
        /* Then undo the runtime PM settings in sdio_bus_probe() */
-        pm_runtime_put_noidle(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_put_noidle(dev);
 out:
        return ret;
@@ -191,6 +199,8 @@ out:
 static int sdio_bus_pm_prepare(struct device *dev)
 {
+        struct sdio_func *func = dev_to_sdio_func(dev);
        /*
         * Resume an SDIO device which was suspended at run time at this
         * point, in order to allow standard SDIO suspend/resume paths
@@ -212,7 +222,8 @@ static int sdio_bus_pm_prepare(struct device *dev)
         * since there is little point in failing system suspend if a
         * device can't be resumed.
         */
-        pm_runtime_resume(dev);
+        if (func->card->host->caps & MMC_CAP_POWER_OFF_CARD)
+                pm_runtime_resume(dev);
        return 0;
 }
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 82a1079bbdc7..5d46021cbb57 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1002,7 +1002,7 @@ static inline void omap_hsmmc_reset_controller_fsm(struct omap_hsmmc_host *host,
         * Monitor a 0->1 transition first
         */
        if (mmc_slot(host).features & HSMMC_HAS_UPDATED_RESET) {
-                while ((!(OMAP_HSMMC_READ(host, SYSCTL) & bit))
+                while ((!(OMAP_HSMMC_READ(host->base, SYSCTL) & bit))
                                        && (i++ < limit))
                        cpu_relax();
        }
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 2e9cca19c90b..9b82910b9dbb 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -17,6 +17,7 @@
 #include <linux/clk.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/sdhci-pltfm.h>
+#include <mach/hardware.h>
 #include "sdhci.h"
 #include "sdhci-pltfm.h"
 #include "sdhci-esdhc.h"
@@ -112,6 +113,13 @@ static int esdhc_pltfm_init(struct sdhci_host *host, struct sdhci_pltfm_data *pd
        clk_enable(clk);
        pltfm_host->clk = clk;
+        if (cpu_is_mx35() || cpu_is_mx51())
+                host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+        /* Fix errata ENGcm07207 which is present on i.MX25 and i.MX35 */
+        if (cpu_is_mx25() || cpu_is_mx35())
+                host->quirks |= SDHCI_QUIRK_NO_MULTIBLOCK;
        return 0;
 }
@@ -133,10 +141,8 @@ static struct sdhci_ops sdhci_esdhc_ops = {
 };
 struct sdhci_pltfm_data sdhci_esdhc_imx_pdata = {
-        .quirks = ESDHC_DEFAULT_QUIRKS | SDHCI_QUIRK_NO_MULTIBLOCK
+        .quirks = ESDHC_DEFAULT_QUIRKS | SDHCI_QUIRK_BROKEN_ADMA,
-                        | SDHCI_QUIRK_BROKEN_ADMA,
        /* ADMA has issues. Might be fixable */
-        /* NO_MULTIBLOCK might be MX35 only (Errata: ENGcm07207) */
        .ops = &sdhci_esdhc_ops,
        .init = esdhc_pltfm_init,
        .exit = esdhc_pltfm_exit,
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 55746bac2f44..3d9c2460d437 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -149,11 +149,11 @@ static const struct sdhci_pci_fixes sdhci_cafe = {
 * ADMA operation is disabled for Moorestown platform due to
 * hardware bugs.
 */
-static int mrst_hc1_probe(struct sdhci_pci_chip *chip)
+static int mrst_hc_probe(struct sdhci_pci_chip *chip)
 {
        /*
-         * slots number is fixed here for MRST as SDIO3 is never used and has
+         * slots number is fixed here for MRST as SDIO3/5 are never used and
-         * hardware bugs.
+         * have hardware bugs.
         */
        chip->num_slots = 1;
        return 0;
@@ -163,9 +163,9 @@ static const struct sdhci_pci_fixes sdhci_intel_mrst_hc0 = {
        .quirks         = SDHCI_QUIRK_BROKEN_ADMA | SDHCI_QUIRK_NO_HISPD_BIT,
 };
-static const struct sdhci_pci_fixes sdhci_intel_mrst_hc1 = {
+static const struct sdhci_pci_fixes sdhci_intel_mrst_hc1_hc2 = {
        .quirks         = SDHCI_QUIRK_BROKEN_ADMA | SDHCI_QUIRK_NO_HISPD_BIT,
-        .probe          = mrst_hc1_probe,
+        .probe          = mrst_hc_probe,
 };
 static const struct sdhci_pci_fixes sdhci_intel_mfd_sd = {
@@ -538,7 +538,15 @@ static const struct pci_device_id pci_ids[] __devinitdata = {
                .device         = PCI_DEVICE_ID_INTEL_MRST_SD1,
                .subvendor      = PCI_ANY_ID,
                .subdevice      = PCI_ANY_ID,
-                .driver_data    = (kernel_ulong_t)&sdhci_intel_mrst_hc1,
+                .driver_data    = (kernel_ulong_t)&sdhci_intel_mrst_hc1_hc2,
+        },
+        {
+                .vendor         = PCI_VENDOR_ID_INTEL,
+                .device         = PCI_DEVICE_ID_INTEL_MRST_SD2,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .driver_data    = (kernel_ulong_t)&sdhci_intel_mrst_hc1_hc2,
        },
        {
@@ -637,6 +645,7 @@ static int sdhci_pci_suspend (struct pci_dev *pdev, pm_message_t state)
 {
        struct sdhci_pci_chip *chip;
        struct sdhci_pci_slot *slot;
+        mmc_pm_flag_t slot_pm_flags;
        mmc_pm_flag_t pm_flags = 0;
        int i, ret;
@@ -657,7 +666,11 @@ static int sdhci_pci_suspend (struct pci_dev *pdev, pm_message_t state)
                        return ret;
                }
-                pm_flags |= slot->host->mmc->pm_flags;
+                slot_pm_flags = slot->host->mmc->pm_flags;
+                if (slot_pm_flags & MMC_PM_WAKE_SDIO_IRQ)
+                        sdhci_enable_irq_wakeups(slot->host);
+                pm_flags |= slot_pm_flags;
        }
        if (chip->fixes && chip->fixes->suspend) {
@@ -671,8 +684,10 @@ static int sdhci_pci_suspend (struct pci_dev *pdev, pm_message_t state)
        pci_save_state(pdev);
        if (pm_flags & MMC_PM_KEEP_POWER) {
-                if (pm_flags & MMC_PM_WAKE_SDIO_IRQ)
+                if (pm_flags & MMC_PM_WAKE_SDIO_IRQ) {
+                        pci_pme_active(pdev, true);
                        pci_enable_wake(pdev, PCI_D3hot, 1);
+                }
                pci_set_power_state(pdev, PCI_D3hot);
        } else {
                pci_enable_wake(pdev, pci_choose_state(pdev, state), 0);
diff --git a/drivers/mmc/host/sdhci-pxa.c b/drivers/mmc/host/sdhci-pxa.c
index fc406ac5d193..5a61208cbc66 100644
--- a/drivers/mmc/host/sdhci-pxa.c
+++ b/drivers/mmc/host/sdhci-pxa.c
@@ -141,6 +141,10 @@ static int __devinit sdhci_pxa_probe(struct platform_device *pdev)
        if (pdata->quirks)
                host->quirks |= pdata->quirks;
+        /* If slot design supports 8 bit data, indicate this to MMC. */
+        if (pdata->flags & PXA_FLAG_SD_8_BIT_CAPABLE_SLOT)
+                host->mmc->caps |= MMC_CAP_8_BIT_DATA;
        ret = sdhci_add_host(host);
        if (ret) {
                dev_err(&pdev->dev, "failed to add host\n");
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 782c0ee3c925..a25db426c910 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1185,17 +1185,31 @@ static void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        if (host->ops->platform_send_init_74_clocks)
                host->ops->platform_send_init_74_clocks(host, ios->power_mode);
-        ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
+        /*
+         * If your platform has 8-bit width support but is not a v3 controller,
-        if (ios->bus_width == MMC_BUS_WIDTH_8)
+         * or if it requires special setup code, you should implement that in
-                ctrl |= SDHCI_CTRL_8BITBUS;
+         * platform_8bit_width().
-        else
+         */
-                ctrl &= ~SDHCI_CTRL_8BITBUS;
+        if (host->ops->platform_8bit_width)
+                host->ops->platform_8bit_width(host, ios->bus_width);
+        else {
+                ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
+                if (ios->bus_width == MMC_BUS_WIDTH_8) {
+                        ctrl &= ~SDHCI_CTRL_4BITBUS;
+                        if (host->version >= SDHCI_SPEC_300)
+                                ctrl |= SDHCI_CTRL_8BITBUS;
+                } else {
+                        if (host->version >= SDHCI_SPEC_300)
+                                ctrl &= ~SDHCI_CTRL_8BITBUS;
+                        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                                ctrl |= SDHCI_CTRL_4BITBUS;
+                        else
+                                ctrl &= ~SDHCI_CTRL_4BITBUS;
+                }
+                sdhci_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+        }
-        if (ios->bus_width == MMC_BUS_WIDTH_4)
+        ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
-                ctrl |= SDHCI_CTRL_4BITBUS;
-        else
-                ctrl &= ~SDHCI_CTRL_4BITBUS;
        if ((ios->timing == MMC_TIMING_SD_HS ||
             ios->timing == MMC_TIMING_MMC_HS)
@@ -1681,6 +1695,16 @@ int sdhci_resume_host(struct sdhci_host *host)
 EXPORT_SYMBOL_GPL(sdhci_resume_host);
+void sdhci_enable_irq_wakeups(struct sdhci_host *host)
+{
+        u8 val;
+        val = sdhci_readb(host, SDHCI_WAKE_UP_CONTROL);
+        val |= SDHCI_WAKE_ON_INT;
+        sdhci_writeb(host, val, SDHCI_WAKE_UP_CONTROL);
+}
+EXPORT_SYMBOL_GPL(sdhci_enable_irq_wakeups);
 #endif /* CONFIG_PM */
 /*****************************************************************************\
@@ -1845,11 +1869,19 @@ int sdhci_add_host(struct sdhci_host *host)
                mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
        else
                mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
        mmc->f_max = host->max_clk;
        mmc->caps |= MMC_CAP_SDIO_IRQ;
+        /*
+         * A controller may support 8-bit width, but the board itself
+         * might not have the pins brought out.  Boards that support
+         * 8-bit width must set "mmc->caps |= MMC_CAP_8_BIT_DATA;" in
+         * their platform code before calling sdhci_add_host(), and we
+         * won't assume 8-bit width for hosts without that CAP.
+         */
        if (!(host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA))
-                mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA;
+                mmc->caps |= MMC_CAP_4_BIT_DATA;
        if (caps & SDHCI_CAN_DO_HISPD)
                mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED;
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index b7b8a3b28b01..e42d7f00c060 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -76,7 +76,7 @@
 #define   SDHCI_CTRL_ADMA1      0x08
 #define   SDHCI_CTRL_ADMA32     0x10
 #define   SDHCI_CTRL_ADMA64     0x18
-#define  SDHCI_CTRL_8BITBUS     0x20
+#define   SDHCI_CTRL_8BITBUS    0x20
 #define SDHCI_POWER_CONTROL     0x29
 #define  SDHCI_POWER_ON         0x01
@@ -87,6 +87,9 @@
 #define SDHCI_BLOCK_GAP_CONTROL 0x2A
 #define SDHCI_WAKE_UP_CONTROL   0x2B
+#define  SDHCI_WAKE_ON_INT      0x01
+#define  SDHCI_WAKE_ON_INSERT   0x02
+#define  SDHCI_WAKE_ON_REMOVE   0x04
 #define SDHCI_CLOCK_CONTROL     0x2C
 #define  SDHCI_DIVIDER_SHIFT    8
@@ -152,6 +155,7 @@
 #define  SDHCI_CLOCK_BASE_SHIFT 8
 #define  SDHCI_MAX_BLOCK_MASK   0x00030000
 #define  SDHCI_MAX_BLOCK_SHIFT  16
+#define  SDHCI_CAN_DO_8BIT      0x00040000
 #define  SDHCI_CAN_DO_ADMA2     0x00080000
 #define  SDHCI_CAN_DO_ADMA1     0x00100000
 #define  SDHCI_CAN_DO_HISPD     0x00200000
@@ -212,6 +216,8 @@ struct sdhci_ops {
        unsigned int    (*get_max_clock)(struct sdhci_host *host);
        unsigned int    (*get_min_clock)(struct sdhci_host *host);
        unsigned int    (*get_timeout_clock)(struct sdhci_host *host);
+        int             (*platform_8bit_width)(struct sdhci_host *host,
+                                               int width);
        void (*platform_send_init_74_clocks)(struct sdhci_host *host,
                                             u8 power_mode);
        unsigned int    (*get_ro)(struct sdhci_host *host);
@@ -317,6 +323,7 @@ extern void sdhci_remove_host(struct sdhci_host *host, int dead);
 #ifdef CONFIG_PM
 extern int sdhci_suspend_host(struct sdhci_host *host, pm_message_t state);
 extern int sdhci_resume_host(struct sdhci_host *host);
+extern void sdhci_enable_irq_wakeups(struct sdhci_host *host);
 #endif
 #endif /* __SDHCI_HW_H */
diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
index b4ead4a13c98..f8f65df9b017 100644
--- a/drivers/mmc/host/ushc.c
+++ b/drivers/mmc/host/ushc.c
@@ -425,7 +425,7 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
        struct usb_device *usb_dev = interface_to_usbdev(intf);
        struct mmc_host *mmc;
        struct ushc_data *ushc;
-        int ret = -ENOMEM;
+        int ret;
        mmc = mmc_alloc_host(sizeof(struct ushc_data), &intf->dev);
        if (mmc == NULL)
@@ -462,11 +462,15 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
        mmc->max_blk_count = 511;
        ushc->int_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->int_urb == NULL)
+        if (ushc->int_urb == NULL) {
+                ret = -ENOMEM;
                goto err;
+        }
        ushc->int_data = kzalloc(sizeof(struct ushc_int_data), GFP_KERNEL);
-        if (ushc->int_data == NULL)
+        if (ushc->int_data == NULL) {
+                ret = -ENOMEM;
                goto err;
+        }
        usb_fill_int_urb(ushc->int_urb, ushc->usb_dev,
                         usb_rcvintpipe(usb_dev,
                                        intf->cur_altsetting->endpoint[0].desc.bEndpointAddress),
@@ -475,11 +479,15 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
                         intf->cur_altsetting->endpoint[0].desc.bInterval);
        ushc->cbw_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->cbw_urb == NULL)
+        if (ushc->cbw_urb == NULL) {
+                ret = -ENOMEM;
                goto err;
+        }
        ushc->cbw = kzalloc(sizeof(struct ushc_cbw), GFP_KERNEL);
-        if (ushc->cbw == NULL)
+        if (ushc->cbw == NULL) {
+                ret = -ENOMEM;
                goto err;
+        }
        ushc->cbw->signature = USHC_CBW_SIGNATURE;
        usb_fill_bulk_urb(ushc->cbw_urb, ushc->usb_dev, usb_sndbulkpipe(usb_dev, 2),
@@ -487,15 +495,21 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
                          cbw_callback, ushc);
        ushc->data_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->data_urb == NULL)
+        if (ushc->data_urb == NULL) {
+                ret = -ENOMEM;
                goto err;
+        }
        ushc->csw_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (ushc->csw_urb == NULL)
+        if (ushc->csw_urb == NULL) {
+                ret = -ENOMEM;
                goto err;
+        }
        ushc->csw = kzalloc(sizeof(struct ushc_cbw), GFP_KERNEL);
-        if (ushc->csw == NULL)
+        if (ushc->csw == NULL) {
+                ret = -ENOMEM;
                goto err;
+        }
        usb_fill_bulk_urb(ushc->csw_urb, ushc->usb_dev, usb_rcvbulkpipe(usb_dev, 6),
                          ushc->csw, sizeof(struct ushc_csw),
                          csw_callback, ushc);
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index c2960ac9f39c..811775aa8ee8 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -482,10 +482,17 @@ static int nor_erase_prepare(struct ubi_device *ubi, int pnum)
        uint32_t data = 0;
        struct ubi_vid_hdr vid_hdr;
-        addr = (loff_t)pnum * ubi->peb_size + ubi->vid_hdr_aloffset;
+        /*
+         * It is important to first invalidate the EC header, and then the VID
+         * header. Otherwise a power cut may lead to valid EC header and
+         * invalid VID header, in which case UBI will treat this PEB as
+         * corrupted and will try to preserve it, and print scary warnings (see
+         * the header comment in scan.c for more information).
+         */
+        addr = (loff_t)pnum * ubi->peb_size;
        err = ubi->mtd->write(ubi->mtd, addr, 4, &written, (void *)&data);
        if (!err) {
-                addr -= ubi->vid_hdr_aloffset;
+                addr += ubi->vid_hdr_aloffset;
                err = ubi->mtd->write(ubi->mtd, addr, 4, &written,
                                      (void *)&data);
                if (!err)
@@ -494,18 +501,24 @@ static int nor_erase_prepare(struct ubi_device *ubi, int pnum)
        /*
         * We failed to write to the media. This was observed with Spansion
-         * S29GL512N NOR flash. Most probably the eraseblock erasure was
+         * S29GL512N NOR flash. Most probably the previously eraseblock erasure
-         * interrupted at a very inappropriate moment, so it became unwritable.
+         * was interrupted at a very inappropriate moment, so it became
-         * In this case we probably anyway have garbage in this PEB.
+         * unwritable. In this case we probably anyway have garbage in this
+         * PEB.
         */
        err1 = ubi_io_read_vid_hdr(ubi, pnum, &vid_hdr, 0);
-        if (err1 == UBI_IO_BAD_HDR_EBADMSG || err1 == UBI_IO_BAD_HDR)
+        if (err1 == UBI_IO_BAD_HDR_EBADMSG || err1 == UBI_IO_BAD_HDR) {
-                /*
+                struct ubi_ec_hdr ec_hdr;
-                 * The VID header is corrupted, so we can safely erase this
-                 * PEB and not afraid that it will be treated as a valid PEB in
+                err1 = ubi_io_read_ec_hdr(ubi, pnum, &ec_hdr, 0);
-                 * case of an unclean reboot.
+                if (err1 == UBI_IO_BAD_HDR_EBADMSG || err1 == UBI_IO_BAD_HDR)
-                 */
+                        /*
-                return 0;
+                         * Both VID and EC headers are corrupted, so we can
+                         * safely erase this PEB and not afraid that it will be
+                         * treated as a valid PEB in case of an unclean reboot.
+                         */
+                        return 0;
+        }
        /*
         * The PEB contains a valid VID header, but we cannot invalidate it.
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 3c631863bf40..79ca304fc4db 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -787,16 +787,15 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
                 * erased, so it became unstable and corrupted, and should be
                 * erased.
                 */
-                return 0;
+                err = 0;
+                goto out_unlock;
        }
        if (err)
-                return err;
+                goto out_unlock;
-        if (ubi_check_pattern(ubi->peb_buf1, 0xFF, ubi->leb_size)) {
+        if (ubi_check_pattern(ubi->peb_buf1, 0xFF, ubi->leb_size))
-                mutex_unlock(&ubi->buf_mutex);
+                goto out_unlock;
-                return 0;
-        }
        ubi_err("PEB %d contains corrupted VID header, and the data does not "
                "contain all 0xFF, this may be a non-UBI PEB or a severe VID "
@@ -806,8 +805,11 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
                pnum, ubi->leb_start, ubi->leb_size);
        ubi_dbg_print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
                               ubi->peb_buf1, ubi->leb_size, 1);
+        err = 1;
+out_unlock:
        mutex_unlock(&ubi->buf_mutex);
-        return 1;
+        return err;
 }
 /**
@@ -951,6 +953,10 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si,
                         * impossible to distinguish it from a PEB which just
                         * contains garbage because of a power cut during erase
                         * operation. So we just schedule this PEB for erasure.
+                         *
+                         * Besides, in case of NOR flash, we deliberatly
+                         * corrupt both headers because NOR flash erasure is
+                         * slow and can start from the end.
                         */
                        err = 0;
                else
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index f6668cdaac85..4f1755bddf6b 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2543,10 +2543,10 @@ config PCH_GBE
        depends on PCI
        select MII
        ---help---
-          This is a gigabit ethernet driver for Topcliff PCH.
+          This is a gigabit ethernet driver for EG20T PCH.
-          Topcliff PCH is the platform controller hub that is used in Intel's
+          EG20T PCH is the platform controller hub that is used in Intel's
          general embedded platform.
-          Topcliff PCH has Gigabit Ethernet interface.
+          EG20T PCH has Gigabit Ethernet interface.
          Using this interface, it is able to access system devices connected
          to Gigabit Ethernet.
          This driver enables Gigabit Ethernet function.
@@ -2945,6 +2945,18 @@ source "drivers/s390/net/Kconfig"
 source "drivers/net/caif/Kconfig"
+config TILE_NET
+        tristate "Tilera GBE/XGBE network driver support"
+        depends on TILE
+        default y
+        select CRC32
+        help
+          This is a standard Linux network device driver for the
+          on-chip Tilera Gigabit Ethernet and XAUI interfaces.
+          To compile this driver as a module, choose M here: the module
+          will be called tile_net.
 config XEN_NETDEV_FRONTEND
        tristate "Xen network device frontend driver"
        depends on XEN
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 652fc6b98039..b90738d13994 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -301,3 +301,4 @@ obj-$(CONFIG_CAIF) += caif/
 obj-$(CONFIG_OCTEON_MGMT_ETHERNET) += octeon/
 obj-$(CONFIG_PCH_GBE) += pch_gbe/
+obj-$(CONFIG_TILE_NET) += tile/
diff --git a/drivers/net/atl1c/atl1c_hw.c b/drivers/net/atl1c/atl1c_hw.c
index 919080b2c3a5..1bf672009948 100644
--- a/drivers/net/atl1c/atl1c_hw.c
+++ b/drivers/net/atl1c/atl1c_hw.c
@@ -82,7 +82,7 @@ static int atl1c_get_permanent_address(struct atl1c_hw *hw)
        addr[0] = addr[1] = 0;
        AT_READ_REG(hw, REG_OTP_CTRL, &otp_ctrl_data);
        if (atl1c_check_eeprom_exist(hw)) {
-                if (hw->nic_type == athr_l1c || hw->nic_type == athr_l2c_b) {
+                if (hw->nic_type == athr_l1c || hw->nic_type == athr_l2c) {
                        /* Enable OTP CLK */
                        if (!(otp_ctrl_data & OTP_CTRL_CLK_EN)) {
                                otp_ctrl_data |= OTP_CTRL_CLK_EN;
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 43489f89c142..53eff9ba6e95 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -155,10 +155,10 @@ static void au1000_enable_mac(struct net_device *dev, int force_reset)
        spin_lock_irqsave(&aup->lock, flags);
        if (force_reset || (!aup->mac_enabled)) {
-                writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+                writel(MAC_EN_CLOCK_ENABLE, aup->enable);
                au_sync_delay(2);
                writel((MAC_EN_RESET0 | MAC_EN_RESET1 | MAC_EN_RESET2
-                                | MAC_EN_CLOCK_ENABLE), &aup->enable);
+                                | MAC_EN_CLOCK_ENABLE), aup->enable);
                au_sync_delay(2);
                aup->mac_enabled = 1;
@@ -503,9 +503,9 @@ static void au1000_reset_mac_unlocked(struct net_device *dev)
        au1000_hard_stop(dev);
-        writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+        writel(MAC_EN_CLOCK_ENABLE, aup->enable);
        au_sync_delay(2);
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
        au_sync_delay(2);
        aup->tx_full = 0;
@@ -1119,7 +1119,7 @@ static int __devinit au1000_probe(struct platform_device *pdev)
        /* set a random MAC now in case platform_data doesn't provide one */
        random_ether_addr(dev->dev_addr);
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
        aup->mac_enabled = 0;
        pd = pdev->dev.platform_data;
diff --git a/drivers/net/cxgb4vf/cxgb4vf_main.c b/drivers/net/cxgb4vf/cxgb4vf_main.c
index c3449bbc585a..d887a76cd39d 100644
--- a/drivers/net/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/cxgb4vf/cxgb4vf_main.c
@@ -816,40 +816,48 @@ static struct net_device_stats *cxgb4vf_get_stats(struct net_device *dev)
 }
 /*
- * Collect up to maxaddrs worth of a netdevice's unicast addresses into an
+ * Collect up to maxaddrs worth of a netdevice's unicast addresses, starting
- * array of addrss pointers and return the number collected.
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
 */
-static inline int collect_netdev_uc_list_addrs(const struct net_device *dev,
+static inline unsigned int collect_netdev_uc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
+                                                        const u8 **addr,
-                                               unsigned int maxaddrs)
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
        unsigned int naddr = 0;
        const struct netdev_hw_addr *ha;
-        for_each_dev_addr(dev, ha) {
+        for_each_dev_addr(dev, ha)
-                addr[naddr++] = ha->addr;
+                if (index++ >= offset) {
-                if (naddr >= maxaddrs)
+                        addr[naddr++] = ha->addr;
-                        break;
+                        if (naddr >= maxaddrs)
-        }
+                                break;
+                }
        return naddr;
 }
 /*
- * Collect up to maxaddrs worth of a netdevice's multicast addresses into an
+ * Collect up to maxaddrs worth of a netdevice's multicast addresses, starting
- * array of addrss pointers and return the number collected.
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
 */
-static inline int collect_netdev_mc_list_addrs(const struct net_device *dev,
+static inline unsigned int collect_netdev_mc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
+                                                        const u8 **addr,
-                                               unsigned int maxaddrs)
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
        unsigned int naddr = 0;
        const struct netdev_hw_addr *ha;
-        netdev_for_each_mc_addr(ha, dev) {
+        netdev_for_each_mc_addr(ha, dev)
-                addr[naddr++] = ha->addr;
+                if (index++ >= offset) {
-                if (naddr >= maxaddrs)
+                        addr[naddr++] = ha->addr;
-                        break;
+                        if (naddr >= maxaddrs)
-        }
+                                break;
+                }
        return naddr;
 }
@@ -862,16 +870,20 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
        u64 mhash = 0;
        u64 uhash = 0;
        bool free = true;
-        u16 filt_idx[7];
+        unsigned int offset, naddr;
        const u8 *addr[7];
-        int ret, naddr = 0;
+        int ret;
        const struct port_info *pi = netdev_priv(dev);
        /* first do the secondary unicast addresses */
-        naddr = collect_netdev_uc_list_addrs(dev, addr, ARRAY_SIZE(addr));
+        for (offset = 0; ; offset += naddr) {
-        if (naddr > 0) {
+                naddr = collect_netdev_uc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
                ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &uhash, sleep);
+                                          naddr, addr, NULL, &uhash, sleep);
                if (ret < 0)
                        return ret;
@@ -879,12 +891,17 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
        }
        /* next set up the multicast addresses */
-        naddr = collect_netdev_mc_list_addrs(dev, addr, ARRAY_SIZE(addr));
+        for (offset = 0; ; offset += naddr) {
-        if (naddr > 0) {
+                naddr = collect_netdev_mc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
                ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &mhash, sleep);
+                                          naddr, addr, NULL, &mhash, sleep);
                if (ret < 0)
                        return ret;
+                free = false;
        }
        return t4vf_set_addr_hash(pi->adapter, pi->viid, uhash != 0,
diff --git a/drivers/net/cxgb4vf/t4vf_hw.c b/drivers/net/cxgb4vf/t4vf_hw.c
index e306c20dfaee..19520afe1a12 100644
--- a/drivers/net/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/cxgb4vf/t4vf_hw.c
@@ -1014,48 +1014,72 @@ int t4vf_alloc_mac_filt(struct adapter *adapter, unsigned int viid, bool free,
                        unsigned int naddr, const u8 **addr, u16 *idx,
                        u64 *hash, bool sleep_ok)
 {
-        int i, ret;
+        int offset, ret = 0;
+        unsigned nfilters = 0;
+        unsigned int rem = naddr;
        struct fw_vi_mac_cmd cmd, rpl;
-        struct fw_vi_mac_exact *p;
-        size_t len16;
-        if (naddr > ARRAY_SIZE(cmd.u.exact))
+        if (naddr > FW_CLS_TCAM_NUM_ENTRIES)
                return -EINVAL;
-        len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
-                                      u.exact[naddr]), 16);
-        memset(&cmd, 0, sizeof(cmd));
+        for (offset = 0; offset < naddr; /**/) {
-        cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
+                unsigned int fw_naddr = (rem < ARRAY_SIZE(cmd.u.exact)
-                                     FW_CMD_REQUEST |
+                                         ? rem
-                                     FW_CMD_WRITE |
+                                         : ARRAY_SIZE(cmd.u.exact));
-                                     (free ? FW_CMD_EXEC : 0) |
+                size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
-                                     FW_VI_MAC_CMD_VIID(viid));
+                                                     u.exact[fw_naddr]), 16);
-        cmd.freemacs_to_len16 = cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
+                struct fw_vi_mac_exact *p;
-                                            FW_CMD_LEN16(len16));
+                int i;
-        for (i = 0, p = cmd.u.exact; i < naddr; i++, p++) {
+                memset(&cmd, 0, sizeof(cmd));
-                p->valid_to_idx =
+                cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
-                        cpu_to_be16(FW_VI_MAC_CMD_VALID |
+                                             FW_CMD_REQUEST |
-                                    FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
+                                             FW_CMD_WRITE |
-                memcpy(p->macaddr, addr[i], sizeof(p->macaddr));
+                                             (free ? FW_CMD_EXEC : 0) |
-        }
+                                             FW_VI_MAC_CMD_VIID(viid));
+                cmd.freemacs_to_len16 =
+                        cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
+                                    FW_CMD_LEN16(len16));
+                for (i = 0, p = cmd.u.exact; i < fw_naddr; i++, p++) {
+                        p->valid_to_idx = cpu_to_be16(
+                                FW_VI_MAC_CMD_VALID |
+                                FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
+                        memcpy(p->macaddr, addr[offset+i], sizeof(p->macaddr));
+                }
+                ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl,
+                                        sleep_ok);
+                if (ret && ret != -ENOMEM)
+                        break;
-        ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl, sleep_ok);
+                for (i = 0, p = rpl.u.exact; i < fw_naddr; i++, p++) {
-        if (ret)
+                        u16 index = FW_VI_MAC_CMD_IDX_GET(
-                return ret;
+                                be16_to_cpu(p->valid_to_idx));
-        for (i = 0, p = rpl.u.exact; i < naddr; i++, p++) {
+                        if (idx)
-                u16 index = FW_VI_MAC_CMD_IDX_GET(be16_to_cpu(p->valid_to_idx));
+                                idx[offset+i] =
+                                        (index >= FW_CLS_TCAM_NUM_ENTRIES
-                if (idx)
+                                         ? 0xffff
-                        idx[i] = (index >= FW_CLS_TCAM_NUM_ENTRIES
+                                         : index);
-                                  ? 0xffff
+                        if (index < FW_CLS_TCAM_NUM_ENTRIES)
-                                  : index);
+                                nfilters++;
-                if (index < FW_CLS_TCAM_NUM_ENTRIES)
+                        else if (hash)
-                        ret++;
+                                *hash |= (1ULL << hash_mac_addr(addr[offset+i]));
-                else if (hash)
+                }
-                        *hash |= (1 << hash_mac_addr(addr[i]));
+                free = false;
+                offset += fw_naddr;
+                rem -= fw_naddr;
        }
+        /*
+         * If there were no errors or we merely ran out of room in our MAC
+         * address arena, return the number of filters actually written.
+         */
+        if (ret == 0 || ret == -ENOMEM)
+                ret = nfilters;
        return ret;
 }
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 4686c3983fc3..4d62f7bfa036 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.21-k6-NAPI"
+#define DRV_VERSION "7.3.21-k8-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
@@ -485,9 +485,6 @@ void e1000_down(struct e1000_adapter *adapter)
        struct net_device *netdev = adapter->netdev;
        u32 rctl, tctl;
-        /* signal that we're down so the interrupt handler does not
-         * reschedule our watchdog timer */
-        set_bit(__E1000_DOWN, &adapter->flags);
        /* disable receives in the hardware */
        rctl = er32(RCTL);
@@ -508,6 +505,13 @@ void e1000_down(struct e1000_adapter *adapter)
        e1000_irq_disable(adapter);
+        /*
+         * Setting DOWN must be after irq_disable to prevent
+         * a screaming interrupt.  Setting DOWN also prevents
+         * timers and tasks from rescheduling.
+         */
+        set_bit(__E1000_DOWN, &adapter->flags);
        del_timer_sync(&adapter->tx_fifo_stall_timer);
        del_timer_sync(&adapter->watchdog_timer);
        del_timer_sync(&adapter->phy_info_timer);
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 182b2a7be8dc..3d0af08483a1 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -400,6 +400,7 @@ static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes)
                        skb_arr_rq1[index] = netdev_alloc_skb(dev,
                                                              EHEA_L_PKT_SIZE);
                        if (!skb_arr_rq1[index]) {
+                                ehea_info("Unable to allocate enough skb in the array\n");
                                pr->rq1_skba.os_skbs = fill_wqes - i;
                                break;
                        }
@@ -422,13 +423,20 @@ static void ehea_init_fill_rq1(struct ehea_port_res *pr, int nr_rq1a)
        struct net_device *dev = pr->port->netdev;
        int i;
-        for (i = 0; i < pr->rq1_skba.len; i++) {
+        if (nr_rq1a > pr->rq1_skba.len) {
+                ehea_error("NR_RQ1A bigger than skb array len\n");
+                return;
+        }
+        for (i = 0; i < nr_rq1a; i++) {
                skb_arr_rq1[i] = netdev_alloc_skb(dev, EHEA_L_PKT_SIZE);
-                if (!skb_arr_rq1[i])
+                if (!skb_arr_rq1[i]) {
+                        ehea_info("No enough memory to allocate skb array\n");
                        break;
+                }
        }
        /* Ring doorbell */
-        ehea_update_rq1a(pr->qp, nr_rq1a);
+        ehea_update_rq1a(pr->qp, i);
 }
 static int ehea_refill_rq_def(struct ehea_port_res *pr,
@@ -735,8 +743,10 @@ static int ehea_proc_rwqes(struct net_device *dev,
                                        skb = netdev_alloc_skb(dev,
                                                               EHEA_L_PKT_SIZE);
-                                        if (!skb)
+                                        if (!skb) {
+                                                ehea_info("Not enough memory to allocate skb\n");
                                                break;
+                                        }
                                }
                                skb_copy_to_linear_data(skb, ((char *)cqe) + 64,
                                                 cqe->num_bytes_transfered - 4);
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 00b38bccd6d0..52a7c86af663 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -258,7 +258,7 @@ static int sh_sir_set_baudrate(struct sh_sir_self *self, u32 baudrate)
        /* Baud Rate Error Correction x 10000 */
        u32 rate_err_array[] = {
-                0000, 0625, 1250, 1875,
+                   0,  625, 1250, 1875,
                2500, 3125, 3750, 4375,
                5000, 5625, 6250, 6875,
                7500, 8125, 8750, 9375,
diff --git a/drivers/net/mlx4/fw.c b/drivers/net/mlx4/fw.c
index b68eee2414c2..7a7e18ba278a 100644
--- a/drivers/net/mlx4/fw.c
+++ b/drivers/net/mlx4/fw.c
@@ -289,6 +289,10 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                MLX4_GET(field, outbox, QUERY_DEV_CAP_LOG_BF_REG_SZ_OFFSET);
                dev_cap->bf_reg_size = 1 << (field & 0x1f);
                MLX4_GET(field, outbox, QUERY_DEV_CAP_LOG_MAX_BF_REGS_PER_PAGE_OFFSET);
+                if ((1 << (field & 0x3f)) > (PAGE_SIZE / dev_cap->bf_reg_size)) {
+                        mlx4_warn(dev, "firmware bug: log2 # of blue flame regs is invalid (%d), forcing 3\n", field & 0x1f);
+                        field = 3;
+                }
                dev_cap->bf_regs_per_page = 1 << (field & 0x3f);
                mlx4_dbg(dev, "BlueFlame available (reg size %d, regs/page %d)\n",
                         dev_cap->bf_reg_size, dev_cap->bf_regs_per_page);
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index 472056b47440..03a1d280105f 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 1999 - 2010 Intel Corporation.
- * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR CO., LTD.
 *
 * This code was derived from the Intel e1000e Linux driver.
 *
@@ -2464,8 +2464,8 @@ static void __exit pch_gbe_exit_module(void)
 module_init(pch_gbe_init_module);
 module_exit(pch_gbe_exit_module);
-MODULE_DESCRIPTION("OKI semiconductor PCH Gigabit ethernet Driver");
+MODULE_DESCRIPTION("EG20T PCH Gigabit ethernet Driver");
-MODULE_AUTHOR("OKI semiconductor, <masa-korg@dsn.okisemi.com>");
+MODULE_AUTHOR("OKI SEMICONDUCTOR, <toshiharu-linux@dsn.okisemi.com>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, pch_gbe_pcidev_id);
diff --git a/drivers/net/pch_gbe/pch_gbe_param.c b/drivers/net/pch_gbe/pch_gbe_param.c
index 2510146fc560..ef0996a0eaaa 100644
--- a/drivers/net/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -434,8 +434,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                        .err  = "using default of "
                                __MODULE_STRING(PCH_GBE_DEFAULT_TXD),
                        .def  = PCH_GBE_DEFAULT_TXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD } },
+                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD,
-                        .arg  = { .r = { .max = PCH_GBE_MAX_TXD } }
+                                         .max = PCH_GBE_MAX_TXD } }
                };
                struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
                tx_ring->count = TxDescriptors;
@@ -450,8 +450,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                        .err  = "using default of "
                                __MODULE_STRING(PCH_GBE_DEFAULT_RXD),
                        .def  = PCH_GBE_DEFAULT_RXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD } },
+                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD,
-                        .arg  = { .r = { .max = PCH_GBE_MAX_RXD } }
+                                         .max = PCH_GBE_MAX_RXD } }
                };
                struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
                rx_ring->count = RxDescriptors;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index f0bd1a1aba3a..e8b9c53c304b 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -30,11 +30,14 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/marvell_phy.h>
+#include <linux/of.h>
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
+#define MII_MARVELL_PHY_PAGE            22
 #define MII_M1011_IEVENT                0x13
 #define MII_M1011_IEVENT_CLEAR          0x0000
@@ -80,7 +83,6 @@
 #define MII_88E1121_PHY_LED_CTRL        16
 #define MII_88E1121_PHY_LED_PAGE        3
 #define MII_88E1121_PHY_LED_DEF         0x0030
-#define MII_88E1121_PHY_PAGE            22
 #define MII_M1011_PHY_STATUS            0x11
 #define MII_M1011_PHY_STATUS_1000       0x8000
@@ -186,13 +188,94 @@ static int marvell_config_aneg(struct phy_device *phydev)
        return 0;
 }
+#ifdef CONFIG_OF_MDIO
+/*
+ * Set and/or override some configuration registers based on the
+ * marvell,reg-init property stored in the of_node for the phydev.
+ *
+ * marvell,reg-init = <reg-page reg mask value>,...;
+ *
+ * There may be one or more sets of <reg-page reg mask value>:
+ *
+ * reg-page: which register bank to use.
+ * reg: the register.
+ * mask: if non-zero, ANDed with existing register value.
+ * value: ORed with the masked value and written to the regiser.
+ *
+ */
+static int marvell_of_reg_init(struct phy_device *phydev)
+{
+        const __be32 *paddr;
+        int len, i, saved_page, current_page, page_changed, ret;
+        if (!phydev->dev.of_node)
+                return 0;
+        paddr = of_get_property(phydev->dev.of_node, "marvell,reg-init", &len);
+        if (!paddr || len < (4 * sizeof(*paddr)))
+                return 0;
+        saved_page = phy_read(phydev, MII_MARVELL_PHY_PAGE);
+        if (saved_page < 0)
+                return saved_page;
+        page_changed = 0;
+        current_page = saved_page;
+        ret = 0;
+        len /= sizeof(*paddr);
+        for (i = 0; i < len - 3; i += 4) {
+                u16 reg_page = be32_to_cpup(paddr + i);
+                u16 reg = be32_to_cpup(paddr + i + 1);
+                u16 mask = be32_to_cpup(paddr + i + 2);
+                u16 val_bits = be32_to_cpup(paddr + i + 3);
+                int val;
+                if (reg_page != current_page) {
+                        current_page = reg_page;
+                        page_changed = 1;
+                        ret = phy_write(phydev, MII_MARVELL_PHY_PAGE, reg_page);
+                        if (ret < 0)
+                                goto err;
+                }
+                val = 0;
+                if (mask) {
+                        val = phy_read(phydev, reg);
+                        if (val < 0) {
+                                ret = val;
+                                goto err;
+                        }
+                        val &= mask;
+                }
+                val |= val_bits;
+                ret = phy_write(phydev, reg, val);
+                if (ret < 0)
+                        goto err;
+        }
+err:
+        if (page_changed) {
+                i = phy_write(phydev, MII_MARVELL_PHY_PAGE, saved_page);
+                if (ret == 0)
+                        ret = i;
+        }
+        return ret;
+}
+#else
+static int marvell_of_reg_init(struct phy_device *phydev)
+{
+        return 0;
+}
+#endif /* CONFIG_OF_MDIO */
 static int m88e1121_config_aneg(struct phy_device *phydev)
 {
        int err, oldpage, mscr;
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE,
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE,
                        MII_88E1121_PHY_MSCR_PAGE);
        if (err < 0)
                return err;
@@ -218,7 +301,7 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
                        return err;
        }
-        phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
        if (err < 0)
@@ -229,11 +312,11 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
        if (err < 0)
                return err;
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-        phy_write(phydev, MII_88E1121_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
        phy_write(phydev, MII_88E1121_PHY_LED_CTRL, MII_88E1121_PHY_LED_DEF);
-        phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
        err = genphy_config_aneg(phydev);
@@ -244,9 +327,9 @@ static int m88e1318_config_aneg(struct phy_device *phydev)
 {
        int err, oldpage, mscr;
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE,
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE,
                        MII_88E1121_PHY_MSCR_PAGE);
        if (err < 0)
                return err;
@@ -258,7 +341,7 @@ static int m88e1318_config_aneg(struct phy_device *phydev)
        if (err < 0)
                return err;
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
        if (err < 0)
                return err;
@@ -368,6 +451,9 @@ static int m88e1111_config_init(struct phy_device *phydev)
                        return err;
        }
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
        if (err < 0)
@@ -398,7 +484,7 @@ static int m88e1118_config_init(struct phy_device *phydev)
        int err;
        /* Change address */
-        err = phy_write(phydev, 0x16, 0x0002);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0002);
        if (err < 0)
                return err;
@@ -408,7 +494,7 @@ static int m88e1118_config_init(struct phy_device *phydev)
                return err;
        /* Change address */
-        err = phy_write(phydev, 0x16, 0x0003);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0003);
        if (err < 0)
                return err;
@@ -420,8 +506,42 @@ static int m88e1118_config_init(struct phy_device *phydev)
        if (err < 0)
                return err;
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
        /* Reset address */
-        err = phy_write(phydev, 0x16, 0x0);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0);
+        if (err < 0)
+                return err;
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+        if (err < 0)
+                return err;
+        return 0;
+}
+static int m88e1149_config_init(struct phy_device *phydev)
+{
+        int err;
+        /* Change address */
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0002);
+        if (err < 0)
+                return err;
+        /* Enable 1000 Mbit */
+        err = phy_write(phydev, 0x15, 0x1048);
+        if (err < 0)
+                return err;
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
+        /* Reset address */
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0);
        if (err < 0)
                return err;
@@ -491,6 +611,10 @@ static int m88e1145_config_init(struct phy_device *phydev)
                }
        }
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
        return 0;
 }
@@ -685,6 +809,19 @@ static struct phy_driver marvell_drivers[] = {
                .driver = { .owner = THIS_MODULE },
        },
        {
+                .phy_id = MARVELL_PHY_ID_88E1149R,
+                .phy_id_mask = MARVELL_PHY_ID_MASK,
+                .name = "Marvell 88E1149R",
+                .features = PHY_GBIT_FEATURES,
+                .flags = PHY_HAS_INTERRUPT,
+                .config_init = &m88e1149_config_init,
+                .config_aneg = &m88e1118_config_aneg,
+                .read_status = &genphy_read_status,
+                .ack_interrupt = &marvell_ack_interrupt,
+                .config_intr = &marvell_config_intr,
+                .driver = { .owner = THIS_MODULE },
+        },
+        {
                .phy_id = MARVELL_PHY_ID_88E1240,
                .phy_id_mask = MARVELL_PHY_ID_MASK,
                .name = "Marvell 88E1240",
@@ -735,6 +872,7 @@ static struct mdio_device_id __maybe_unused marvell_tbl[] = {
        { 0x01410e10, 0xfffffff0 },
        { 0x01410cb0, 0xfffffff0 },
        { 0x01410cd0, 0xfffffff0 },
+        { 0x01410e50, 0xfffffff0 },
        { 0x01410e30, 0xfffffff0 },
        { 0x01410e90, 0xfffffff0 },
        { }
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 09cf56d0416a..39659976a1ac 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -2584,16 +2584,16 @@ ppp_create_interface(struct net *net, int unit, int *retp)
         */
        dev_net_set(dev, net);
-        ret = -EEXIST;
        mutex_lock(&pn->all_ppp_mutex);
        if (unit < 0) {
                unit = unit_get(&pn->units_idr, ppp);
                if (unit < 0) {
-                        *retp = unit;
+                        ret = unit;
                        goto out2;
                }
        } else {
+                ret = -EEXIST;
                if (unit_find(&pn->units_idr, unit))
                        goto out2; /* unit already exists */
                /*
@@ -2668,10 +2668,10 @@ static void ppp_shutdown_interface(struct ppp *ppp)
                ppp->closing = 1;
                ppp_unlock(ppp);
                unregister_netdev(ppp->dev);
+                unit_put(&pn->units_idr, ppp->file.index);
        } else
                ppp_unlock(ppp);
-        unit_put(&pn->units_idr, ppp->file.index);
        ppp->file.dead = 1;
        ppp->owner = NULL;
        wake_up_interruptible(&ppp->file.rwait);
@@ -2859,8 +2859,7 @@ static void __exit ppp_cleanup(void)
 * by holding all_ppp_mutex
 */
-/* associate pointer with specified number */
+static int __unit_alloc(struct idr *p, void *ptr, int n)
-static int unit_set(struct idr *p, void *ptr, int n)
 {
        int unit, err;
@@ -2871,10 +2870,24 @@ again:
        }
        err = idr_get_new_above(p, ptr, n, &unit);
-        if (err == -EAGAIN)
+        if (err < 0) {
-                goto again;
+                if (err == -EAGAIN)
+                        goto again;
+                return err;
+        }
+        return unit;
+}
+/* associate pointer with specified number */
+static int unit_set(struct idr *p, void *ptr, int n)
+{
+        int unit;
-        if (unit != n) {
+        unit = __unit_alloc(p, ptr, n);
+        if (unit < 0)
+                return unit;
+        else if (unit != n) {
                idr_remove(p, unit);
                return -EINVAL;
        }
@@ -2885,19 +2898,7 @@ again:
 /* get new free unit number and associate pointer with it */
 static int unit_get(struct idr *p, void *ptr)
 {
-        int unit, err;
+        return __unit_alloc(p, ptr, 0);
-again:
-        if (!idr_pre_get(p, GFP_KERNEL)) {
-                printk(KERN_ERR "PPP: No free memory for idr\n");
-                return -ENOMEM;
-        }
-        err = idr_get_new_above(p, ptr, 0, &unit);
-        if (err == -EAGAIN)
-                goto again;
-        return unit;
 }
 /* put unit number back to a pool */
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index c30e0fe55a31..528eaef5308f 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -62,15 +62,15 @@ static const u32 default_msg =
 /* NETIF_MSG_PKTDATA | */
    NETIF_MSG_HW | NETIF_MSG_WOL | 0;
-static int debug = 0x00007fff;  /* defaults above */
+static int debug = -1;  /* defaults above */
-module_param(debug, int, 0);
+module_param(debug, int, 0664);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 #define MSIX_IRQ 0
 #define MSI_IRQ 1
 #define LEG_IRQ 2
 static int qlge_irq_type = MSIX_IRQ;
-module_param(qlge_irq_type, int, MSIX_IRQ);
+module_param(qlge_irq_type, int, 0664);
 MODULE_PARM_DESC(qlge_irq_type, "0 = MSI-X, 1 = MSI, 2 = Legacy.");
 static int qlge_mpi_coredump;
diff --git a/drivers/net/tile/Makefile b/drivers/net/tile/Makefile
new file mode 100644
index 000000000000..f634f142cab4
--- /dev/null
+++ b/drivers/net/tile/Makefile
@@ -0,0 +1,10 @@
+#
+# Makefile for the TILE on-chip networking support.
+#
+obj-$(CONFIG_TILE_NET) += tile_net.o
+ifdef CONFIG_TILEGX
+tile_net-objs := tilegx.o mpipe.o iorpc_mpipe.o dma_queue.o
+else
+tile_net-objs := tilepro.o
+endif
diff --git a/drivers/net/tile/tilepro.c b/drivers/net/tile/tilepro.c
new file mode 100644
index 000000000000..0e6bac5ec65b
--- /dev/null
+++ b/drivers/net/tile/tilepro.c
@@ -0,0 +1,2406 @@
+/*
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/moduleparam.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>      /* printk() */
+#include <linux/slab.h>        /* kmalloc() */
+#include <linux/errno.h>       /* error codes */
+#include <linux/types.h>       /* size_t */
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/netdevice.h>   /* struct device, and other headers */
+#include <linux/etherdevice.h> /* eth_type_trans */
+#include <linux/skbuff.h>
+#include <linux/ioctl.h>
+#include <linux/cdev.h>
+#include <linux/hugetlb.h>
+#include <linux/in6.h>
+#include <linux/timer.h>
+#include <linux/io.h>
+#include <asm/checksum.h>
+#include <asm/homecache.h>
+#include <hv/drv_xgbe_intf.h>
+#include <hv/drv_xgbe_impl.h>
+#include <hv/hypervisor.h>
+#include <hv/netio_intf.h>
+/* For TSO */
+#include <linux/ip.h>
+#include <linux/tcp.h>
+/* There is no singlethread_cpu, so schedule work on the current cpu. */
+#define singlethread_cpu -1
+/*
+ * First, "tile_net_init_module()" initializes all four "devices" which
+ * can be used by linux.
+ *
+ * Then, "ifconfig DEVICE up" calls "tile_net_open()", which analyzes
+ * the network cpus, then uses "tile_net_open_aux()" to initialize
+ * LIPP/LEPP, and then uses "tile_net_open_inner()" to register all
+ * the tiles, provide buffers to LIPP, allow ingress to start, and
+ * turn on hypervisor interrupt handling (and NAPI) on all tiles.
+ *
+ * If registration fails due to the link being down, then "retry_work"
+ * is used to keep calling "tile_net_open_inner()" until it succeeds.
+ *
+ * If "ifconfig DEVICE down" is called, it uses "tile_net_stop()" to
+ * stop egress, drain the LIPP buffers, unregister all the tiles, stop
+ * LIPP/LEPP, and wipe the LEPP queue.
+ *
+ * We start out with the ingress interrupt enabled on each CPU.  When
+ * this interrupt fires, we disable it, and call "napi_schedule()".
+ * This will cause "tile_net_poll()" to be called, which will pull
+ * packets from the netio queue, filtering them out, or passing them
+ * to "netif_receive_skb()".  If our budget is exhausted, we will
+ * return, knowing we will be called again later.  Otherwise, we
+ * reenable the ingress interrupt, and call "napi_complete()".
+ *
+ *
+ * NOTE: The use of "native_driver" ensures that EPP exists, and that
+ * "epp_sendv" is legal, and that "LIPP" is being used.
+ *
+ * NOTE: Failing to free completions for an arbitrarily long time
+ * (which is defined to be illegal) does in fact cause bizarre
+ * problems.  The "egress_timer" helps prevent this from happening.
+ *
+ * NOTE: The egress code can be interrupted by the interrupt handler.
+ */
+/* HACK: Allow use of "jumbo" packets. */
+/* This should be 1500 if "jumbo" is not set in LIPP. */
+/* This should be at most 10226 (10240 - 14) if "jumbo" is set in LIPP. */
+/* ISSUE: This has not been thoroughly tested (except at 1500). */
+#define TILE_NET_MTU 1500
+/* HACK: Define to support GSO. */
+/* ISSUE: This may actually hurt performance of the TCP blaster. */
+/* #define TILE_NET_GSO */
+/* Define this to collapse "duplicate" acks. */
+/* #define IGNORE_DUP_ACKS */
+/* HACK: Define this to verify incoming packets. */
+/* #define TILE_NET_VERIFY_INGRESS */
+/* Use 3000 to enable the Linux Traffic Control (QoS) layer, else 0. */
+#define TILE_NET_TX_QUEUE_LEN 0
+/* Define to dump packets (prints out the whole packet on tx and rx). */
+/* #define TILE_NET_DUMP_PACKETS */
+/* Define to enable debug spew (all PDEBUG's are enabled). */
+/* #define TILE_NET_DEBUG */
+/* Define to activate paranoia checks. */
+/* #define TILE_NET_PARANOIA */
+/* Default transmit lockup timeout period, in jiffies. */
+#define TILE_NET_TIMEOUT (5 * HZ)
+/* Default retry interval for bringing up the NetIO interface, in jiffies. */
+#define TILE_NET_RETRY_INTERVAL (5 * HZ)
+/* Number of ports (xgbe0, xgbe1, gbe0, gbe1). */
+#define TILE_NET_DEVS 4
+/* Paranoia. */
+#if NET_IP_ALIGN != LIPP_PACKET_PADDING
+#error "NET_IP_ALIGN must match LIPP_PACKET_PADDING."
+#endif
+/* Debug print. */
+#ifdef TILE_NET_DEBUG
+#define PDEBUG(fmt, args...) net_printk(fmt, ## args)
+#else
+#define PDEBUG(fmt, args...)
+#endif
+MODULE_AUTHOR("Tilera");
+MODULE_LICENSE("GPL");
+#define IS_MULTICAST(mac_addr) \
+        (((u8 *)(mac_addr))[0] & 0x01)
+#define IS_BROADCAST(mac_addr) \
+        (((u16 *)(mac_addr))[0] == 0xffff)
+/*
+ * Queue of incoming packets for a specific cpu and device.
+ *
+ * Includes a pointer to the "system" data, and the actual "user" data.
+ */
+struct tile_netio_queue {
+        netio_queue_impl_t *__system_part;
+        netio_queue_user_impl_t __user_part;
+};
+/*
+ * Statistics counters for a specific cpu and device.
+ */
+struct tile_net_stats_t {
+        u32 rx_packets;
+        u32 rx_bytes;
+        u32 tx_packets;
+        u32 tx_bytes;
+};
+/*
+ * Info for a specific cpu and device.
+ *
+ * ISSUE: There is a "dev" pointer in "napi" as well.
+ */
+struct tile_net_cpu {
+        /* The NAPI struct. */
+        struct napi_struct napi;
+        /* Packet queue. */
+        struct tile_netio_queue queue;
+        /* Statistics. */
+        struct tile_net_stats_t stats;
+        /* ISSUE: Is this needed? */
+        bool napi_enabled;
+        /* True if this tile has succcessfully registered with the IPP. */
+        bool registered;
+        /* True if the link was down last time we tried to register. */
+        bool link_down;
+        /* True if "egress_timer" is scheduled. */
+        bool egress_timer_scheduled;
+        /* Number of small sk_buffs which must still be provided. */
+        unsigned int num_needed_small_buffers;
+        /* Number of large sk_buffs which must still be provided. */
+        unsigned int num_needed_large_buffers;
+        /* A timer for handling egress completions. */
+        struct timer_list egress_timer;
+};
+/*
+ * Info for a specific device.
+ */
+struct tile_net_priv {
+        /* Our network device. */
+        struct net_device *dev;
+        /* The actual egress queue. */
+        lepp_queue_t *epp_queue;
+        /* Protects "epp_queue->cmd_tail" and "epp_queue->comp_tail" */
+        spinlock_t cmd_lock;
+        /* Protects "epp_queue->comp_head". */
+        spinlock_t comp_lock;
+        /* The hypervisor handle for this interface. */
+        int hv_devhdl;
+        /* The intr bit mask that IDs this device. */
+        u32 intr_id;
+        /* True iff "tile_net_open_aux()" has succeeded. */
+        int partly_opened;
+        /* True iff "tile_net_open_inner()" has succeeded. */
+        int fully_opened;
+        /* Effective network cpus. */
+        struct cpumask network_cpus_map;
+        /* Number of network cpus. */
+        int network_cpus_count;
+        /* Credits per network cpu. */
+        int network_cpus_credits;
+        /* Network stats. */
+        struct net_device_stats stats;
+        /* For NetIO bringup retries. */
+        struct delayed_work retry_work;
+        /* Quick access to per cpu data. */
+        struct tile_net_cpu *cpu[NR_CPUS];
+};
+/*
+ * The actual devices (xgbe0, xgbe1, gbe0, gbe1).
+ */
+static struct net_device *tile_net_devs[TILE_NET_DEVS];
+/*
+ * The "tile_net_cpu" structures for each device.
+ */
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_xgbe0);
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_xgbe1);
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_gbe0);
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_gbe1);
+/*
+ * True if "network_cpus" was specified.
+ */
+static bool network_cpus_used;
+/*
+ * The actual cpus in "network_cpus".
+ */
+static struct cpumask network_cpus_map;
+#ifdef TILE_NET_DEBUG
+/*
+ * printk with extra stuff.
+ *
+ * We print the CPU we're running in brackets.
+ */
+static void net_printk(char *fmt, ...)
+{
+        int i;
+        int len;
+        va_list args;
+        static char buf[256];
+        len = sprintf(buf, "tile_net[%2.2d]: ", smp_processor_id());
+        va_start(args, fmt);
+        i = vscnprintf(buf + len, sizeof(buf) - len - 1, fmt, args);
+        va_end(args);
+        buf[255] = '\0';
+        pr_notice(buf);
+}
+#endif
+#ifdef TILE_NET_DUMP_PACKETS
+/*
+ * Dump a packet.
+ */
+static void dump_packet(unsigned char *data, unsigned long length, char *s)
+{
+        unsigned long i;
+        static unsigned int count;
+        pr_info("dump_packet(data %p, length 0x%lx s %s count 0x%x)\n",
+               data, length, s, count++);
+        pr_info("\n");
+        for (i = 0; i < length; i++) {
+                if ((i & 0xf) == 0)
+                        sprintf(buf, "%8.8lx:", i);
+                sprintf(buf + strlen(buf), " %2.2x", data[i]);
+                if ((i & 0xf) == 0xf || i == length - 1)
+                        pr_info("%s\n", buf);
+        }
+}
+#endif
+/*
+ * Provide support for the __netio_fastio1() swint
+ * (see <hv/drv_xgbe_intf.h> for how it is used).
+ *
+ * The fastio swint2 call may clobber all the caller-saved registers.
+ * It rarely clobbers memory, but we allow for the possibility in
+ * the signature just to be on the safe side.
+ *
+ * Also, gcc doesn't seem to allow an input operand to be
+ * clobbered, so we fake it with dummy outputs.
+ *
+ * This function can't be static because of the way it is declared
+ * in the netio header.
+ */
+inline int __netio_fastio1(u32 fastio_index, u32 arg0)
+{
+        long result, clobber_r1, clobber_r10;
+        asm volatile("swint2"
+                     : "=R00" (result),
+                       "=R01" (clobber_r1), "=R10" (clobber_r10)
+                     : "R10" (fastio_index), "R01" (arg0)
+                     : "memory", "r2", "r3", "r4",
+                       "r5", "r6", "r7", "r8", "r9",
+                       "r11", "r12", "r13", "r14",
+                       "r15", "r16", "r17", "r18", "r19",
+                       "r20", "r21", "r22", "r23", "r24",
+                       "r25", "r26", "r27", "r28", "r29");
+        return result;
+}
+/*
+ * Provide a linux buffer to LIPP.
+ */
+static void tile_net_provide_linux_buffer(struct tile_net_cpu *info,
+                                          void *va, bool small)
+{
+        struct tile_netio_queue *queue = &info->queue;
+        /* Convert "va" and "small" to "linux_buffer_t". */
+        unsigned int buffer = ((unsigned int)(__pa(va) >> 7) << 1) + small;
+        __netio_fastio_free_buffer(queue->__user_part.__fastio_index, buffer);
+}
+/*
+ * Provide a linux buffer for LIPP.
+ */
+static bool tile_net_provide_needed_buffer(struct tile_net_cpu *info,
+                                           bool small)
+{
+        /* ISSUE: What should we use here? */
+        unsigned int large_size = NET_IP_ALIGN + TILE_NET_MTU + 100;
+        /* Round up to ensure to avoid "false sharing" with last cache line. */
+        unsigned int buffer_size =
+                 (((small ? LIPP_SMALL_PACKET_SIZE : large_size) +
+                   CHIP_L2_LINE_SIZE() - 1) & -CHIP_L2_LINE_SIZE());
+        /*
+         * ISSUE: Since CPAs are 38 bits, and we can only encode the
+         * high 31 bits in a "linux_buffer_t", the low 7 bits must be
+         * zero, and thus, we must align the actual "va" mod 128.
+         */
+        const unsigned long align = 128;
+        struct sk_buff *skb;
+        void *va;
+        struct sk_buff **skb_ptr;
+        /* Note that "dev_alloc_skb()" adds NET_SKB_PAD more bytes, */
+        /* and also "reserves" that many bytes. */
+        /* ISSUE: Can we "share" the NET_SKB_PAD bytes with "skb_ptr"? */
+        int len = sizeof(*skb_ptr) + align + buffer_size;
+        while (1) {
+                /* Allocate (or fail). */
+                skb = dev_alloc_skb(len);
+                if (skb == NULL)
+                        return false;
+                /* Make room for a back-pointer to 'skb'. */
+                skb_reserve(skb, sizeof(*skb_ptr));
+                /* Make sure we are aligned. */
+                skb_reserve(skb, -(long)skb->data & (align - 1));
+                /* This address is given to IPP. */
+                va = skb->data;
+                if (small)
+                        break;
+                /* ISSUE: This has never been observed! */
+                /* Large buffers must not span a huge page. */
+                if (((((long)va & ~HPAGE_MASK) + 1535) & HPAGE_MASK) == 0)
+                        break;
+                pr_err("Leaking unaligned linux buffer at %p.\n", va);
+        }
+        /* Skip two bytes to satisfy LIPP assumptions. */
+        /* Note that this aligns IP on a 16 byte boundary. */
+        /* ISSUE: Do this when the packet arrives? */
+        skb_reserve(skb, NET_IP_ALIGN);
+        /* Save a back-pointer to 'skb'. */
+        skb_ptr = va - sizeof(*skb_ptr);
+        *skb_ptr = skb;
+        /* Invalidate the packet buffer. */
+        if (!hash_default)
+                __inv_buffer(skb->data, buffer_size);
+        /* Make sure "skb_ptr" has been flushed. */
+        __insn_mf();
+#ifdef TILE_NET_PARANOIA
+#if CHIP_HAS_CBOX_HOME_MAP()
+        if (hash_default) {
+                HV_PTE pte = *virt_to_pte(current->mm, (unsigned long)va);
+                if (hv_pte_get_mode(pte) != HV_PTE_MODE_CACHE_HASH_L3)
+                        panic("Non-coherent ingress buffer!");
+        }
+#endif
+#endif
+        /* Provide the new buffer. */
+        tile_net_provide_linux_buffer(info, va, small);
+        return true;
+}
+/*
+ * Provide linux buffers for LIPP.
+ */
+static void tile_net_provide_needed_buffers(struct tile_net_cpu *info)
+{
+        while (info->num_needed_small_buffers != 0) {
+                if (!tile_net_provide_needed_buffer(info, true))
+                        goto oops;
+                info->num_needed_small_buffers--;
+        }
+        while (info->num_needed_large_buffers != 0) {
+                if (!tile_net_provide_needed_buffer(info, false))
+                        goto oops;
+                info->num_needed_large_buffers--;
+        }
+        return;
+oops:
+        /* Add a description to the page allocation failure dump. */
+        pr_notice("Could not provide a linux buffer to LIPP.\n");
+}
+/*
+ * Grab some LEPP completions, and store them in "comps", of size
+ * "comps_size", and return the number of completions which were
+ * stored, so the caller can free them.
+ *
+ * If "pending" is not NULL, it will be set to true if there might
+ * still be some pending completions caused by this tile, else false.
+ */
+static unsigned int tile_net_lepp_grab_comps(struct net_device *dev,
+                                             struct sk_buff *comps[],
+                                             unsigned int comps_size,
+                                             bool *pending)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        lepp_queue_t *eq = priv->epp_queue;
+        unsigned int n = 0;
+        unsigned int comp_head;
+        unsigned int comp_busy;
+        unsigned int comp_tail;
+        spin_lock(&priv->comp_lock);
+        comp_head = eq->comp_head;
+        comp_busy = eq->comp_busy;
+        comp_tail = eq->comp_tail;
+        while (comp_head != comp_busy && n < comps_size) {
+                comps[n++] = eq->comps[comp_head];
+                LEPP_QINC(comp_head);
+        }
+        if (pending != NULL)
+                *pending = (comp_head != comp_tail);
+        eq->comp_head = comp_head;
+        spin_unlock(&priv->comp_lock);
+        return n;
+}
+/*
+ * Make sure the egress timer is scheduled.
+ *
+ * Note that we use "schedule if not scheduled" logic instead of the more
+ * obvious "reschedule" logic, because "reschedule" is fairly expensive.
+ */
+static void tile_net_schedule_egress_timer(struct tile_net_cpu *info)
+{
+        if (!info->egress_timer_scheduled) {
+                mod_timer_pinned(&info->egress_timer, jiffies + 1);
+                info->egress_timer_scheduled = true;
+        }
+}
+/*
+ * The "function" for "info->egress_timer".
+ *
+ * This timer will reschedule itself as long as there are any pending
+ * completions expected (on behalf of any tile).
+ *
+ * ISSUE: Realistically, will the timer ever stop scheduling itself?
+ *
+ * ISSUE: This timer is almost never actually needed, so just use a global
+ * timer that can run on any tile.
+ *
+ * ISSUE: Maybe instead track number of expected completions, and free
+ * only that many, resetting to zero if "pending" is ever false.
+ */
+static void tile_net_handle_egress_timer(unsigned long arg)
+{
+        struct tile_net_cpu *info = (struct tile_net_cpu *)arg;
+        struct net_device *dev = info->napi.dev;
+        struct sk_buff *olds[32];
+        unsigned int wanted = 32;
+        unsigned int i, nolds = 0;
+        bool pending;
+        /* The timer is no longer scheduled. */
+        info->egress_timer_scheduled = false;
+        nolds = tile_net_lepp_grab_comps(dev, olds, wanted, &pending);
+        for (i = 0; i < nolds; i++)
+                kfree_skb(olds[i]);
+        /* Reschedule timer if needed. */
+        if (pending)
+                tile_net_schedule_egress_timer(info);
+}
+#ifdef IGNORE_DUP_ACKS
+/*
+ * Help detect "duplicate" ACKs.  These are sequential packets (for a
+ * given flow) which are exactly 66 bytes long, sharing everything but
+ * ID=2@0x12, Hsum=2@0x18, Ack=4@0x2a, WinSize=2@0x30, Csum=2@0x32,
+ * Tstamps=10@0x38.  The ID's are +1, the Hsum's are -1, the Ack's are
+ * +N, and the Tstamps are usually identical.
+ *
+ * NOTE: Apparently truly duplicate acks (with identical "ack" values),
+ * should not be collapsed, as they are used for some kind of flow control.
+ */
+static bool is_dup_ack(char *s1, char *s2, unsigned int len)
+{
+        int i;
+        unsigned long long ignorable = 0;
+        /* Identification. */
+        ignorable |= (1ULL << 0x12);
+        ignorable |= (1ULL << 0x13);
+        /* Header checksum. */
+        ignorable |= (1ULL << 0x18);
+        ignorable |= (1ULL << 0x19);
+        /* ACK. */
+        ignorable |= (1ULL << 0x2a);
+        ignorable |= (1ULL << 0x2b);
+        ignorable |= (1ULL << 0x2c);
+        ignorable |= (1ULL << 0x2d);
+        /* WinSize. */
+        ignorable |= (1ULL << 0x30);
+        ignorable |= (1ULL << 0x31);
+        /* Checksum. */
+        ignorable |= (1ULL << 0x32);
+        ignorable |= (1ULL << 0x33);
+        for (i = 0; i < len; i++, ignorable >>= 1) {
+                if ((ignorable & 1) || (s1[i] == s2[i]))
+                        continue;
+#ifdef TILE_NET_DEBUG
+                /* HACK: Mention non-timestamp diffs. */
+                if (i < 0x38 && i != 0x2f &&
+                    net_ratelimit())
+                        pr_info("Diff at 0x%x\n", i);
+#endif
+                return false;
+        }
+#ifdef TILE_NET_NO_SUPPRESS_DUP_ACKS
+        /* HACK: Do not suppress truly duplicate ACKs. */
+        /* ISSUE: Is this actually necessary or helpful? */
+        if (s1[0x2a] == s2[0x2a] &&
+            s1[0x2b] == s2[0x2b] &&
+            s1[0x2c] == s2[0x2c] &&
+            s1[0x2d] == s2[0x2d]) {
+                return false;
+        }
+#endif
+        return true;
+}
+#endif
+/*
+ * Like "tile_net_handle_packets()", but just discard packets.
+ */
+static void tile_net_discard_packets(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_netio_queue *queue = &info->queue;
+        netio_queue_impl_t *qsp = queue->__system_part;
+        netio_queue_user_impl_t *qup = &queue->__user_part;
+        while (qup->__packet_receive_read !=
+               qsp->__packet_receive_queue.__packet_write) {
+                int index = qup->__packet_receive_read;
+                int index2_aux = index + sizeof(netio_pkt_t);
+                int index2 =
+                        ((index2_aux ==
+                          qsp->__packet_receive_queue.__last_packet_plus_one) ?
+                         0 : index2_aux);
+                netio_pkt_t *pkt = (netio_pkt_t *)
+                        ((unsigned long) &qsp[1] + index);
+                /* Extract the "linux_buffer_t". */
+                unsigned int buffer = pkt->__packet.word;
+                /* Convert "linux_buffer_t" to "va". */
+                void *va = __va((phys_addr_t)(buffer >> 1) << 7);
+                /* Acquire the associated "skb". */
+                struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+                struct sk_buff *skb = *skb_ptr;
+                kfree_skb(skb);
+                /* Consume this packet. */
+                qup->__packet_receive_read = index2;
+        }
+}
+/*
+ * Handle the next packet.  Return true if "processed", false if "filtered".
+ */
+static bool tile_net_poll_aux(struct tile_net_cpu *info, int index)
+{
+        struct net_device *dev = info->napi.dev;
+        struct tile_netio_queue *queue = &info->queue;
+        netio_queue_impl_t *qsp = queue->__system_part;
+        netio_queue_user_impl_t *qup = &queue->__user_part;
+        struct tile_net_stats_t *stats = &info->stats;
+        int filter;
+        int index2_aux = index + sizeof(netio_pkt_t);
+        int index2 =
+                ((index2_aux ==
+                  qsp->__packet_receive_queue.__last_packet_plus_one) ?
+                 0 : index2_aux);
+        netio_pkt_t *pkt = (netio_pkt_t *)((unsigned long) &qsp[1] + index);
+        netio_pkt_metadata_t *metadata = NETIO_PKT_METADATA(pkt);
+        /* Extract the packet size. */
+        unsigned long len =
+                (NETIO_PKT_CUSTOM_LENGTH(pkt) +
+                 NET_IP_ALIGN - NETIO_PACKET_PADDING);
+        /* Extract the "linux_buffer_t". */
+        unsigned int buffer = pkt->__packet.word;
+        /* Extract "small" (vs "large"). */
+        bool small = ((buffer & 1) != 0);
+        /* Convert "linux_buffer_t" to "va". */
+        void *va = __va((phys_addr_t)(buffer >> 1) << 7);
+        /* Extract the packet data pointer. */
+        /* Compare to "NETIO_PKT_CUSTOM_DATA(pkt)". */
+        unsigned char *buf = va + NET_IP_ALIGN;
+#ifdef IGNORE_DUP_ACKS
+        static int other;
+        static int final;
+        static int keep;
+        static int skip;
+#endif
+        /* Invalidate the packet buffer. */
+        if (!hash_default)
+                __inv_buffer(buf, len);
+        /* ISSUE: Is this needed? */
+        dev->last_rx = jiffies;
+#ifdef TILE_NET_DUMP_PACKETS
+        dump_packet(buf, len, "rx");
+#endif /* TILE_NET_DUMP_PACKETS */
+#ifdef TILE_NET_VERIFY_INGRESS
+        if (!NETIO_PKT_L4_CSUM_CORRECT_M(metadata, pkt) &&
+            NETIO_PKT_L4_CSUM_CALCULATED_M(metadata, pkt)) {
+                /*
+                 * FIXME: This complains about UDP packets
+                 * with a "zero" checksum (bug 6624).
+                 */
+#ifdef TILE_NET_PANIC_ON_BAD
+                dump_packet(buf, len, "rx");
+                panic("Bad L4 checksum.");
+#else
+                pr_warning("Bad L4 checksum on %d byte packet.\n", len);
+#endif
+        }
+        if (!NETIO_PKT_L3_CSUM_CORRECT_M(metadata, pkt) &&
+            NETIO_PKT_L3_CSUM_CALCULATED_M(metadata, pkt)) {
+                dump_packet(buf, len, "rx");
+                panic("Bad L3 checksum.");
+        }
+        switch (NETIO_PKT_STATUS_M(metadata, pkt)) {
+        case NETIO_PKT_STATUS_OVERSIZE:
+                if (len >= 64) {
+                        dump_packet(buf, len, "rx");
+                        panic("Unexpected OVERSIZE.");
+                }
+                break;
+        case NETIO_PKT_STATUS_BAD:
+#ifdef TILE_NET_PANIC_ON_BAD
+                dump_packet(buf, len, "rx");
+                panic("Unexpected BAD packet.");
+#else
+                pr_warning("Unexpected BAD %d byte packet.\n", len);
+#endif
+        }
+#endif
+        filter = 0;
+        if (!(dev->flags & IFF_UP)) {
+                /* Filter packets received before we're up. */
+                filter = 1;
+        } else if (!(dev->flags & IFF_PROMISC)) {
+                /*
+                 * FIXME: Implement HW multicast filter.
+                 */
+                if (!IS_MULTICAST(buf) && !IS_BROADCAST(buf)) {
+                        /* Filter packets not for our address. */
+                        const u8 *mine = dev->dev_addr;
+                        filter = compare_ether_addr(mine, buf);
+                }
+        }
+#ifdef IGNORE_DUP_ACKS
+        if (len != 66) {
+                /* FIXME: Must check "is_tcp_ack(buf, len)" somehow. */
+                other++;
+        } else if (index2 ==
+                   qsp->__packet_receive_queue.__packet_write) {
+                final++;
+        } else {
+                netio_pkt_t *pkt2 = (netio_pkt_t *)
+                        ((unsigned long) &qsp[1] + index2);
+                netio_pkt_metadata_t *metadata2 =
+                        NETIO_PKT_METADATA(pkt2);
+                /* Extract the packet size. */
+                unsigned long len2 =
+                        (NETIO_PKT_CUSTOM_LENGTH(pkt2) +
+                         NET_IP_ALIGN - NETIO_PACKET_PADDING);
+                if (len2 == 66 &&
+                    NETIO_PKT_FLOW_HASH_M(metadata, pkt) ==
+                    NETIO_PKT_FLOW_HASH_M(metadata2, pkt2)) {
+                        /* Extract the "linux_buffer_t". */
+                        unsigned int buffer2 = pkt2->__packet.word;
+                        /* Convert "linux_buffer_t" to "va". */
+                        void *va2 =
+                                __va((phys_addr_t)(buffer2 >> 1) << 7);
+                        /* Extract the packet data pointer. */
+                        /* Compare to "NETIO_PKT_CUSTOM_DATA(pkt)". */
+                        unsigned char *buf2 = va2 + NET_IP_ALIGN;
+                        /* Invalidate the packet buffer. */
+                        if (!hash_default)
+                                __inv_buffer(buf2, len2);
+                        if (is_dup_ack(buf, buf2, len)) {
+                                skip++;
+                                filter = 1;
+                        } else {
+                                keep++;
+                        }
+                }
+        }
+        if (net_ratelimit())
+                pr_info("Other %d Final %d Keep %d Skip %d.\n",
+                        other, final, keep, skip);
+#endif
+        if (filter) {
+                /* ISSUE: Update "drop" statistics? */
+                tile_net_provide_linux_buffer(info, va, small);
+        } else {
+                /* Acquire the associated "skb". */
+                struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+                struct sk_buff *skb = *skb_ptr;
+                /* Paranoia. */
+                if (skb->data != buf)
+                        panic("Corrupt linux buffer from LIPP! "
+                              "VA=%p, skb=%p, skb->data=%p\n",
+                              va, skb, skb->data);
+                /* Encode the actual packet length. */
+                skb_put(skb, len);
+                /* NOTE: This call also sets "skb->dev = dev". */
+                skb->protocol = eth_type_trans(skb, dev);
+                /* ISSUE: Discard corrupt packets? */
+                /* ISSUE: Discard packets with bad checksums? */
+                /* Avoid recomputing TCP/UDP checksums. */
+                if (NETIO_PKT_L4_CSUM_CORRECT_M(metadata, pkt))
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                netif_receive_skb(skb);
+                stats->rx_packets++;
+                stats->rx_bytes += len;
+                if (small)
+                        info->num_needed_small_buffers++;
+                else
+                        info->num_needed_large_buffers++;
+        }
+        /* Return four credits after every fourth packet. */
+        if (--qup->__receive_credit_remaining == 0) {
+                u32 interval = qup->__receive_credit_interval;
+                qup->__receive_credit_remaining = interval;
+                __netio_fastio_return_credits(qup->__fastio_index, interval);
+        }
+        /* Consume this packet. */
+        qup->__packet_receive_read = index2;
+        return !filter;
+}
+/*
+ * Handle some packets for the given device on the current CPU.
+ *
+ * ISSUE: The "rotting packet" race condition occurs if a packet
+ * arrives after the queue appears to be empty, and before the
+ * hypervisor interrupt is re-enabled.
+ */
+static int tile_net_poll(struct napi_struct *napi, int budget)
+{
+        struct net_device *dev = napi->dev;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_netio_queue *queue = &info->queue;
+        netio_queue_impl_t *qsp = queue->__system_part;
+        netio_queue_user_impl_t *qup = &queue->__user_part;
+        unsigned int work = 0;
+        while (1) {
+                int index = qup->__packet_receive_read;
+                if (index == qsp->__packet_receive_queue.__packet_write)
+                        break;
+                if (tile_net_poll_aux(info, index)) {
+                        if (++work >= budget)
+                                goto done;
+                }
+        }
+        napi_complete(&info->napi);
+        /* Re-enable hypervisor interrupts. */
+        enable_percpu_irq(priv->intr_id);
+        /* HACK: Avoid the "rotting packet" problem. */
+        if (qup->__packet_receive_read !=
+            qsp->__packet_receive_queue.__packet_write)
+                napi_schedule(&info->napi);
+        /* ISSUE: Handle completions? */
+done:
+        tile_net_provide_needed_buffers(info);
+        return work;
+}
+/*
+ * Handle an ingress interrupt for the given device on the current cpu.
+ */
+static irqreturn_t tile_net_handle_ingress_interrupt(int irq, void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        /* Disable hypervisor interrupt. */
+        disable_percpu_irq(priv->intr_id);
+        napi_schedule(&info->napi);
+        return IRQ_HANDLED;
+}
+/*
+ * One time initialization per interface.
+ */
+static int tile_net_open_aux(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int ret;
+        int dummy;
+        unsigned int epp_lotar;
+        /*
+         * Find out where EPP memory should be homed.
+         */
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)&epp_lotar, sizeof(epp_lotar),
+                           NETIO_EPP_SHM_OFF);
+        if (ret < 0) {
+                pr_err("could not read epp_shm_queue lotar.\n");
+                return -EIO;
+        }
+        /*
+         * Home the page on the EPP.
+         */
+        {
+                int epp_home = hv_lotar_to_cpu(epp_lotar);
+                struct page *page = virt_to_page(priv->epp_queue);
+                homecache_change_page_home(page, 0, epp_home);
+        }
+        /*
+         * Register the EPP shared memory queue.
+         */
+        {
+                netio_ipp_address_t ea = {
+                        .va = 0,
+                        .pa = __pa(priv->epp_queue),
+                        .pte = hv_pte(0),
+                        .size = PAGE_SIZE,
+                };
+                ea.pte = hv_pte_set_lotar(ea.pte, epp_lotar);
+                ea.pte = hv_pte_set_mode(ea.pte, HV_PTE_MODE_CACHE_TILE_L3);
+                ret = hv_dev_pwrite(priv->hv_devhdl, 0,
+                                    (HV_VirtAddr)&ea,
+                                    sizeof(ea),
+                                    NETIO_EPP_SHM_OFF);
+                if (ret < 0)
+                        return -EIO;
+        }
+        /*
+         * Start LIPP/LEPP.
+         */
+        if (hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                          sizeof(dummy), NETIO_IPP_START_SHIM_OFF) < 0) {
+                pr_warning("Failed to start LIPP/LEPP.\n");
+                return -EIO;
+        }
+        return 0;
+}
+/*
+ * Register with hypervisor on each CPU.
+ *
+ * Strangely, this function does important things even if it "fails",
+ * which is especially common if the link is not up yet.  Hopefully
+ * these things are all "harmless" if done twice!
+ */
+static void tile_net_register(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info;
+        struct tile_netio_queue *queue;
+        /* Only network cpus can receive packets. */
+        int queue_id =
+                cpumask_test_cpu(my_cpu, &priv->network_cpus_map) ? 0 : 255;
+        netio_input_config_t config = {
+                .flags = 0,
+                .num_receive_packets = priv->network_cpus_credits,
+                .queue_id = queue_id
+        };
+        int ret = 0;
+        netio_queue_impl_t *queuep;
+        PDEBUG("tile_net_register(queue_id %d)\n", queue_id);
+        if (!strcmp(dev->name, "xgbe0"))
+                info = &__get_cpu_var(hv_xgbe0);
+        else if (!strcmp(dev->name, "xgbe1"))
+                info = &__get_cpu_var(hv_xgbe1);
+        else if (!strcmp(dev->name, "gbe0"))
+                info = &__get_cpu_var(hv_gbe0);
+        else if (!strcmp(dev->name, "gbe1"))
+                info = &__get_cpu_var(hv_gbe1);
+        else
+                BUG();
+        /* Initialize the egress timer. */
+        init_timer(&info->egress_timer);
+        info->egress_timer.data = (long)info;
+        info->egress_timer.function = tile_net_handle_egress_timer;
+        priv->cpu[my_cpu] = info;
+        /*
+         * Register ourselves with the IPP.
+         */
+        ret = hv_dev_pwrite(priv->hv_devhdl, 0,
+                            (HV_VirtAddr)&config,
+                            sizeof(netio_input_config_t),
+                            NETIO_IPP_INPUT_REGISTER_OFF);
+        PDEBUG("hv_dev_pwrite(NETIO_IPP_INPUT_REGISTER_OFF) returned %d\n",
+               ret);
+        if (ret < 0) {
+                printk(KERN_DEBUG "hv_dev_pwrite NETIO_IPP_INPUT_REGISTER_OFF"
+                       " failure %d\n", ret);
+                info->link_down = (ret == NETIO_LINK_DOWN);
+                return;
+        }
+        /*
+         * Get the pointer to our queue's system part.
+         */
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)&queuep,
+                           sizeof(netio_queue_impl_t *),
+                           NETIO_IPP_INPUT_REGISTER_OFF);
+        PDEBUG("hv_dev_pread(NETIO_IPP_INPUT_REGISTER_OFF) returned %d\n",
+               ret);
+        PDEBUG("queuep %p\n", queuep);
+        if (ret <= 0) {
+                /* ISSUE: Shouldn't this be a fatal error? */
+                pr_err("hv_dev_pread NETIO_IPP_INPUT_REGISTER_OFF failure\n");
+                return;
+        }
+        queue = &info->queue;
+        queue->__system_part = queuep;
+        memset(&queue->__user_part, 0, sizeof(netio_queue_user_impl_t));
+        /* This is traditionally "config.num_receive_packets / 2". */
+        queue->__user_part.__receive_credit_interval = 4;
+        queue->__user_part.__receive_credit_remaining =
+                queue->__user_part.__receive_credit_interval;
+        /*
+         * Get a fastio index from the hypervisor.
+         * ISSUE: Shouldn't this check the result?
+         */
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)&queue->__user_part.__fastio_index,
+                           sizeof(queue->__user_part.__fastio_index),
+                           NETIO_IPP_GET_FASTIO_OFF);
+        PDEBUG("hv_dev_pread(NETIO_IPP_GET_FASTIO_OFF) returned %d\n", ret);
+        netif_napi_add(dev, &info->napi, tile_net_poll, 64);
+        /* Now we are registered. */
+        info->registered = true;
+}
+/*
+ * Unregister with hypervisor on each CPU.
+ */
+static void tile_net_unregister(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        int ret = 0;
+        int dummy = 0;
+        /* Do nothing if never registered. */
+        if (info == NULL)
+                return;
+        /* Do nothing if already unregistered. */
+        if (!info->registered)
+                return;
+        /*
+         * Unregister ourselves with LIPP.
+         */
+        ret = hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                            sizeof(dummy), NETIO_IPP_INPUT_UNREGISTER_OFF);
+        PDEBUG("hv_dev_pwrite(NETIO_IPP_INPUT_UNREGISTER_OFF) returned %d\n",
+               ret);
+        if (ret < 0) {
+                /* FIXME: Just panic? */
+                pr_err("hv_dev_pwrite NETIO_IPP_INPUT_UNREGISTER_OFF"
+                       " failure %d\n", ret);
+        }
+        /*
+         * Discard all packets still in our NetIO queue.  Hopefully,
+         * once the unregister call is complete, there will be no
+         * packets still in flight on the IDN.
+         */
+        tile_net_discard_packets(dev);
+        /* Reset state. */
+        info->num_needed_small_buffers = 0;
+        info->num_needed_large_buffers = 0;
+        /* Cancel egress timer. */
+        del_timer(&info->egress_timer);
+        info->egress_timer_scheduled = false;
+        netif_napi_del(&info->napi);
+        /* Now we are unregistered. */
+        info->registered = false;
+}
+/*
+ * Helper function for "tile_net_stop()".
+ *
+ * Also used to handle registration failure in "tile_net_open_inner()",
+ * when "fully_opened" is known to be false, and the various extra
+ * steps in "tile_net_stop()" are not necessary.  ISSUE: It might be
+ * simpler if we could just call "tile_net_stop()" anyway.
+ */
+static void tile_net_stop_aux(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int dummy = 0;
+        /* Unregister all tiles, so LIPP will stop delivering packets. */
+        on_each_cpu(tile_net_unregister, (void *)dev, 1);
+        /* Stop LIPP/LEPP. */
+        if (hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                          sizeof(dummy), NETIO_IPP_STOP_SHIM_OFF) < 0)
+                panic("Failed to stop LIPP/LEPP!\n");
+        priv->partly_opened = 0;
+}
+/*
+ * Disable ingress interrupts for the given device on the current cpu.
+ */
+static void tile_net_disable_intr(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        /* Disable hypervisor interrupt. */
+        disable_percpu_irq(priv->intr_id);
+        /* Disable NAPI if needed. */
+        if (info != NULL && info->napi_enabled) {
+                napi_disable(&info->napi);
+                info->napi_enabled = false;
+        }
+}
+/*
+ * Enable ingress interrupts for the given device on the current cpu.
+ */
+static void tile_net_enable_intr(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        /* Enable hypervisor interrupt. */
+        enable_percpu_irq(priv->intr_id);
+        /* Enable NAPI. */
+        napi_enable(&info->napi);
+        info->napi_enabled = true;
+}
+/*
+ * tile_net_open_inner does most of the work of bringing up the interface.
+ * It's called from tile_net_open(), and also from tile_net_retry_open().
+ * The return value is 0 if the interface was brought up, < 0 if
+ * tile_net_open() should return the return value as an error, and > 0 if
+ * tile_net_open() should return success and schedule a work item to
+ * periodically retry the bringup.
+ */
+static int tile_net_open_inner(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info;
+        struct tile_netio_queue *queue;
+        unsigned int irq;
+        int i;
+        /*
+         * First try to register just on the local CPU, and handle any
+         * semi-expected "link down" failure specially.  Note that we
+         * do NOT call "tile_net_stop_aux()", unlike below.
+         */
+        tile_net_register(dev);
+        info = priv->cpu[my_cpu];
+        if (!info->registered) {
+                if (info->link_down)
+                        return 1;
+                return -EAGAIN;
+        }
+        /*
+         * Now register everywhere else.  If any registration fails,
+         * even for "link down" (which might not be possible), we
+         * clean up using "tile_net_stop_aux()".
+         */
+        smp_call_function(tile_net_register, (void *)dev, 1);
+        for_each_online_cpu(i) {
+                if (!priv->cpu[i]->registered) {
+                        tile_net_stop_aux(dev);
+                        return -EAGAIN;
+                }
+        }
+        queue = &info->queue;
+        /*
+         * Set the device intr bit mask.
+         * The tile_net_register above sets per tile __intr_id.
+         */
+        priv->intr_id = queue->__system_part->__intr_id;
+        BUG_ON(!priv->intr_id);
+        /*
+         * Register the device interrupt handler.
+         * The __ffs() function returns the index into the interrupt handler
+         * table from the interrupt bit mask which should have one bit
+         * and one bit only set.
+         */
+        irq = __ffs(priv->intr_id);
+        tile_irq_activate(irq, TILE_IRQ_PERCPU);
+        BUG_ON(request_irq(irq, tile_net_handle_ingress_interrupt,
+                           0, dev->name, (void *)dev) != 0);
+        /* ISSUE: How could "priv->fully_opened" ever be "true" here? */
+        if (!priv->fully_opened) {
+                int dummy = 0;
+                /* Allocate initial buffers. */
+                int max_buffers =
+                        priv->network_cpus_count * priv->network_cpus_credits;
+                info->num_needed_small_buffers =
+                        min(LIPP_SMALL_BUFFERS, max_buffers);
+                info->num_needed_large_buffers =
+                        min(LIPP_LARGE_BUFFERS, max_buffers);
+                tile_net_provide_needed_buffers(info);
+                if (info->num_needed_small_buffers != 0 ||
+                    info->num_needed_large_buffers != 0)
+                        panic("Insufficient memory for buffer stack!");
+                /* Start LIPP/LEPP and activate "ingress" at the shim. */
+                if (hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                                  sizeof(dummy), NETIO_IPP_INPUT_INIT_OFF) < 0)
+                        panic("Failed to activate the LIPP Shim!\n");
+                priv->fully_opened = 1;
+        }
+        /* On each tile, enable the hypervisor to trigger interrupts. */
+        /* ISSUE: Do this before starting LIPP/LEPP? */
+        on_each_cpu(tile_net_enable_intr, (void *)dev, 1);
+        /* Start our transmit queue. */
+        netif_start_queue(dev);
+        return 0;
+}
+/*
+ * Called periodically to retry bringing up the NetIO interface,
+ * if it doesn't come up cleanly during tile_net_open().
+ */
+static void tile_net_open_retry(struct work_struct *w)
+{
+        struct delayed_work *dw =
+                container_of(w, struct delayed_work, work);
+        struct tile_net_priv *priv =
+                container_of(dw, struct tile_net_priv, retry_work);
+        /*
+         * Try to bring the NetIO interface up.  If it fails, reschedule
+         * ourselves to try again later; otherwise, tell Linux we now have
+         * a working link.  ISSUE: What if the return value is negative?
+         */
+        if (tile_net_open_inner(priv->dev))
+                schedule_delayed_work_on(singlethread_cpu, &priv->retry_work,
+                                         TILE_NET_RETRY_INTERVAL);
+        else
+                netif_carrier_on(priv->dev);
+}
+/*
+ * Called when a network interface is made active.
+ *
+ * Returns 0 on success, negative value on failure.
+ *
+ * The open entry point is called when a network interface is made
+ * active by the system (IFF_UP).  At this point all resources needed
+ * for transmit and receive operations are allocated, the interrupt
+ * handler is registered with the OS, the watchdog timer is started,
+ * and the stack is notified that the interface is ready.
+ *
+ * If the actual link is not available yet, then we tell Linux that
+ * we have no carrier, and we keep checking until the link comes up.
+ */
+static int tile_net_open(struct net_device *dev)
+{
+        int ret = 0;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        /*
+         * We rely on priv->partly_opened to tell us if this is the
+         * first time this interface is being brought up. If it is
+         * set, the IPP was already initialized and should not be
+         * initialized again.
+         */
+        if (!priv->partly_opened) {
+                int count;
+                int credits;
+                /* Initialize LIPP/LEPP, and start the Shim. */
+                ret = tile_net_open_aux(dev);
+                if (ret < 0) {
+                        pr_err("tile_net_open_aux failed: %d\n", ret);
+                        return ret;
+                }
+                /* Analyze the network cpus. */
+                if (network_cpus_used)
+                        cpumask_copy(&priv->network_cpus_map,
+                                     &network_cpus_map);
+                else
+                        cpumask_copy(&priv->network_cpus_map, cpu_online_mask);
+                count = cpumask_weight(&priv->network_cpus_map);
+                /* Limit credits to available buffers, and apply min. */
+                credits = max(16, (LIPP_LARGE_BUFFERS / count) & ~1);
+                /* Apply "GBE" max limit. */
+                /* ISSUE: Use higher limit for XGBE? */
+                credits = min(NETIO_MAX_RECEIVE_PKTS, credits);
+                priv->network_cpus_count = count;
+                priv->network_cpus_credits = credits;
+#ifdef TILE_NET_DEBUG
+                pr_info("Using %d network cpus, with %d credits each\n",
+                       priv->network_cpus_count, priv->network_cpus_credits);
+#endif
+                priv->partly_opened = 1;
+        }
+        /*
+         * Attempt to bring up the link.
+         */
+        ret = tile_net_open_inner(dev);
+        if (ret <= 0) {
+                if (ret == 0)
+                        netif_carrier_on(dev);
+                return ret;
+        }
+        /*
+         * We were unable to bring up the NetIO interface, but we want to
+         * try again in a little bit.  Tell Linux that we have no carrier
+         * so it doesn't try to use the interface before the link comes up
+         * and then remember to try again later.
+         */
+        netif_carrier_off(dev);
+        schedule_delayed_work_on(singlethread_cpu, &priv->retry_work,
+                                 TILE_NET_RETRY_INTERVAL);
+        return 0;
+}
+/*
+ * Disables a network interface.
+ *
+ * Returns 0, this is not allowed to fail.
+ *
+ * The close entry point is called when an interface is de-activated
+ * by the OS.  The hardware is still under the drivers control, but
+ * needs to be disabled.  A global MAC reset is issued to stop the
+ * hardware, and all transmit and receive resources are freed.
+ *
+ * ISSUE: Can this can be called while "tile_net_poll()" is running?
+ */
+static int tile_net_stop(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        bool pending = true;
+        PDEBUG("tile_net_stop()\n");
+        /* ISSUE: Only needed if not yet fully open. */
+        cancel_delayed_work_sync(&priv->retry_work);
+        /* Can't transmit any more. */
+        netif_stop_queue(dev);
+        /*
+         * Disable hypervisor interrupts on each tile.
+         */
+        on_each_cpu(tile_net_disable_intr, (void *)dev, 1);
+        /*
+         * Unregister the interrupt handler.
+         * The __ffs() function returns the index into the interrupt handler
+         * table from the interrupt bit mask which should have one bit
+         * and one bit only set.
+         */
+        if (priv->intr_id)
+                free_irq(__ffs(priv->intr_id), dev);
+        /*
+         * Drain all the LIPP buffers.
+         */
+        while (true) {
+                int buffer;
+                /* NOTE: This should never fail. */
+                if (hv_dev_pread(priv->hv_devhdl, 0, (HV_VirtAddr)&buffer,
+                                 sizeof(buffer), NETIO_IPP_DRAIN_OFF) < 0)
+                        break;
+                /* Stop when done. */
+                if (buffer == 0)
+                        break;
+                {
+                        /* Convert "linux_buffer_t" to "va". */
+                        void *va = __va((phys_addr_t)(buffer >> 1) << 7);
+                        /* Acquire the associated "skb". */
+                        struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+                        struct sk_buff *skb = *skb_ptr;
+                        kfree_skb(skb);
+                }
+        }
+        /* Stop LIPP/LEPP. */
+        tile_net_stop_aux(dev);
+        priv->fully_opened = 0;
+        /*
+         * XXX: ISSUE: It appears that, in practice anyway, by the
+         * time we get here, there are no pending completions.
+         */
+        while (pending) {
+                struct sk_buff *olds[32];
+                unsigned int wanted = 32;
+                unsigned int i, nolds = 0;
+                nolds = tile_net_lepp_grab_comps(dev, olds,
+                                                 wanted, &pending);
+                /* ISSUE: We have never actually seen this debug spew. */
+                if (nolds != 0)
+                        pr_info("During tile_net_stop(), grabbed %d comps.\n",
+                               nolds);
+                for (i = 0; i < nolds; i++)
+                        kfree_skb(olds[i]);
+        }
+        /* Wipe the EPP queue. */
+        memset(priv->epp_queue, 0, sizeof(lepp_queue_t));
+        /* Evict the EPP queue. */
+        finv_buffer(priv->epp_queue, PAGE_SIZE);
+        return 0;
+}
+/*
+ * Prepare the "frags" info for the resulting LEPP command.
+ *
+ * If needed, flush the memory used by the frags.
+ */
+static unsigned int tile_net_tx_frags(lepp_frag_t *frags,
+                                      struct sk_buff *skb,
+                                      void *b_data, unsigned int b_len)
+{
+        unsigned int i, n = 0;
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        phys_addr_t cpa;
+        if (b_len != 0) {
+                if (!hash_default)
+                        finv_buffer_remote(b_data, b_len);
+                cpa = __pa(b_data);
+                frags[n].cpa_lo = cpa;
+                frags[n].cpa_hi = cpa >> 32;
+                frags[n].length = b_len;
+                frags[n].hash_for_home = hash_default;
+                n++;
+        }
+        for (i = 0; i < sh->nr_frags; i++) {
+                skb_frag_t *f = &sh->frags[i];
+                unsigned long pfn = page_to_pfn(f->page);
+                /* FIXME: Compute "hash_for_home" properly. */
+                /* ISSUE: The hypervisor checks CHIP_HAS_REV1_DMA_PACKETS(). */
+                int hash_for_home = hash_default;
+                /* FIXME: Hmmm. */
+                if (!hash_default) {
+                        void *va = pfn_to_kaddr(pfn) + f->page_offset;
+                        BUG_ON(PageHighMem(f->page));
+                        finv_buffer_remote(va, f->size);
+                }
+                cpa = ((phys_addr_t)pfn << PAGE_SHIFT) + f->page_offset;
+                frags[n].cpa_lo = cpa;
+                frags[n].cpa_hi = cpa >> 32;
+                frags[n].length = f->size;
+                frags[n].hash_for_home = hash_for_home;
+                n++;
+        }
+        return n;
+}
+/*
+ * This function takes "skb", consisting of a header template and a
+ * payload, and hands it to LEPP, to emit as one or more segments,
+ * each consisting of a possibly modified header, plus a piece of the
+ * payload, via a process known as "tcp segmentation offload".
+ *
+ * Usually, "data" will contain the header template, of size "sh_len",
+ * and "sh->frags" will contain "skb->data_len" bytes of payload, and
+ * there will be "sh->gso_segs" segments.
+ *
+ * Sometimes, if "sendfile()" requires copying, we will be called with
+ * "data" containing the header and payload, with "frags" being empty.
+ *
+ * In theory, "sh->nr_frags" could be 3, but in practice, it seems
+ * that this will never actually happen.
+ *
+ * See "emulate_large_send_offload()" for some reference code, which
+ * does not handle checksumming.
+ *
+ * ISSUE: How do we make sure that high memory DMA does not migrate?
+ */
+static int tile_net_tx_tso(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_net_stats_t *stats = &info->stats;
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned char *data = skb->data;
+        /* The ip header follows the ethernet header. */
+        struct iphdr *ih = ip_hdr(skb);
+        unsigned int ih_len = ih->ihl * 4;
+        /* Note that "nh == ih", by definition. */
+        unsigned char *nh = skb_network_header(skb);
+        unsigned int eh_len = nh - data;
+        /* The tcp header follows the ip header. */
+        struct tcphdr *th = (struct tcphdr *)(nh + ih_len);
+        unsigned int th_len = th->doff * 4;
+        /* The total number of header bytes. */
+        /* NOTE: This may be less than skb_headlen(skb). */
+        unsigned int sh_len = eh_len + ih_len + th_len;
+        /* The number of payload bytes at "skb->data + sh_len". */
+        /* This is non-zero for sendfile() without HIGHDMA. */
+        unsigned int b_len = skb_headlen(skb) - sh_len;
+        /* The total number of payload bytes. */
+        unsigned int d_len = b_len + skb->data_len;
+        /* The maximum payload size. */
+        unsigned int p_len = sh->gso_size;
+        /* The total number of segments. */
+        unsigned int num_segs = sh->gso_segs;
+        /* The temporary copy of the command. */
+        u32 cmd_body[(LEPP_MAX_CMD_SIZE + 3) / 4];
+        lepp_tso_cmd_t *cmd = (lepp_tso_cmd_t *)cmd_body;
+        /* Analyze the "frags". */
+        unsigned int num_frags =
+                tile_net_tx_frags(cmd->frags, skb, data + sh_len, b_len);
+        /* The size of the command, including frags and header. */
+        size_t cmd_size = LEPP_TSO_CMD_SIZE(num_frags, sh_len);
+        /* The command header. */
+        lepp_tso_cmd_t cmd_init = {
+                .tso = true,
+                .header_size = sh_len,
+                .ip_offset = eh_len,
+                .tcp_offset = eh_len + ih_len,
+                .payload_size = p_len,
+                .num_frags = num_frags,
+        };
+        unsigned long irqflags;
+        lepp_queue_t *eq = priv->epp_queue;
+        struct sk_buff *olds[4];
+        unsigned int wanted = 4;
+        unsigned int i, nolds = 0;
+        unsigned int cmd_head, cmd_tail, cmd_next;
+        unsigned int comp_tail;
+        unsigned int free_slots;
+        /* Paranoia. */
+        BUG_ON(skb->protocol != htons(ETH_P_IP));
+        BUG_ON(ih->protocol != IPPROTO_TCP);
+        BUG_ON(skb->ip_summed != CHECKSUM_PARTIAL);
+        BUG_ON(num_frags > LEPP_MAX_FRAGS);
+        /*--BUG_ON(num_segs != (d_len + (p_len - 1)) / p_len); */
+        BUG_ON(num_segs <= 1);
+        /* Finish preparing the command. */
+        /* Copy the command header. */
+        *cmd = cmd_init;
+        /* Copy the "header". */
+        memcpy(&cmd->frags[num_frags], data, sh_len);
+        /* Prefetch and wait, to minimize time spent holding the spinlock. */
+        prefetch_L1(&eq->comp_tail);
+        prefetch_L1(&eq->cmd_tail);
+        mb();
+        /* Enqueue the command. */
+        spin_lock_irqsave(&priv->cmd_lock, irqflags);
+        /*
+         * Handle completions if needed to make room.
+         * HACK: Spin until there is sufficient room.
+         */
+        free_slots = lepp_num_free_comp_slots(eq);
+        if (free_slots < 1) {
+spin:
+                nolds += tile_net_lepp_grab_comps(dev, olds + nolds,
+                                                  wanted - nolds, NULL);
+                if (lepp_num_free_comp_slots(eq) < 1)
+                        goto spin;
+        }
+        cmd_head = eq->cmd_head;
+        cmd_tail = eq->cmd_tail;
+        /* NOTE: The "gotos" below are untested. */
+        /* Prepare to advance, detecting full queue. */
+        cmd_next = cmd_tail + cmd_size;
+        if (cmd_tail < cmd_head && cmd_next >= cmd_head)
+                goto spin;
+        if (cmd_next > LEPP_CMD_LIMIT) {
+                cmd_next = 0;
+                if (cmd_next == cmd_head)
+                        goto spin;
+        }
+        /* Copy the command. */
+        memcpy(&eq->cmds[cmd_tail], cmd, cmd_size);
+        /* Advance. */
+        cmd_tail = cmd_next;
+        /* Record "skb" for eventual freeing. */
+        comp_tail = eq->comp_tail;
+        eq->comps[comp_tail] = skb;
+        LEPP_QINC(comp_tail);
+        eq->comp_tail = comp_tail;
+        /* Flush before allowing LEPP to handle the command. */
+        __insn_mf();
+        eq->cmd_tail = cmd_tail;
+        spin_unlock_irqrestore(&priv->cmd_lock, irqflags);
+        if (nolds == 0)
+                nolds = tile_net_lepp_grab_comps(dev, olds, wanted, NULL);
+        /* Handle completions. */
+        for (i = 0; i < nolds; i++)
+                kfree_skb(olds[i]);
+        /* Update stats. */
+        stats->tx_packets += num_segs;
+        stats->tx_bytes += (num_segs * sh_len) + d_len;
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer(info);
+        return NETDEV_TX_OK;
+}
+/*
+ * Transmit a packet (called by the kernel via "hard_start_xmit" hook).
+ */
+static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_net_stats_t *stats = &info->stats;
+        unsigned long irqflags;
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned int len = skb->len;
+        unsigned char *data = skb->data;
+        unsigned int csum_start = skb->csum_start - skb_headroom(skb);
+        lepp_frag_t frags[LEPP_MAX_FRAGS];
+        unsigned int num_frags;
+        lepp_queue_t *eq = priv->epp_queue;
+        struct sk_buff *olds[4];
+        unsigned int wanted = 4;
+        unsigned int i, nolds = 0;
+        unsigned int cmd_size = sizeof(lepp_cmd_t);
+        unsigned int cmd_head, cmd_tail, cmd_next;
+        unsigned int comp_tail;
+        lepp_cmd_t cmds[LEPP_MAX_FRAGS];
+        unsigned int free_slots;
+        /*
+         * This is paranoia, since we think that if the link doesn't come
+         * up, telling Linux we have no carrier will keep it from trying
+         * to transmit.  If it does, though, we can't execute this routine,
+         * since data structures we depend on aren't set up yet.
+         */
+        if (!info->registered)
+                return NETDEV_TX_BUSY;
+        /* Save the timestamp. */
+        dev->trans_start = jiffies;
+#ifdef TILE_NET_PARANOIA
+#if CHIP_HAS_CBOX_HOME_MAP()
+        if (hash_default) {
+                HV_PTE pte = *virt_to_pte(current->mm, (unsigned long)data);
+                if (hv_pte_get_mode(pte) != HV_PTE_MODE_CACHE_HASH_L3)
+                        panic("Non-coherent egress buffer!");
+        }
+#endif
+#endif
+#ifdef TILE_NET_DUMP_PACKETS
+        /* ISSUE: Does not dump the "frags". */
+        dump_packet(data, skb_headlen(skb), "tx");
+#endif /* TILE_NET_DUMP_PACKETS */
+        if (sh->gso_size != 0)
+                return tile_net_tx_tso(skb, dev);
+        /* Prepare the commands. */
+        num_frags = tile_net_tx_frags(frags, skb, data, skb_headlen(skb));
+        for (i = 0; i < num_frags; i++) {
+                bool final = (i == num_frags - 1);
+                lepp_cmd_t cmd = {
+                        .cpa_lo = frags[i].cpa_lo,
+                        .cpa_hi = frags[i].cpa_hi,
+                        .length = frags[i].length,
+                        .hash_for_home = frags[i].hash_for_home,
+                        .send_completion = final,
+                        .end_of_packet = final
+                };
+                if (i == 0 && skb->ip_summed == CHECKSUM_PARTIAL) {
+                        cmd.compute_checksum = 1;
+                        cmd.checksum_data.bits.start_byte = csum_start;
+                        cmd.checksum_data.bits.count = len - csum_start;
+                        cmd.checksum_data.bits.destination_byte =
+                                csum_start + skb->csum_offset;
+                }
+                cmds[i] = cmd;
+        }
+        /* Prefetch and wait, to minimize time spent holding the spinlock. */
+        prefetch_L1(&eq->comp_tail);
+        prefetch_L1(&eq->cmd_tail);
+        mb();
+        /* Enqueue the commands. */
+        spin_lock_irqsave(&priv->cmd_lock, irqflags);
+        /*
+         * Handle completions if needed to make room.
+         * HACK: Spin until there is sufficient room.
+         */
+        free_slots = lepp_num_free_comp_slots(eq);
+        if (free_slots < 1) {
+spin:
+                nolds += tile_net_lepp_grab_comps(dev, olds + nolds,
+                                                  wanted - nolds, NULL);
+                if (lepp_num_free_comp_slots(eq) < 1)
+                        goto spin;
+        }
+        cmd_head = eq->cmd_head;
+        cmd_tail = eq->cmd_tail;
+        /* NOTE: The "gotos" below are untested. */
+        /* Copy the commands, or fail. */
+        for (i = 0; i < num_frags; i++) {
+                /* Prepare to advance, detecting full queue. */
+                cmd_next = cmd_tail + cmd_size;
+                if (cmd_tail < cmd_head && cmd_next >= cmd_head)
+                        goto spin;
+                if (cmd_next > LEPP_CMD_LIMIT) {
+                        cmd_next = 0;
+                        if (cmd_next == cmd_head)
+                                goto spin;
+                }
+                /* Copy the command. */
+                *(lepp_cmd_t *)&eq->cmds[cmd_tail] = cmds[i];
+                /* Advance. */
+                cmd_tail = cmd_next;
+        }
+        /* Record "skb" for eventual freeing. */
+        comp_tail = eq->comp_tail;
+        eq->comps[comp_tail] = skb;
+        LEPP_QINC(comp_tail);
+        eq->comp_tail = comp_tail;
+        /* Flush before allowing LEPP to handle the command. */
+        __insn_mf();
+        eq->cmd_tail = cmd_tail;
+        spin_unlock_irqrestore(&priv->cmd_lock, irqflags);
+        if (nolds == 0)
+                nolds = tile_net_lepp_grab_comps(dev, olds, wanted, NULL);
+        /* Handle completions. */
+        for (i = 0; i < nolds; i++)
+                kfree_skb(olds[i]);
+        /* HACK: Track "expanded" size for short packets (e.g. 42 < 60). */
+        stats->tx_packets++;
+        stats->tx_bytes += ((len >= ETH_ZLEN) ? len : ETH_ZLEN);
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer(info);
+        return NETDEV_TX_OK;
+}
+/*
+ * Deal with a transmit timeout.
+ */
+static void tile_net_tx_timeout(struct net_device *dev)
+{
+        PDEBUG("tile_net_tx_timeout()\n");
+        PDEBUG("Transmit timeout at %ld, latency %ld\n", jiffies,
+               jiffies - dev->trans_start);
+        /* XXX: ISSUE: This doesn't seem useful for us. */
+        netif_wake_queue(dev);
+}
+/*
+ * Ioctl commands.
+ */
+static int tile_net_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+        return -EOPNOTSUPP;
+}
+/*
+ * Get System Network Statistics.
+ *
+ * Returns the address of the device statistics structure.
+ */
+static struct net_device_stats *tile_net_get_stats(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        u32 rx_packets = 0;
+        u32 tx_packets = 0;
+        u32 rx_bytes = 0;
+        u32 tx_bytes = 0;
+        int i;
+        for_each_online_cpu(i) {
+                if (priv->cpu[i]) {
+                        rx_packets += priv->cpu[i]->stats.rx_packets;
+                        rx_bytes += priv->cpu[i]->stats.rx_bytes;
+                        tx_packets += priv->cpu[i]->stats.tx_packets;
+                        tx_bytes += priv->cpu[i]->stats.tx_bytes;
+                }
+        }
+        priv->stats.rx_packets = rx_packets;
+        priv->stats.rx_bytes = rx_bytes;
+        priv->stats.tx_packets = tx_packets;
+        priv->stats.tx_bytes = tx_bytes;
+        return &priv->stats;
+}
+/*
+ * Change the "mtu".
+ *
+ * The "change_mtu" method is usually not needed.
+ * If you need it, it must be like this.
+ */
+static int tile_net_change_mtu(struct net_device *dev, int new_mtu)
+{
+        PDEBUG("tile_net_change_mtu()\n");
+        /* Check ranges. */
+        if ((new_mtu < 68) || (new_mtu > 1500))
+                return -EINVAL;
+        /* Accept the value. */
+        dev->mtu = new_mtu;
+        return 0;
+}
+/*
+ * Change the Ethernet Address of the NIC.
+ *
+ * The hypervisor driver does not support changing MAC address.  However,
+ * the IPP does not do anything with the MAC address, so the address which
+ * gets used on outgoing packets, and which is accepted on incoming packets,
+ * is completely up to the NetIO program or kernel driver which is actually
+ * handling them.
+ *
+ * Returns 0 on success, negative on failure.
+ */
+static int tile_net_set_mac_address(struct net_device *dev, void *p)
+{
+        struct sockaddr *addr = p;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EINVAL;
+        /* ISSUE: Note that "dev_addr" is now a pointer. */
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        return 0;
+}
+/*
+ * Obtain the MAC address from the hypervisor.
+ * This must be done before opening the device.
+ */
+static int tile_net_get_mac(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        char hv_dev_name[32];
+        int len;
+        __netio_getset_offset_t offset = { .word = NETIO_IPP_PARAM_OFF };
+        int ret;
+        /* For example, "xgbe0". */
+        strcpy(hv_dev_name, dev->name);
+        len = strlen(hv_dev_name);
+        /* For example, "xgbe/0". */
+        hv_dev_name[len] = hv_dev_name[len - 1];
+        hv_dev_name[len - 1] = '/';
+        len++;
+        /* For example, "xgbe/0/native_hash". */
+        strcpy(hv_dev_name + len, hash_default ? "/native_hash" : "/native");
+        /* Get the hypervisor handle for this device. */
+        priv->hv_devhdl = hv_dev_open((HV_VirtAddr)hv_dev_name, 0);
+        PDEBUG("hv_dev_open(%s) returned %d %p\n",
+               hv_dev_name, priv->hv_devhdl, &priv->hv_devhdl);
+        if (priv->hv_devhdl < 0) {
+                if (priv->hv_devhdl == HV_ENODEV)
+                        printk(KERN_DEBUG "Ignoring unconfigured device %s\n",
+                                 hv_dev_name);
+                else
+                        printk(KERN_DEBUG "hv_dev_open(%s) returned %d\n",
+                                 hv_dev_name, priv->hv_devhdl);
+                return -1;
+        }
+        /*
+         * Read the hardware address from the hypervisor.
+         * ISSUE: Note that "dev_addr" is now a pointer.
+         */
+        offset.bits.class = NETIO_PARAM;
+        offset.bits.addr = NETIO_PARAM_MAC;
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)dev->dev_addr, dev->addr_len,
+                           offset.word);
+        PDEBUG("hv_dev_pread(NETIO_PARAM_MAC) returned %d\n", ret);
+        if (ret <= 0) {
+                printk(KERN_DEBUG "hv_dev_pread(NETIO_PARAM_MAC) %s failed\n",
+                       dev->name);
+                /*
+                 * Since the device is configured by the hypervisor but we
+                 * can't get its MAC address, we are most likely running
+                 * the simulator, so let's generate a random MAC address.
+                 */
+                random_ether_addr(dev->dev_addr);
+        }
+        return 0;
+}
+static struct net_device_ops tile_net_ops = {
+        .ndo_open = tile_net_open,
+        .ndo_stop = tile_net_stop,
+        .ndo_start_xmit = tile_net_tx,
+        .ndo_do_ioctl = tile_net_ioctl,
+        .ndo_get_stats = tile_net_get_stats,
+        .ndo_change_mtu = tile_net_change_mtu,
+        .ndo_tx_timeout = tile_net_tx_timeout,
+        .ndo_set_mac_address = tile_net_set_mac_address
+};
+/*
+ * The setup function.
+ *
+ * This uses ether_setup() to assign various fields in dev, including
+ * setting IFF_BROADCAST and IFF_MULTICAST, then sets some extra fields.
+ */
+static void tile_net_setup(struct net_device *dev)
+{
+        PDEBUG("tile_net_setup()\n");
+        ether_setup(dev);
+        dev->netdev_ops = &tile_net_ops;
+        dev->watchdog_timeo = TILE_NET_TIMEOUT;
+        /* We want lockless xmit. */
+        dev->features |= NETIF_F_LLTX;
+        /* We support hardware tx checksums. */
+        dev->features |= NETIF_F_HW_CSUM;
+        /* We support scatter/gather. */
+        dev->features |= NETIF_F_SG;
+        /* We support TSO. */
+        dev->features |= NETIF_F_TSO;
+#ifdef TILE_NET_GSO
+        /* We support GSO. */
+        dev->features |= NETIF_F_GSO;
+#endif
+        if (hash_default)
+                dev->features |= NETIF_F_HIGHDMA;
+        /* ISSUE: We should support NETIF_F_UFO. */
+        dev->tx_queue_len = TILE_NET_TX_QUEUE_LEN;
+        dev->mtu = TILE_NET_MTU;
+}
+/*
+ * Allocate the device structure, register the device, and obtain the
+ * MAC address from the hypervisor.
+ */
+static struct net_device *tile_net_dev_init(const char *name)
+{
+        int ret;
+        struct net_device *dev;
+        struct tile_net_priv *priv;
+        struct page *page;
+        /*
+         * Allocate the device structure.  This allocates "priv", calls
+         * tile_net_setup(), and saves "name".  Normally, "name" is a
+         * template, instantiated by register_netdev(), but not for us.
+         */
+        dev = alloc_netdev(sizeof(*priv), name, tile_net_setup);
+        if (!dev) {
+                pr_err("alloc_netdev(%s) failed\n", name);
+                return NULL;
+        }
+        priv = netdev_priv(dev);
+        /* Initialize "priv". */
+        memset(priv, 0, sizeof(*priv));
+        /* Save "dev" for "tile_net_open_retry()". */
+        priv->dev = dev;
+        INIT_DELAYED_WORK(&priv->retry_work, tile_net_open_retry);
+        spin_lock_init(&priv->cmd_lock);
+        spin_lock_init(&priv->comp_lock);
+        /* Allocate "epp_queue". */
+        BUG_ON(get_order(sizeof(lepp_queue_t)) != 0);
+        page = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0);
+        if (!page) {
+                free_netdev(dev);
+                return NULL;
+        }
+        priv->epp_queue = page_address(page);
+        /* Register the network device. */
+        ret = register_netdev(dev);
+        if (ret) {
+                pr_err("register_netdev %s failed %d\n", dev->name, ret);
+                free_page((unsigned long)priv->epp_queue);
+                free_netdev(dev);
+                return NULL;
+        }
+        /* Get the MAC address. */
+        ret = tile_net_get_mac(dev);
+        if (ret < 0) {
+                unregister_netdev(dev);
+                free_page((unsigned long)priv->epp_queue);
+                free_netdev(dev);
+                return NULL;
+        }
+        return dev;
+}
+/*
+ * Module cleanup.
+ */
+static void tile_net_cleanup(void)
+{
+        int i;
+        for (i = 0; i < TILE_NET_DEVS; i++) {
+                if (tile_net_devs[i]) {
+                        struct net_device *dev = tile_net_devs[i];
+                        struct tile_net_priv *priv = netdev_priv(dev);
+                        unregister_netdev(dev);
+                        finv_buffer(priv->epp_queue, PAGE_SIZE);
+                        free_page((unsigned long)priv->epp_queue);
+                        free_netdev(dev);
+                }
+        }
+}
+/*
+ * Module initialization.
+ */
+static int tile_net_init_module(void)
+{
+        pr_info("Tilera IPP Net Driver\n");
+        tile_net_devs[0] = tile_net_dev_init("xgbe0");
+        tile_net_devs[1] = tile_net_dev_init("xgbe1");
+        tile_net_devs[2] = tile_net_dev_init("gbe0");
+        tile_net_devs[3] = tile_net_dev_init("gbe1");
+        return 0;
+}
+#ifndef MODULE
+/*
+ * The "network_cpus" boot argument specifies the cpus that are dedicated
+ * to handle ingress packets.
+ *
+ * The parameter should be in the form "network_cpus=m-n[,x-y]", where
+ * m, n, x, y are integer numbers that represent the cpus that can be
+ * neither a dedicated cpu nor a dataplane cpu.
+ */
+static int __init network_cpus_setup(char *str)
+{
+        int rc = cpulist_parse_crop(str, &network_cpus_map);
+        if (rc != 0) {
+                pr_warning("network_cpus=%s: malformed cpu list\n",
+                       str);
+        } else {
+                /* Remove dedicated cpus. */
+                cpumask_and(&network_cpus_map, &network_cpus_map,
+                            cpu_possible_mask);
+                if (cpumask_empty(&network_cpus_map)) {
+                        pr_warning("Ignoring network_cpus='%s'.\n",
+                               str);
+                } else {
+                        char buf[1024];
+                        cpulist_scnprintf(buf, sizeof(buf), &network_cpus_map);
+                        pr_info("Linux network CPUs: %s\n", buf);
+                        network_cpus_used = true;
+                }
+        }
+        return 0;
+}
+__setup("network_cpus=", network_cpus_setup);
+#endif
+module_init(tile_net_init_module);
+module_exit(tile_net_cleanup);
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 05a95586f3c5..055b87ab4f07 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -899,7 +899,8 @@ struct ucc_geth_hardware_statistics {
 #define UCC_GETH_UTFS_INIT                      512     /* Tx virtual FIFO size
                                                         */
 #define UCC_GETH_UTFET_INIT                     256     /* 1/2 utfs */
-#define UCC_GETH_UTFTT_INIT                     512
+#define UCC_GETH_UTFTT_INIT                     256     /* 1/2 utfs
+                                                           due to errata */
 /* Gigabit Ethernet (1000 Mbps) */
 #define UCC_GETH_URFS_GIGA_INIT                 4096/*2048*/    /* Rx virtual
                                                                   FIFO size */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index b154a94de03e..62e9e8dc8190 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2994,12 +2994,14 @@ static int hso_probe(struct usb_interface *interface,
        case HSO_INTF_BULK:
                /* It's a regular bulk interface */
-                if (((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) &&
+                if ((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) {
-                    !disable_net)
+                        if (!disable_net)
-                        hso_dev = hso_create_net_device(interface, port_spec);
+                                hso_dev =
-                else
+                                    hso_create_net_device(interface, port_spec);
+                } else {
                        hso_dev =
                            hso_create_bulk_serial_device(interface, port_spec);
+                }
                if (!hso_dev)
                        goto exit;
                break;
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index d81ad8397885..24297b274cd4 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -498,7 +498,6 @@ norbuff:
 static int x25_asy_close(struct net_device *dev)
 {
        struct x25_asy *sl = netdev_priv(dev);
-        int err;
        spin_lock(&sl->lock);
        if (sl->tty)
@@ -507,10 +506,6 @@ static int x25_asy_close(struct net_device *dev)
        netif_stop_queue(dev);
        sl->rcount = 0;
        sl->xleft  = 0;
-        err = lapb_unregister(dev);
-        if (err != LAPB_OK)
-                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
-                        err);
        spin_unlock(&sl->lock);
        return 0;
 }
@@ -582,7 +577,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
        if (err)
                return err;
        /* Done.  We have linked the TTY line to a channel. */
-        return sl->dev->base_addr;
+        return 0;
 }
@@ -595,6 +590,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
 static void x25_asy_close_tty(struct tty_struct *tty)
 {
        struct x25_asy *sl = tty->disc_data;
+        int err;
        /* First make sure we're connected. */
        if (!sl || sl->magic != X25_ASY_MAGIC)
@@ -605,6 +601,11 @@ static void x25_asy_close_tty(struct tty_struct *tty)
                dev_close(sl->dev);
        rtnl_unlock();
+        err = lapb_unregister(sl->dev);
+        if (err != LAPB_OK)
+                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
+                        err);
        tty->disc_data = NULL;
        sl->tty = NULL;
        x25_asy_free(sl);
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index c76ea53c20ce..1a62e351ec77 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -518,7 +518,7 @@ bool ath_stoprecv(struct ath_softc *sc)
        bool stopped;
        spin_lock_bh(&sc->rx.rxbuflock);
-        ath9k_hw_stoppcurecv(ah);
+        ath9k_hw_abortpcurecv(ah);
        ath9k_hw_setrxfilter(ah, 0);
        stopped = ath9k_hw_stopdmarecv(ah);
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 980ae70ea424..a314c2c2bfbe 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -647,7 +647,7 @@ init:
        }
 unlock:
-        if (err && (vif_id != -1)) {
+        if (err && (vif_id >= 0)) {
                vif_priv->active = false;
                bitmap_release_region(&ar->vif_bitmap, vif_id, 0);
                ar->vifs--;
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 9a55338d957f..09e2dfd7b175 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func,
 err_free_ssb:
        kfree(sdio);
 err_disable_func:
+        sdio_claim_host(func);
        sdio_disable_func(func);
 err_release_host:
        sdio_release_host(func);
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index d9f51485beee..9383063d2b16 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -349,7 +349,6 @@ static struct irq_chip dino_interrupt_type = {
        .name   = "GSC-PCI",
        .unmask = dino_unmask_irq,
        .mask   = dino_mask_irq,
-        .ack    = no_ack_irq,
 };
diff --git a/drivers/parisc/eisa.c b/drivers/parisc/eisa.c
index 1211974f55aa..e860038b0b84 100644
--- a/drivers/parisc/eisa.c
+++ b/drivers/parisc/eisa.c
@@ -186,7 +186,6 @@ static struct irq_chip eisa_interrupt_type = {
        .name   =       "EISA",
        .unmask =       eisa_unmask_irq,
        .mask   =       eisa_mask_irq,
-        .ack    =       no_ack_irq,
 };
 static irqreturn_t eisa_irq(int wax_irq, void *intr_dev)
@@ -340,7 +339,7 @@ static int __init eisa_probe(struct parisc_device *dev)
        setup_irq(2, &irq2_action);
        for (i = 0; i < 16; i++) {
                set_irq_chip_and_handler(i, &eisa_interrupt_type,
-                        handle_level_irq);
+                                         handle_simple_irq);
        }
        
        EISA_bus = 1;
diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c
index e605298e3aee..772b1939ac21 100644
--- a/drivers/parisc/gsc.c
+++ b/drivers/parisc/gsc.c
@@ -143,7 +143,6 @@ static struct irq_chip gsc_asic_interrupt_type = {
        .name   =       "GSC-ASIC",
        .unmask =       gsc_asic_unmask_irq,
        .mask   =       gsc_asic_mask_irq,
-        .ack    =       no_ack_irq,
 };
 int gsc_assign_irq(struct irq_chip *type, void *data)
@@ -153,7 +152,7 @@ int gsc_assign_irq(struct irq_chip *type, void *data)
        if (irq > GSC_IRQ_MAX)
                return NO_IRQ;
-        set_irq_chip_and_handler(irq, type, handle_level_irq);
+        set_irq_chip_and_handler(irq, type, handle_simple_irq);
        set_irq_chip_data(irq, data);
        return irq++;
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index a3120a09c43d..0327894bf235 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -669,6 +669,13 @@ printk("\n");
        DBG(KERN_DEBUG "enable_irq(%d): eoi(%p, 0x%x)\n", irq,
                        vi->eoi_addr, vi->eoi_data);
        iosapic_eoi(vi->eoi_addr, vi->eoi_data);
+}
+static void iosapic_eoi_irq(unsigned int irq)
+{
+        struct vector_info *vi = get_irq_chip_data(irq);
+        iosapic_eoi(vi->eoi_addr, vi->eoi_data);
        cpu_eoi_irq(irq);
 }
@@ -705,6 +712,7 @@ static struct irq_chip iosapic_interrupt_type = {
        .unmask =       iosapic_unmask_irq,
        .mask   =       iosapic_mask_irq,
        .ack    =       cpu_ack_irq,
+        .eoi    =       iosapic_eoi_irq,
 #ifdef CONFIG_SMP
        .set_affinity = iosapic_set_affinity_irq,
 #endif
diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index 2350e8a86eef..f2f501e5b6a0 100644
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -64,6 +64,7 @@ static unsigned int led_diskio    __read_mostly = 1;
 static unsigned int led_lanrxtx   __read_mostly = 1;
 static char lcd_text[32]          __read_mostly;
 static char lcd_text_default[32]  __read_mostly;
+static int  lcd_no_led_support    __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */
 static struct workqueue_struct *led_wq;
@@ -115,7 +116,7 @@ lcd_info __attribute__((aligned(8))) __read_mostly =
        .lcd_width =            16,
        .lcd_cmd_reg_addr =     KITTYHAWK_LCD_CMD,
        .lcd_data_reg_addr =    KITTYHAWK_LCD_DATA,
-        .min_cmd_delay =        40,
+        .min_cmd_delay =        80,
        .reset_cmd1 =           0x80,
        .reset_cmd2 =           0xc0,
 };
@@ -135,6 +136,9 @@ static int start_task(void)
        /* Display the default text now */
        if (led_type == LED_HASLCD) lcd_print( lcd_text_default );
+        /* KittyHawk has no LED support on its LCD */
+        if (lcd_no_led_support) return 0;
        /* Create the work queue and queue the LED task */
        led_wq = create_singlethread_workqueue("led_wq");       
        queue_delayed_work(led_wq, &led_task, 0);
@@ -248,9 +252,13 @@ static int __init led_create_procfs(void)
        proc_pdc_root = proc_mkdir("pdc", 0);
        if (!proc_pdc_root) return -1;
-        ent = proc_create_data("led", S_IRUGO|S_IWUSR, proc_pdc_root,
-                                &led_proc_fops, (void *)LED_NOLCD); /* LED */
+        if (!lcd_no_led_support)
-        if (!ent) return -1;
+        {
+                ent = proc_create_data("led", S_IRUGO|S_IWUSR, proc_pdc_root,
+                                        &led_proc_fops, (void *)LED_NOLCD); /* LED */
+                if (!ent) return -1;
+        }
        if (led_type == LED_HASLCD)
        {
@@ -692,6 +700,7 @@ int __init led_init(void)
        case 0x58B:             /* KittyHawk DC2 100 (K200) */
                printk(KERN_INFO "%s: KittyHawk-Machine (hversion 0x%x) found, "
                                "LED detection skipped.\n", __FILE__, CPU_HVERSION);
+                lcd_no_led_support = 1;
                goto found;     /* use the preinitialized values of lcd_info */
        }
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index 0846dafdfff1..28241532c0fd 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -323,7 +323,6 @@ static struct irq_chip superio_interrupt_type = {
        .name   =       SUPERIO,
        .unmask =       superio_unmask_irq,
        .mask   =       superio_mask_irq,
-        .ack =          no_ack_irq,
 };
 #ifdef DEBUG_SUPERIO_INIT
@@ -354,7 +353,7 @@ int superio_fixup_irq(struct pci_dev *pcidev)
 #endif
        for (i = 0; i < 16; i++) {
-                set_irq_chip_and_handler(i, &superio_interrupt_type, handle_level_irq);
+                set_irq_chip_and_handler(i, &superio_interrupt_type, handle_simple_irq);
        }
        /*
diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
index f01e344cf4bd..98e6fdf34d30 100644
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -49,6 +49,7 @@ obj-$(CONFIG_MIPS) += setup-bus.o setup-irq.o
 obj-$(CONFIG_X86_VISWS) += setup-irq.o
 obj-$(CONFIG_MN10300) += setup-bus.o
 obj-$(CONFIG_MICROBLAZE) += setup-bus.o
+obj-$(CONFIG_TILE) += setup-bus.o setup-irq.o
 #
 # ACPI Related PCI FW Functions
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index f5c63fe9db5c..6f9350cabbd5 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2136,6 +2136,24 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82865_HB,
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82875_HB,
                        quirk_unhide_mch_dev6);
+#ifdef CONFIG_TILE
+/*
+ * The Tilera TILEmpower platform needs to set the link speed
+ * to 2.5GT(Giga-Transfers)/s (Gen 1). The default link speed
+ * setting is 5GT/s (Gen 2). 0x98 is the Link Control2 PCIe
+ * capability register of the PEX8624 PCIe switch. The switch
+ * supports link speed auto negotiation, but falsely sets
+ * the link speed to 5GT/s.
+ */
+static void __devinit quirk_tile_plx_gen1(struct pci_dev *dev)
+{
+        if (tile_plx_gen1) {
+                pci_write_config_dword(dev, 0x98, 0x1);
+                mdelay(50);
+        }
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_PLX, 0x8624, quirk_tile_plx_gen1);
+#endif /* CONFIG_TILE */
 #ifdef CONFIG_PCI_MSI
 /* Some chipsets do not support MSI. We cannot easily rely on setting
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index 3753fd0722e7..2fe8cb8e95cd 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -70,6 +70,7 @@ void soc_pcmcia_debug(struct soc_pcmcia_socket *skt, const char *func,
                va_end(args);
        }
 }
+EXPORT_SYMBOL(soc_pcmcia_debug);
 #endif
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 60a5a5c6b50a..d235f44fd7a3 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -81,6 +81,8 @@ MODULE_PARM_DESC(wapf, "WAPF value");
 static int wlan_status = 1;
 static int bluetooth_status = 1;
+static int wimax_status = -1;
+static int wwan_status = -1;
 module_param(wlan_status, int, 0444);
 MODULE_PARM_DESC(wlan_status, "Set the wireless status on boot "
@@ -92,6 +94,16 @@ MODULE_PARM_DESC(bluetooth_status, "Set the wireless status on boot "
                 "(0 = disabled, 1 = enabled, -1 = don't do anything). "
                 "default is 1");
+module_param(wimax_status, int, 0444);
+MODULE_PARM_DESC(wimax_status, "Set the wireless status on boot "
+                 "(0 = disabled, 1 = enabled, -1 = don't do anything). "
+                 "default is 1");
+module_param(wwan_status, int, 0444);
+MODULE_PARM_DESC(wwan_status, "Set the wireless status on boot "
+                 "(0 = disabled, 1 = enabled, -1 = don't do anything). "
+                 "default is 1");
 /*
 * Some events we use, same for all Asus
 */
@@ -114,6 +126,8 @@ MODULE_PARM_DESC(bluetooth_status, "Set the wireless status on boot "
 */
 #define WL_RSTS         0x01    /* internal Wifi */
 #define BT_RSTS         0x02    /* internal Bluetooth */
+#define WM_RSTS         0x08    /* internal wimax */
+#define WW_RSTS         0x20    /* internal wwan */
 /* LED */
 #define METHOD_MLED             "MLED"
@@ -132,6 +146,11 @@ MODULE_PARM_DESC(bluetooth_status, "Set the wireless status on boot "
 */
 #define METHOD_WLAN             "WLED"
 #define METHOD_BLUETOOTH        "BLED"
+/* WWAN and WIMAX */
+#define METHOD_WWAN             "GSMC"
+#define METHOD_WIMAX            "WMXC"
 #define METHOD_WL_STATUS        "RSTS"
 /* Brightness */
@@ -883,6 +902,64 @@ static ssize_t store_bluetooth(struct device *dev,
 }
 /*
+ * Wimax
+ */
+static int asus_wimax_set(struct asus_laptop *asus, int status)
+{
+        if (write_acpi_int(asus->handle, METHOD_WIMAX, !!status)) {
+                pr_warning("Error setting wimax status to %d", status);
+                return -EIO;
+        }
+        return 0;
+}
+static ssize_t show_wimax(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct asus_laptop *asus = dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", asus_wireless_status(asus, WM_RSTS));
+}
+static ssize_t store_wimax(struct device *dev,
+                               struct device_attribute *attr, const char *buf,
+                               size_t count)
+{
+        struct asus_laptop *asus = dev_get_drvdata(dev);
+        return sysfs_acpi_set(asus, buf, count, METHOD_WIMAX);
+}
+/*
+ * Wwan
+ */
+static int asus_wwan_set(struct asus_laptop *asus, int status)
+{
+        if (write_acpi_int(asus->handle, METHOD_WWAN, !!status)) {
+                pr_warning("Error setting wwan status to %d", status);
+                return -EIO;
+        }
+        return 0;
+}
+static ssize_t show_wwan(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct asus_laptop *asus = dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", asus_wireless_status(asus, WW_RSTS));
+}
+static ssize_t store_wwan(struct device *dev,
+                               struct device_attribute *attr, const char *buf,
+                               size_t count)
+{
+        struct asus_laptop *asus = dev_get_drvdata(dev);
+        return sysfs_acpi_set(asus, buf, count, METHOD_WWAN);
+}
+/*
 * Display
 */
 static void asus_set_display(struct asus_laptop *asus, int value)
@@ -1202,6 +1279,8 @@ static DEVICE_ATTR(infos, S_IRUGO, show_infos, NULL);
 static DEVICE_ATTR(wlan, S_IRUGO | S_IWUSR, show_wlan, store_wlan);
 static DEVICE_ATTR(bluetooth, S_IRUGO | S_IWUSR,
                   show_bluetooth, store_bluetooth);
+static DEVICE_ATTR(wimax, S_IRUGO | S_IWUSR, show_wimax, store_wimax);
+static DEVICE_ATTR(wwan, S_IRUGO | S_IWUSR, show_wwan, store_wwan);
 static DEVICE_ATTR(display, S_IRUGO | S_IWUSR, show_disp, store_disp);
 static DEVICE_ATTR(ledd, S_IRUGO | S_IWUSR, show_ledd, store_ledd);
 static DEVICE_ATTR(ls_level, S_IRUGO | S_IWUSR, show_lslvl, store_lslvl);
@@ -1212,6 +1291,8 @@ static struct attribute *asus_attributes[] = {
        &dev_attr_infos.attr,
        &dev_attr_wlan.attr,
        &dev_attr_bluetooth.attr,
+        &dev_attr_wimax.attr,
+        &dev_attr_wwan.attr,
        &dev_attr_display.attr,
        &dev_attr_ledd.attr,
        &dev_attr_ls_level.attr,
@@ -1239,6 +1320,13 @@ static mode_t asus_sysfs_is_visible(struct kobject *kobj,
        } else if (attr == &dev_attr_display.attr) {
                supported = !acpi_check_handle(handle, METHOD_SWITCH_DISPLAY, NULL);
+        } else if (attr == &dev_attr_wimax.attr) {
+                supported =
+                        !acpi_check_handle(asus->handle, METHOD_WIMAX, NULL);
+        } else if (attr == &dev_attr_wwan.attr) {
+                supported = !acpi_check_handle(asus->handle, METHOD_WWAN, NULL);
        } else if (attr == &dev_attr_ledd.attr) {
                supported = !acpi_check_handle(handle, METHOD_LEDD, NULL);
@@ -1397,7 +1485,8 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
        /*
         * The HWRS method return informations about the hardware.
-         * 0x80 bit is for WLAN, 0x100 for Bluetooth.
+         * 0x80 bit is for WLAN, 0x100 for Bluetooth,
+         * 0x40 for WWAN, 0x10 for WIMAX.
         * The significance of others is yet to be found.
         */
        status =
@@ -1440,6 +1529,12 @@ static int __devinit asus_acpi_init(struct asus_laptop *asus)
        if (wlan_status >= 0)
                asus_wlan_set(asus, !!wlan_status);
+        if (wimax_status >= 0)
+                asus_wimax_set(asus, !!wimax_status);
+        if (wwan_status >= 0)
+                asus_wwan_set(asus, !!wwan_status);
        /* Keyboard Backlight is on by default */
        if (!acpi_check_handle(asus->handle, METHOD_KBD_LIGHT_SET, NULL))
                asus_kled_set(asus, 1);
diff --git a/drivers/platform/x86/eeepc-wmi.c b/drivers/platform/x86/eeepc-wmi.c
index 462ceab93f87..0d50fbbe2478 100644
--- a/drivers/platform/x86/eeepc-wmi.c
+++ b/drivers/platform/x86/eeepc-wmi.c
@@ -298,8 +298,8 @@ static void eeepc_wmi_notify(u32 value, void *context)
        kfree(obj);
 }
-static int store_cpufv(struct device *dev, struct device_attribute *attr,
+static ssize_t store_cpufv(struct device *dev, struct device_attribute *attr,
-                       const char *buf, size_t count)
+                           const char *buf, size_t count)
 {
        int value;
        struct acpi_buffer input = { (acpi_size)sizeof(value), &value };
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 1dac659b5e0c..9e05af9c41cb 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -172,6 +172,8 @@ static int hp_wmi_perform_query(int query, int write, u32 *buffer,
        bios_return = *((struct bios_return *)obj->buffer.pointer);
        memcpy(buffer, &bios_return.value, sizeof(bios_return.value));
+        kfree(obj);
        return 0;
 }
diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 3c2c6b91ecb3..94a114aa8e28 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -28,6 +28,7 @@
 #include <linux/io.h>
 #include <linux/sysdev.h>
 #include <linux/dmi.h>
+#include <linux/efi.h>
 #include <linux/mutex.h>
 #include <asm/bios_ebda.h>
@@ -220,32 +221,13 @@ static void rtl_teardown_sysfs(void) {
        sysdev_class_unregister(&class_rtl);
 }
-static int dmi_check_cb(const struct dmi_system_id *id)
-{
-        RTL_DEBUG("found IBM server '%s'\n", id->ident);
-        return 0;
-}
-#define ibm_dmi_entry(NAME, TYPE)                  \
-{                                                  \
-        .ident = NAME,                             \
-        .matches = {                               \
-                DMI_MATCH(DMI_SYS_VENDOR, "IBM"),  \
-                DMI_MATCH(DMI_PRODUCT_NAME, TYPE), \
-        },                                         \
-        .callback = dmi_check_cb                   \
-}
 static struct dmi_system_id __initdata ibm_rtl_dmi_table[] = {
-        ibm_dmi_entry("BladeCenter LS21", "7971"),
+        {                                                  \
-        ibm_dmi_entry("BladeCenter LS22", "7901"),
+                .matches = {                               \
-        ibm_dmi_entry("BladeCenter HS21 XM", "7995"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "IBM"),  \
-        ibm_dmi_entry("BladeCenter HS22", "7870"),
+                },                                         \
-        ibm_dmi_entry("BladeCenter HS22V", "7871"),
+        },
-        ibm_dmi_entry("System x3550 M2", "7946"),
-        ibm_dmi_entry("System x3650 M2", "7947"),
-        ibm_dmi_entry("System x3550 M3", "7944"),
-        ibm_dmi_entry("System x3650 M3", "7945"),
        { }
 };
@@ -257,7 +239,7 @@ static int __init ibm_rtl_init(void) {
        if (force)
                pr_warning("ibm-rtl: module loaded by force\n");
        /* first ensure that we are running on IBM HW */
-        else if (!dmi_check_system(ibm_rtl_dmi_table))
+        else if (efi_enabled || !dmi_check_system(ibm_rtl_dmi_table))
                return -ENODEV;
        /* Get the address for the Extended BIOS Data Area */
@@ -302,7 +284,7 @@ static int __init ibm_rtl_init(void) {
                        RTL_DEBUG("rtl_cmd_width = %u, rtl_cmd_type = %u\n",
                              rtl_cmd_width, rtl_cmd_type);
                        addr = ioread32(&rtl_table->cmd_port_address);
-                        RTL_DEBUG("addr = %#llx\n", addr);
+                        RTL_DEBUG("addr = %#llx\n", (unsigned long long)addr);
                        plen = rtl_cmd_width/sizeof(char);
                        rtl_cmd_addr = rtl_port_map(addr, plen);
                        RTL_DEBUG("rtl_cmd_addr = %#llx\n", (u64)rtl_cmd_addr);
diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
index 42a5469a2459..35278ad7e628 100644
--- a/drivers/platform/x86/msi-wmi.c
+++ b/drivers/platform/x86/msi-wmi.c
@@ -43,16 +43,18 @@ MODULE_ALIAS("wmi:B6F3EEF2-3D2F-49DC-9DE3-85BCE18C62F2");
 #define dprintk(msg...) pr_debug(DRV_PFX msg)
-#define KEYCODE_BASE 0xD0
+#define SCANCODE_BASE 0xD0
-#define MSI_WMI_BRIGHTNESSUP   KEYCODE_BASE
+#define MSI_WMI_BRIGHTNESSUP   SCANCODE_BASE
-#define MSI_WMI_BRIGHTNESSDOWN (KEYCODE_BASE + 1)
+#define MSI_WMI_BRIGHTNESSDOWN (SCANCODE_BASE + 1)
-#define MSI_WMI_VOLUMEUP       (KEYCODE_BASE + 2)
+#define MSI_WMI_VOLUMEUP       (SCANCODE_BASE + 2)
-#define MSI_WMI_VOLUMEDOWN     (KEYCODE_BASE + 3)
+#define MSI_WMI_VOLUMEDOWN     (SCANCODE_BASE + 3)
+#define MSI_WMI_MUTE           (SCANCODE_BASE + 4)
 static struct key_entry msi_wmi_keymap[] = {
        { KE_KEY, MSI_WMI_BRIGHTNESSUP,   {KEY_BRIGHTNESSUP} },
        { KE_KEY, MSI_WMI_BRIGHTNESSDOWN, {KEY_BRIGHTNESSDOWN} },
        { KE_KEY, MSI_WMI_VOLUMEUP,       {KEY_VOLUMEUP} },
        { KE_KEY, MSI_WMI_VOLUMEDOWN,     {KEY_VOLUMEDOWN} },
+        { KE_KEY, MSI_WMI_MUTE,           {KEY_MUTE} },
        { KE_END, 0}
 };
 static ktime_t last_pressed[ARRAY_SIZE(msi_wmi_keymap) - 1];
@@ -169,7 +171,7 @@ static void msi_wmi_notify(u32 value, void *context)
                        ktime_t diff;
                        cur = ktime_get_real();
                        diff = ktime_sub(cur, last_pressed[key->code -
-                                        KEYCODE_BASE]);
+                                        SCANCODE_BASE]);
                        /* Ignore event if the same event happened in a 50 ms
                           timeframe -> Key press may result in 10-20 GPEs */
                        if (ktime_to_us(diff) < 1000 * 50) {
@@ -178,7 +180,7 @@ static void msi_wmi_notify(u32 value, void *context)
                                         key->code, ktime_to_us(diff));
                                return;
                        }
-                        last_pressed[key->code - KEYCODE_BASE] = cur;
+                        last_pressed[key->code - SCANCODE_BASE] = cur;
                        if (key->type == KE_KEY &&
                        /* Brightness is served via acpi video driver */
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 2d61186ad5a2..e8c21994b36d 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -8497,7 +8497,6 @@ static void ibm_exit(struct ibm_struct *ibm)
                                           ibm->acpi->type,
                                           dispatch_acpi_notify);
                ibm->flags.acpi_notify_installed = 0;
-                ibm->flags.acpi_notify_installed = 0;
        }
        if (ibm->flags.proc_created) {
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 06f304f46e02..4276da7291b8 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -135,6 +135,7 @@ static const struct key_entry toshiba_acpi_keymap[] __initconst = {
        { KE_KEY, 0x141, { KEY_BRIGHTNESSUP } },
        { KE_KEY, 0x142, { KEY_WLAN } },
        { KE_KEY, 0x143, { KEY_PROG1 } },
+        { KE_KEY, 0x17f, { KEY_FN } },
        { KE_KEY, 0xb05, { KEY_PROG2 } },
        { KE_KEY, 0xb06, { KEY_WWW } },
        { KE_KEY, 0xb07, { KEY_MAIL } },
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 104b77c87ef5..aecd9a9b549f 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -755,7 +755,7 @@ static bool guid_already_parsed(const char *guid_string)
        struct wmi_block *wblock;
        list_for_each_entry(wblock, &wmi_block_list, list)
-                if (strncmp(wblock->gblock.guid, guid_string, 16) == 0)
+                if (memcmp(wblock->gblock.guid, guid_string, 16) == 0)
                        return true;
        return false;
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index f1d10c974cd4..ba521f0f0fac 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -911,7 +911,7 @@ out:
 }
 /**
- * set_consumer_device_supply: Bind a regulator to a symbolic supply
+ * set_consumer_device_supply - Bind a regulator to a symbolic supply
 * @rdev:         regulator source
 * @consumer_dev: device the supply applies to
 * @consumer_dev_name: dev_name() string for device supply applies to
@@ -1052,7 +1052,6 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
                        printk(KERN_WARNING
                               "%s: could not add device link %s err %d\n",
                               __func__, dev->kobj.name, err);
-                        device_remove_file(dev, &regulator->dev_attr);
                        goto link_name_err;
                }
        }
@@ -1268,13 +1267,17 @@ static int _regulator_enable(struct regulator_dev *rdev)
 {
        int ret, delay;
-        /* do we need to enable the supply regulator first */
+        if (rdev->use_count == 0) {
-        if (rdev->supply) {
+                /* do we need to enable the supply regulator first */
-                ret = _regulator_enable(rdev->supply);
+                if (rdev->supply) {
-                if (ret < 0) {
+                        mutex_lock(&rdev->supply->mutex);
-                        printk(KERN_ERR "%s: failed to enable %s: %d\n",
+                        ret = _regulator_enable(rdev->supply);
-                               __func__, rdev_get_name(rdev), ret);
+                        mutex_unlock(&rdev->supply->mutex);
-                        return ret;
+                        if (ret < 0) {
+                                printk(KERN_ERR "%s: failed to enable %s: %d\n",
+                                       __func__, rdev_get_name(rdev), ret);
+                                return ret;
+                        }
                }
        }
@@ -1313,10 +1316,12 @@ static int _regulator_enable(struct regulator_dev *rdev)
                        if (ret < 0)
                                return ret;
-                        if (delay >= 1000)
+                        if (delay >= 1000) {
                                mdelay(delay / 1000);
-                        else if (delay)
+                                udelay(delay % 1000);
+                        } else if (delay) {
                                udelay(delay);
+                        }
                } else if (ret < 0) {
                        printk(KERN_ERR "%s: is_enabled() failed for %s: %d\n",
@@ -1359,6 +1364,7 @@ static int _regulator_disable(struct regulator_dev *rdev,
                struct regulator_dev **supply_rdev_ptr)
 {
        int ret = 0;
+        *supply_rdev_ptr = NULL;
        if (WARN(rdev->use_count <= 0,
                        "unbalanced disables for %s\n",
@@ -2346,6 +2352,7 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
        if (init_data->supply_regulator && init_data->supply_regulator_dev) {
                dev_err(dev,
                        "Supply regulator specified by both name and dev\n");
+                ret = -EINVAL;
                goto scrub;
        }
@@ -2364,6 +2371,7 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
                if (!found) {
                        dev_err(dev, "Failed to find supply %s\n",
                                init_data->supply_regulator);
+                        ret = -ENODEV;
                        goto scrub;
                }
diff --git a/drivers/regulator/mc13783-regulator.c b/drivers/regulator/mc13783-regulator.c
index 4597d508a229..ecd99f59dba8 100644
--- a/drivers/regulator/mc13783-regulator.c
+++ b/drivers/regulator/mc13783-regulator.c
@@ -465,8 +465,8 @@ static struct regulator_ops mc13783_fixed_regulator_ops = {
        .get_voltage = mc13783_fixed_regulator_get_voltage,
 };
-int mc13783_powermisc_rmw(struct mc13783_regulator_priv *priv, u32 mask,
+static int mc13783_powermisc_rmw(struct mc13783_regulator_priv *priv, u32 mask,
-                                                                        u32 val)
+                                 u32 val)
 {
        struct mc13783 *mc13783 = priv->mc13783;
        int ret;
diff --git a/drivers/regulator/twl-regulator.c b/drivers/regulator/twl-regulator.c
index 7e5892efc437..a57262a4fa6c 100644
--- a/drivers/regulator/twl-regulator.c
+++ b/drivers/regulator/twl-regulator.c
@@ -219,12 +219,12 @@ static int twlreg_set_mode(struct regulator_dev *rdev, unsigned mode)
                return -EACCES;
        status = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
-                        message >> 8, 0x15 /* PB_WORD_MSB */ );
+                        message >> 8, TWL4030_PM_MASTER_PB_WORD_MSB);
-        if (status >= 0)
+        if (status < 0)
                return status;
        return twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
-                        message, 0x16 /* PB_WORD_LSB */ );
+                        message & 0xff, TWL4030_PM_MASTER_PB_WORD_LSB);
 }
 /*----------------------------------------------------------------------*/
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index a5050e217150..825951b6b83f 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -635,7 +635,7 @@ static void css_process_crw(struct crw *crw0, struct crw *crw1, int overflow)
        init_subchannel_id(&mchk_schid);
        mchk_schid.sch_no = crw0->rsid;
        if (crw1)
-                mchk_schid.ssid = (crw1->rsid >> 8) & 3;
+                mchk_schid.ssid = (crw1->rsid >> 4) & 3;
        /*
         * Since we are always presented with IPI in the CRW, we have to
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 752dbee06af5..5d9c66627b6e 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -292,8 +292,8 @@ void qdio_shutdown_thinint(struct qdio_irq *irq_ptr)
                return;
        /* reset adapter interrupt indicators */
-        put_indicator(irq_ptr->dsci);
        set_subchannel_ind(irq_ptr, 1);
+        put_indicator(irq_ptr->dsci);
 }
 void __exit tiqdio_unregister_thinints(void)
diff --git a/drivers/scsi/arm/fas216.h b/drivers/scsi/arm/fas216.h
index 377cfb72cc66..f30f8d659dc4 100644
--- a/drivers/scsi/arm/fas216.h
+++ b/drivers/scsi/arm/fas216.h
@@ -345,7 +345,7 @@ extern int fas216_queue_command(struct Scsi_Host *h, struct scsi_cmnd *SCpnt);
 *         : SCpnt - Command to queue
 * Returns : 0 - success, else error
 */
-extern int fas216_noqueue_command(struct Scsi_Host *, struct scsi_cmnd *)
+extern int fas216_noqueue_command(struct Scsi_Host *, struct scsi_cmnd *);
 /* Function: irqreturn_t fas216_intr (FAS216_Info *info)
 * Purpose : handle interrupts from the interface to progress a command
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 4d8e14b7aa93..09a550860dcf 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -2872,7 +2872,7 @@ static struct console serial8250_console = {
        .device         = uart_console_device,
        .setup          = serial8250_console_setup,
        .early_setup    = serial8250_console_early_setup,
-        .flags          = CON_PRINTBUFFER,
+        .flags          = CON_PRINTBUFFER | CON_ANYTIME,
        .index          = -1,
        .data           = &serial8250_reg,
 };
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index 5fc699e929dc..d40010a22ecd 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -900,8 +900,7 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
        unsigned char cval, fcr = 0;
        unsigned long flags;
        unsigned int baud, quot;
-        u32 mul = 0x3600;
+        u32 ps, mul;
-        u32 ps = 0x10;
        switch (termios->c_cflag & CSIZE) {
        case CS5:
@@ -943,31 +942,24 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
        baud = uart_get_baud_rate(port, termios, old, 0, 4000000);
        quot = 1;
+        ps = 0x10;
+        mul = 0x3600;
        switch (baud) {
        case 3500000:
                mul = 0x3345;
                ps = 0xC;
                break;
-        case 3000000:
-                mul = 0x2EE0;
-                break;
-        case 2500000:
-                mul = 0x2710;
-                break;
-        case 2000000:
-                mul = 0x1F40;
-                break;
        case 1843200:
                mul = 0x2400;
                break;
+        case 3000000:
+        case 2500000:
+        case 2000000:
        case 1500000:
-                mul = 0x1770;
-                break;
        case 1000000:
-                mul = 0xFA0;
-                break;
        case 500000:
-                mul = 0x7D0;
+                /* mul/ps/quot = 0x9C4/0x10/0x1 will make a 500000 bps */
+                mul = baud / 500000 * 0x9C4;
                break;
        default:
                /* Use uart_get_divisor to get quot for other baud rates */
diff --git a/drivers/sh/clk/core.c b/drivers/sh/clk/core.c
index cb12a8e1466b..3f5e387ed564 100644
--- a/drivers/sh/clk/core.c
+++ b/drivers/sh/clk/core.c
@@ -418,8 +418,11 @@ int clk_register(struct clk *clk)
                list_add(&clk->sibling, &root_clks);
        list_add(&clk->node, &clock_list);
+#ifdef CONFIG_SH_CLK_CPG_LEGACY
        if (clk->ops && clk->ops->init)
                clk->ops->init(clk);
+#endif
 out_unlock:
        mutex_unlock(&clock_list_sem);
@@ -455,19 +458,13 @@ EXPORT_SYMBOL_GPL(clk_get_rate);
 int clk_set_rate(struct clk *clk, unsigned long rate)
 {
-        return clk_set_rate_ex(clk, rate, 0);
-}
-EXPORT_SYMBOL_GPL(clk_set_rate);
-int clk_set_rate_ex(struct clk *clk, unsigned long rate, int algo_id)
-{
        int ret = -EOPNOTSUPP;
        unsigned long flags;
        spin_lock_irqsave(&clock_lock, flags);
        if (likely(clk->ops && clk->ops->set_rate)) {
-                ret = clk->ops->set_rate(clk, rate, algo_id);
+                ret = clk->ops->set_rate(clk, rate);
                if (ret != 0)
                        goto out_unlock;
        } else {
@@ -485,7 +482,7 @@ out_unlock:
        return ret;
 }
-EXPORT_SYMBOL_GPL(clk_set_rate_ex);
+EXPORT_SYMBOL_GPL(clk_set_rate);
 int clk_set_parent(struct clk *clk, struct clk *parent)
 {
@@ -653,8 +650,7 @@ static int clks_sysdev_suspend(struct sys_device *dev, pm_message_t state)
                                        clkp->ops->set_parent(clkp,
                                                clkp->parent);
                                if (likely(clkp->ops->set_rate))
-                                        clkp->ops->set_rate(clkp,
+                                        clkp->ops->set_rate(clkp, rate);
-                                                rate, NO_CHANGE);
                                else if (likely(clkp->ops->recalc))
                                        clkp->rate = clkp->ops->recalc(clkp);
                        }
diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c
index 3aea5f0ceb09..6172335ae323 100644
--- a/drivers/sh/clk/cpg.c
+++ b/drivers/sh/clk/cpg.c
@@ -110,8 +110,7 @@ static int sh_clk_div6_set_parent(struct clk *clk, struct clk *parent)
        return 0;
 }
-static int sh_clk_div6_set_rate(struct clk *clk,
+static int sh_clk_div6_set_rate(struct clk *clk, unsigned long rate)
-                                unsigned long rate, int algo_id)
 {
        unsigned long value;
        int idx;
@@ -132,7 +131,7 @@ static int sh_clk_div6_enable(struct clk *clk)
        unsigned long value;
        int ret;
-        ret = sh_clk_div6_set_rate(clk, clk->rate, 0);
+        ret = sh_clk_div6_set_rate(clk, clk->rate);
        if (ret == 0) {
                value = __raw_readl(clk->enable_reg);
                value &= ~0x100; /* clear stop bit to enable clock */
@@ -253,7 +252,7 @@ static int sh_clk_div4_set_parent(struct clk *clk, struct clk *parent)
        return 0;
 }
-static int sh_clk_div4_set_rate(struct clk *clk, unsigned long rate, int algo_id)
+static int sh_clk_div4_set_rate(struct clk *clk, unsigned long rate)
 {
        struct clk_div4_table *d4t = clk->priv;
        unsigned long value;
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index 154529aacc03..a067046c9da2 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -352,8 +352,12 @@ atmel_spi_dma_map_xfer(struct atmel_spi *as, struct spi_transfer *xfer)
        xfer->tx_dma = xfer->rx_dma = INVALID_DMA_ADDRESS;
        if (xfer->tx_buf) {
+                /* tx_buf is a const void* where we need a void * for the dma
+                 * mapping */
+                void *nonconst_tx = (void *)xfer->tx_buf;
                xfer->tx_dma = dma_map_single(dev,
-                                (void *) xfer->tx_buf, xfer->len,
+                                nonconst_tx, xfer->len,
                                DMA_TO_DEVICE);
                if (dma_mapping_error(dev, xfer->tx_dma))
                        return -ENOMEM;
diff --git a/drivers/ssb/b43_pci_bridge.c b/drivers/ssb/b43_pci_bridge.c
index ef9c6a04ad8f..744d3f6e4709 100644
--- a/drivers/ssb/b43_pci_bridge.c
+++ b/drivers/ssb/b43_pci_bridge.c
@@ -24,6 +24,7 @@ static const struct pci_device_id b43_pci_bridge_tbl[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4315) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BCM_GVC,  0x4318) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
diff --git a/drivers/staging/asus_oled/asus_oled.c b/drivers/staging/asus_oled/asus_oled.c
index 8c95d8c2a4f4..016c6f7f8630 100644
--- a/drivers/staging/asus_oled/asus_oled.c
+++ b/drivers/staging/asus_oled/asus_oled.c
@@ -620,13 +620,13 @@ static ssize_t class_set_picture(struct device *device,
 #define ASUS_OLED_DEVICE_ATTR(_file)            dev_attr_asus_oled_##_file
-static DEVICE_ATTR(asus_oled_enabled, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(asus_oled_enabled, S_IWUSR | S_IRUGO,
                   get_enabled, set_enabled);
-static DEVICE_ATTR(asus_oled_picture, S_IWUGO , NULL, set_picture);
+static DEVICE_ATTR(asus_oled_picture, S_IWUSR , NULL, set_picture);
-static DEVICE_ATTR(enabled, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(enabled, S_IWUSR | S_IRUGO,
                   class_get_enabled, class_set_enabled);
-static DEVICE_ATTR(picture, S_IWUGO, NULL, class_set_picture);
+static DEVICE_ATTR(picture, S_IWUSR, NULL, class_set_picture);
 static int asus_oled_probe(struct usb_interface *interface,
                           const struct usb_device_id *id)
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index b68a7e5173be..d85de82f941a 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -463,9 +463,6 @@ static void hardif_remove_interface(struct batman_if *batman_if)
                return;
        batman_if->if_status = IF_TO_BE_REMOVED;
-        /* caller must take if_list_lock */
-        list_del_rcu(&batman_if->list);
        synchronize_rcu();
        sysfs_del_hardif(&batman_if->hardif_obj);
        hardif_put(batman_if);
@@ -474,13 +471,21 @@ static void hardif_remove_interface(struct batman_if *batman_if)
 void hardif_remove_interfaces(void)
 {
        struct batman_if *batman_if, *batman_if_tmp;
+        struct list_head if_queue;
+        INIT_LIST_HEAD(&if_queue);
-        rtnl_lock();
        spin_lock(&if_list_lock);
        list_for_each_entry_safe(batman_if, batman_if_tmp, &if_list, list) {
-                hardif_remove_interface(batman_if);
+                list_del_rcu(&batman_if->list);
+                list_add_tail(&batman_if->list, &if_queue);
        }
        spin_unlock(&if_list_lock);
+        rtnl_lock();
+        list_for_each_entry_safe(batman_if, batman_if_tmp, &if_queue, list) {
+                hardif_remove_interface(batman_if);
+        }
        rtnl_unlock();
 }
@@ -507,8 +512,10 @@ static int hard_if_event(struct notifier_block *this,
                break;
        case NETDEV_UNREGISTER:
                spin_lock(&if_list_lock);
-                hardif_remove_interface(batman_if);
+                list_del_rcu(&batman_if->list);
                spin_unlock(&if_list_lock);
+                hardif_remove_interface(batman_if);
                break;
        case NETDEV_CHANGEMTU:
                if (batman_if->soft_iface)
diff --git a/drivers/staging/batman-adv/soft-interface.c b/drivers/staging/batman-adv/soft-interface.c
index 3904db9ce7b1..0e996181daf7 100644
--- a/drivers/staging/batman-adv/soft-interface.c
+++ b/drivers/staging/batman-adv/soft-interface.c
@@ -194,14 +194,15 @@ void interface_rx(struct net_device *soft_iface,
        struct bat_priv *priv = netdev_priv(soft_iface);
        /* check if enough space is available for pulling, and pull */
-        if (!pskb_may_pull(skb, hdr_size)) {
+        if (!pskb_may_pull(skb, hdr_size))
-                kfree_skb(skb);
+                goto dropped;
-                return;
-        }
        skb_pull_rcsum(skb, hdr_size);
 /*      skb_set_mac_header(skb, -sizeof(struct ethhdr));*/
        /* skb->dev & skb->pkt_type are set here */
+        if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+                goto dropped;
        skb->protocol = eth_type_trans(skb, soft_iface);
        /* should not be neccesary anymore as we use skb_pull_rcsum()
@@ -216,6 +217,11 @@ void interface_rx(struct net_device *soft_iface,
        soft_iface->last_rx = jiffies;
        netif_rx(skb);
+        return;
+dropped:
+        kfree_skb(skb);
+        return;
 }
 #ifdef HAVE_NET_DEVICE_OPS
diff --git a/drivers/staging/brcm80211/README b/drivers/staging/brcm80211/README
index c8f1cf1b4409..a27bb0b4f581 100644
--- a/drivers/staging/brcm80211/README
+++ b/drivers/staging/brcm80211/README
@@ -88,7 +88,9 @@ with the driver.
 Contact Info:
 =============
-Brett Rudley    brudley@broadcom.com
+Brett Rudley            brudley@broadcom.com
-Henry Ptasinski henryp@broadcom.com
+Henry Ptasinski         henryp@broadcom.com
-Dowan Kim       dowan@broadcom.com
+Dowan Kim                       dowan@broadcom.com
+Roland Vossen           rvossen@broadcom.com
+Arend van Spriel        arend@broadcom.com
diff --git a/drivers/staging/brcm80211/TODO b/drivers/staging/brcm80211/TODO
index dbf904184899..24ebadbe4241 100644
--- a/drivers/staging/brcm80211/TODO
+++ b/drivers/staging/brcm80211/TODO
@@ -46,4 +46,6 @@ Contact
 Brett Rudley <brudley@broadcom.com>
 Henry Ptasinski <henryp@broadcom.com>
 Dowan Kim <dowan@broadcom.com>
+Roland Vossen <rvossen@broadcom.com>
+Arend van Spriel <arend@broadcom.com>
diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index 1f177a67ff11..de784ff08caa 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -2295,8 +2295,8 @@ static void tidy_up(struct usbduxsub *usbduxsub_tmp)
        usbduxsub_tmp->inBuffer = NULL;
        kfree(usbduxsub_tmp->insnBuffer);
        usbduxsub_tmp->insnBuffer = NULL;
-        kfree(usbduxsub_tmp->inBuffer);
+        kfree(usbduxsub_tmp->outBuffer);
-        usbduxsub_tmp->inBuffer = NULL;
+        usbduxsub_tmp->outBuffer = NULL;
        kfree(usbduxsub_tmp->dac_commands);
        usbduxsub_tmp->dac_commands = NULL;
        kfree(usbduxsub_tmp->dux_commands);
diff --git a/drivers/staging/easycap/easycap.h b/drivers/staging/easycap/easycap.h
index 25961c23dc0f..884263b2775d 100644
--- a/drivers/staging/easycap/easycap.h
+++ b/drivers/staging/easycap/easycap.h
@@ -75,6 +75,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/module.h>
 #include <linux/kref.h>
 #include <linux/usb.h>
diff --git a/drivers/staging/frontier/tranzport.c b/drivers/staging/frontier/tranzport.c
index a145a15cfdb3..8894ab14f167 100644
--- a/drivers/staging/frontier/tranzport.c
+++ b/drivers/staging/frontier/tranzport.c
@@ -204,7 +204,7 @@ static void usb_tranzport_abort_transfers(struct usb_tranzport *dev)
                t->value = temp;        \
                return count;   \
        }       \
-        static DEVICE_ATTR(value, S_IWUGO | S_IRUGO, show_##value, set_##value);
+        static DEVICE_ATTR(value, S_IWUSR | S_IRUGO, show_##value, set_##value);
 show_int(enable);
 show_int(offline);
diff --git a/drivers/staging/go7007/go7007-driver.c b/drivers/staging/go7007/go7007-driver.c
index b3f42f37a313..48d4e483d8a4 100644
--- a/drivers/staging/go7007/go7007-driver.c
+++ b/drivers/staging/go7007/go7007-driver.c
@@ -199,7 +199,7 @@ static int init_i2c_module(struct i2c_adapter *adapter, const char *type,
        struct go7007 *go = i2c_get_adapdata(adapter);
        struct v4l2_device *v4l2_dev = &go->v4l2_dev;
-        if (v4l2_i2c_new_subdev(v4l2_dev, adapter, NULL, type, addr, NULL))
+        if (v4l2_i2c_new_subdev(v4l2_dev, adapter, type, addr, NULL))
                return 0;
        printk(KERN_INFO "go7007: probing for module i2c:%s failed\n", type);
diff --git a/drivers/staging/iio/accel/adis16220_core.c b/drivers/staging/iio/accel/adis16220_core.c
index c86d1498737d..1c1e98aee2d9 100644
--- a/drivers/staging/iio/accel/adis16220_core.c
+++ b/drivers/staging/iio/accel/adis16220_core.c
@@ -507,7 +507,7 @@ static IIO_DEVICE_ATTR(reset, S_IWUSR, NULL,
                adis16220_write_reset, 0);
 #define IIO_DEV_ATTR_CAPTURE(_store)                            \
-        IIO_DEVICE_ATTR(capture, S_IWUGO, NULL, _store, 0)
+        IIO_DEVICE_ATTR(capture, S_IWUSR, NULL, _store, 0)
 static IIO_DEV_ATTR_CAPTURE(adis16220_write_capture);
diff --git a/drivers/staging/intel_sst/intel_sst_stream_encoded.c b/drivers/staging/intel_sst/intel_sst_stream_encoded.c
index fbae39fda5c0..5c455608b024 100644
--- a/drivers/staging/intel_sst/intel_sst_stream_encoded.c
+++ b/drivers/staging/intel_sst/intel_sst_stream_encoded.c
@@ -1269,7 +1269,7 @@ finish:
        dbufs->output_bytes_produced = total_output;
        str_info->status = str_info->prev;
        str_info->prev = STREAM_DECODE;
-        str_info->decode_ibuf = NULL;
        kfree(str_info->decode_ibuf);
+        str_info->decode_ibuf = NULL;
        return retval;
 }
diff --git a/drivers/staging/line6/control.c b/drivers/staging/line6/control.c
index 040e25ca6d33..67e23b6e2d35 100644
--- a/drivers/staging/line6/control.c
+++ b/drivers/staging/line6/control.c
@@ -266,210 +266,210 @@ VARIAX_PARAM_R(float, mix2);
 VARIAX_PARAM_R(float, mix1);
 VARIAX_PARAM_R(int, pickup_wiring);
-static DEVICE_ATTR(tweak, S_IWUGO | S_IRUGO, pod_get_tweak, pod_set_tweak);
+static DEVICE_ATTR(tweak, S_IWUSR | S_IRUGO, pod_get_tweak, pod_set_tweak);
-static DEVICE_ATTR(wah_position, S_IWUGO | S_IRUGO, pod_get_wah_position,
+static DEVICE_ATTR(wah_position, S_IWUSR | S_IRUGO, pod_get_wah_position,
                   pod_set_wah_position);
-static DEVICE_ATTR(compression_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(compression_gain, S_IWUSR | S_IRUGO,
                   pod_get_compression_gain, pod_set_compression_gain);
-static DEVICE_ATTR(vol_pedal_position, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(vol_pedal_position, S_IWUSR | S_IRUGO,
                   pod_get_vol_pedal_position, pod_set_vol_pedal_position);
-static DEVICE_ATTR(compression_threshold, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(compression_threshold, S_IWUSR | S_IRUGO,
                   pod_get_compression_threshold,
                   pod_set_compression_threshold);
-static DEVICE_ATTR(pan, S_IWUGO | S_IRUGO, pod_get_pan, pod_set_pan);
+static DEVICE_ATTR(pan, S_IWUSR | S_IRUGO, pod_get_pan, pod_set_pan);
-static DEVICE_ATTR(amp_model_setup, S_IWUGO | S_IRUGO, pod_get_amp_model_setup,
+static DEVICE_ATTR(amp_model_setup, S_IWUSR | S_IRUGO, pod_get_amp_model_setup,
                   pod_set_amp_model_setup);
-static DEVICE_ATTR(amp_model, S_IWUGO | S_IRUGO, pod_get_amp_model,
+static DEVICE_ATTR(amp_model, S_IWUSR | S_IRUGO, pod_get_amp_model,
                   pod_set_amp_model);
-static DEVICE_ATTR(drive, S_IWUGO | S_IRUGO, pod_get_drive, pod_set_drive);
+static DEVICE_ATTR(drive, S_IWUSR | S_IRUGO, pod_get_drive, pod_set_drive);
-static DEVICE_ATTR(bass, S_IWUGO | S_IRUGO, pod_get_bass, pod_set_bass);
+static DEVICE_ATTR(bass, S_IWUSR | S_IRUGO, pod_get_bass, pod_set_bass);
-static DEVICE_ATTR(mid, S_IWUGO | S_IRUGO, pod_get_mid, pod_set_mid);
+static DEVICE_ATTR(mid, S_IWUSR | S_IRUGO, pod_get_mid, pod_set_mid);
-static DEVICE_ATTR(lowmid, S_IWUGO | S_IRUGO, pod_get_lowmid, pod_set_lowmid);
+static DEVICE_ATTR(lowmid, S_IWUSR | S_IRUGO, pod_get_lowmid, pod_set_lowmid);
-static DEVICE_ATTR(treble, S_IWUGO | S_IRUGO, pod_get_treble, pod_set_treble);
+static DEVICE_ATTR(treble, S_IWUSR | S_IRUGO, pod_get_treble, pod_set_treble);
-static DEVICE_ATTR(highmid, S_IWUGO | S_IRUGO, pod_get_highmid,
+static DEVICE_ATTR(highmid, S_IWUSR | S_IRUGO, pod_get_highmid,
                   pod_set_highmid);
-static DEVICE_ATTR(chan_vol, S_IWUGO | S_IRUGO, pod_get_chan_vol,
+static DEVICE_ATTR(chan_vol, S_IWUSR | S_IRUGO, pod_get_chan_vol,
                   pod_set_chan_vol);
-static DEVICE_ATTR(reverb_mix, S_IWUGO | S_IRUGO, pod_get_reverb_mix,
+static DEVICE_ATTR(reverb_mix, S_IWUSR | S_IRUGO, pod_get_reverb_mix,
                   pod_set_reverb_mix);
-static DEVICE_ATTR(effect_setup, S_IWUGO | S_IRUGO, pod_get_effect_setup,
+static DEVICE_ATTR(effect_setup, S_IWUSR | S_IRUGO, pod_get_effect_setup,
                   pod_set_effect_setup);
-static DEVICE_ATTR(band_1_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_1_frequency, S_IWUSR | S_IRUGO,
                   pod_get_band_1_frequency, pod_set_band_1_frequency);
-static DEVICE_ATTR(presence, S_IWUGO | S_IRUGO, pod_get_presence,
+static DEVICE_ATTR(presence, S_IWUSR | S_IRUGO, pod_get_presence,
                   pod_set_presence);
-static DEVICE_ATTR2(treble__bass, treble, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(treble__bass, treble, S_IWUSR | S_IRUGO,
                    pod_get_treble__bass, pod_set_treble__bass);
-static DEVICE_ATTR(noise_gate_enable, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(noise_gate_enable, S_IWUSR | S_IRUGO,
                   pod_get_noise_gate_enable, pod_set_noise_gate_enable);
-static DEVICE_ATTR(gate_threshold, S_IWUGO | S_IRUGO, pod_get_gate_threshold,
+static DEVICE_ATTR(gate_threshold, S_IWUSR | S_IRUGO, pod_get_gate_threshold,
                   pod_set_gate_threshold);
-static DEVICE_ATTR(gate_decay_time, S_IWUGO | S_IRUGO, pod_get_gate_decay_time,
+static DEVICE_ATTR(gate_decay_time, S_IWUSR | S_IRUGO, pod_get_gate_decay_time,
                   pod_set_gate_decay_time);
-static DEVICE_ATTR(stomp_enable, S_IWUGO | S_IRUGO, pod_get_stomp_enable,
+static DEVICE_ATTR(stomp_enable, S_IWUSR | S_IRUGO, pod_get_stomp_enable,
                   pod_set_stomp_enable);
-static DEVICE_ATTR(comp_enable, S_IWUGO | S_IRUGO, pod_get_comp_enable,
+static DEVICE_ATTR(comp_enable, S_IWUSR | S_IRUGO, pod_get_comp_enable,
                   pod_set_comp_enable);
-static DEVICE_ATTR(stomp_time, S_IWUGO | S_IRUGO, pod_get_stomp_time,
+static DEVICE_ATTR(stomp_time, S_IWUSR | S_IRUGO, pod_get_stomp_time,
                   pod_set_stomp_time);
-static DEVICE_ATTR(delay_enable, S_IWUGO | S_IRUGO, pod_get_delay_enable,
+static DEVICE_ATTR(delay_enable, S_IWUSR | S_IRUGO, pod_get_delay_enable,
                   pod_set_delay_enable);
-static DEVICE_ATTR(mod_param_1, S_IWUGO | S_IRUGO, pod_get_mod_param_1,
+static DEVICE_ATTR(mod_param_1, S_IWUSR | S_IRUGO, pod_get_mod_param_1,
                   pod_set_mod_param_1);
-static DEVICE_ATTR(delay_param_1, S_IWUGO | S_IRUGO, pod_get_delay_param_1,
+static DEVICE_ATTR(delay_param_1, S_IWUSR | S_IRUGO, pod_get_delay_param_1,
                   pod_set_delay_param_1);
-static DEVICE_ATTR(delay_param_1_note_value, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_param_1_note_value, S_IWUSR | S_IRUGO,
                   pod_get_delay_param_1_note_value,
                   pod_set_delay_param_1_note_value);
-static DEVICE_ATTR2(band_2_frequency__bass, band_2_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_2_frequency__bass, band_2_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_2_frequency__bass,
                    pod_set_band_2_frequency__bass);
-static DEVICE_ATTR(delay_param_2, S_IWUGO | S_IRUGO, pod_get_delay_param_2,
+static DEVICE_ATTR(delay_param_2, S_IWUSR | S_IRUGO, pod_get_delay_param_2,
                   pod_set_delay_param_2);
-static DEVICE_ATTR(delay_volume_mix, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_volume_mix, S_IWUSR | S_IRUGO,
                   pod_get_delay_volume_mix, pod_set_delay_volume_mix);
-static DEVICE_ATTR(delay_param_3, S_IWUGO | S_IRUGO, pod_get_delay_param_3,
+static DEVICE_ATTR(delay_param_3, S_IWUSR | S_IRUGO, pod_get_delay_param_3,
                   pod_set_delay_param_3);
-static DEVICE_ATTR(reverb_enable, S_IWUGO | S_IRUGO, pod_get_reverb_enable,
+static DEVICE_ATTR(reverb_enable, S_IWUSR | S_IRUGO, pod_get_reverb_enable,
                   pod_set_reverb_enable);
-static DEVICE_ATTR(reverb_type, S_IWUGO | S_IRUGO, pod_get_reverb_type,
+static DEVICE_ATTR(reverb_type, S_IWUSR | S_IRUGO, pod_get_reverb_type,
                   pod_set_reverb_type);
-static DEVICE_ATTR(reverb_decay, S_IWUGO | S_IRUGO, pod_get_reverb_decay,
+static DEVICE_ATTR(reverb_decay, S_IWUSR | S_IRUGO, pod_get_reverb_decay,
                   pod_set_reverb_decay);
-static DEVICE_ATTR(reverb_tone, S_IWUGO | S_IRUGO, pod_get_reverb_tone,
+static DEVICE_ATTR(reverb_tone, S_IWUSR | S_IRUGO, pod_get_reverb_tone,
                   pod_set_reverb_tone);
-static DEVICE_ATTR(reverb_pre_delay, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(reverb_pre_delay, S_IWUSR | S_IRUGO,
                   pod_get_reverb_pre_delay, pod_set_reverb_pre_delay);
-static DEVICE_ATTR(reverb_pre_post, S_IWUGO | S_IRUGO, pod_get_reverb_pre_post,
+static DEVICE_ATTR(reverb_pre_post, S_IWUSR | S_IRUGO, pod_get_reverb_pre_post,
                   pod_set_reverb_pre_post);
-static DEVICE_ATTR(band_2_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_2_frequency, S_IWUSR | S_IRUGO,
                   pod_get_band_2_frequency, pod_set_band_2_frequency);
-static DEVICE_ATTR2(band_3_frequency__bass, band_3_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_3_frequency__bass, band_3_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_3_frequency__bass,
                    pod_set_band_3_frequency__bass);
-static DEVICE_ATTR(wah_enable, S_IWUGO | S_IRUGO, pod_get_wah_enable,
+static DEVICE_ATTR(wah_enable, S_IWUSR | S_IRUGO, pod_get_wah_enable,
                   pod_set_wah_enable);
-static DEVICE_ATTR(modulation_lo_cut, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(modulation_lo_cut, S_IWUSR | S_IRUGO,
                   pod_get_modulation_lo_cut, pod_set_modulation_lo_cut);
-static DEVICE_ATTR(delay_reverb_lo_cut, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_reverb_lo_cut, S_IWUSR | S_IRUGO,
                   pod_get_delay_reverb_lo_cut, pod_set_delay_reverb_lo_cut);
-static DEVICE_ATTR(volume_pedal_minimum, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(volume_pedal_minimum, S_IWUSR | S_IRUGO,
                   pod_get_volume_pedal_minimum, pod_set_volume_pedal_minimum);
-static DEVICE_ATTR(eq_pre_post, S_IWUGO | S_IRUGO, pod_get_eq_pre_post,
+static DEVICE_ATTR(eq_pre_post, S_IWUSR | S_IRUGO, pod_get_eq_pre_post,
                   pod_set_eq_pre_post);
-static DEVICE_ATTR(volume_pre_post, S_IWUGO | S_IRUGO, pod_get_volume_pre_post,
+static DEVICE_ATTR(volume_pre_post, S_IWUSR | S_IRUGO, pod_get_volume_pre_post,
                   pod_set_volume_pre_post);
-static DEVICE_ATTR(di_model, S_IWUGO | S_IRUGO, pod_get_di_model,
+static DEVICE_ATTR(di_model, S_IWUSR | S_IRUGO, pod_get_di_model,
                   pod_set_di_model);
-static DEVICE_ATTR(di_delay, S_IWUGO | S_IRUGO, pod_get_di_delay,
+static DEVICE_ATTR(di_delay, S_IWUSR | S_IRUGO, pod_get_di_delay,
                   pod_set_di_delay);
-static DEVICE_ATTR(mod_enable, S_IWUGO | S_IRUGO, pod_get_mod_enable,
+static DEVICE_ATTR(mod_enable, S_IWUSR | S_IRUGO, pod_get_mod_enable,
                   pod_set_mod_enable);
-static DEVICE_ATTR(mod_param_1_note_value, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(mod_param_1_note_value, S_IWUSR | S_IRUGO,
                   pod_get_mod_param_1_note_value,
                   pod_set_mod_param_1_note_value);
-static DEVICE_ATTR(mod_param_2, S_IWUGO | S_IRUGO, pod_get_mod_param_2,
+static DEVICE_ATTR(mod_param_2, S_IWUSR | S_IRUGO, pod_get_mod_param_2,
                   pod_set_mod_param_2);
-static DEVICE_ATTR(mod_param_3, S_IWUGO | S_IRUGO, pod_get_mod_param_3,
+static DEVICE_ATTR(mod_param_3, S_IWUSR | S_IRUGO, pod_get_mod_param_3,
                   pod_set_mod_param_3);
-static DEVICE_ATTR(mod_param_4, S_IWUGO | S_IRUGO, pod_get_mod_param_4,
+static DEVICE_ATTR(mod_param_4, S_IWUSR | S_IRUGO, pod_get_mod_param_4,
                   pod_set_mod_param_4);
-static DEVICE_ATTR(mod_param_5, S_IWUGO | S_IRUGO, pod_get_mod_param_5,
+static DEVICE_ATTR(mod_param_5, S_IWUSR | S_IRUGO, pod_get_mod_param_5,
                   pod_set_mod_param_5);
-static DEVICE_ATTR(mod_volume_mix, S_IWUGO | S_IRUGO, pod_get_mod_volume_mix,
+static DEVICE_ATTR(mod_volume_mix, S_IWUSR | S_IRUGO, pod_get_mod_volume_mix,
                   pod_set_mod_volume_mix);
-static DEVICE_ATTR(mod_pre_post, S_IWUGO | S_IRUGO, pod_get_mod_pre_post,
+static DEVICE_ATTR(mod_pre_post, S_IWUSR | S_IRUGO, pod_get_mod_pre_post,
                   pod_set_mod_pre_post);
-static DEVICE_ATTR(modulation_model, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(modulation_model, S_IWUSR | S_IRUGO,
                   pod_get_modulation_model, pod_set_modulation_model);
-static DEVICE_ATTR(band_3_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_3_frequency, S_IWUSR | S_IRUGO,
                   pod_get_band_3_frequency, pod_set_band_3_frequency);
-static DEVICE_ATTR2(band_4_frequency__bass, band_4_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_4_frequency__bass, band_4_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_4_frequency__bass,
                    pod_set_band_4_frequency__bass);
-static DEVICE_ATTR(mod_param_1_double_precision, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(mod_param_1_double_precision, S_IWUSR | S_IRUGO,
                   pod_get_mod_param_1_double_precision,
                   pod_set_mod_param_1_double_precision);
-static DEVICE_ATTR(delay_param_1_double_precision, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_param_1_double_precision, S_IWUSR | S_IRUGO,
                   pod_get_delay_param_1_double_precision,
                   pod_set_delay_param_1_double_precision);
-static DEVICE_ATTR(eq_enable, S_IWUGO | S_IRUGO, pod_get_eq_enable,
+static DEVICE_ATTR(eq_enable, S_IWUSR | S_IRUGO, pod_get_eq_enable,
                   pod_set_eq_enable);
-static DEVICE_ATTR(tap, S_IWUGO | S_IRUGO, pod_get_tap, pod_set_tap);
+static DEVICE_ATTR(tap, S_IWUSR | S_IRUGO, pod_get_tap, pod_set_tap);
-static DEVICE_ATTR(volume_tweak_pedal_assign, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(volume_tweak_pedal_assign, S_IWUSR | S_IRUGO,
                   pod_get_volume_tweak_pedal_assign,
                   pod_set_volume_tweak_pedal_assign);
-static DEVICE_ATTR(band_5_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_5_frequency, S_IWUSR | S_IRUGO,
                   pod_get_band_5_frequency, pod_set_band_5_frequency);
-static DEVICE_ATTR(tuner, S_IWUGO | S_IRUGO, pod_get_tuner, pod_set_tuner);
+static DEVICE_ATTR(tuner, S_IWUSR | S_IRUGO, pod_get_tuner, pod_set_tuner);
-static DEVICE_ATTR(mic_selection, S_IWUGO | S_IRUGO, pod_get_mic_selection,
+static DEVICE_ATTR(mic_selection, S_IWUSR | S_IRUGO, pod_get_mic_selection,
                   pod_set_mic_selection);
-static DEVICE_ATTR(cabinet_model, S_IWUGO | S_IRUGO, pod_get_cabinet_model,
+static DEVICE_ATTR(cabinet_model, S_IWUSR | S_IRUGO, pod_get_cabinet_model,
                   pod_set_cabinet_model);
-static DEVICE_ATTR(stomp_model, S_IWUGO | S_IRUGO, pod_get_stomp_model,
+static DEVICE_ATTR(stomp_model, S_IWUSR | S_IRUGO, pod_get_stomp_model,
                   pod_set_stomp_model);
-static DEVICE_ATTR(roomlevel, S_IWUGO | S_IRUGO, pod_get_roomlevel,
+static DEVICE_ATTR(roomlevel, S_IWUSR | S_IRUGO, pod_get_roomlevel,
                   pod_set_roomlevel);
-static DEVICE_ATTR(band_4_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_4_frequency, S_IWUSR | S_IRUGO,
                   pod_get_band_4_frequency, pod_set_band_4_frequency);
-static DEVICE_ATTR(band_6_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_6_frequency, S_IWUSR | S_IRUGO,
                   pod_get_band_6_frequency, pod_set_band_6_frequency);
-static DEVICE_ATTR(stomp_param_1_note_value, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(stomp_param_1_note_value, S_IWUSR | S_IRUGO,
                   pod_get_stomp_param_1_note_value,
                   pod_set_stomp_param_1_note_value);
-static DEVICE_ATTR(stomp_param_2, S_IWUGO | S_IRUGO, pod_get_stomp_param_2,
+static DEVICE_ATTR(stomp_param_2, S_IWUSR | S_IRUGO, pod_get_stomp_param_2,
                   pod_set_stomp_param_2);
-static DEVICE_ATTR(stomp_param_3, S_IWUGO | S_IRUGO, pod_get_stomp_param_3,
+static DEVICE_ATTR(stomp_param_3, S_IWUSR | S_IRUGO, pod_get_stomp_param_3,
                   pod_set_stomp_param_3);
-static DEVICE_ATTR(stomp_param_4, S_IWUGO | S_IRUGO, pod_get_stomp_param_4,
+static DEVICE_ATTR(stomp_param_4, S_IWUSR | S_IRUGO, pod_get_stomp_param_4,
                   pod_set_stomp_param_4);
-static DEVICE_ATTR(stomp_param_5, S_IWUGO | S_IRUGO, pod_get_stomp_param_5,
+static DEVICE_ATTR(stomp_param_5, S_IWUSR | S_IRUGO, pod_get_stomp_param_5,
                   pod_set_stomp_param_5);
-static DEVICE_ATTR(stomp_param_6, S_IWUGO | S_IRUGO, pod_get_stomp_param_6,
+static DEVICE_ATTR(stomp_param_6, S_IWUSR | S_IRUGO, pod_get_stomp_param_6,
                   pod_set_stomp_param_6);
-static DEVICE_ATTR(amp_switch_select, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(amp_switch_select, S_IWUSR | S_IRUGO,
                   pod_get_amp_switch_select, pod_set_amp_switch_select);
-static DEVICE_ATTR(delay_param_4, S_IWUGO | S_IRUGO, pod_get_delay_param_4,
+static DEVICE_ATTR(delay_param_4, S_IWUSR | S_IRUGO, pod_get_delay_param_4,
                   pod_set_delay_param_4);
-static DEVICE_ATTR(delay_param_5, S_IWUGO | S_IRUGO, pod_get_delay_param_5,
+static DEVICE_ATTR(delay_param_5, S_IWUSR | S_IRUGO, pod_get_delay_param_5,
                   pod_set_delay_param_5);
-static DEVICE_ATTR(delay_pre_post, S_IWUGO | S_IRUGO, pod_get_delay_pre_post,
+static DEVICE_ATTR(delay_pre_post, S_IWUSR | S_IRUGO, pod_get_delay_pre_post,
                   pod_set_delay_pre_post);
-static DEVICE_ATTR(delay_model, S_IWUGO | S_IRUGO, pod_get_delay_model,
+static DEVICE_ATTR(delay_model, S_IWUSR | S_IRUGO, pod_get_delay_model,
                   pod_set_delay_model);
-static DEVICE_ATTR(delay_verb_model, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_verb_model, S_IWUSR | S_IRUGO,
                   pod_get_delay_verb_model, pod_set_delay_verb_model);
-static DEVICE_ATTR(tempo_msb, S_IWUGO | S_IRUGO, pod_get_tempo_msb,
+static DEVICE_ATTR(tempo_msb, S_IWUSR | S_IRUGO, pod_get_tempo_msb,
                   pod_set_tempo_msb);
-static DEVICE_ATTR(tempo_lsb, S_IWUGO | S_IRUGO, pod_get_tempo_lsb,
+static DEVICE_ATTR(tempo_lsb, S_IWUSR | S_IRUGO, pod_get_tempo_lsb,
                   pod_set_tempo_lsb);
-static DEVICE_ATTR(wah_model, S_IWUGO | S_IRUGO, pod_get_wah_model,
+static DEVICE_ATTR(wah_model, S_IWUSR | S_IRUGO, pod_get_wah_model,
                   pod_set_wah_model);
-static DEVICE_ATTR(bypass_volume, S_IWUGO | S_IRUGO, pod_get_bypass_volume,
+static DEVICE_ATTR(bypass_volume, S_IWUSR | S_IRUGO, pod_get_bypass_volume,
                   pod_set_bypass_volume);
-static DEVICE_ATTR(fx_loop_on_off, S_IWUGO | S_IRUGO, pod_get_fx_loop_on_off,
+static DEVICE_ATTR(fx_loop_on_off, S_IWUSR | S_IRUGO, pod_get_fx_loop_on_off,
                   pod_set_fx_loop_on_off);
-static DEVICE_ATTR(tweak_param_select, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(tweak_param_select, S_IWUSR | S_IRUGO,
                   pod_get_tweak_param_select, pod_set_tweak_param_select);
-static DEVICE_ATTR(amp1_engage, S_IWUGO | S_IRUGO, pod_get_amp1_engage,
+static DEVICE_ATTR(amp1_engage, S_IWUSR | S_IRUGO, pod_get_amp1_engage,
                   pod_set_amp1_engage);
-static DEVICE_ATTR(band_1_gain, S_IWUGO | S_IRUGO, pod_get_band_1_gain,
+static DEVICE_ATTR(band_1_gain, S_IWUSR | S_IRUGO, pod_get_band_1_gain,
                   pod_set_band_1_gain);
-static DEVICE_ATTR2(band_2_gain__bass, band_2_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_2_gain__bass, band_2_gain, S_IWUSR | S_IRUGO,
                    pod_get_band_2_gain__bass, pod_set_band_2_gain__bass);
-static DEVICE_ATTR(band_2_gain, S_IWUGO | S_IRUGO, pod_get_band_2_gain,
+static DEVICE_ATTR(band_2_gain, S_IWUSR | S_IRUGO, pod_get_band_2_gain,
                   pod_set_band_2_gain);
-static DEVICE_ATTR2(band_3_gain__bass, band_3_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_3_gain__bass, band_3_gain, S_IWUSR | S_IRUGO,
                    pod_get_band_3_gain__bass, pod_set_band_3_gain__bass);
-static DEVICE_ATTR(band_3_gain, S_IWUGO | S_IRUGO, pod_get_band_3_gain,
+static DEVICE_ATTR(band_3_gain, S_IWUSR | S_IRUGO, pod_get_band_3_gain,
                   pod_set_band_3_gain);
-static DEVICE_ATTR2(band_4_gain__bass, band_4_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_4_gain__bass, band_4_gain, S_IWUSR | S_IRUGO,
                    pod_get_band_4_gain__bass, pod_set_band_4_gain__bass);
-static DEVICE_ATTR2(band_5_gain__bass, band_5_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_5_gain__bass, band_5_gain, S_IWUSR | S_IRUGO,
                    pod_get_band_5_gain__bass, pod_set_band_5_gain__bass);
-static DEVICE_ATTR(band_4_gain, S_IWUGO | S_IRUGO, pod_get_band_4_gain,
+static DEVICE_ATTR(band_4_gain, S_IWUSR | S_IRUGO, pod_get_band_4_gain,
                   pod_set_band_4_gain);
-static DEVICE_ATTR2(band_6_gain__bass, band_6_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_6_gain__bass, band_6_gain, S_IWUSR | S_IRUGO,
                    pod_get_band_6_gain__bass, pod_set_band_6_gain__bass);
 static DEVICE_ATTR(body, S_IRUGO, variax_get_body, line6_nop_write);
 static DEVICE_ATTR(pickup1_enable, S_IRUGO, variax_get_pickup1_enable,
diff --git a/drivers/staging/line6/midi.c b/drivers/staging/line6/midi.c
index 4304dfe6c166..ab67e889d2c4 100644
--- a/drivers/staging/line6/midi.c
+++ b/drivers/staging/line6/midi.c
@@ -350,9 +350,9 @@ static ssize_t midi_set_midi_mask_receive(struct device *dev,
        return count;
 }
-static DEVICE_ATTR(midi_mask_transmit, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(midi_mask_transmit, S_IWUSR | S_IRUGO,
                   midi_get_midi_mask_transmit, midi_set_midi_mask_transmit);
-static DEVICE_ATTR(midi_mask_receive, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(midi_mask_receive, S_IWUSR | S_IRUGO,
                   midi_get_midi_mask_receive, midi_set_midi_mask_receive);
 /* MIDI device destructor */
diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c
index e54770e34d2e..b9c55f9eb501 100644
--- a/drivers/staging/line6/pcm.c
+++ b/drivers/staging/line6/pcm.c
@@ -79,9 +79,9 @@ static ssize_t pcm_set_impulse_period(struct device *dev,
        return count;
 }
-static DEVICE_ATTR(impulse_volume, S_IWUGO | S_IRUGO, pcm_get_impulse_volume,
+static DEVICE_ATTR(impulse_volume, S_IWUSR | S_IRUGO, pcm_get_impulse_volume,
                   pcm_set_impulse_volume);
-static DEVICE_ATTR(impulse_period, S_IWUGO | S_IRUGO, pcm_get_impulse_period,
+static DEVICE_ATTR(impulse_period, S_IWUSR | S_IRUGO, pcm_get_impulse_period,
                   pcm_set_impulse_period);
 #endif
diff --git a/drivers/staging/line6/pod.c b/drivers/staging/line6/pod.c
index 22e2cedcacf7..d9b30212585c 100644
--- a/drivers/staging/line6/pod.c
+++ b/drivers/staging/line6/pod.c
@@ -1051,48 +1051,48 @@ POD_GET_SYSTEM_PARAM(tuner_pitch, 1);
 #undef GET_SYSTEM_PARAM
 /* POD special files: */
-static DEVICE_ATTR(channel, S_IWUGO | S_IRUGO, pod_get_channel,
+static DEVICE_ATTR(channel, S_IWUSR | S_IRUGO, pod_get_channel,
                   pod_set_channel);
 static DEVICE_ATTR(clip, S_IRUGO, pod_wait_for_clip, line6_nop_write);
 static DEVICE_ATTR(device_id, S_IRUGO, pod_get_device_id, line6_nop_write);
 static DEVICE_ATTR(dirty, S_IRUGO, pod_get_dirty, line6_nop_write);
-static DEVICE_ATTR(dump, S_IWUGO | S_IRUGO, pod_get_dump, pod_set_dump);
+static DEVICE_ATTR(dump, S_IWUSR | S_IRUGO, pod_get_dump, pod_set_dump);
-static DEVICE_ATTR(dump_buf, S_IWUGO | S_IRUGO, pod_get_dump_buf,
+static DEVICE_ATTR(dump_buf, S_IWUSR | S_IRUGO, pod_get_dump_buf,
                   pod_set_dump_buf);
-static DEVICE_ATTR(finish, S_IWUGO, line6_nop_read, pod_set_finish);
+static DEVICE_ATTR(finish, S_IWUSR, line6_nop_read, pod_set_finish);
 static DEVICE_ATTR(firmware_version, S_IRUGO, pod_get_firmware_version,
                   line6_nop_write);
-static DEVICE_ATTR(midi_postprocess, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(midi_postprocess, S_IWUSR | S_IRUGO,
                   pod_get_midi_postprocess, pod_set_midi_postprocess);
-static DEVICE_ATTR(monitor_level, S_IWUGO | S_IRUGO, pod_get_monitor_level,
+static DEVICE_ATTR(monitor_level, S_IWUSR | S_IRUGO, pod_get_monitor_level,
                   pod_set_monitor_level);
 static DEVICE_ATTR(name, S_IRUGO, pod_get_name, line6_nop_write);
 static DEVICE_ATTR(name_buf, S_IRUGO, pod_get_name_buf, line6_nop_write);
-static DEVICE_ATTR(retrieve_amp_setup, S_IWUGO, line6_nop_read,
+static DEVICE_ATTR(retrieve_amp_setup, S_IWUSR, line6_nop_read,
                   pod_set_retrieve_amp_setup);
-static DEVICE_ATTR(retrieve_channel, S_IWUGO, line6_nop_read,
+static DEVICE_ATTR(retrieve_channel, S_IWUSR, line6_nop_read,
                   pod_set_retrieve_channel);
-static DEVICE_ATTR(retrieve_effects_setup, S_IWUGO, line6_nop_read,
+static DEVICE_ATTR(retrieve_effects_setup, S_IWUSR, line6_nop_read,
                   pod_set_retrieve_effects_setup);
-static DEVICE_ATTR(routing, S_IWUGO | S_IRUGO, pod_get_routing,
+static DEVICE_ATTR(routing, S_IWUSR | S_IRUGO, pod_get_routing,
                   pod_set_routing);
 static DEVICE_ATTR(serial_number, S_IRUGO, pod_get_serial_number,
                   line6_nop_write);
-static DEVICE_ATTR(store_amp_setup, S_IWUGO, line6_nop_read,
+static DEVICE_ATTR(store_amp_setup, S_IWUSR, line6_nop_read,
                   pod_set_store_amp_setup);
-static DEVICE_ATTR(store_channel, S_IWUGO, line6_nop_read,
+static DEVICE_ATTR(store_channel, S_IWUSR, line6_nop_read,
                   pod_set_store_channel);
-static DEVICE_ATTR(store_effects_setup, S_IWUGO, line6_nop_read,
+static DEVICE_ATTR(store_effects_setup, S_IWUSR, line6_nop_read,
                   pod_set_store_effects_setup);
-static DEVICE_ATTR(tuner_freq, S_IWUGO | S_IRUGO, pod_get_tuner_freq,
+static DEVICE_ATTR(tuner_freq, S_IWUSR | S_IRUGO, pod_get_tuner_freq,
                   pod_set_tuner_freq);
-static DEVICE_ATTR(tuner_mute, S_IWUGO | S_IRUGO, pod_get_tuner_mute,
+static DEVICE_ATTR(tuner_mute, S_IWUSR | S_IRUGO, pod_get_tuner_mute,
                   pod_set_tuner_mute);
 static DEVICE_ATTR(tuner_note, S_IRUGO, pod_get_tuner_note, line6_nop_write);
 static DEVICE_ATTR(tuner_pitch, S_IRUGO, pod_get_tuner_pitch, line6_nop_write);
 #ifdef CONFIG_LINE6_USB_RAW
-static DEVICE_ATTR(raw, S_IWUGO, line6_nop_read, line6_set_raw);
+static DEVICE_ATTR(raw, S_IWUSR, line6_nop_read, line6_set_raw);
 #endif
 /* control info callback */
diff --git a/drivers/staging/line6/toneport.c b/drivers/staging/line6/toneport.c
index 6a10b0f9749a..879e6992bbc6 100644
--- a/drivers/staging/line6/toneport.c
+++ b/drivers/staging/line6/toneport.c
@@ -154,9 +154,9 @@ static ssize_t toneport_set_led_green(struct device *dev,
        return count;
 }
-static DEVICE_ATTR(led_red, S_IWUGO | S_IRUGO, line6_nop_read,
+static DEVICE_ATTR(led_red, S_IWUSR | S_IRUGO, line6_nop_read,
                   toneport_set_led_red);
-static DEVICE_ATTR(led_green, S_IWUGO | S_IRUGO, line6_nop_read,
+static DEVICE_ATTR(led_green, S_IWUSR | S_IRUGO, line6_nop_read,
                   toneport_set_led_green);
 static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2)
diff --git a/drivers/staging/line6/variax.c b/drivers/staging/line6/variax.c
index 894eee7f2317..81241cdf1be9 100644
--- a/drivers/staging/line6/variax.c
+++ b/drivers/staging/line6/variax.c
@@ -549,21 +549,21 @@ static ssize_t variax_set_raw2(struct device *dev,
 #endif
 /* Variax workbench special files: */
-static DEVICE_ATTR(model, S_IWUGO | S_IRUGO, variax_get_model,
+static DEVICE_ATTR(model, S_IWUSR | S_IRUGO, variax_get_model,
                   variax_set_model);
-static DEVICE_ATTR(volume, S_IWUGO | S_IRUGO, variax_get_volume,
+static DEVICE_ATTR(volume, S_IWUSR | S_IRUGO, variax_get_volume,
                   variax_set_volume);
-static DEVICE_ATTR(tone, S_IWUGO | S_IRUGO, variax_get_tone, variax_set_tone);
+static DEVICE_ATTR(tone, S_IWUSR | S_IRUGO, variax_get_tone, variax_set_tone);
 static DEVICE_ATTR(name, S_IRUGO, variax_get_name, line6_nop_write);
 static DEVICE_ATTR(bank, S_IRUGO, variax_get_bank, line6_nop_write);
 static DEVICE_ATTR(dump, S_IRUGO, variax_get_dump, line6_nop_write);
-static DEVICE_ATTR(active, S_IWUGO | S_IRUGO, variax_get_active,
+static DEVICE_ATTR(active, S_IWUSR | S_IRUGO, variax_get_active,
                   variax_set_active);
 static DEVICE_ATTR(guitar, S_IRUGO, variax_get_guitar, line6_nop_write);
 #ifdef CONFIG_LINE6_USB_RAW
-static DEVICE_ATTR(raw, S_IWUGO, line6_nop_read, line6_set_raw);
+static DEVICE_ATTR(raw, S_IWUSR, line6_nop_read, line6_set_raw);
-static DEVICE_ATTR(raw2, S_IWUGO, line6_nop_read, variax_set_raw2);
+static DEVICE_ATTR(raw2, S_IWUSR, line6_nop_read, variax_set_raw2);
 #endif
 /*
diff --git a/drivers/staging/quickstart/quickstart.c b/drivers/staging/quickstart/quickstart.c
index d746715d3d89..d83bec876d2e 100644
--- a/drivers/staging/quickstart/quickstart.c
+++ b/drivers/staging/quickstart/quickstart.c
@@ -355,7 +355,6 @@ static int quickstart_acpi_remove(struct acpi_device *device, int type)
 static void quickstart_exit(void)
 {
        input_unregister_device(quickstart_input);
-        input_free_device(quickstart_input);
        device_remove_file(&pf_device->dev, &dev_attr_pressed_button);
        device_remove_file(&pf_device->dev, &dev_attr_buttons);
@@ -375,6 +374,7 @@ static int __init quickstart_init_input(void)
 {
        struct quickstart_btn **ptr = &quickstart_data.btn_lst;
        int count;
+        int ret;
        quickstart_input = input_allocate_device();
@@ -391,7 +391,13 @@ static int __init quickstart_init_input(void)
                ptr = &((*ptr)->next);
        }
-        return input_register_device(quickstart_input);
+        ret = input_register_device(quickstart_input);
+        if (ret) {
+                input_free_device(quickstart_input);
+                return ret;
+        }
+        return 0;
 }
 static int __init quickstart_init(void)
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index ddacfc6c4861..cd15daae5412 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -182,6 +182,7 @@ struct usb_device_id rtusb_usb_id[] = {
        {USB_DEVICE(0x2001, 0x3C09)},   /* D-Link */
        {USB_DEVICE(0x2001, 0x3C0A)},   /* D-Link 3072 */
        {USB_DEVICE(0x2019, 0xED14)},   /* Planex Communications, Inc. */
+        {USB_DEVICE(0x0411, 0x015D)},   /* Buffalo Airstation WLI-UC-GN */
        {}                      /* Terminating entry */
 };
diff --git a/drivers/staging/rtl8187se/r8185b_init.c b/drivers/staging/rtl8187se/r8185b_init.c
index 46000d72f4c4..3bdf9b31cc4e 100644
--- a/drivers/staging/rtl8187se/r8185b_init.c
+++ b/drivers/staging/rtl8187se/r8185b_init.c
@@ -264,8 +264,12 @@ HwHSSIThreeWire(
                        udelay(10);
                }
-                if (TryCnt == TC_3W_POLL_MAX_TRY_CNT)
+                if (TryCnt == TC_3W_POLL_MAX_TRY_CNT) {
-                        panic("HwThreeWire(): CmdReg: %#X RE|WE bits are not clear!!\n", u1bTmp);
+                        printk(KERN_ERR "rtl8187se: HwThreeWire(): CmdReg:"
+                               " %#X RE|WE bits are not clear!!\n", u1bTmp);
+                        dump_stack();
+                        return 0;
+                }
                /* RTL8187S HSSI Read/Write Function */
                u1bTmp = read_nic_byte(dev, RF_SW_CONFIG);
@@ -298,13 +302,23 @@ HwHSSIThreeWire(
                                int idx;
                                int ByteCnt = nDataBufBitCnt / 8;
                                                                /* printk("%d\n",nDataBufBitCnt); */
-                                if ((nDataBufBitCnt % 8) != 0)
+                                if ((nDataBufBitCnt % 8) != 0) {
-                                panic("HwThreeWire(): nDataBufBitCnt(%d) should be multiple of 8!!!\n",
+                                        printk(KERN_ERR "rtl8187se: "
-                                nDataBufBitCnt);
+                                               "HwThreeWire(): nDataBufBitCnt(%d)"
+                                               " should be multiple of 8!!!\n",
+                                               nDataBufBitCnt);
+                                        dump_stack();
+                                        nDataBufBitCnt += 8;
+                                        nDataBufBitCnt &= ~7;
+                                }
-                               if (nDataBufBitCnt > 64)
+                               if (nDataBufBitCnt > 64) {
-                                panic("HwThreeWire(): nDataBufBitCnt(%d) should <= 64!!!\n",
+                                        printk(KERN_ERR "rtl8187se: HwThreeWire():"
-                                nDataBufBitCnt);
+                                               " nDataBufBitCnt(%d) should <= 64!!!\n",
+                                               nDataBufBitCnt);
+                                        dump_stack();
+                                        nDataBufBitCnt = 64;
+                                }
                                for (idx = 0; idx < ByteCnt; idx++)
                                        write_nic_byte(dev, (SW_3W_DB0+idx), *(pDataBuf+idx));
diff --git a/drivers/staging/rtl8712/usb_halinit.c b/drivers/staging/rtl8712/usb_halinit.c
index f6569dce3012..0e9483bbabe1 100644
--- a/drivers/staging/rtl8712/usb_halinit.c
+++ b/drivers/staging/rtl8712/usb_halinit.c
@@ -37,7 +37,7 @@ u8 r8712_usb_hal_bus_init(struct _adapter *padapter)
 {
        u8 val8 = 0;
        u8 ret = _SUCCESS;
-        u8 PollingCnt = 20;
+        int PollingCnt = 20;
        struct registry_priv *pregistrypriv = &padapter->registrypriv;
        if (pregistrypriv->chip_version == RTL8712_FPGA) {
diff --git a/drivers/staging/samsung-laptop/samsung-laptop.c b/drivers/staging/samsung-laptop/samsung-laptop.c
index eb44b60e1eb5..ac2bf11e1119 100644
--- a/drivers/staging/samsung-laptop/samsung-laptop.c
+++ b/drivers/staging/samsung-laptop/samsung-laptop.c
@@ -356,7 +356,7 @@ static ssize_t set_silent_state(struct device *dev,
        }
        return count;
 }
-static DEVICE_ATTR(silent, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(silent, S_IWUSR | S_IRUGO,
                   get_silent_state, set_silent_state);
diff --git a/drivers/staging/speakup/fakekey.c b/drivers/staging/speakup/fakekey.c
index adb93f21c0d6..65b231178f05 100644
--- a/drivers/staging/speakup/fakekey.c
+++ b/drivers/staging/speakup/fakekey.c
@@ -62,7 +62,6 @@ void speakup_remove_virtual_keyboard(void)
 {
        if (virt_keyboard != NULL) {
                input_unregister_device(virt_keyboard);
-                input_free_device(virt_keyboard);
                virt_keyboard = NULL;
        }
 }
diff --git a/drivers/staging/spectra/ffsport.c b/drivers/staging/spectra/ffsport.c
index c7932da03c56..63a9d0adf32d 100644
--- a/drivers/staging/spectra/ffsport.c
+++ b/drivers/staging/spectra/ffsport.c
@@ -656,7 +656,7 @@ static int SBD_setup_device(struct spectra_nand_dev *dev, int which)
        /* Here we force report 512 byte hardware sector size to Kernel */
        blk_queue_logical_block_size(dev->queue, 512);
-        blk_queue_ordered(dev->queue, QUEUE_ORDERED_DRAIN_FLUSH);
+        blk_queue_flush(dev->queue, REQ_FLUSH);
        dev->thread = kthread_run(spectra_trans_thread, dev, "nand_thd");
        if (IS_ERR(dev->thread)) {
diff --git a/drivers/staging/tm6000/tm6000-cards.c b/drivers/staging/tm6000/tm6000-cards.c
index 664e6038090d..b143258f094a 100644
--- a/drivers/staging/tm6000/tm6000-cards.c
+++ b/drivers/staging/tm6000/tm6000-cards.c
@@ -545,7 +545,7 @@ static void tm6000_config_tuner(struct tm6000_core *dev)
        /* Load tuner module */
        v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                NULL, "tuner", dev->tuner_addr, NULL);
+                "tuner", dev->tuner_addr, NULL);
        memset(&tun_setup, 0, sizeof(tun_setup));
        tun_setup.type = dev->tuner_type;
@@ -683,7 +683,7 @@ static int tm6000_init_dev(struct tm6000_core *dev)
        if (dev->caps.has_tda9874)
                v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                        NULL, "tvaudio", I2C_ADDR_TDA9874, NULL);
+                        "tvaudio", I2C_ADDR_TDA9874, NULL);
        /* register and initialize V4L2 */
        rc = tm6000_v4l2_register(dev);
diff --git a/drivers/staging/udlfb/udlfb.c b/drivers/staging/udlfb/udlfb.c
index fed25105970a..b7ac16005265 100644
--- a/drivers/staging/udlfb/udlfb.c
+++ b/drivers/staging/udlfb/udlfb.c
@@ -1441,7 +1441,7 @@ static struct device_attribute fb_device_attrs[] = {
        __ATTR_RO(metrics_bytes_identical),
        __ATTR_RO(metrics_bytes_sent),
        __ATTR_RO(metrics_cpu_kcycles_used),
-        __ATTR(metrics_reset, S_IWUGO, NULL, metrics_reset_store),
+        __ATTR(metrics_reset, S_IWUSR, NULL, metrics_reset_store),
 };
 /*
diff --git a/drivers/staging/winbond/sysdef.h b/drivers/staging/winbond/sysdef.h
index 9195adf98e14..d0d71f69bc8c 100644
--- a/drivers/staging/winbond/sysdef.h
+++ b/drivers/staging/winbond/sysdef.h
@@ -2,6 +2,9 @@
 #ifndef SYS_DEF_H
 #define SYS_DEF_H
+#include <linux/delay.h>
 #define WB_LINUX
 #define WB_LINUX_WPA_PSK
diff --git a/drivers/staging/zram/zram_sysfs.c b/drivers/staging/zram/zram_sysfs.c
index 6c574a994d11..6b3cf00b0ff4 100644
--- a/drivers/staging/zram/zram_sysfs.c
+++ b/drivers/staging/zram/zram_sysfs.c
@@ -189,10 +189,10 @@ static ssize_t mem_used_total_show(struct device *dev,
        return sprintf(buf, "%llu\n", val);
 }
-static DEVICE_ATTR(disksize, S_IRUGO | S_IWUGO,
+static DEVICE_ATTR(disksize, S_IRUGO | S_IWUSR,
                disksize_show, disksize_store);
 static DEVICE_ATTR(initstate, S_IRUGO, initstate_show, NULL);
-static DEVICE_ATTR(reset, S_IWUGO, NULL, reset_store);
+static DEVICE_ATTR(reset, S_IWUSR, NULL, reset_store);
 static DEVICE_ATTR(num_reads, S_IRUGO, num_reads_show, NULL);
 static DEVICE_ATTR(num_writes, S_IRUGO, num_writes_show, NULL);
 static DEVICE_ATTR(invalid_io, S_IRUGO, invalid_io_show, NULL);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index c05c5af5aa04..35480dd57a30 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -559,6 +559,9 @@ void __tty_hangup(struct tty_struct *tty)
        tty_lock();
+        /* some functions below drop BTM, so we need this bit */
+        set_bit(TTY_HUPPING, &tty->flags);
        /* inuse_filps is protected by the single tty lock,
           this really needs to change if we want to flush the
           workqueue with the lock held */
@@ -578,6 +581,10 @@ void __tty_hangup(struct tty_struct *tty)
        }
        spin_unlock(&tty_files_lock);
+        /*
+         * it drops BTM and thus races with reopen
+         * we protect the race by TTY_HUPPING
+         */
        tty_ldisc_hangup(tty);
        read_lock(&tasklist_lock);
@@ -615,7 +622,6 @@ void __tty_hangup(struct tty_struct *tty)
        tty->session = NULL;
        tty->pgrp = NULL;
        tty->ctrl_status = 0;
-        set_bit(TTY_HUPPED, &tty->flags);
        spin_unlock_irqrestore(&tty->ctrl_lock, flags);
        /* Account for the p->signal references we killed */
@@ -641,6 +647,7 @@ void __tty_hangup(struct tty_struct *tty)
         * can't yet guarantee all that.
         */
        set_bit(TTY_HUPPED, &tty->flags);
+        clear_bit(TTY_HUPPING, &tty->flags);
        tty_ldisc_enable(tty);
        tty_unlock();
@@ -1310,7 +1317,9 @@ static int tty_reopen(struct tty_struct *tty)
 {
        struct tty_driver *driver = tty->driver;
-        if (test_bit(TTY_CLOSING, &tty->flags))
+        if (test_bit(TTY_CLOSING, &tty->flags) ||
+                        test_bit(TTY_HUPPING, &tty->flags) ||
+                        test_bit(TTY_LDISC_CHANGING, &tty->flags))
                return -EIO;
        if (driver->type == TTY_DRIVER_TYPE_PTY &&
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index d8e96b005023..4214d58276f7 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -454,6 +454,8 @@ static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
                /* BTM here locks versus a hangup event */
                WARN_ON(!tty_locked());
                ret = ld->ops->open(tty);
+                if (ret)
+                        clear_bit(TTY_LDISC_OPEN, &tty->flags);
                return ret;
        }
        return 0;
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index a858d2b87b94..51fe1795d5a8 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -3,7 +3,7 @@
 *
 * Copyright(C) 2005, Benedikt Spranger <b.spranger@linutronix.de>
 * Copyright(C) 2005, Thomas Gleixner <tglx@linutronix.de>
- * Copyright(C) 2006, Hans J. Koch <hjk@linutronix.de>
+ * Copyright(C) 2006, Hans J. Koch <hjk@hansjkoch.de>
 * Copyright(C) 2006, Greg Kroah-Hartman <greg@kroah.com>
 *
 * Userspace IO
diff --git a/drivers/uio/uio_cif.c b/drivers/uio/uio_cif.c
index a8ea2f19a0cc..a84a451159ed 100644
--- a/drivers/uio/uio_cif.c
+++ b/drivers/uio/uio_cif.c
@@ -1,7 +1,7 @@
 /*
 * UIO Hilscher CIF card driver
 *
- * (C) 2007 Hans J. Koch <hjk@linutronix.de>
+ * (C) 2007 Hans J. Koch <hjk@hansjkoch.de>
 * Original code (C) 2005 Benedikt Spranger <b.spranger@linutronix.de>
 *
 * Licensed under GPL version 2 only.
diff --git a/drivers/uio/uio_netx.c b/drivers/uio/uio_netx.c
index 5a18e9f7b836..5ffdb483b015 100644
--- a/drivers/uio/uio_netx.c
+++ b/drivers/uio/uio_netx.c
@@ -2,7 +2,7 @@
 * UIO driver for Hilscher NetX based fieldbus cards (cifX, comX).
 * See http://www.hilscher.com for details.
 *
- * (C) 2007 Hans J. Koch <hjk@linutronix.de>
+ * (C) 2007 Hans J. Koch <hjk@hansjkoch.de>
 * (C) 2008 Manuel Traut <manut@linutronix.de>
 *
 * Licensed under GPL version 2 only.
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index ea071a5b6eee..44447f54942f 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -2301,7 +2301,7 @@ out:
        return ret;
 }
-static DEVICE_ATTR(stat_status, S_IWUGO | S_IRUGO, read_status, reboot);
+static DEVICE_ATTR(stat_status, S_IWUSR | S_IRUGO, read_status, reboot);
 static ssize_t read_human_status(struct device *dev,
                        struct device_attribute *attr, char *buf)
@@ -2364,8 +2364,7 @@ out:
        return ret;
 }
-static DEVICE_ATTR(stat_human_status, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(stat_human_status, S_IRUGO, read_human_status, NULL);
-                                read_human_status, NULL);
 static ssize_t read_delin(struct device *dev, struct device_attribute *attr,
                char *buf)
@@ -2397,7 +2396,7 @@ out:
        return ret;
 }
-static DEVICE_ATTR(stat_delin, S_IWUGO | S_IRUGO, read_delin, NULL);
+static DEVICE_ATTR(stat_delin, S_IRUGO, read_delin, NULL);
 #define UEA_ATTR(name, reset)                                   \
                                                                \
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 61800f77dac8..ced846ac4141 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1330,6 +1330,8 @@ static int map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
         */
        if (usb_endpoint_xfer_control(&urb->ep->desc)) {
+                if (hcd->self.uses_pio_for_control)
+                        return ret;
                if (hcd->self.uses_dma) {
                        urb->setup_dma = dma_map_single(
                                        hcd->self.controller,
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index b5e20e873cba..717ff653fa23 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -2017,7 +2017,7 @@ static int __init usba_udc_probe(struct platform_device *pdev)
                        }
                } else {
                        /* gpio_request fail so use -EINVAL for gpio_is_valid */
-                        ubc->vbus_pin = -EINVAL;
+                        udc->vbus_pin = -EINVAL;
                }
        }
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 86afdc73322f..6e2599661b5b 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -1067,7 +1067,7 @@ static inline void create_debug_files (struct ehci_hcd *ehci)
                                                    &debug_registers_fops))
                goto file_error;
-        if (!debugfs_create_file("lpm", S_IRUGO|S_IWUGO, ehci->debug_dir, bus,
+        if (!debugfs_create_file("lpm", S_IRUGO|S_IWUSR, ehci->debug_dir, bus,
                                                    &debug_lpm_fops))
                goto file_error;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 502a7e6fef42..e9062806d4a2 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1063,10 +1063,11 @@ rescan:
                                tmp && tmp != qh;
                                tmp = tmp->qh_next.qh)
                        continue;
-                /* periodic qh self-unlinks on empty */
+                /* periodic qh self-unlinks on empty, and a COMPLETING qh
-                if (!tmp)
+                 * may already be unlinked.
-                        goto nogood;
+                 */
-                unlink_async (ehci, qh);
+                if (tmp)
+                        unlink_async(ehci, qh);
                /* FALL THROUGH */
        case QH_STATE_UNLINK:           /* wait for hw to finish? */
        case QH_STATE_UNLINK_WAIT:
@@ -1083,7 +1084,6 @@ idle_timeout:
                }
                /* else FALL THROUGH */
        default:
-nogood:
                /* caller was supposed to have unlinked any requests;
                 * that's not our job.  just leak this memory.
                 */
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index d36e4e75e08d..12f70c302b0b 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -141,6 +141,10 @@ static void ehci_mem_cleanup (struct ehci_hcd *ehci)
                qh_put (ehci->async);
        ehci->async = NULL;
+        if (ehci->dummy)
+                qh_put(ehci->dummy);
+        ehci->dummy = NULL;
        /* DMA consistent memory and pools */
        if (ehci->qtd_pool)
                dma_pool_destroy (ehci->qtd_pool);
@@ -227,8 +231,26 @@ static int ehci_mem_init (struct ehci_hcd *ehci, gfp_t flags)
        if (ehci->periodic == NULL) {
                goto fail;
        }
-        for (i = 0; i < ehci->periodic_size; i++)
-                ehci->periodic [i] = EHCI_LIST_END(ehci);
+        if (ehci->use_dummy_qh) {
+                struct ehci_qh_hw       *hw;
+                ehci->dummy = ehci_qh_alloc(ehci, flags);
+                if (!ehci->dummy)
+                        goto fail;
+                hw = ehci->dummy->hw;
+                hw->hw_next = EHCI_LIST_END(ehci);
+                hw->hw_qtd_next = EHCI_LIST_END(ehci);
+                hw->hw_alt_next = EHCI_LIST_END(ehci);
+                hw->hw_token &= ~QTD_STS_ACTIVE;
+                ehci->dummy->hw = hw;
+                for (i = 0; i < ehci->periodic_size; i++)
+                        ehci->periodic[i] = ehci->dummy->qh_dma;
+        } else {
+                for (i = 0; i < ehci->periodic_size; i++)
+                        ehci->periodic[i] = EHCI_LIST_END(ehci);
+        }
        /* software shadow of hardware table */
        ehci->pshadow = kcalloc(ehci->periodic_size, sizeof(void *), flags);
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index a1e8d273103f..655f3c9f88bf 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -103,6 +103,19 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
        if (retval)
                return retval;
+        if ((pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x7808) ||
+            (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x4396)) {
+                /* EHCI controller on AMD SB700/SB800/Hudson-2/3 platforms may
+                 * read/write memory space which does not belong to it when
+                 * there is NULL pointer with T-bit set to 1 in the frame list
+                 * table. To avoid the issue, the frame list link pointer
+                 * should always contain a valid pointer to a inactive qh.
+                 */
+                ehci->use_dummy_qh = 1;
+                ehci_info(ehci, "applying AMD SB700/SB800/Hudson-2/3 EHCI "
+                                "dummy qh workaround\n");
+        }
        /* data structure init */
        retval = ehci_init(hcd);
        if (retval)
@@ -148,6 +161,18 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                        if (pdev->revision < 0xa4)
                                ehci->no_selective_suspend = 1;
                        break;
+                /* MCP89 chips on the MacBookAir3,1 give EPROTO when
+                 * fetching device descriptors unless LPM is disabled.
+                 * There are also intermittent problems enumerating
+                 * devices with PPCD enabled.
+                 */
+                case 0x0d9d:
+                        ehci_info(ehci, "disable lpm/ppcd for nvidia mcp89");
+                        ehci->has_lpm = 0;
+                        ehci->has_ppcd = 0;
+                        ehci->command &= ~CMD_PPCEE;
+                        break;
                }
                break;
        case PCI_VENDOR_ID_VIA:
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index a92526d6e5ae..d9f78eb26572 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -98,7 +98,14 @@ static void periodic_unlink (struct ehci_hcd *ehci, unsigned frame, void *ptr)
         */
        *prev_p = *periodic_next_shadow(ehci, &here,
                        Q_NEXT_TYPE(ehci, *hw_p));
-        *hw_p = *shadow_next_periodic(ehci, &here, Q_NEXT_TYPE(ehci, *hw_p));
+        if (!ehci->use_dummy_qh ||
+            *shadow_next_periodic(ehci, &here, Q_NEXT_TYPE(ehci, *hw_p))
+                        != EHCI_LIST_END(ehci))
+                *hw_p = *shadow_next_periodic(ehci, &here,
+                                Q_NEXT_TYPE(ehci, *hw_p));
+        else
+                *hw_p = ehci->dummy->qh_dma;
 }
 /* how many of the uframe's 125 usecs are allocated? */
@@ -2335,7 +2342,11 @@ restart:
                                 * pointer for much longer, if at all.
                                 */
                                *q_p = q.itd->itd_next;
-                                *hw_p = q.itd->hw_next;
+                                if (!ehci->use_dummy_qh ||
+                                    q.itd->hw_next != EHCI_LIST_END(ehci))
+                                        *hw_p = q.itd->hw_next;
+                                else
+                                        *hw_p = ehci->dummy->qh_dma;
                                type = Q_NEXT_TYPE(ehci, q.itd->hw_next);
                                wmb();
                                modified = itd_complete (ehci, q.itd);
@@ -2368,7 +2379,11 @@ restart:
                                 * URB completion.
                                 */
                                *q_p = q.sitd->sitd_next;
-                                *hw_p = q.sitd->hw_next;
+                                if (!ehci->use_dummy_qh ||
+                                    q.sitd->hw_next != EHCI_LIST_END(ehci))
+                                        *hw_p = q.sitd->hw_next;
+                                else
+                                        *hw_p = ehci->dummy->qh_dma;
                                type = Q_NEXT_TYPE(ehci, q.sitd->hw_next);
                                wmb();
                                modified = sitd_complete (ehci, q.sitd);
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index bde823f704e9..ba8eab366b82 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -73,6 +73,7 @@ struct ehci_hcd {			/* one per controller */
        /* async schedule support */
        struct ehci_qh          *async;
+        struct ehci_qh          *dummy;         /* For AMD quirk use */
        struct ehci_qh          *reclaim;
        unsigned                scanning : 1;
@@ -131,6 +132,7 @@ struct ehci_hcd {			/* one per controller */
        unsigned                need_io_watchdog:1;
        unsigned                broken_periodic:1;
        unsigned                fs_i_thresh:1;  /* Intel iso scheduling */
+        unsigned                use_dummy_qh:1; /* AMD Frame List table quirk*/
        /* required for usb32 quirk */
        #define OHCI_CTRL_HCFS          (3 << 6)
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 6c4fb4efb4bb..43a39eb56cc6 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -2683,7 +2683,7 @@ static int __devexit isp1362_remove(struct platform_device *pdev)
        return 0;
 }
-static int __init isp1362_probe(struct platform_device *pdev)
+static int __devinit isp1362_probe(struct platform_device *pdev)
 {
        struct usb_hcd *hcd;
        struct isp1362_hcd *isp1362_hcd;
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index fef5a1f9d483..5d963e350494 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -229,6 +229,13 @@ void xhci_ring_device(struct xhci_hcd *xhci, int slot_id)
 static void xhci_disable_port(struct xhci_hcd *xhci, u16 wIndex,
                u32 __iomem *addr, u32 port_status)
 {
+        /* Don't allow the USB core to disable SuperSpeed ports. */
+        if (xhci->port_array[wIndex] == 0x03) {
+                xhci_dbg(xhci, "Ignoring request to disable "
+                                "SuperSpeed port.\n");
+                return;
+        }
        /* Write 1 to disable the port */
        xhci_writel(xhci, port_status | PORT_PE, addr);
        port_status = xhci_readl(xhci, addr);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 202770676da3..0fae58ef8afe 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1045,7 +1045,7 @@ static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
        if (udev->speed == USB_SPEED_SUPER)
                return ep->ss_ep_comp.wBytesPerInterval;
-        max_packet = ep->desc.wMaxPacketSize & 0x3ff;
+        max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize);
        max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
        /* A 0 in max burst means 1 transfer per ESIT */
        return max_packet * (max_burst + 1);
@@ -1135,7 +1135,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
                /* Fall through */
        case USB_SPEED_FULL:
        case USB_SPEED_LOW:
-                max_packet = ep->desc.wMaxPacketSize & 0x3ff;
+                max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize);
                ep_ctx->ep_info2 |= MAX_PACKET(max_packet);
                break;
        default:
@@ -1443,6 +1443,13 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
        xhci->dcbaa = NULL;
        scratchpad_free(xhci);
+        xhci->num_usb2_ports = 0;
+        xhci->num_usb3_ports = 0;
+        kfree(xhci->usb2_ports);
+        kfree(xhci->usb3_ports);
+        kfree(xhci->port_array);
        xhci->page_size = 0;
        xhci->page_shift = 0;
        xhci->bus_suspended = 0;
@@ -1627,6 +1634,161 @@ static void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
                        &xhci->ir_set->erst_dequeue);
 }
+static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
+                u32 __iomem *addr, u8 major_revision)
+{
+        u32 temp, port_offset, port_count;
+        int i;
+        if (major_revision > 0x03) {
+                xhci_warn(xhci, "Ignoring unknown port speed, "
+                                "Ext Cap %p, revision = 0x%x\n",
+                                addr, major_revision);
+                /* Ignoring port protocol we can't understand. FIXME */
+                return;
+        }
+        /* Port offset and count in the third dword, see section 7.2 */
+        temp = xhci_readl(xhci, addr + 2);
+        port_offset = XHCI_EXT_PORT_OFF(temp);
+        port_count = XHCI_EXT_PORT_COUNT(temp);
+        xhci_dbg(xhci, "Ext Cap %p, port offset = %u, "
+                        "count = %u, revision = 0x%x\n",
+                        addr, port_offset, port_count, major_revision);
+        /* Port count includes the current port offset */
+        if (port_offset == 0 || (port_offset + port_count - 1) > num_ports)
+                /* WTF? "Valid values are ‘1’ to MaxPorts" */
+                return;
+        port_offset--;
+        for (i = port_offset; i < (port_offset + port_count); i++) {
+                /* Duplicate entry.  Ignore the port if the revisions differ. */
+                if (xhci->port_array[i] != 0) {
+                        xhci_warn(xhci, "Duplicate port entry, Ext Cap %p,"
+                                        " port %u\n", addr, i);
+                        xhci_warn(xhci, "Port was marked as USB %u, "
+                                        "duplicated as USB %u\n",
+                                        xhci->port_array[i], major_revision);
+                        /* Only adjust the roothub port counts if we haven't
+                         * found a similar duplicate.
+                         */
+                        if (xhci->port_array[i] != major_revision &&
+                                xhci->port_array[i] != (u8) -1) {
+                                if (xhci->port_array[i] == 0x03)
+                                        xhci->num_usb3_ports--;
+                                else
+                                        xhci->num_usb2_ports--;
+                                xhci->port_array[i] = (u8) -1;
+                        }
+                        /* FIXME: Should we disable the port? */
+                }
+                xhci->port_array[i] = major_revision;
+                if (major_revision == 0x03)
+                        xhci->num_usb3_ports++;
+                else
+                        xhci->num_usb2_ports++;
+        }
+        /* FIXME: Should we disable ports not in the Extended Capabilities? */
+}
+/*
+ * Scan the Extended Capabilities for the "Supported Protocol Capabilities" that
+ * specify what speeds each port is supposed to be.  We can't count on the port
+ * speed bits in the PORTSC register being correct until a device is connected,
+ * but we need to set up the two fake roothubs with the correct number of USB
+ * 3.0 and USB 2.0 ports at host controller initialization time.
+ */
+static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
+{
+        u32 __iomem *addr;
+        u32 offset;
+        unsigned int num_ports;
+        int i, port_index;
+        addr = &xhci->cap_regs->hcc_params;
+        offset = XHCI_HCC_EXT_CAPS(xhci_readl(xhci, addr));
+        if (offset == 0) {
+                xhci_err(xhci, "No Extended Capability registers, "
+                                "unable to set up roothub.\n");
+                return -ENODEV;
+        }
+        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+        xhci->port_array = kzalloc(sizeof(*xhci->port_array)*num_ports, flags);
+        if (!xhci->port_array)
+                return -ENOMEM;
+        /*
+         * For whatever reason, the first capability offset is from the
+         * capability register base, not from the HCCPARAMS register.
+         * See section 5.3.6 for offset calculation.
+         */
+        addr = &xhci->cap_regs->hc_capbase + offset;
+        while (1) {
+                u32 cap_id;
+                cap_id = xhci_readl(xhci, addr);
+                if (XHCI_EXT_CAPS_ID(cap_id) == XHCI_EXT_CAPS_PROTOCOL)
+                        xhci_add_in_port(xhci, num_ports, addr,
+                                        (u8) XHCI_EXT_PORT_MAJOR(cap_id));
+                offset = XHCI_EXT_CAPS_NEXT(cap_id);
+                if (!offset || (xhci->num_usb2_ports + xhci->num_usb3_ports)
+                                == num_ports)
+                        break;
+                /*
+                 * Once you're into the Extended Capabilities, the offset is
+                 * always relative to the register holding the offset.
+                 */
+                addr += offset;
+        }
+        if (xhci->num_usb2_ports == 0 && xhci->num_usb3_ports == 0) {
+                xhci_warn(xhci, "No ports on the roothubs?\n");
+                return -ENODEV;
+        }
+        xhci_dbg(xhci, "Found %u USB 2.0 ports and %u USB 3.0 ports.\n",
+                        xhci->num_usb2_ports, xhci->num_usb3_ports);
+        /*
+         * Note we could have all USB 3.0 ports, or all USB 2.0 ports.
+         * Not sure how the USB core will handle a hub with no ports...
+         */
+        if (xhci->num_usb2_ports) {
+                xhci->usb2_ports = kmalloc(sizeof(*xhci->usb2_ports)*
+                                xhci->num_usb2_ports, flags);
+                if (!xhci->usb2_ports)
+                        return -ENOMEM;
+                port_index = 0;
+                for (i = 0; i < num_ports; i++)
+                        if (xhci->port_array[i] != 0x03) {
+                                xhci->usb2_ports[port_index] =
+                                        &xhci->op_regs->port_status_base +
+                                        NUM_PORT_REGS*i;
+                                xhci_dbg(xhci, "USB 2.0 port at index %u, "
+                                                "addr = %p\n", i,
+                                                xhci->usb2_ports[port_index]);
+                                port_index++;
+                        }
+        }
+        if (xhci->num_usb3_ports) {
+                xhci->usb3_ports = kmalloc(sizeof(*xhci->usb3_ports)*
+                                xhci->num_usb3_ports, flags);
+                if (!xhci->usb3_ports)
+                        return -ENOMEM;
+                port_index = 0;
+                for (i = 0; i < num_ports; i++)
+                        if (xhci->port_array[i] == 0x03) {
+                                xhci->usb3_ports[port_index] =
+                                        &xhci->op_regs->port_status_base +
+                                        NUM_PORT_REGS*i;
+                                xhci_dbg(xhci, "USB 3.0 port at index %u, "
+                                                "addr = %p\n", i,
+                                                xhci->usb3_ports[port_index]);
+                                port_index++;
+                        }
+        }
+        return 0;
+}
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 {
@@ -1809,6 +1971,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
        if (scratchpad_alloc(xhci, flags))
                goto fail;
+        if (xhci_setup_port_arrays(xhci, flags))
+                goto fail;
        return 0;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 9f3115e729b1..df558f6f84e3 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2104,7 +2104,6 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
        if (!(status & STS_EINT)) {
                spin_unlock(&xhci->lock);
-                xhci_warn(xhci, "Spurious interrupt.\n");
                return IRQ_NONE;
        }
        xhci_dbg(xhci, "op reg status = %08x\n", status);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 5d7d4e951ea4..45e4a3108cc3 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -577,6 +577,65 @@ static void xhci_restore_registers(struct xhci_hcd *xhci)
        xhci_write_64(xhci, xhci->s3.erst_base, &xhci->ir_set->erst_base);
 }
+static void xhci_set_cmd_ring_deq(struct xhci_hcd *xhci)
+{
+        u64     val_64;
+        /* step 2: initialize command ring buffer */
+        val_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
+        val_64 = (val_64 & (u64) CMD_RING_RSVD_BITS) |
+                (xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
+                                      xhci->cmd_ring->dequeue) &
+                 (u64) ~CMD_RING_RSVD_BITS) |
+                xhci->cmd_ring->cycle_state;
+        xhci_dbg(xhci, "// Setting command ring address to 0x%llx\n",
+                        (long unsigned long) val_64);
+        xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring);
+}
+/*
+ * The whole command ring must be cleared to zero when we suspend the host.
+ *
+ * The host doesn't save the command ring pointer in the suspend well, so we
+ * need to re-program it on resume.  Unfortunately, the pointer must be 64-byte
+ * aligned, because of the reserved bits in the command ring dequeue pointer
+ * register.  Therefore, we can't just set the dequeue pointer back in the
+ * middle of the ring (TRBs are 16-byte aligned).
+ */
+static void xhci_clear_command_ring(struct xhci_hcd *xhci)
+{
+        struct xhci_ring *ring;
+        struct xhci_segment *seg;
+        ring = xhci->cmd_ring;
+        seg = ring->deq_seg;
+        do {
+                memset(seg->trbs, 0, SEGMENT_SIZE);
+                seg = seg->next;
+        } while (seg != ring->deq_seg);
+        /* Reset the software enqueue and dequeue pointers */
+        ring->deq_seg = ring->first_seg;
+        ring->dequeue = ring->first_seg->trbs;
+        ring->enq_seg = ring->deq_seg;
+        ring->enqueue = ring->dequeue;
+        /*
+         * Ring is now zeroed, so the HW should look for change of ownership
+         * when the cycle bit is set to 1.
+         */
+        ring->cycle_state = 1;
+        /*
+         * Reset the hardware dequeue pointer.
+         * Yes, this will need to be re-written after resume, but we're paranoid
+         * and want to make sure the hardware doesn't access bogus memory
+         * because, say, the BIOS or an SMI started the host without changing
+         * the command ring pointers.
+         */
+        xhci_set_cmd_ring_deq(xhci);
+}
 /*
 * Stop HC (not bus-specific)
 *
@@ -604,6 +663,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
                spin_unlock_irq(&xhci->lock);
                return -ETIMEDOUT;
        }
+        xhci_clear_command_ring(xhci);
        /* step 3: save registers */
        xhci_save_registers(xhci);
@@ -635,7 +695,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
        u32                     command, temp = 0;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
-        u64     val_64;
        int     old_state, retval;
        old_state = hcd->state;
@@ -648,15 +707,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                /* step 1: restore register */
                xhci_restore_registers(xhci);
                /* step 2: initialize command ring buffer */
-                val_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
+                xhci_set_cmd_ring_deq(xhci);
-                val_64 = (val_64 & (u64) CMD_RING_RSVD_BITS) |
-                         (xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
-                                               xhci->cmd_ring->dequeue) &
-                         (u64) ~CMD_RING_RSVD_BITS) |
-                         xhci->cmd_ring->cycle_state;
-                xhci_dbg(xhci, "// Setting command ring address to 0x%llx\n",
-                                (long unsigned long) val_64);
-                xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring);
                /* step 3: restore state and start state*/
                /* step 3: set CRS flag */
                command = xhci_readl(xhci, &xhci->op_regs->command);
@@ -714,6 +765,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                return retval;
        }
+        spin_unlock_irq(&xhci->lock);
        /* Re-setup MSI-X */
        if (hcd->irq)
                free_irq(hcd->irq, hcd);
@@ -736,6 +788,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                hcd->irq = pdev->irq;
        }
+        spin_lock_irq(&xhci->lock);
        /* step 4: set Run/Stop bit */
        command = xhci_readl(xhci, &xhci->op_regs->command);
        command |= CMD_RUN;
@@ -1496,6 +1549,15 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
                cmd_completion = command->completion;
                cmd_status = &command->status;
                command->command_trb = xhci->cmd_ring->enqueue;
+                /* Enqueue pointer can be left pointing to the link TRB,
+                 * we must handle that
+                 */
+                if ((command->command_trb->link.control & TRB_TYPE_BITMASK)
+                                == TRB_TYPE(TRB_LINK))
+                        command->command_trb =
+                                xhci->cmd_ring->enq_seg->next->trbs;
                list_add_tail(&command->cmd_list, &virt_dev->cmd_list);
        } else {
                in_ctx = virt_dev->in_ctx;
@@ -2219,6 +2281,15 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
        /* Attempt to submit the Reset Device command to the command ring */
        spin_lock_irqsave(&xhci->lock, flags);
        reset_device_cmd->command_trb = xhci->cmd_ring->enqueue;
+        /* Enqueue pointer can be left pointing to the link TRB,
+         * we must handle that
+         */
+        if ((reset_device_cmd->command_trb->link.control & TRB_TYPE_BITMASK)
+                        == TRB_TYPE(TRB_LINK))
+                reset_device_cmd->command_trb =
+                        xhci->cmd_ring->enq_seg->next->trbs;
        list_add_tail(&reset_device_cmd->cmd_list, &virt_dev->cmd_list);
        ret = xhci_queue_reset_device(xhci, slot_id);
        if (ret) {
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 93d3bf4d213c..170c367112d2 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -454,6 +454,24 @@ struct xhci_doorbell_array {
 /**
+ * struct xhci_protocol_caps
+ * @revision:           major revision, minor revision, capability ID,
+ *                      and next capability pointer.
+ * @name_string:        Four ASCII characters to say which spec this xHC
+ *                      follows, typically "USB ".
+ * @port_info:          Port offset, count, and protocol-defined information.
+ */
+struct xhci_protocol_caps {
+        u32     revision;
+        u32     name_string;
+        u32     port_info;
+};
+#define XHCI_EXT_PORT_MAJOR(x)  (((x) >> 24) & 0xff)
+#define XHCI_EXT_PORT_OFF(x)    ((x) & 0xff)
+#define XHCI_EXT_PORT_COUNT(x)  (((x) >> 8) & 0xff)
+/**
 * struct xhci_container_ctx
 * @type: Type of context.  Used to calculated offsets to contained contexts.
 * @size: Size of the context data
@@ -621,6 +639,11 @@ struct xhci_ep_ctx {
 #define MAX_PACKET_MASK         (0xffff << 16)
 #define MAX_PACKET_DECODED(p)   (((p) >> 16) & 0xffff)
+/* Get max packet size from ep desc. Bit 10..0 specify the max packet size.
+ * USB2.0 spec 9.6.6.
+ */
+#define GET_MAX_PACKET(p)       ((p) & 0x7ff)
 /* tx_info bitmasks */
 #define AVG_TRB_LENGTH_FOR_EP(p)        ((p) & 0xffff)
 #define MAX_ESIT_PAYLOAD_FOR_EP(p)      (((p) & 0xffff) << 16)
@@ -1235,6 +1258,14 @@ struct xhci_hcd {
        u32                     suspended_ports[8];     /* which ports are
                                                           suspended */
        unsigned long           resume_done[MAX_HC_PORTS];
+        /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
+        u8                      *port_array;
+        /* Array of pointers to USB 3.0 PORTSC registers */
+        u32 __iomem             **usb3_ports;
+        unsigned int            num_usb3_ports;
+        /* Array of pointers to USB 2.0 PORTSC registers */
+        u32 __iomem             **usb2_ports;
+        unsigned int            num_usb2_ports;
 };
 /* For testing purposes */
diff --git a/drivers/usb/misc/cypress_cy7c63.c b/drivers/usb/misc/cypress_cy7c63.c
index 2f43c57743c9..9251773ecef4 100644
--- a/drivers/usb/misc/cypress_cy7c63.c
+++ b/drivers/usb/misc/cypress_cy7c63.c
@@ -196,11 +196,9 @@ static ssize_t get_port1_handler(struct device *dev,
        return read_port(dev, attr, buf, 1, CYPRESS_READ_PORT_ID1);
 }
-static DEVICE_ATTR(port0, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(port0, S_IRUGO | S_IWUSR, get_port0_handler, set_port0_handler);
-                   get_port0_handler, set_port0_handler);
-static DEVICE_ATTR(port1, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(port1, S_IRUGO | S_IWUSR, get_port1_handler, set_port1_handler);
-                   get_port1_handler, set_port1_handler);
 static int cypress_probe(struct usb_interface *interface,
diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c
index d77aba46ae85..f63776a48e2a 100644
--- a/drivers/usb/misc/trancevibrator.c
+++ b/drivers/usb/misc/trancevibrator.c
@@ -86,7 +86,7 @@ static ssize_t set_speed(struct device *dev, struct device_attribute *attr,
        return count;
 }
-static DEVICE_ATTR(speed, S_IWUGO | S_IRUGO, show_speed, set_speed);
+static DEVICE_ATTR(speed, S_IRUGO | S_IWUSR, show_speed, set_speed);
 static int tv_probe(struct usb_interface *interface,
                    const struct usb_device_id *id)
diff --git a/drivers/usb/misc/usbled.c b/drivers/usb/misc/usbled.c
index 63da2c3c838f..c96f51de1696 100644
--- a/drivers/usb/misc/usbled.c
+++ b/drivers/usb/misc/usbled.c
@@ -94,7 +94,7 @@ static ssize_t set_##value(struct device *dev, struct device_attribute *attr, co
        change_color(led);                                              \
        return count;                                                   \
 }                                                                       \
-static DEVICE_ATTR(value, S_IWUGO | S_IRUGO, show_##value, set_##value);
+static DEVICE_ATTR(value, S_IRUGO | S_IWUSR, show_##value, set_##value);
 show_set(blue);
 show_set(red);
 show_set(green);
diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
index de8ef945b536..417b8f207e8b 100644
--- a/drivers/usb/misc/usbsevseg.c
+++ b/drivers/usb/misc/usbsevseg.c
@@ -192,7 +192,7 @@ static ssize_t set_attr_##name(struct device *dev, 		\
                                                                \
        return count;                                           \
 }                                                               \
-static DEVICE_ATTR(name, S_IWUGO | S_IRUGO, show_attr_##name, set_attr_##name);
+static DEVICE_ATTR(name, S_IRUGO | S_IWUSR, show_attr_##name, set_attr_##name);
 static ssize_t show_attr_text(struct device *dev,
        struct device_attribute *attr, char *buf)
@@ -223,7 +223,7 @@ static ssize_t set_attr_text(struct device *dev,
        return count;
 }
-static DEVICE_ATTR(text, S_IWUGO | S_IRUGO, show_attr_text, set_attr_text);
+static DEVICE_ATTR(text, S_IRUGO | S_IWUSR, show_attr_text, set_attr_text);
 static ssize_t show_attr_decimals(struct device *dev,
        struct device_attribute *attr, char *buf)
@@ -272,8 +272,7 @@ static ssize_t set_attr_decimals(struct device *dev,
        return count;
 }
-static DEVICE_ATTR(decimals, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(decimals, S_IRUGO | S_IWUSR, show_attr_decimals, set_attr_decimals);
-        show_attr_decimals, set_attr_decimals);
 static ssize_t show_attr_textmode(struct device *dev,
        struct device_attribute *attr, char *buf)
@@ -319,8 +318,7 @@ static ssize_t set_attr_textmode(struct device *dev,
        return -EINVAL;
 }
-static DEVICE_ATTR(textmode, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(textmode, S_IRUGO | S_IWUSR, show_attr_textmode, set_attr_textmode);
-        show_attr_textmode, set_attr_textmode);
 MYDEV_ATTR_SIMPLE_UNSIGNED(powered, update_display_powered);
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 719c6180b31f..ac5bfd619e62 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -536,6 +536,7 @@ static const struct file_operations yurex_fops = {
        .open =         yurex_open,
        .release =      yurex_release,
        .fasync =       yurex_fasync,
+        .llseek =       default_llseek,
 };
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index e6669fc3b804..99beebce8550 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2116,12 +2116,15 @@ bad_config:
         * Otherwise, wait till the gadget driver hooks up.
         */
        if (!is_otg_enabled(musb) && is_host_enabled(musb)) {
+                struct usb_hcd  *hcd = musb_to_hcd(musb);
                MUSB_HST_MODE(musb);
                musb->xceiv->default_a = 1;
                musb->xceiv->state = OTG_STATE_A_IDLE;
                status = usb_add_hcd(musb_to_hcd(musb), -1, 0);
+                hcd->self.uses_pio_for_control = 1;
                DBG(1, "%s mode, status %d, devctl %02x %c\n",
                        "HOST", status,
                        musb_readb(musb->mregs, MUSB_DEVCTL),
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 36cfd060dbe5..9d6ade82b9f2 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -92,6 +92,59 @@
 /* ----------------------------------------------------------------------- */
+/* Maps the buffer to dma  */
+static inline void map_dma_buffer(struct musb_request *request,
+                                struct musb *musb)
+{
+        if (request->request.dma == DMA_ADDR_INVALID) {
+                request->request.dma = dma_map_single(
+                                musb->controller,
+                                request->request.buf,
+                                request->request.length,
+                                request->tx
+                                        ? DMA_TO_DEVICE
+                                        : DMA_FROM_DEVICE);
+                request->mapped = 1;
+        } else {
+                dma_sync_single_for_device(musb->controller,
+                        request->request.dma,
+                        request->request.length,
+                        request->tx
+                                ? DMA_TO_DEVICE
+                                : DMA_FROM_DEVICE);
+                request->mapped = 0;
+        }
+}
+/* Unmap the buffer from dma and maps it back to cpu */
+static inline void unmap_dma_buffer(struct musb_request *request,
+                                struct musb *musb)
+{
+        if (request->request.dma == DMA_ADDR_INVALID) {
+                DBG(20, "not unmapping a never mapped buffer\n");
+                return;
+        }
+        if (request->mapped) {
+                dma_unmap_single(musb->controller,
+                        request->request.dma,
+                        request->request.length,
+                        request->tx
+                                ? DMA_TO_DEVICE
+                                : DMA_FROM_DEVICE);
+                request->request.dma = DMA_ADDR_INVALID;
+                request->mapped = 0;
+        } else {
+                dma_sync_single_for_cpu(musb->controller,
+                        request->request.dma,
+                        request->request.length,
+                        request->tx
+                                ? DMA_TO_DEVICE
+                                : DMA_FROM_DEVICE);
+        }
+}
 /*
 * Immediately complete a request.
 *
@@ -119,24 +172,8 @@ __acquires(ep->musb->lock)
        ep->busy = 1;
        spin_unlock(&musb->lock);
-        if (is_dma_capable()) {
+        if (is_dma_capable() && ep->dma)
-                if (req->mapped) {
+                unmap_dma_buffer(req, musb);
-                        dma_unmap_single(musb->controller,
-                                        req->request.dma,
-                                        req->request.length,
-                                        req->tx
-                                                ? DMA_TO_DEVICE
-                                                : DMA_FROM_DEVICE);
-                        req->request.dma = DMA_ADDR_INVALID;
-                        req->mapped = 0;
-                } else if (req->request.dma != DMA_ADDR_INVALID)
-                        dma_sync_single_for_cpu(musb->controller,
-                                        req->request.dma,
-                                        req->request.length,
-                                        req->tx
-                                                ? DMA_TO_DEVICE
-                                                : DMA_FROM_DEVICE);
-        }
        if (request->status == 0)
                DBG(5, "%s done request %p,  %d/%d\n",
                                ep->end_point.name, request,
@@ -395,6 +432,13 @@ static void txstate(struct musb *musb, struct musb_request *req)
 #endif
        if (!use_dma) {
+                /*
+                 * Unmap the dma buffer back to cpu if dma channel
+                 * programming fails
+                 */
+                if (is_dma_capable() && musb_ep->dma)
+                        unmap_dma_buffer(req, musb);
                musb_write_fifo(musb_ep->hw_ep, fifo_count,
                                (u8 *) (request->buf + request->actual));
                request->actual += fifo_count;
@@ -713,6 +757,21 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                                        return;
                        }
 #endif
+                        /*
+                         * Unmap the dma buffer back to cpu if dma channel
+                         * programming fails. This buffer is mapped if the
+                         * channel allocation is successful
+                         */
+                         if (is_dma_capable() && musb_ep->dma) {
+                                unmap_dma_buffer(req, musb);
+                                /*
+                                 * Clear DMAENAB and AUTOCLEAR for the
+                                 * PIO mode transfer
+                                 */
+                                csr &= ~(MUSB_RXCSR_DMAENAB | MUSB_RXCSR_AUTOCLEAR);
+                                musb_writew(epio, MUSB_RXCSR, csr);
+                        }
                        musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
                                        (request->buf + request->actual));
@@ -837,7 +896,9 @@ void musb_g_rx(struct musb *musb, u8 epnum)
                if (!request)
                        return;
        }
+#if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_TUSB_OMAP_DMA)
 exit:
+#endif
        /* Analyze request */
        rxstate(musb, to_musb_request(request));
 }
@@ -1150,26 +1211,9 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
        request->epnum = musb_ep->current_epnum;
        request->tx = musb_ep->is_in;
-        if (is_dma_capable() && musb_ep->dma) {
+        if (is_dma_capable() && musb_ep->dma)
-                if (request->request.dma == DMA_ADDR_INVALID) {
+                map_dma_buffer(request, musb);
-                        request->request.dma = dma_map_single(
+        else
-                                        musb->controller,
-                                        request->request.buf,
-                                        request->request.length,
-                                        request->tx
-                                                ? DMA_TO_DEVICE
-                                                : DMA_FROM_DEVICE);
-                        request->mapped = 1;
-                } else {
-                        dma_sync_single_for_device(musb->controller,
-                                        request->request.dma,
-                                        request->request.length,
-                                        request->tx
-                                                ? DMA_TO_DEVICE
-                                                : DMA_FROM_DEVICE);
-                        request->mapped = 0;
-                }
-        } else
                request->mapped = 0;
        spin_lock_irqsave(&musb->lock, lockflags);
@@ -1789,6 +1833,8 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                spin_unlock_irqrestore(&musb->lock, flags);
                if (is_otg_enabled(musb)) {
+                        struct usb_hcd  *hcd = musb_to_hcd(musb);
                        DBG(3, "OTG startup...\n");
                        /* REVISIT:  funcall to other code, which also
@@ -1803,6 +1849,8 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                                musb->gadget_driver = NULL;
                                musb->g.dev.driver = NULL;
                                spin_unlock_irqrestore(&musb->lock, flags);
+                        } else {
+                                hcd->self.uses_pio_for_control = 1;
                        }
                }
        }
diff --git a/drivers/usb/otg/langwell_otg.c b/drivers/usb/otg/langwell_otg.c
index bdc3ea66be69..9fea48264fa2 100644
--- a/drivers/usb/otg/langwell_otg.c
+++ b/drivers/usb/otg/langwell_otg.c
@@ -1896,7 +1896,7 @@ set_a_bus_req(struct device *dev, struct device_attribute *attr,
        }
        return count;
 }
-static DEVICE_ATTR(a_bus_req, S_IRUGO | S_IWUGO, get_a_bus_req, set_a_bus_req);
+static DEVICE_ATTR(a_bus_req, S_IRUGO | S_IWUSR, get_a_bus_req, set_a_bus_req);
 static ssize_t
 get_a_bus_drop(struct device *dev, struct device_attribute *attr, char *buf)
@@ -1942,8 +1942,7 @@ set_a_bus_drop(struct device *dev, struct device_attribute *attr,
        }
        return count;
 }
-static DEVICE_ATTR(a_bus_drop, S_IRUGO | S_IWUGO,
+static DEVICE_ATTR(a_bus_drop, S_IRUGO | S_IWUSR, get_a_bus_drop, set_a_bus_drop);
-        get_a_bus_drop, set_a_bus_drop);
 static ssize_t
 get_b_bus_req(struct device *dev, struct device_attribute *attr, char *buf)
@@ -1988,7 +1987,7 @@ set_b_bus_req(struct device *dev, struct device_attribute *attr,
        }
        return count;
 }
-static DEVICE_ATTR(b_bus_req, S_IRUGO | S_IWUGO, get_b_bus_req, set_b_bus_req);
+static DEVICE_ATTR(b_bus_req, S_IRUGO | S_IWUSR, get_b_bus_req, set_b_bus_req);
 static ssize_t
 set_a_clr_err(struct device *dev, struct device_attribute *attr,
@@ -2012,7 +2011,7 @@ set_a_clr_err(struct device *dev, struct device_attribute *attr,
        }
        return count;
 }
-static DEVICE_ATTR(a_clr_err, S_IWUGO, NULL, set_a_clr_err);
+static DEVICE_ATTR(a_clr_err, S_IWUSR, NULL, set_a_clr_err);
 static struct attribute *inputs_attrs[] = {
        &dev_attr_a_bus_req.attr,
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 76f8b3556672..6a50965e23f2 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -201,6 +201,7 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) },
+        { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) },
        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) },
        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) },
        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) },
@@ -696,6 +697,7 @@ static struct usb_device_id id_table_combined [] = {
                .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
        { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
        { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 263f62551197..1286f1e23d8c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -114,6 +114,9 @@
 /* Lenz LI-USB Computer Interface. */
 #define FTDI_LENZ_LIUSB_PID     0xD780
+/* Vardaan Enterprises Serial Interface VEUSB422R3 */
+#define FTDI_VARDAAN_PID        0xF070
 /*
 * Xsens Technologies BV products (http://www.xsens.com).
 */
@@ -721,6 +724,7 @@
 */
 #define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
 #define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
+#define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
 /*
 * Bayer Ascensia Contour blood glucose meter USB-converter cable.
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 861223f2af6e..6954de50c0ff 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -51,6 +51,7 @@ static struct usb_driver usb_serial_driver = {
        .suspend =      usb_serial_suspend,
        .resume =       usb_serial_resume,
        .no_dynamic_id =        1,
+        .supports_autosuspend = 1,
 };
 /* There is no MODULE_DEVICE_TABLE for usbserial.c.  Instead
@@ -1343,6 +1344,8 @@ int usb_serial_register(struct usb_serial_driver *driver)
                return -ENODEV;
        fixup_generic(driver);
+        if (driver->usb_driver)
+                driver->usb_driver->supports_autosuspend = 1;
        if (!driver->description)
                driver->description = driver->driver.name;
diff --git a/drivers/usb/storage/sierra_ms.c b/drivers/usb/storage/sierra_ms.c
index 57fc2f532cab..ceba512f84d0 100644
--- a/drivers/usb/storage/sierra_ms.c
+++ b/drivers/usb/storage/sierra_ms.c
@@ -121,7 +121,7 @@ static ssize_t show_truinst(struct device *dev, struct device_attribute *attr,
        }
        return result;
 }
-static DEVICE_ATTR(truinst, S_IWUGO | S_IRUGO, show_truinst, NULL);
+static DEVICE_ATTR(truinst, S_IRUGO, show_truinst, NULL);
 int sierra_ms_init(struct us_data *us)
 {
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 4b4da5b86ff9..f442668a1e52 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -129,8 +129,9 @@ static void handle_tx(struct vhost_net *net)
        size_t hdr_size;
        struct socket *sock;
-        sock = rcu_dereference_check(vq->private_data,
+        /* TODO: check that we are running from vhost_worker?
-                                     lockdep_is_held(&vq->mutex));
+         * Not sure it's worth it, it's straight-forward enough. */
+        sock = rcu_dereference_check(vq->private_data, 1);
        if (!sock)
                return;
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index e207810bba3c..08703299ef61 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -197,12 +197,12 @@ static int backlight_suspend(struct device *dev, pm_message_t state)
 {
        struct backlight_device *bd = to_backlight_device(dev);
-        if (bd->ops->options & BL_CORE_SUSPENDRESUME) {
+        mutex_lock(&bd->ops_lock);
-                mutex_lock(&bd->ops_lock);
+        if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) {
                bd->props.state |= BL_CORE_SUSPENDED;
                backlight_update_status(bd);
-                mutex_unlock(&bd->ops_lock);
        }
+        mutex_unlock(&bd->ops_lock);
        return 0;
 }
@@ -211,12 +211,12 @@ static int backlight_resume(struct device *dev)
 {
        struct backlight_device *bd = to_backlight_device(dev);
-        if (bd->ops->options & BL_CORE_SUSPENDRESUME) {
+        mutex_lock(&bd->ops_lock);
-                mutex_lock(&bd->ops_lock);
+        if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) {
                bd->props.state &= ~BL_CORE_SUSPENDED;
                backlight_update_status(bd);
-                mutex_unlock(&bd->ops_lock);
        }
+        mutex_unlock(&bd->ops_lock);
        return 0;
 }
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c
index cad7d45c8bac..c265aed09e04 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/da8xx-fb.c
@@ -1029,10 +1029,6 @@ static int __init fb_probe(struct platform_device *device)
                goto err_release_pl_mem;
        }
-        ret = request_irq(par->irq, lcdc_irq_handler, 0, DRIVER_NAME, par);
-        if (ret)
-                goto err_release_pl_mem;
        /* Initialize par */
        da8xx_fb_info->var.bits_per_pixel = lcd_cfg->bpp;
@@ -1060,7 +1056,7 @@ static int __init fb_probe(struct platform_device *device)
        ret = fb_alloc_cmap(&da8xx_fb_info->cmap, PALETTE_SIZE, 0);
        if (ret)
-                goto err_free_irq;
+                goto err_release_pl_mem;
        da8xx_fb_info->cmap.len = par->palette_sz;
        /* initialize var_screeninfo */
@@ -1088,8 +1084,13 @@ static int __init fb_probe(struct platform_device *device)
                goto err_cpu_freq;
        }
 #endif
+        ret = request_irq(par->irq, lcdc_irq_handler, 0, DRIVER_NAME, par);
+        if (ret)
+                goto irq_freq;
        return 0;
+irq_freq:
 #ifdef CONFIG_CPU_FREQ
 err_cpu_freq:
        unregister_framebuffer(da8xx_fb_info);
@@ -1098,9 +1099,6 @@ err_cpu_freq:
 err_dealloc_cmap:
        fb_dealloc_cmap(&da8xx_fb_info->cmap);
-err_free_irq:
-        free_irq(par->irq, par);
 err_release_pl_mem:
        dma_free_coherent(NULL, PALETTE_SIZE, par->v_palette_base,
                          par->p_palette_base);
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index f53b9f1d6aba..5c3960da755a 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -80,6 +80,7 @@ static const struct fb_cmap default_16_colors = {
 *      @cmap: frame buffer colormap structure
 *      @len: length of @cmap
 *      @transp: boolean, 1 if there is transparency, 0 otherwise
+ *      @flags: flags for kmalloc memory allocation
 *
 *      Allocates memory for a colormap @cmap.  @len is the
 *      number of entries in the palette.
@@ -88,34 +89,48 @@ static const struct fb_cmap default_16_colors = {
 *
 */
-int fb_alloc_cmap(struct fb_cmap *cmap, int len, int transp)
+int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags)
 {
-    int size = len*sizeof(u16);
+        int size = len * sizeof(u16);
+        int ret = -ENOMEM;
-    if (cmap->len != len) {
-        fb_dealloc_cmap(cmap);
+        if (cmap->len != len) {
-        if (!len)
+                fb_dealloc_cmap(cmap);
-            return 0;
+                if (!len)
-        if (!(cmap->red = kmalloc(size, GFP_ATOMIC)))
+                        return 0;
-            goto fail;
-        if (!(cmap->green = kmalloc(size, GFP_ATOMIC)))
+                cmap->red = kmalloc(size, flags);
-            goto fail;
+                if (!cmap->red)
-        if (!(cmap->blue = kmalloc(size, GFP_ATOMIC)))
+                        goto fail;
-            goto fail;
+                cmap->green = kmalloc(size, flags);
-        if (transp) {
+                if (!cmap->green)
-            if (!(cmap->transp = kmalloc(size, GFP_ATOMIC)))
+                        goto fail;
+                cmap->blue = kmalloc(size, flags);
+                if (!cmap->blue)
+                        goto fail;
+                if (transp) {
+                        cmap->transp = kmalloc(size, flags);
+                        if (!cmap->transp)
+                                goto fail;
+                } else {
+                        cmap->transp = NULL;
+                }
+        }
+        cmap->start = 0;
+        cmap->len = len;
+        ret = fb_copy_cmap(fb_default_cmap(len), cmap);
+        if (ret)
                goto fail;
-        } else
+        return 0;
-            cmap->transp = NULL;
-    }
-    cmap->start = 0;
-    cmap->len = len;
-    fb_copy_cmap(fb_default_cmap(len), cmap);
-    return 0;
 fail:
-    fb_dealloc_cmap(cmap);
+        fb_dealloc_cmap(cmap);
-    return -ENOMEM;
+        return ret;
+}
+int fb_alloc_cmap(struct fb_cmap *cmap, int len, int transp)
+{
+        return fb_alloc_cmap_gfp(cmap, len, transp, GFP_ATOMIC);
 }
 /**
@@ -250,8 +265,12 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
        int rc, size = cmap->len * sizeof(u16);
        struct fb_cmap umap;
+        if (size < 0 || size < cmap->len)
+                return -E2BIG;
        memset(&umap, 0, sizeof(struct fb_cmap));
-        rc = fb_alloc_cmap(&umap, cmap->len, cmap->transp != NULL);
+        rc = fb_alloc_cmap_gfp(&umap, cmap->len, cmap->transp != NULL,
+                                GFP_KERNEL);
        if (rc)
                return rc;
        if (copy_from_user(umap.red, cmap->red, size) ||
diff --git a/drivers/video/geode/lxfb.h b/drivers/video/geode/lxfb.h
index e4c4d89b7860..be8ccb47ebe0 100644
--- a/drivers/video/geode/lxfb.h
+++ b/drivers/video/geode/lxfb.h
@@ -22,6 +22,7 @@
 #define DC_HFILT_COUNT  0x100
 #define DC_VFILT_COUNT  0x100
 #define VP_COEFF_SIZE   0x1000
+#define VP_PAL_COUNT    0x100
 #define OUTPUT_CRT   0x01
 #define OUTPUT_PANEL 0x02
@@ -48,7 +49,8 @@ struct lxfb_par {
        uint64_t vp[VP_REG_COUNT];
        uint64_t fp[FP_REG_COUNT];
-        uint32_t pal[DC_PAL_COUNT];
+        uint32_t dc_pal[DC_PAL_COUNT];
+        uint32_t vp_pal[VP_PAL_COUNT];
        uint32_t hcoeff[DC_HFILT_COUNT * 2];
        uint32_t vcoeff[DC_VFILT_COUNT];
        uint32_t vp_coeff[VP_COEFF_SIZE / 4];
diff --git a/drivers/video/geode/lxfb_ops.c b/drivers/video/geode/lxfb_ops.c
index bc35a95e59d4..79e9abc72b83 100644
--- a/drivers/video/geode/lxfb_ops.c
+++ b/drivers/video/geode/lxfb_ops.c
@@ -276,10 +276,10 @@ static void lx_graphics_enable(struct fb_info *info)
                write_fp(par, FP_PT1, 0);
                temp = FP_PT2_SCRC;
-                if (info->var.sync & FB_SYNC_HOR_HIGH_ACT)
+                if (!(info->var.sync & FB_SYNC_HOR_HIGH_ACT))
                        temp |= FP_PT2_HSP;
-                if (info->var.sync & FB_SYNC_VERT_HIGH_ACT)
+                if (!(info->var.sync & FB_SYNC_VERT_HIGH_ACT))
                        temp |= FP_PT2_VSP;
                write_fp(par, FP_PT2, temp);
@@ -610,10 +610,15 @@ static void lx_save_regs(struct lxfb_par *par)
        memcpy(par->vp, par->vp_regs, sizeof(par->vp));
        memcpy(par->fp, par->vp_regs + VP_FP_START, sizeof(par->fp));
-        /* save the palette */
+        /* save the display controller palette */
        write_dc(par, DC_PAL_ADDRESS, 0);
-        for (i = 0; i < ARRAY_SIZE(par->pal); i++)
+        for (i = 0; i < ARRAY_SIZE(par->dc_pal); i++)
-                par->pal[i] = read_dc(par, DC_PAL_DATA);
+                par->dc_pal[i] = read_dc(par, DC_PAL_DATA);
+        /* save the video processor palette */
+        write_vp(par, VP_PAR, 0);
+        for (i = 0; i < ARRAY_SIZE(par->vp_pal); i++)
+                par->vp_pal[i] = read_vp(par, VP_PDR);
        /* save the horizontal filter coefficients */
        filt = par->dc[DC_IRQ_FILT_CTL] | DC_IRQ_FILT_CTL_H_FILT_SEL;
@@ -706,8 +711,8 @@ static void lx_restore_display_ctlr(struct lxfb_par *par)
        /* restore the palette */
        write_dc(par, DC_PAL_ADDRESS, 0);
-        for (i = 0; i < ARRAY_SIZE(par->pal); i++)
+        for (i = 0; i < ARRAY_SIZE(par->dc_pal); i++)
-                write_dc(par, DC_PAL_DATA, par->pal[i]);
+                write_dc(par, DC_PAL_DATA, par->dc_pal[i]);
        /* restore the horizontal filter coefficients */
        filt = par->dc[DC_IRQ_FILT_CTL] | DC_IRQ_FILT_CTL_H_FILT_SEL;
@@ -751,6 +756,11 @@ static void lx_restore_video_proc(struct lxfb_par *par)
                }
        }
+        /* restore video processor palette */
+        write_vp(par, VP_PAR, 0);
+        for (i = 0; i < ARRAY_SIZE(par->vp_pal); i++)
+                write_vp(par, VP_PDR, par->vp_pal[i]);
        /* restore video coeff ram */
        memcpy(par->vp_regs + VP_VCR, par->vp_coeff, sizeof(par->vp_coeff));
 }
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index 7cfc170bce19..ca0f6be9d12e 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -27,6 +27,7 @@
 #include <linux/clk.h>
 #include <linux/mutex.h>
+#include <mach/dma.h>
 #include <mach/hardware.h>
 #include <mach/ipu.h>
 #include <mach/mx3fb.h>
@@ -1420,6 +1421,9 @@ static bool chan_filter(struct dma_chan *chan, void *arg)
        struct device *dev;
        struct mx3fb_platform_data *mx3fb_pdata;
+        if (!imx_dma_is_ipu(chan))
+                return false;
        if (!rq)
                return false;
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 9b1364723c65..b02d97a879d6 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -860,7 +860,7 @@ static void sh_mobile_fb_reconfig(struct fb_info *info)
                /* Couldn't reconfigure, hopefully, can continue as before */
                return;
-        info->fix.line_length = mode2.xres * (ch->cfg.bpp / 8);
+        info->fix.line_length = mode1.xres * (ch->cfg.bpp / 8);
        /*
         * fb_set_var() calls the notifier change internally, only if
@@ -868,7 +868,7 @@ static void sh_mobile_fb_reconfig(struct fb_info *info)
         * user event, we have to call the chain ourselves.
         */
        event.info = info;
-        event.data = &mode2;
+        event.data = &mode1;
        fb_notifier_call_chain(evnt, &event);
 }
diff --git a/drivers/video/sis/init.c b/drivers/video/sis/init.c
index c311ad3c3687..31137adc8fba 100644
--- a/drivers/video/sis/init.c
+++ b/drivers/video/sis/init.c
@@ -62,11 +62,11 @@
 #include "init.h"
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 #include "300vtbl.h"
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 #include "310vtbl.h"
 #endif
@@ -78,7 +78,7 @@
 /*         POINTER INITIALIZATION            */
 /*********************************************/
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
 static void
 InitCommonPointer(struct SiS_Private *SiS_Pr)
 {
@@ -160,7 +160,7 @@ InitCommonPointer(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static void
 InitTo300Pointer(struct SiS_Private *SiS_Pr)
 {
@@ -237,7 +237,7 @@ InitTo300Pointer(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void
 InitTo310Pointer(struct SiS_Private *SiS_Pr)
 {
@@ -321,13 +321,13 @@ bool
 SiSInitPtr(struct SiS_Private *SiS_Pr)
 {
   if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      InitTo300Pointer(SiS_Pr);
 #else
      return false;
 #endif
   } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      InitTo310Pointer(SiS_Pr);
 #else
      return false;
@@ -340,9 +340,7 @@ SiSInitPtr(struct SiS_Private *SiS_Pr)
 /*            HELPER: Get ModeID             */
 /*********************************************/
-#ifndef SIS_XORG_XF86
 static
-#endif
 unsigned short
 SiS_GetModeID(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDisplay,
                int Depth, bool FSTN, int LCDwidth, int LCDheight)
@@ -884,51 +882,51 @@ SiS_GetModeID_VGA2(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDispl
 void
 SiS_SetReg(SISIOADDRESS port, unsigned short index, unsigned short data)
 {
-   OutPortByte(port, index);
+        outb((u8)index, port);
-   OutPortByte(port + 1, data);
+        outb((u8)data, port + 1);
 }
 void
 SiS_SetRegByte(SISIOADDRESS port, unsigned short data)
 {
-   OutPortByte(port, data);
+        outb((u8)data, port);
 }
 void
 SiS_SetRegShort(SISIOADDRESS port, unsigned short data)
 {
-   OutPortWord(port, data);
+        outw((u16)data, port);
 }
 void
 SiS_SetRegLong(SISIOADDRESS port, unsigned int data)
 {
-   OutPortLong(port, data);
+        outl((u32)data, port);
 }
 unsigned char
 SiS_GetReg(SISIOADDRESS port, unsigned short index)
 {
-   OutPortByte(port, index);
+        outb((u8)index, port);
-   return(InPortByte(port + 1));
+        return inb(port + 1);
 }
 unsigned char
 SiS_GetRegByte(SISIOADDRESS port)
 {
-   return(InPortByte(port));
+        return inb(port);
 }
 unsigned short
 SiS_GetRegShort(SISIOADDRESS port)
 {
-   return(InPortWord(port));
+        return inw(port);
 }
 unsigned int
 SiS_GetRegLong(SISIOADDRESS port)
 {
-   return(InPortLong(port));
+        return inl(port);
 }
 void
@@ -1089,7 +1087,7 @@ static void
 SiSInitPCIetc(struct SiS_Private *SiS_Pr)
 {
   switch(SiS_Pr->ChipType) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
   case SIS_300:
   case SIS_540:
   case SIS_630:
@@ -1108,7 +1106,7 @@ SiSInitPCIetc(struct SiS_Private *SiS_Pr)
      SiS_SetRegOR(SiS_Pr->SiS_P3c4,0x1E,0x5A);
      break;
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   case SIS_315H:
   case SIS_315:
   case SIS_315PRO:
@@ -1152,9 +1150,7 @@ SiSInitPCIetc(struct SiS_Private *SiS_Pr)
 /*             HELPER: SetLVDSetc            */
 /*********************************************/
-#ifdef SIS_LINUX_KERNEL
 static
-#endif
 void
 SiSSetLVDSetc(struct SiS_Private *SiS_Pr)
 {
@@ -1174,7 +1170,7 @@ SiSSetLVDSetc(struct SiS_Private *SiS_Pr)
   if((temp == 1) || (temp == 2)) return;
   switch(SiS_Pr->ChipType) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
   case SIS_540:
   case SIS_630:
   case SIS_730:
@@ -1188,7 +1184,7 @@ SiSSetLVDSetc(struct SiS_Private *SiS_Pr)
        }
        break;
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   case SIS_550:
   case SIS_650:
   case SIS_740:
@@ -1420,9 +1416,7 @@ SiS_ResetSegmentRegisters(struct SiS_Private *SiS_Pr)
 /*             HELPER: GetVBType             */
 /*********************************************/
-#ifdef SIS_LINUX_KERNEL
 static
-#endif
 void
 SiS_GetVBType(struct SiS_Private *SiS_Pr)
 {
@@ -1487,7 +1481,6 @@ SiS_GetVBType(struct SiS_Private *SiS_Pr)
 /*           HELPER: Check RAM size          */
 /*********************************************/
-#ifdef SIS_LINUX_KERNEL
 static bool
 SiS_CheckMemorySize(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
                unsigned short ModeIdIndex)
@@ -1501,13 +1494,12 @@ SiS_CheckMemorySize(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   if(AdapterMemSize < memorysize) return false;
   return true;
 }
-#endif
 /*********************************************/
 /*           HELPER: Get DRAM type           */
 /*********************************************/
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static unsigned char
 SiS_Get310DRAMType(struct SiS_Private *SiS_Pr)
 {
@@ -1574,7 +1566,6 @@ SiS_GetMCLK(struct SiS_Private *SiS_Pr)
 /*           HELPER: ClearBuffer             */
 /*********************************************/
-#ifdef SIS_LINUX_KERNEL
 static void
 SiS_ClearBuffer(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
 {
@@ -1587,7 +1578,7 @@ SiS_ClearBuffer(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
   if(SiS_Pr->SiS_ModeType >= ModeEGA) {
      if(ModeNo > 0x13) {
-         SiS_SetMemory(memaddr, memsize, 0);
+         memset_io(memaddr, 0, memsize);
      } else {
         pBuffer = (unsigned short SISIOMEMTYPE *)memaddr;
         for(i = 0; i < 0x4000; i++) writew(0x0000, &pBuffer[i]);
@@ -1596,10 +1587,9 @@ SiS_ClearBuffer(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
      pBuffer = (unsigned short SISIOMEMTYPE *)memaddr;
      for(i = 0; i < 0x4000; i++) writew(0x0720, &pBuffer[i]);
   } else {
-      SiS_SetMemory(memaddr, 0x8000, 0);
+      memset_io(memaddr, 0, 0x8000);
   }
 }
-#endif
 /*********************************************/
 /*           HELPER: SearchModeID            */
@@ -2132,7 +2122,7 @@ SiS_SetCRT1CRTC(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
      SiS_SetReg(SiS_Pr->SiS_P3d4,0x14,0x4F);
   }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(SiS_Pr->ChipType == XGI_20) {
      SiS_SetReg(SiS_Pr->SiS_P3d4,0x04,crt1data[4] - 1);
      if(!(temp = crt1data[5] & 0x1f)) {
@@ -2215,7 +2205,7 @@ SiS_SetCRT1VCLK(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   SiS_SetReg(SiS_Pr->SiS_P3c4,0x2c,clkb);
   if(SiS_Pr->ChipType >= SIS_315H) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      SiS_SetReg(SiS_Pr->SiS_P3c4,0x2D,0x01);
      if(SiS_Pr->ChipType == XGI_20) {
         unsigned short mf = SiS_GetModeFlag(SiS_Pr, ModeNo, ModeIdIndex);
@@ -2236,7 +2226,7 @@ SiS_SetCRT1VCLK(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
 /*                  FIFO                     */
 /*********************************************/
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 void
 SiS_GetFIFOThresholdIndex300(struct SiS_Private *SiS_Pr, unsigned short *idx1,
                unsigned short *idx2)
@@ -2506,11 +2496,7 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   SiS_SetRegANDOR(SiS_Pr->SiS_P3c4,0x09,0x80,data);
  /* Write foreground and background queue */
-#ifdef SIS_LINUX_KERNEL
   templ = sisfb_read_nbridge_pci_dword(SiS_Pr, 0x50);
-#else
-   templ = pciReadLong(0x00000000, 0x50);
-#endif
   if(SiS_Pr->ChipType == SIS_730) {
@@ -2530,13 +2516,8 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   }
-#ifdef SIS_LINUX_KERNEL
   sisfb_write_nbridge_pci_dword(SiS_Pr, 0x50, templ);
   templ = sisfb_read_nbridge_pci_dword(SiS_Pr, 0xA0);
-#else
-   pciWriteLong(0x00000000, 0x50, templ);
-   templ = pciReadLong(0x00000000, 0xA0);
-#endif
   /* GUI grant timer (PCI config 0xA3) */
   if(SiS_Pr->ChipType == SIS_730) {
@@ -2552,15 +2533,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   }
-#ifdef SIS_LINUX_KERNEL
   sisfb_write_nbridge_pci_dword(SiS_Pr, 0xA0, templ);
-#else
-   pciWriteLong(0x00000000, 0xA0, templ);
-#endif
 }
-#endif /* SIS300 */
+#endif /* CONFIG_FB_SIS_300 */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void
 SiS_SetCRT1FIFO_310(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short ModeIdIndex)
 {
@@ -2612,7 +2589,7 @@ SiS_SetVCLKState(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   }
   if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      if(VCLK > 150) data |= 0x80;
      SiS_SetRegANDOR(SiS_Pr->SiS_P3c4,0x07,0x7B,data);
@@ -2621,7 +2598,7 @@ SiS_SetVCLKState(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
      SiS_SetRegANDOR(SiS_Pr->SiS_P3c4,0x32,0xF7,data);
 #endif
   } else if(SiS_Pr->ChipType < XGI_20) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      if(VCLK >= 166) data |= 0x0c;
      SiS_SetRegANDOR(SiS_Pr->SiS_P3c4,0x32,0xf3,data);
@@ -2630,7 +2607,7 @@ SiS_SetVCLKState(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
      }
 #endif
   } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      if(VCLK >= 200) data |= 0x0c;
      if(SiS_Pr->ChipType == XGI_20) data &= ~0x04;
      SiS_SetRegANDOR(SiS_Pr->SiS_P3c4,0x32,0xf3,data);
@@ -2675,7 +2652,7 @@ SiS_SetCRT1ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
                unsigned short ModeIdIndex, unsigned short RRTI)
 {
   unsigned short data, infoflag = 0, modeflag, resindex;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   unsigned char  *ROMAddr  = SiS_Pr->VirtualRomBase;
   unsigned short data2, data3;
 #endif
@@ -2736,7 +2713,7 @@ SiS_SetCRT1ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
      SiS_SetRegANDOR(SiS_Pr->SiS_P3c4,0x0F,0xB7,data);
   }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(SiS_Pr->ChipType >= SIS_315H) {
      SiS_SetRegAND(SiS_Pr->SiS_P3c4,0x31,0xfb);
   }
@@ -2826,7 +2803,7 @@ SiS_SetCRT1ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   SiS_SetVCLKState(SiS_Pr, ModeNo, RRTI, ModeIdIndex);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(((SiS_Pr->ChipType >= SIS_315H) && (SiS_Pr->ChipType < SIS_661)) ||
       (SiS_Pr->ChipType == XGI_40)) {
      if(SiS_GetReg(SiS_Pr->SiS_P3d4,0x31) & 0x40) {
@@ -2845,7 +2822,7 @@ SiS_SetCRT1ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
 #endif
 }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void
 SiS_SetupDualChip(struct SiS_Private *SiS_Pr)
 {
@@ -2999,11 +2976,6 @@ SiS_SetCRT1Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sho
   SiS_Pr->SiS_SelectCRT2Rate = 0;
   SiS_Pr->SiS_SetFlag &= (~ProgrammingCRT2);
-#ifdef SIS_XORG_XF86
-   xf86DrvMsgVerb(0, X_PROBED, 4, "(init: VBType=0x%04x, VBInfo=0x%04x)\n",
-                    SiS_Pr->SiS_VBType, SiS_Pr->SiS_VBInfo);
-#endif
   if(SiS_Pr->SiS_VBInfo & SetSimuScanMode) {
      if(SiS_Pr->SiS_VBInfo & SetInSlaveMode) {
         SiS_Pr->SiS_SetFlag |= ProgrammingCRT2;
@@ -3028,7 +3000,7 @@ SiS_SetCRT1Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sho
   }
   switch(SiS_Pr->ChipType) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
   case SIS_300:
      SiS_SetCRT1FIFO_300(SiS_Pr, ModeNo, RefreshRateTableIndex);
      break;
@@ -3039,7 +3011,7 @@ SiS_SetCRT1Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sho
      break;
 #endif
   default:
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      if(SiS_Pr->ChipType == XGI_20) {
         unsigned char sr2b = 0, sr2c = 0;
         switch(ModeNo) {
@@ -3062,7 +3034,7 @@ SiS_SetCRT1Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sho
   SiS_SetCRT1ModeRegs(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(SiS_Pr->ChipType == XGI_40) {
      SiS_SetupDualChip(SiS_Pr);
   }
@@ -3070,11 +3042,9 @@ SiS_SetCRT1Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sho
   SiS_LoadDAC(SiS_Pr, ModeNo, ModeIdIndex);
-#ifdef SIS_LINUX_KERNEL
   if(SiS_Pr->SiS_flag_clearbuffer) {
      SiS_ClearBuffer(SiS_Pr, ModeNo);
   }
-#endif
   if(!(SiS_Pr->SiS_VBInfo & (SetSimuScanMode | SwitchCRT2 | SetCRT2ToLCDA))) {
      SiS_WaitRetrace1(SiS_Pr);
@@ -3104,7 +3074,7 @@ SiS_InitVB(struct SiS_Private *SiS_Pr)
 static void
 SiS_ResetVB(struct SiS_Private *SiS_Pr)
 {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   unsigned char  *ROMAddr = SiS_Pr->VirtualRomBase;
   unsigned short temp;
@@ -3139,7 +3109,7 @@ SiS_StrangeStuff(struct SiS_Private *SiS_Pr)
    * which locks CRT2 in some way to CRT1 timing. Disable
    * this here.
    */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if((IS_SIS651) || (IS_SISM650) ||
      SiS_Pr->ChipType == SIS_340 ||
      SiS_Pr->ChipType == XGI_40) {
@@ -3160,7 +3130,7 @@ SiS_StrangeStuff(struct SiS_Private *SiS_Pr)
 static void
 SiS_Handle760(struct SiS_Private *SiS_Pr)
 {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   unsigned int somebase;
   unsigned char temp1, temp2, temp3;
@@ -3170,11 +3140,7 @@ SiS_Handle760(struct SiS_Private *SiS_Pr)
       (!(SiS_Pr->SiS_SysFlags & SF_760UMA)) )
      return;
-#ifdef SIS_LINUX_KERNEL
   somebase = sisfb_read_mio_pci_word(SiS_Pr, 0x74);
-#else
-   somebase = pciReadWord(0x00001000, 0x74);
-#endif
   somebase &= 0xffff;
   if(somebase == 0) return;
@@ -3190,105 +3156,34 @@ SiS_Handle760(struct SiS_Private *SiS_Pr)
      temp2 = 0x0b;
   }
-#ifdef SIS_LINUX_KERNEL
   sisfb_write_nbridge_pci_byte(SiS_Pr, 0x7e, temp1);
   sisfb_write_nbridge_pci_byte(SiS_Pr, 0x8d, temp2);
-#else
-   pciWriteByte(0x00000000, 0x7e, temp1);
-   pciWriteByte(0x00000000, 0x8d, temp2);
-#endif
   SiS_SetRegByte((somebase + 0x85), temp3);
 #endif
 }
 /*********************************************/
-/*      X.org/XFree86: SET SCREEN PITCH      */
-/*********************************************/
-#ifdef SIS_XORG_XF86
-static void
-SiS_SetPitchCRT1(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn)
-{
-   SISPtr pSiS = SISPTR(pScrn);
-   unsigned short HDisplay = pSiS->scrnPitch >> 3;
-   SiS_SetReg(SiS_Pr->SiS_P3d4,0x13,(HDisplay & 0xFF));
-   SiS_SetRegANDOR(SiS_Pr->SiS_P3c4,0x0E,0xF0,(HDisplay >> 8));
-}
-static void
-SiS_SetPitchCRT2(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn)
-{
-   SISPtr pSiS = SISPTR(pScrn);
-   unsigned short HDisplay = pSiS->scrnPitch2 >> 3;
-    /* Unlock CRT2 */
-   if(pSiS->VGAEngine == SIS_315_VGA)
-      SiS_SetRegOR(SiS_Pr->SiS_Part1Port,0x2F, 0x01);
-   else
-      SiS_SetRegOR(SiS_Pr->SiS_Part1Port,0x24, 0x01);
-   SiS_SetReg(SiS_Pr->SiS_Part1Port,0x07,(HDisplay & 0xFF));
-   SiS_SetRegANDOR(SiS_Pr->SiS_Part1Port,0x09,0xF0,(HDisplay >> 8));
-}
-static void
-SiS_SetPitch(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn)
-{
-   SISPtr pSiS = SISPTR(pScrn);
-   bool isslavemode = false;
-   if( (pSiS->VBFlags2 & VB2_VIDEOBRIDGE) &&
-       ( ((pSiS->VGAEngine == SIS_300_VGA) &&
-          (SiS_GetReg(SiS_Pr->SiS_Part1Port,0x00) & 0xa0) == 0x20) ||
-         ((pSiS->VGAEngine == SIS_315_VGA) &&
-          (SiS_GetReg(SiS_Pr->SiS_Part1Port,0x00) & 0x50) == 0x10) ) ) {
-      isslavemode = true;
-   }
-   /* We need to set pitch for CRT1 if bridge is in slave mode, too */
-   if((pSiS->VBFlags & DISPTYPE_DISP1) || (isslavemode)) {
-      SiS_SetPitchCRT1(SiS_Pr, pScrn);
-   }
-   /* We must not set the pitch for CRT2 if bridge is in slave mode */
-   if((pSiS->VBFlags & DISPTYPE_DISP2) && (!isslavemode)) {
-      SiS_SetPitchCRT2(SiS_Pr, pScrn);
-   }
-}
-#endif
-/*********************************************/
 /*                 SiSSetMode()              */
 /*********************************************/
-#ifdef SIS_XORG_XF86
-/* We need pScrn for setting the pitch correctly */
-bool
-SiSSetMode(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn, unsigned short ModeNo, bool dosetpitch)
-#else
 bool
 SiSSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
-#endif
 {
   SISIOADDRESS BaseAddr = SiS_Pr->IOAddress;
   unsigned short RealModeNo, ModeIdIndex;
   unsigned char  backupreg = 0;
-#ifdef SIS_LINUX_KERNEL
   unsigned short KeepLockReg;
   SiS_Pr->UseCustomMode = false;
   SiS_Pr->CRT1UsesCustomMode = false;
-#endif
   SiS_Pr->SiS_flag_clearbuffer = 0;
   if(SiS_Pr->UseCustomMode) {
      ModeNo = 0xfe;
   } else {
-#ifdef SIS_LINUX_KERNEL
      if(!(ModeNo & 0x80)) SiS_Pr->SiS_flag_clearbuffer = 1;
-#endif
      ModeNo &= 0x7f;
   }
@@ -3301,13 +3196,8 @@ SiSSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
   SiS_GetSysFlags(SiS_Pr);
   SiS_Pr->SiS_VGAINFO = 0x11;
-#if defined(SIS_XORG_XF86) && (defined(i386) || defined(__i386) || defined(__i386__) || defined(__AMD64__) || defined(__amd64__) || defined(__x86_64__))
-   if(pScrn) SiS_Pr->SiS_VGAINFO = SiS_GetSetBIOSScratch(pScrn, 0x489, 0xff);
-#endif
-#ifdef SIS_LINUX_KERNEL
   KeepLockReg = SiS_GetReg(SiS_Pr->SiS_P3c4,0x05);
-#endif
   SiS_SetReg(SiS_Pr->SiS_P3c4,0x05,0x86);
   SiSInitPCIetc(SiS_Pr);
@@ -3344,12 +3234,10 @@ SiSSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
   SiS_GetLCDResInfo(SiS_Pr, ModeNo, ModeIdIndex);
   SiS_SetLowModeTest(SiS_Pr, ModeNo);
-#ifdef SIS_LINUX_KERNEL
   /* Check memory size (kernel framebuffer driver only) */
   if(!SiS_CheckMemorySize(SiS_Pr, ModeNo, ModeIdIndex)) {
      return false;
   }
-#endif
   SiS_OpenCRTC(SiS_Pr);
@@ -3384,7 +3272,7 @@ SiSSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
   SiS_DisplayOn(SiS_Pr);
   SiS_SetRegByte(SiS_Pr->SiS_P3c6,0xFF);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(SiS_Pr->ChipType >= SIS_315H) {
      if(SiS_Pr->SiS_IF_DEF_LVDS == 1) {
         if(!(SiS_IsDualEdge(SiS_Pr))) {
@@ -3396,7 +3284,7 @@ SiSSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
   if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {
      if(SiS_Pr->ChipType >= SIS_315H) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
         if(!SiS_Pr->SiS_ROMNew) {
            if(SiS_IsVAMode(SiS_Pr)) {
               SiS_SetRegOR(SiS_Pr->SiS_P3d4,0x35,0x01);
@@ -3424,424 +3312,16 @@ SiSSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
      }
   }
-#ifdef SIS_XORG_XF86
-   if(pScrn) {
-      /* SetPitch: Adapt to virtual size & position */
-      if((ModeNo > 0x13) && (dosetpitch)) {
-         SiS_SetPitch(SiS_Pr, pScrn);
-      }
-      /* Backup/Set ModeNo in BIOS scratch area */
-      SiS_GetSetModeID(pScrn, ModeNo);
-   }
-#endif
   SiS_CloseCRTC(SiS_Pr);
   SiS_Handle760(SiS_Pr);
-#ifdef SIS_LINUX_KERNEL
   /* We never lock registers in XF86 */
   if(KeepLockReg != 0xA1) SiS_SetReg(SiS_Pr->SiS_P3c4,0x05,0x00);
-#endif
   return true;
 }
-/*********************************************/
-/*       X.org/XFree86: SiSBIOSSetMode()     */
-/*           for non-Dual-Head mode          */
-/*********************************************/
-#ifdef SIS_XORG_XF86
-bool
-SiSBIOSSetMode(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn,
-               DisplayModePtr mode, bool IsCustom)
-{
-   SISPtr pSiS = SISPTR(pScrn);
-   unsigned short ModeNo = 0;
-   SiS_Pr->UseCustomMode = false;
-   if((IsCustom) && (SiS_CheckBuildCustomMode(pScrn, mode, pSiS->VBFlags))) {
-      xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3, "Setting custom mode %dx%d\n",
-                SiS_Pr->CHDisplay,
-                (mode->Flags & V_INTERLACE ? SiS_Pr->CVDisplay * 2 :
-                   (mode->Flags & V_DBLSCAN ? SiS_Pr->CVDisplay / 2 :
-                      SiS_Pr->CVDisplay)));
-   } else {
-      /* Don't need vbflags here; checks done earlier */
-      ModeNo = SiS_GetModeNumber(pScrn, mode, pSiS->VBFlags);
-      if(!ModeNo) return false;
-      xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3, "Setting standard mode 0x%x\n", ModeNo);
-   }
-   return(SiSSetMode(SiS_Pr, pScrn, ModeNo, true));
-}
-/*********************************************/
-/*    X.org/XFree86: SiSBIOSSetModeCRT2()    */
-/*           for Dual-Head modes             */
-/*********************************************/
-bool
-SiSBIOSSetModeCRT2(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn,
-               DisplayModePtr mode, bool IsCustom)
-{
-   SISIOADDRESS BaseAddr = SiS_Pr->IOAddress;
-   SISPtr  pSiS = SISPTR(pScrn);
-#ifdef SISDUALHEAD
-   SISEntPtr pSiSEnt = pSiS->entityPrivate;
-#endif
-   unsigned short ModeIdIndex;
-   unsigned short ModeNo = 0;
-   unsigned char  backupreg = 0;
-   SiS_Pr->UseCustomMode = false;
-   /* Remember: Custom modes for CRT2 are ONLY supported
-    *     -) on the 30x/B/C, and
-    *     -) if CRT2 is LCD or VGA, or CRT1 is LCDA
-    */
-   if((IsCustom) && (SiS_CheckBuildCustomMode(pScrn, mode, pSiS->VBFlags))) {
-         ModeNo = 0xfe;
-   } else {
-         ModeNo = SiS_GetModeNumber(pScrn, mode, pSiS->VBFlags);
-         if(!ModeNo) return false;
-   }
-   SiSRegInit(SiS_Pr, BaseAddr);
-   SiSInitPtr(SiS_Pr);
-   SiS_GetSysFlags(SiS_Pr);
-#if defined(i386) || defined(__i386) || defined(__i386__) || defined(__AMD64__) || defined(__amd64__) || defined(__x86_64__)
-   SiS_Pr->SiS_VGAINFO = SiS_GetSetBIOSScratch(pScrn, 0x489, 0xff);
-#else
-   SiS_Pr->SiS_VGAINFO = 0x11;
-#endif
-   SiS_SetReg(SiS_Pr->SiS_P3c4,0x05,0x86);
-   SiSInitPCIetc(SiS_Pr);
-   SiSSetLVDSetc(SiS_Pr);
-   SiSDetermineROMUsage(SiS_Pr);
-   /* Save mode info so we can set it from within SetMode for CRT1 */
-#ifdef SISDUALHEAD
-   if(pSiS->DualHeadMode) {
-      pSiSEnt->CRT2ModeNo = ModeNo;
-      pSiSEnt->CRT2DMode = mode;
-      pSiSEnt->CRT2IsCustom = IsCustom;
-      pSiSEnt->CRT2CR30 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x30);
-      pSiSEnt->CRT2CR31 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x31);
-      pSiSEnt->CRT2CR35 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x35);
-      pSiSEnt->CRT2CR38 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x38);
-#if 0
-      /* We can't set CRT2 mode before CRT1 mode is set - says who...? */
-      if(pSiSEnt->CRT1ModeNo == -1) {
-         xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3,
-                "Setting CRT2 mode delayed until after setting CRT1 mode\n");
-         return true;
-      }
-#endif
-      pSiSEnt->CRT2ModeSet = true;
-   }
-#endif
-   if(SiS_Pr->UseCustomMode) {
-      unsigned short temptemp = SiS_Pr->CVDisplay;
-      if(SiS_Pr->CModeFlag & DoubleScanMode)     temptemp >>= 1;
-      else if(SiS_Pr->CInfoFlag & InterlaceMode) temptemp <<= 1;
-      xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3,
-          "Setting custom mode %dx%d on CRT2\n",
-          SiS_Pr->CHDisplay, temptemp);
-   } else {
-      xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3,
-          "Setting standard mode 0x%x on CRT2\n", ModeNo);
-   }
-   SiS_UnLockCRT2(SiS_Pr);
-   if(!SiS_Pr->UseCustomMode) {
-      if(!(SiS_SearchModeID(SiS_Pr, &ModeNo, &ModeIdIndex))) return false;
-   } else {
-      ModeIdIndex = 0;
-   }
-   SiS_GetVBType(SiS_Pr);
-   SiS_InitVB(SiS_Pr);
-   if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {
-      if(SiS_Pr->ChipType >= SIS_315H) {
-         SiS_ResetVB(SiS_Pr);
-         SiS_SetRegOR(SiS_Pr->SiS_P3c4,0x32,0x10);
-         SiS_SetRegOR(SiS_Pr->SiS_Part2Port,0x00,0x0c);
-         backupreg = SiS_GetReg(SiS_Pr->SiS_P3d4,0x38);
-      } else {
-         backupreg = SiS_GetReg(SiS_Pr->SiS_P3d4,0x35);
-      }
-   }
-   /* Get VB information (connectors, connected devices) */
-   if(!SiS_Pr->UseCustomMode) {
-      SiS_GetVBInfo(SiS_Pr, ModeNo, ModeIdIndex, 1);
-   } else {
-      /* If this is a custom mode, we don't check the modeflag for CRT2Mode */
-      SiS_GetVBInfo(SiS_Pr, ModeNo, ModeIdIndex, 0);
-   }
-   SiS_SetYPbPr(SiS_Pr);
-   SiS_SetTVMode(SiS_Pr, ModeNo, ModeIdIndex);
-   SiS_GetLCDResInfo(SiS_Pr, ModeNo, ModeIdIndex);
-   SiS_SetLowModeTest(SiS_Pr, ModeNo);
-   SiS_ResetSegmentRegisters(SiS_Pr);
-   /* Set mode on CRT2 */
-   if( (SiS_Pr->SiS_VBType & VB_SISVB)    ||
-       (SiS_Pr->SiS_IF_DEF_LVDS     == 1) ||
-       (SiS_Pr->SiS_IF_DEF_CH70xx   != 0) ||
-       (SiS_Pr->SiS_IF_DEF_TRUMPION != 0) ) {
-      SiS_SetCRT2Group(SiS_Pr, ModeNo);
-   }
-   SiS_StrangeStuff(SiS_Pr);
-   SiS_DisplayOn(SiS_Pr);
-   SiS_SetRegByte(SiS_Pr->SiS_P3c6,0xFF);
-   if(SiS_Pr->ChipType >= SIS_315H) {
-      if(SiS_Pr->SiS_IF_DEF_LVDS == 1) {
-         if(!(SiS_IsDualEdge(SiS_Pr))) {
-            SiS_SetRegAND(SiS_Pr->SiS_Part1Port,0x13,0xfb);
-         }
-      }
-   }
-   if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {
-      if(SiS_Pr->ChipType >= SIS_315H) {
-         if(!SiS_Pr->SiS_ROMNew) {
-            if(SiS_IsVAMode(SiS_Pr)) {
-               SiS_SetRegOR(SiS_Pr->SiS_P3d4,0x35,0x01);
-            } else {
-               SiS_SetRegAND(SiS_Pr->SiS_P3d4,0x35,0xFE);
-            }
-         }
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x38,backupreg);
-         if(SiS_GetReg(SiS_Pr->SiS_P3d4,0x30) & SetCRT2ToLCD) {
-            SiS_SetRegAND(SiS_Pr->SiS_P3d4,0x38,0xfc);
-         }
-      } else if((SiS_Pr->ChipType == SIS_630) ||
-                (SiS_Pr->ChipType == SIS_730)) {
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x35,backupreg);
-      }
-   }
-   /* SetPitch: Adapt to virtual size & position */
-   SiS_SetPitchCRT2(SiS_Pr, pScrn);
-   SiS_Handle760(SiS_Pr);
-   return true;
-}
-/*********************************************/
-/*    X.org/XFree86: SiSBIOSSetModeCRT1()    */
-/*           for Dual-Head modes             */
-/*********************************************/
-bool
-SiSBIOSSetModeCRT1(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn,
-                   DisplayModePtr mode, bool IsCustom)
-{
-   SISIOADDRESS BaseAddr = SiS_Pr->IOAddress;
-   SISPtr  pSiS = SISPTR(pScrn);
-   unsigned short ModeIdIndex, ModeNo = 0;
-   unsigned char  backupreg = 0;
-#ifdef SISDUALHEAD
-   SISEntPtr pSiSEnt = pSiS->entityPrivate;
-   unsigned char  backupcr30, backupcr31, backupcr38, backupcr35, backupp40d=0;
-   bool backupcustom;
-#endif
-   SiS_Pr->UseCustomMode = false;
-   if((IsCustom) && (SiS_CheckBuildCustomMode(pScrn, mode, pSiS->VBFlags))) {
-         unsigned short temptemp = SiS_Pr->CVDisplay;
-         if(SiS_Pr->CModeFlag & DoubleScanMode)     temptemp >>= 1;
-         else if(SiS_Pr->CInfoFlag & InterlaceMode) temptemp <<= 1;
-         xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3,
-                "Setting custom mode %dx%d on CRT1\n",
-                SiS_Pr->CHDisplay, temptemp);
-         ModeNo = 0xfe;
-   } else {
-         ModeNo = SiS_GetModeNumber(pScrn, mode, 0); /* don't give VBFlags */
-         if(!ModeNo) return false;
-         xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3,
-                "Setting standard mode 0x%x on CRT1\n", ModeNo);
-   }
-   SiSInitPtr(SiS_Pr);
-   SiSRegInit(SiS_Pr, BaseAddr);
-   SiS_GetSysFlags(SiS_Pr);
-#if defined(i386) || defined(__i386) || defined(__i386__) || defined(__AMD64__) || defined(__amd64__) || defined(__x86_64__)
-   SiS_Pr->SiS_VGAINFO = SiS_GetSetBIOSScratch(pScrn, 0x489, 0xff);
-#else
-   SiS_Pr->SiS_VGAINFO = 0x11;
-#endif
-   SiS_SetReg(SiS_Pr->SiS_P3c4,0x05,0x86);
-   SiSInitPCIetc(SiS_Pr);
-   SiSSetLVDSetc(SiS_Pr);
-   SiSDetermineROMUsage(SiS_Pr);
-   SiS_UnLockCRT2(SiS_Pr);
-   if(!SiS_Pr->UseCustomMode) {
-      if(!(SiS_SearchModeID(SiS_Pr, &ModeNo, &ModeIdIndex))) return false;
-   } else {
-      ModeIdIndex = 0;
-   }
-   /* Determine VBType */
-   SiS_GetVBType(SiS_Pr);
-   SiS_InitVB(SiS_Pr);
-   if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {
-      if(SiS_Pr->ChipType >= SIS_315H) {
-         backupreg = SiS_GetReg(SiS_Pr->SiS_P3d4,0x38);
-      } else {
-         backupreg = SiS_GetReg(SiS_Pr->SiS_P3d4,0x35);
-      }
-   }
-   /* Get VB information (connectors, connected devices) */
-   /* (We don't care if the current mode is a CRT2 mode) */
-   SiS_GetVBInfo(SiS_Pr, ModeNo, ModeIdIndex, 0);
-   SiS_SetYPbPr(SiS_Pr);
-   SiS_SetTVMode(SiS_Pr, ModeNo, ModeIdIndex);
-   SiS_GetLCDResInfo(SiS_Pr, ModeNo, ModeIdIndex);
-   SiS_SetLowModeTest(SiS_Pr, ModeNo);
-   SiS_OpenCRTC(SiS_Pr);
-   /* Set mode on CRT1 */
-   SiS_SetCRT1Group(SiS_Pr, ModeNo, ModeIdIndex);
-   if(SiS_Pr->SiS_VBInfo & SetCRT2ToLCDA) {
-      SiS_SetCRT2Group(SiS_Pr, ModeNo);
-   }
-   /* SetPitch: Adapt to virtual size & position */
-   SiS_SetPitchCRT1(SiS_Pr, pScrn);
-   SiS_HandleCRT1(SiS_Pr);
-   SiS_StrangeStuff(SiS_Pr);
-   SiS_CloseCRTC(SiS_Pr);
-#ifdef SISDUALHEAD
-   if(pSiS->DualHeadMode) {
-      pSiSEnt->CRT1ModeNo = ModeNo;
-      pSiSEnt->CRT1DMode = mode;
-   }
-#endif
-   if(SiS_Pr->UseCustomMode) {
-      SiS_Pr->CRT1UsesCustomMode = true;
-      SiS_Pr->CSRClock_CRT1 = SiS_Pr->CSRClock;
-      SiS_Pr->CModeFlag_CRT1 = SiS_Pr->CModeFlag;
-   } else {
-      SiS_Pr->CRT1UsesCustomMode = false;
-   }
-   /* Reset CRT2 if changing mode on CRT1 */
-#ifdef SISDUALHEAD
-   if(pSiS->DualHeadMode) {
-      if(pSiSEnt->CRT2ModeNo != -1) {
-         xf86DrvMsgVerb(pScrn->scrnIndex, X_INFO, 3,
-                                "(Re-)Setting mode for CRT2\n");
-         backupcustom = SiS_Pr->UseCustomMode;
-         backupcr30 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x30);
-         backupcr31 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x31);
-         backupcr35 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x35);
-         backupcr38 = SiS_GetReg(SiS_Pr->SiS_P3d4,0x38);
-         if(SiS_Pr->SiS_VBType & VB_SISVB) {
-            /* Backup LUT-enable */
-            if(pSiSEnt->CRT2ModeSet) {
-               backupp40d = SiS_GetReg(SiS_Pr->SiS_Part4Port,0x0d) & 0x08;
-            }
-         }
-         if(SiS_Pr->SiS_VBInfo & SetCRT2ToLCDA) {
-            SiS_SetReg(SiS_Pr->SiS_P3d4,0x30,pSiSEnt->CRT2CR30);
-            SiS_SetReg(SiS_Pr->SiS_P3d4,0x31,pSiSEnt->CRT2CR31);
-            SiS_SetReg(SiS_Pr->SiS_P3d4,0x35,pSiSEnt->CRT2CR35);
-            SiS_SetReg(SiS_Pr->SiS_P3d4,0x38,pSiSEnt->CRT2CR38);
-         }
-         SiSBIOSSetModeCRT2(SiS_Pr, pSiSEnt->pScrn_1,
-                            pSiSEnt->CRT2DMode, pSiSEnt->CRT2IsCustom);
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x30,backupcr30);
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x31,backupcr31);
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x35,backupcr35);
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x38,backupcr38);
-         if(SiS_Pr->SiS_VBType & VB_SISVB) {
-            SiS_SetRegANDOR(SiS_Pr->SiS_Part4Port,0x0d, ~0x08, backupp40d);
-         }
-         SiS_Pr->UseCustomMode = backupcustom;
-      }
-   }
-#endif
-   /* Warning: From here, the custom mode entries in SiS_Pr are
-    * possibly overwritten
-    */
-   SiS_DisplayOn(SiS_Pr);
-   SiS_SetRegByte(SiS_Pr->SiS_P3c6,0xFF);
-   if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {
-      if(SiS_Pr->ChipType >= SIS_315H) {
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x38,backupreg);
-      } else if((SiS_Pr->ChipType == SIS_630) ||
-                (SiS_Pr->ChipType == SIS_730)) {
-         SiS_SetReg(SiS_Pr->SiS_P3d4,0x35,backupreg);
-      }
-   }
-   SiS_Handle760(SiS_Pr);
-   /* Backup/Set ModeNo in BIOS scratch area */
-   SiS_GetSetModeID(pScrn,ModeNo);
-   return true;
-}
-#endif /* Linux_XF86 */
 #ifndef GETBITSTR
 #define BITMASK(h,l)            (((unsigned)(1U << ((h)-(l)+1))-1)<<(l))
 #define GENMASK(mask)           BITMASK(1?mask,0?mask)
@@ -3927,7 +3407,7 @@ SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   SiS_Pr->CVBlankStart = SiS_Pr->SiS_VGAVDE;
   if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      tempbx = SiS_Pr->SiS_VGAHT;
      if(SiS_Pr->SiS_LCDInfo & DontExpandLCD) {
         tempbx = SiS_Pr->PanelHT;
@@ -3936,7 +3416,7 @@ SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
      remaining = tempbx % 8;
 #endif
   } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      /* OK for LCDA, LVDS */
      tempbx = SiS_Pr->PanelHT - SiS_Pr->PanelXRes;
      tempax = SiS_Pr->SiS_VGAHDE;  /* not /2 ! */
@@ -3950,7 +3430,7 @@ SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   SiS_Pr->CHTotal = SiS_Pr->CHBlankEnd = tempbx;
   if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      if(SiS_Pr->SiS_VGAHDE == SiS_Pr->PanelXRes) {
         SiS_Pr->CHSyncStart = SiS_Pr->SiS_VGAHDE + ((SiS_Pr->PanelHRS + 1) & ~1);
         SiS_Pr->CHSyncEnd = SiS_Pr->CHSyncStart + SiS_Pr->PanelHRE;
@@ -3982,7 +3462,7 @@ SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
      }
 #endif
   } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      tempax = VGAHDE;
      if(SiS_Pr->SiS_LCDInfo & DontExpandLCD) {
         tempbx = SiS_Pr->PanelXRes;
@@ -4001,7 +3481,7 @@ SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   if(SiS_Pr->SiS_LCDInfo & DontExpandLCD) {
      tempax = SiS_Pr->PanelYRes;
   } else if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      /* Stupid hack for 640x400/320x200 */
      if(SiS_Pr->SiS_LCDResInfo == Panel_1024x768) {
         if((tempax + tempbx) == 438) tempbx += 16;
@@ -4054,36 +3534,12 @@ SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   if(modeflag & DoubleScanMode) tempax |= 0x80;
   SiS_SetRegANDOR(SiS_Pr->SiS_P3d4,0x09,0x5F,tempax);
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-   xf86DrvMsg(0, X_INFO, "%d %d %d %d  %d %d %d %d  (%d %d %d %d)\n",
-        SiS_Pr->CHDisplay, SiS_Pr->CHSyncStart, SiS_Pr->CHSyncEnd, SiS_Pr->CHTotal,
-        SiS_Pr->CVDisplay, SiS_Pr->CVSyncStart, SiS_Pr->CVSyncEnd, SiS_Pr->CVTotal,
-        SiS_Pr->CHBlankStart, SiS_Pr->CHBlankEnd, SiS_Pr->CVBlankStart, SiS_Pr->CVBlankEnd);
-   xf86DrvMsg(0, X_INFO, " {{0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,\n",
-        SiS_Pr->CCRT1CRTC[0], SiS_Pr->CCRT1CRTC[1],
-        SiS_Pr->CCRT1CRTC[2], SiS_Pr->CCRT1CRTC[3],
-        SiS_Pr->CCRT1CRTC[4], SiS_Pr->CCRT1CRTC[5],
-        SiS_Pr->CCRT1CRTC[6], SiS_Pr->CCRT1CRTC[7]);
-   xf86DrvMsg(0, X_INFO, "   0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,\n",
-        SiS_Pr->CCRT1CRTC[8], SiS_Pr->CCRT1CRTC[9],
-        SiS_Pr->CCRT1CRTC[10], SiS_Pr->CCRT1CRTC[11],
-        SiS_Pr->CCRT1CRTC[12], SiS_Pr->CCRT1CRTC[13],
-        SiS_Pr->CCRT1CRTC[14], SiS_Pr->CCRT1CRTC[15]);
-   xf86DrvMsg(0, X_INFO, "   0x%02x}},\n", SiS_Pr->CCRT1CRTC[16]);
-#endif
-#endif
 }
 void
 SiS_Generic_ConvertCRData(struct SiS_Private *SiS_Pr, unsigned char *crdata,
                        int xres, int yres,
-#ifdef SIS_XORG_XF86
-                        DisplayModePtr current
-#endif
-#ifdef SIS_LINUX_KERNEL
                        struct fb_var_screeninfo *var, bool writeres
-#endif
 )
 {
   unsigned short HRE, HBE, HRS, HBS, HDE, HT;
@@ -4127,25 +3583,10 @@ SiS_Generic_ConvertCRData(struct SiS_Private *SiS_Pr, unsigned char *crdata,
   D = B - F - C;
-#ifdef SIS_XORG_XF86
-   current->HDisplay   = (E * 8);
-   current->HSyncStart = (E * 8) + (F * 8);
-   current->HSyncEnd   = (E * 8) + (F * 8) + (C * 8);
-   current->HTotal     = (E * 8) + (F * 8) + (C * 8) + (D * 8);
-#ifdef TWDEBUG
-   xf86DrvMsg(0, X_INFO,
-                "H: A %d B %d C %d D %d E %d F %d  HT %d HDE %d HRS %d HBS %d HBE %d HRE %d\n",
-                A, B, C, D, E, F, HT, HDE, HRS, HBS, HBE, HRE);
-#else
-   (void)VBS;  (void)HBS;  (void)A;
-#endif
-#endif
-#ifdef SIS_LINUX_KERNEL
   if(writeres) var->xres = xres = E * 8;
   var->left_margin = D * 8;
   var->right_margin = F * 8;
   var->hsync_len = C * 8;
-#endif
   /* Vertical */
   sr_data = crdata[13];
@@ -4192,30 +3633,10 @@ SiS_Generic_ConvertCRData(struct SiS_Private *SiS_Pr, unsigned char *crdata,
   D = B - F - C;
-#ifdef SIS_XORG_XF86
-   current->VDisplay   = VDE + 1;
-   current->VSyncStart = VRS + 1;
-   current->VSyncEnd   = ((VRS & ~0x1f) | VRE) + 1;
-   if(VRE <= (VRS & 0x1f)) current->VSyncEnd += 32;
-   current->VTotal     = E + D + C + F;
-#if 0
-   current->VDisplay   = E;
-   current->VSyncStart = E + D;
-   current->VSyncEnd   = E + D + C;
-   current->VTotal     = E + D + C + F;
-#endif
-#ifdef TWDEBUG
-   xf86DrvMsg(0, X_INFO,
-        "V: A %d B %d C %d D %d E %d F %d  VT %d VDE %d VRS %d VBS %d VBE %d VRE %d\n",
-        A, B, C, D, E, F, VT, VDE, VRS, VBS, VBE, VRE);
-#endif
-#endif
-#ifdef SIS_LINUX_KERNEL
   if(writeres) var->yres = yres = E;
   var->upper_margin = D;
   var->lower_margin = F;
   var->vsync_len = C;
-#endif
   if((xres == 320) && ((yres == 200) || (yres == 240))) {
        /* Terrible hack, but correct CRTC data for
@@ -4224,17 +3645,9 @@ SiS_Generic_ConvertCRData(struct SiS_Private *SiS_Pr, unsigned char *crdata,
         * a negative D. The CRT controller does not
         * seem to like correcting HRE to 50)
         */
-#ifdef SIS_XORG_XF86
-      current->HDisplay   = 320;
-      current->HSyncStart = 328;
-      current->HSyncEnd   = 376;
-      current->HTotal     = 400;
-#endif
-#ifdef SIS_LINUX_KERNEL
      var->left_margin = (400 - 376);
      var->right_margin = (328 - 320);
      var->hsync_len = (376 - 328);
-#endif
   }
diff --git a/drivers/video/sis/init.h b/drivers/video/sis/init.h
index b96005c39c67..ee8ed3c203da 100644
--- a/drivers/video/sis/init.h
+++ b/drivers/video/sis/init.h
@@ -53,21 +53,8 @@
 #ifndef _INIT_H_
 #define _INIT_H_
-#include "osdef.h"
 #include "initdef.h"
-#ifdef SIS_XORG_XF86
-#include "sis.h"
-#define SIS_NEED_inSISREG
-#define SIS_NEED_inSISREGW
-#define SIS_NEED_inSISREGL
-#define SIS_NEED_outSISREG
-#define SIS_NEED_outSISREGW
-#define SIS_NEED_outSISREGL
-#include "sis_regs.h"
-#endif
-#ifdef SIS_LINUX_KERNEL
 #include "vgatypes.h"
 #include "vstruct.h"
 #ifdef SIS_CP
@@ -78,7 +65,6 @@
 #include <linux/fb.h>
 #include "sis.h"
 #include <video/sisfb.h>
-#endif
 /* Mode numbers */
 static const unsigned short ModeIndex_320x200[]      = {0x59, 0x41, 0x00, 0x4f};
@@ -286,7 +272,7 @@ static const struct SiS_ModeResInfo_S SiS_ModeResInfo[] =
        { 1280, 854, 8,16}    /* 0x22 */
 };
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
 static const struct SiS_StandTable_S SiS_StandTable[]=
 {
 /* 0x00: MD_0_200 */
@@ -1521,10 +1507,6 @@ static const struct SiS_LVDSCRT1Data SiS_LVDSCRT1640x480_1_H[] =
 };
 bool            SiSInitPtr(struct SiS_Private *SiS_Pr);
-#ifdef SIS_XORG_XF86
-unsigned short  SiS_GetModeID(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDisplay,
-                                int Depth, bool FSTN, int LCDwith, int LCDheight);
-#endif
 unsigned short  SiS_GetModeID_LCD(int VGAEngine, unsigned int VBFlags, int HDisplay,
                                int VDisplay, int Depth, bool FSTN,
                                unsigned short CustomT, int LCDwith, int LCDheight,
@@ -1550,17 +1532,11 @@ void		SiS_SetRegOR(SISIOADDRESS Port,unsigned short Index, unsigned short DataOR
 void            SiS_DisplayOn(struct SiS_Private *SiS_Pr);
 void            SiS_DisplayOff(struct SiS_Private *SiS_Pr);
 void            SiSRegInit(struct SiS_Private *SiS_Pr, SISIOADDRESS BaseAddr);
-#ifndef SIS_LINUX_KERNEL
-void            SiSSetLVDSetc(struct SiS_Private *SiS_Pr);
-#endif
 void            SiS_SetEnableDstn(struct SiS_Private *SiS_Pr, int enable);
 void            SiS_SetEnableFstn(struct SiS_Private *SiS_Pr, int enable);
 unsigned short  SiS_GetModeFlag(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
                                unsigned short ModeIdIndex);
 bool            SiSDetermineROMLayout661(struct SiS_Private *SiS_Pr);
-#ifndef SIS_LINUX_KERNEL
-void            SiS_GetVBType(struct SiS_Private *SiS_Pr);
-#endif
 bool            SiS_SearchModeID(struct SiS_Private *SiS_Pr, unsigned short *ModeNo,
                                unsigned short *ModeIdIndex);
@@ -1572,37 +1548,19 @@ unsigned short	SiS_GetColorDepth(struct SiS_Private *SiS_Pr, unsigned short Mode
                                unsigned short ModeIdIndex);
 unsigned short  SiS_GetOffset(struct SiS_Private *SiS_Pr,unsigned short ModeNo,
                                unsigned short ModeIdIndex, unsigned short RRTI);
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 void            SiS_GetFIFOThresholdIndex300(struct SiS_Private *SiS_Pr, unsigned short *idx1,
                                unsigned short *idx2);
 unsigned short  SiS_GetFIFOThresholdB300(unsigned short idx1, unsigned short idx2);
 unsigned short  SiS_GetLatencyFactor630(struct SiS_Private *SiS_Pr, unsigned short index);
 #endif
 void            SiS_LoadDAC(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short ModeIdIndex);
-#ifdef SIS_XORG_XF86
-bool            SiSSetMode(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn, unsigned short ModeNo,
-                                bool dosetpitch);
-bool            SiSBIOSSetMode(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn,
-                                DisplayModePtr mode, bool IsCustom);
-bool            SiSBIOSSetModeCRT2(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn,
-                                DisplayModePtr mode, bool IsCustom);
-bool            SiSBIOSSetModeCRT1(struct SiS_Private *SiS_Pr, ScrnInfoPtr pScrn,
-                                DisplayModePtr mode, bool IsCustom);
-#endif
-#ifdef SIS_LINUX_KERNEL
 bool            SiSSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
-#endif
 void            SiS_CalcCRRegisters(struct SiS_Private *SiS_Pr, int depth);
 void            SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
                                unsigned short ModeIdIndex);
-#ifdef SIS_XORG_XF86
-void            SiS_Generic_ConvertCRData(struct SiS_Private *SiS_Pr, unsigned char *crdata, int xres,
-                                int yres, DisplayModePtr current);
-#endif
-#ifdef SIS_LINUX_KERNEL
 void            SiS_Generic_ConvertCRData(struct SiS_Private *SiS_Pr, unsigned char *crdata, int xres,
                                int yres, struct fb_var_screeninfo *var, bool writeres);
-#endif
 /* From init301.c: */
 extern void             SiS_GetVBInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
@@ -1626,29 +1584,16 @@ extern unsigned short	SiS_GetVCLK2Ptr(struct SiS_Private *SiS_Pr, unsigned short
 extern bool             SiS_IsVAMode(struct SiS_Private *);
 extern bool             SiS_IsDualEdge(struct SiS_Private *);
-#ifdef SIS_XORG_XF86
+#ifdef CONFIG_FB_SIS_300
-/* From other modules: */
-extern unsigned short   SiS_CheckBuildCustomMode(ScrnInfoPtr pScrn, DisplayModePtr mode,
-                                unsigned int VBFlags);
-extern unsigned char    SiS_GetSetBIOSScratch(ScrnInfoPtr pScrn, unsigned short offset,
-                                unsigned char value);
-extern unsigned char    SiS_GetSetModeID(ScrnInfoPtr pScrn, unsigned char id);
-extern unsigned short   SiS_GetModeNumber(ScrnInfoPtr pScrn, DisplayModePtr mode,
-                                unsigned int VBFlags);
-#endif
-#ifdef SIS_LINUX_KERNEL
-#ifdef SIS300
 extern unsigned int     sisfb_read_nbridge_pci_dword(struct SiS_Private *SiS_Pr, int reg);
 extern void             sisfb_write_nbridge_pci_dword(struct SiS_Private *SiS_Pr, int reg,
                                unsigned int val);
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 extern void             sisfb_write_nbridge_pci_byte(struct SiS_Private *SiS_Pr, int reg,
                                unsigned char val);
 extern unsigned int     sisfb_read_mio_pci_word(struct SiS_Private *SiS_Pr, int reg);
 #endif
-#endif
 #endif
diff --git a/drivers/video/sis/init301.c b/drivers/video/sis/init301.c
index da33d801c22e..9fa66fd4052a 100644
--- a/drivers/video/sis/init301.c
+++ b/drivers/video/sis/init301.c
@@ -75,11 +75,11 @@
 #include "init301.h"
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 #include "oem300.h"
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 #include "oem310.h"
 #endif
@@ -87,9 +87,7 @@
 #define SiS_I2CDELAYSHORT  150
 static unsigned short   SiS_GetBIOSLCDResInfo(struct SiS_Private *SiS_Pr);
-#ifdef SIS_LINUX_KERNEL
 static void             SiS_SetCH70xx(struct SiS_Private *SiS_Pr, unsigned short reg, unsigned char val);
-#endif
 /*********************************************/
 /*         HELPER: Lock/Unlock CRT2          */
@@ -106,9 +104,7 @@ SiS_UnLockCRT2(struct SiS_Private *SiS_Pr)
      SiS_SetRegOR(SiS_Pr->SiS_Part1Port,0x24,0x01);
 }
-#ifdef SIS_LINUX_KERNEL
 static
-#endif
 void
 SiS_LockCRT2(struct SiS_Private *SiS_Pr)
 {
@@ -138,7 +134,7 @@ SiS_SetRegSR11ANDOR(struct SiS_Private *SiS_Pr, unsigned short DataAND, unsigned
 /*    HELPER: Get Pointer to LCD structure   */
 /*********************************************/
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static unsigned char *
 GetLCDStructPtr661(struct SiS_Private *SiS_Pr)
 {
@@ -404,7 +400,7 @@ SiS_SaveCRT2Info(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
 /*    HELPER: GET SOME DATA FROM BIOS ROM    */
 /*********************************************/
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static bool
 SiS_CR36BIOSWord23b(struct SiS_Private *SiS_Pr)
 {
@@ -449,7 +445,7 @@ SiS_DDC2Delay(struct SiS_Private *SiS_Pr, unsigned int delaytime)
      SiS_GetReg(SiS_Pr->SiS_P3c4, 0x05);
 }
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
 static void
 SiS_GenericDelay(struct SiS_Private *SiS_Pr, unsigned short delay)
 {
@@ -457,7 +453,7 @@ SiS_GenericDelay(struct SiS_Private *SiS_Pr, unsigned short delay)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void
 SiS_LongDelay(struct SiS_Private *SiS_Pr, unsigned short delay)
 {
@@ -467,7 +463,7 @@ SiS_LongDelay(struct SiS_Private *SiS_Pr, unsigned short delay)
 }
 #endif
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
 static void
 SiS_ShortDelay(struct SiS_Private *SiS_Pr, unsigned short delay)
 {
@@ -480,14 +476,14 @@ SiS_ShortDelay(struct SiS_Private *SiS_Pr, unsigned short delay)
 static void
 SiS_PanelDelay(struct SiS_Private *SiS_Pr, unsigned short DelayTime)
 {
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
   unsigned char  *ROMAddr = SiS_Pr->VirtualRomBase;
   unsigned short PanelID, DelayIndex, Delay=0;
 #endif
   if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      PanelID = SiS_GetReg(SiS_Pr->SiS_P3d4,0x36);
      if(SiS_Pr->SiS_VBType & VB_SISVB) {
@@ -513,11 +509,11 @@ SiS_PanelDelay(struct SiS_Private *SiS_Pr, unsigned short DelayTime)
      }
      SiS_ShortDelay(SiS_Pr, Delay);
-#endif  /* SIS300 */
+#endif  /* CONFIG_FB_SIS_300 */
   } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      if((SiS_Pr->ChipType >= SIS_661)    ||
         (SiS_Pr->ChipType <= SIS_315PRO) ||
@@ -579,12 +575,12 @@ SiS_PanelDelay(struct SiS_Private *SiS_Pr, unsigned short DelayTime)
      }
-#endif /* SIS315H */
+#endif /* CONFIG_FB_SIS_315 */
   }
 }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void
 SiS_PanelDelayLoop(struct SiS_Private *SiS_Pr, unsigned short DelayTime, unsigned short DelayLoop)
 {
@@ -613,7 +609,7 @@ SiS_WaitRetrace1(struct SiS_Private *SiS_Pr)
   while((!(SiS_GetRegByte(SiS_Pr->SiS_P3da) & 0x08)) && --watchdog);
 }
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
 static void
 SiS_WaitRetrace2(struct SiS_Private *SiS_Pr, unsigned short reg)
 {
@@ -630,7 +626,7 @@ static void
 SiS_WaitVBRetrace(struct SiS_Private *SiS_Pr)
 {
   if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {
         if(!(SiS_GetReg(SiS_Pr->SiS_Part1Port,0x00) & 0x20)) return;
      }
@@ -641,7 +637,7 @@ SiS_WaitVBRetrace(struct SiS_Private *SiS_Pr)
      }
 #endif
   } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      if(!(SiS_GetReg(SiS_Pr->SiS_Part1Port,0x00) & 0x40)) {
         SiS_WaitRetrace1(SiS_Pr);
      } else {
@@ -686,7 +682,7 @@ SiS_VBLongWait(struct SiS_Private *SiS_Pr)
 /*               HELPER: MISC                */
 /*********************************************/
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static bool
 SiS_Is301B(struct SiS_Private *SiS_Pr)
 {
@@ -708,7 +704,7 @@ SiS_CRT2IsLCD(struct SiS_Private *SiS_Pr)
 bool
 SiS_IsDualEdge(struct SiS_Private *SiS_Pr)
 {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(SiS_Pr->ChipType >= SIS_315H) {
      if((SiS_Pr->ChipType != SIS_650) || (SiS_GetReg(SiS_Pr->SiS_P3d4,0x5f) & 0xf0)) {
         if(SiS_GetReg(SiS_Pr->SiS_P3d4,0x38) & EnableDualEdge) return true;
@@ -721,7 +717,7 @@ SiS_IsDualEdge(struct SiS_Private *SiS_Pr)
 bool
 SiS_IsVAMode(struct SiS_Private *SiS_Pr)
 {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   unsigned short flag;
   if(SiS_Pr->ChipType >= SIS_315H) {
@@ -732,7 +728,7 @@ SiS_IsVAMode(struct SiS_Private *SiS_Pr)
   return false;
 }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_IsVAorLCD(struct SiS_Private *SiS_Pr)
 {
@@ -745,7 +741,7 @@ SiS_IsVAorLCD(struct SiS_Private *SiS_Pr)
 static bool
 SiS_IsDualLink(struct SiS_Private *SiS_Pr)
 {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(SiS_Pr->ChipType >= SIS_315H) {
      if((SiS_CRT2IsLCD(SiS_Pr)) ||
         (SiS_IsVAMode(SiS_Pr))) {
@@ -756,7 +752,7 @@ SiS_IsDualLink(struct SiS_Private *SiS_Pr)
   return false;
 }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_TVEnabled(struct SiS_Private *SiS_Pr)
 {
@@ -768,7 +764,7 @@ SiS_TVEnabled(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_LCDAEnabled(struct SiS_Private *SiS_Pr)
 {
@@ -777,7 +773,7 @@ SiS_LCDAEnabled(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_WeHaveBacklightCtrl(struct SiS_Private *SiS_Pr)
 {
@@ -788,7 +784,7 @@ SiS_WeHaveBacklightCtrl(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_IsNotM650orLater(struct SiS_Private *SiS_Pr)
 {
@@ -804,7 +800,7 @@ SiS_IsNotM650orLater(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_IsYPbPr(struct SiS_Private *SiS_Pr)
 {
@@ -816,7 +812,7 @@ SiS_IsYPbPr(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_IsChScart(struct SiS_Private *SiS_Pr)
 {
@@ -828,7 +824,7 @@ SiS_IsChScart(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_IsTVOrYPbPrOrScart(struct SiS_Private *SiS_Pr)
 {
@@ -848,7 +844,7 @@ SiS_IsTVOrYPbPrOrScart(struct SiS_Private *SiS_Pr)
 }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static bool
 SiS_IsLCDOrLCDA(struct SiS_Private *SiS_Pr)
 {
@@ -914,7 +910,7 @@ SiS_BridgeInSlavemode(struct SiS_Private *SiS_Pr)
 /*********************************************/
 /* Setup general purpose IO for Chrontel communication */
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 void
 SiS_SetChrontelGPIO(struct SiS_Private *SiS_Pr, unsigned short myvbinfo)
 {
@@ -923,11 +919,7 @@ SiS_SetChrontelGPIO(struct SiS_Private *SiS_Pr, unsigned short myvbinfo)
   if(!(SiS_Pr->SiS_ChSW)) return;
-#ifdef SIS_LINUX_KERNEL
   acpibase = sisfb_read_lpc_pci_dword(SiS_Pr, 0x74);
-#else
-   acpibase = pciReadLong(0x00000800, 0x74);
-#endif
   acpibase &= 0xFFFF;
   if(!acpibase) return;
   temp = SiS_GetRegShort((acpibase + 0x3c));   /* ACPI register 0x3c: GP Event 1 I/O mode select */
@@ -969,7 +961,7 @@ SiS_GetVBInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
        tempax &= (DriverMode | LoadDACFlag | SetNotSimuMode | SetPALTV);
        tempbx |= tempax;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
        if(SiS_Pr->ChipType >= SIS_315H) {
           if(SiS_Pr->SiS_VBType & VB_SISLCDA) {
              if(ModeNo == 0x03) {
@@ -1019,7 +1011,7 @@ SiS_GetVBInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
           }
        }
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
        if(!(SiS_Pr->SiS_VBType & VB_SISVGA2)) {
           tempbx &= ~(SetCRT2ToRAMDAC);
@@ -1154,24 +1146,16 @@ SiS_GetVBInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
   SiS_Pr->SiS_VBInfo = tempbx;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
   if(SiS_Pr->ChipType == SIS_630) {
      SiS_SetChrontelGPIO(SiS_Pr, SiS_Pr->SiS_VBInfo);
   }
 #endif
-#ifdef SIS_LINUX_KERNEL
 #if 0
   printk(KERN_DEBUG "sisfb: (init301: VBInfo= 0x%04x, SetFlag=0x%04x)\n",
      SiS_Pr->SiS_VBInfo, SiS_Pr->SiS_SetFlag);
 #endif
-#endif
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-   xf86DrvMsg(0, X_PROBED, "(init301: VBInfo=0x%04x, SetFlag=0x%04x)\n",
-      SiS_Pr->SiS_VBInfo, SiS_Pr->SiS_SetFlag);
-#endif
-#endif
 }
 /*********************************************/
@@ -1415,12 +1399,6 @@ SiS_SetTVMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
   }
   SiS_Pr->SiS_VBInfo &= ~SetPALTV;
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-   xf86DrvMsg(0, X_INFO, "(init301: TVMode %x, VBInfo %x)\n", SiS_Pr->SiS_TVMode, SiS_Pr->SiS_VBInfo);
-#endif
-#endif
 }
 /*********************************************/
@@ -1443,22 +1421,10 @@ SiS_GetBIOSLCDResInfo(struct SiS_Private *SiS_Pr)
 static void
 SiS_GetLCDInfoBIOS(struct SiS_Private *SiS_Pr)
 {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   unsigned char  *ROMAddr;
   unsigned short temp;
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-   xf86DrvMsg(0, X_INFO, "Paneldata driver: [%d %d] [H %d %d] [V %d %d] [C %d 0x%02x 0x%02x]\n",
-        SiS_Pr->PanelHT, SiS_Pr->PanelVT,
-        SiS_Pr->PanelHRS, SiS_Pr->PanelHRE,
-        SiS_Pr->PanelVRS, SiS_Pr->PanelVRE,
-        SiS_Pr->SiS_VBVCLKData[SiS_Pr->PanelVCLKIdx315].CLOCK,
-        SiS_Pr->SiS_VBVCLKData[SiS_Pr->PanelVCLKIdx315].Part4_A,
-        SiS_Pr->SiS_VBVCLKData[SiS_Pr->PanelVCLKIdx315].Part4_B);
-#endif
-#endif
   if((ROMAddr = GetLCDStructPtr661(SiS_Pr))) {
      if((temp = SISGETROMW(6)) != SiS_Pr->PanelHT) {
         SiS_Pr->SiS_NeedRomModeData = true;
@@ -1480,18 +1446,6 @@ SiS_GetLCDInfoBIOS(struct SiS_Private *SiS_Pr)
      SiS_Pr->SiS_VCLKData[VCLK_CUSTOM_315].SR2C =
         SiS_Pr->SiS_VBVCLKData[VCLK_CUSTOM_315].Part4_B = ROMAddr[20];
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-      xf86DrvMsg(0, X_INFO, "Paneldata BIOS:  [%d %d] [H %d %d] [V %d %d] [C %d 0x%02x 0x%02x]\n",
-        SiS_Pr->PanelHT, SiS_Pr->PanelVT,
-        SiS_Pr->PanelHRS, SiS_Pr->PanelHRE,
-        SiS_Pr->PanelVRS, SiS_Pr->PanelVRE,
-        SiS_Pr->SiS_VBVCLKData[SiS_Pr->PanelVCLKIdx315].CLOCK,
-        SiS_Pr->SiS_VBVCLKData[SiS_Pr->PanelVCLKIdx315].Part4_A,
-        SiS_Pr->SiS_VBVCLKData[SiS_Pr->PanelVCLKIdx315].Part4_B);
-#endif
-#endif
   }
 #endif
 }
@@ -1517,13 +1471,13 @@ SiS_GetLCDResInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sh
 {
  unsigned short temp,modeflag,resinfo=0,modexres=0,modeyres=0;
  bool panelcanscale = false;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
  unsigned char *ROMAddr = SiS_Pr->VirtualRomBase;
  static const unsigned char SiS300SeriesLCDRes[] =
          { 0,  1,  2,  3,  7,  4,  5,  8,
            0,  0, 10,  0,  0,  0,  0, 15 };
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  unsigned char   *myptr = NULL;
 #endif
@@ -1562,7 +1516,7 @@ SiS_GetLCDResInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sh
     SiS_Pr->SiS_LCDTypeInfo = (temp & 0x0F) - 1;
  }
  temp &= 0x0f;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
  if(SiS_Pr->ChipType < SIS_315H) {
     /* Very old BIOSes only know 7 sizes (NetVista 2179, 1.01g) */
     if(SiS_Pr->SiS_VBType & VB_SIS301) {
@@ -1574,7 +1528,7 @@ SiS_GetLCDResInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sh
 #endif
  /* Translate to our internal types */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  if(SiS_Pr->ChipType == SIS_550) {
     if     (temp == Panel310_1152x768)  temp = Panel_320x240_2; /* Verified working */
     else if(temp == Panel310_320x240_2) temp = Panel_320x240_2;
@@ -1597,7 +1551,7 @@ SiS_GetLCDResInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sh
  SiS_Pr->SiS_LCDResInfo = temp;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
  if(SiS_Pr->SiS_IF_DEF_LVDS == 1) {
     if(SiS_Pr->SiS_CustomT == CUT_BARCO1366) {
        SiS_Pr->SiS_LCDResInfo = Panel_Barco1366;
@@ -1639,7 +1593,7 @@ SiS_GetLCDResInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sh
  else if(SiS_Pr->UsePanelScaler == 1) SiS_Pr->SiS_LCDInfo |= DontExpandLCD;
  /* Dual link, Pass 1:1 BIOS default, etc. */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  if(SiS_Pr->ChipType >= SIS_661) {
     if(SiS_Pr->SiS_LCDInfo & DontExpandLCD) {
        if(temp & 0x08) SiS_Pr->SiS_LCDInfo |= LCDPass11;
@@ -2076,7 +2030,7 @@ SiS_GetLCDResInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sh
     }
  }
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
  if(SiS_Pr->SiS_IF_DEF_LVDS == 1) {
     if(SiS_Pr->SiS_CustomT == CUT_PANEL848 || SiS_Pr->SiS_CustomT == CUT_PANEL856) {
        SiS_Pr->SiS_LCDInfo = 0x80 | 0x40 | 0x20;   /* neg h/v sync, RGB24(D0 = 0) */
@@ -2186,17 +2140,10 @@ SiS_GetLCDResInfo(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned sh
     SiS_Pr->SiS_SetFlag |= LCDVESATiming;
  }
-#ifdef SIS_LINUX_KERNEL
 #if 0
  printk(KERN_DEBUG "sisfb: (LCDInfo=0x%04x LCDResInfo=0x%02x LCDTypeInfo=0x%02x)\n",
        SiS_Pr->SiS_LCDInfo, SiS_Pr->SiS_LCDResInfo, SiS_Pr->SiS_LCDTypeInfo);
 #endif
-#endif
-#ifdef SIS_XORG_XF86
-  xf86DrvMsgVerb(0, X_PROBED, 4,
-        "(init301: LCDInfo=0x%04x LCDResInfo=0x%02x LCDTypeInfo=0x%02x SetFlag=0x%04x)\n",
-        SiS_Pr->SiS_LCDInfo, SiS_Pr->SiS_LCDResInfo, SiS_Pr->SiS_LCDTypeInfo, SiS_Pr->SiS_SetFlag);
-#endif
 }
 /*********************************************/
@@ -2359,7 +2306,7 @@ SiS_GetVCLK2Ptr(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned shor
              VCLKIndex = SiS_Pr->PanelVCLKIdx315;
           }
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
           /* Special Timing: Barco iQ Pro R series */
           if(SiS_Pr->SiS_CustomT == CUT_BARCO1366) VCLKIndex = 0x44;
@@ -2410,12 +2357,6 @@ SiS_GetVCLK2Ptr(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned shor
  }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-  xf86DrvMsg(0, X_INFO, "VCLKIndex %d (0x%x)\n", VCLKIndex, VCLKIndex);
-#endif
-#endif
  return VCLKIndex;
 }
@@ -2428,10 +2369,10 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
 {
  unsigned short i, j, modeflag, tempah=0;
  short tempcl;
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
  unsigned short tempbl;
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  unsigned char  *ROMAddr = SiS_Pr->VirtualRomBase;
  unsigned short tempah2, tempbl2;
 #endif
@@ -2454,7 +2395,7 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
     if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300    /* ---- 300 series ---- */
+#ifdef CONFIG_FB_SIS_300    /* ---- 300 series ---- */
        /* For 301BDH: (with LCD via LVDS) */
        if(SiS_Pr->SiS_VBType & VB_NoLCD) {
@@ -2477,11 +2418,11 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
        if(SiS_Pr->SiS_VBInfo & SetInSlaveMode)  tempah ^= 0xA0;
-#endif  /* SIS300 */
+#endif  /* CONFIG_FB_SIS_300 */
     } else {
-#ifdef SIS315H    /* ------- 315/330 series ------ */
+#ifdef CONFIG_FB_SIS_315    /* ------- 315/330 series ------ */
        if(ModeNo > 0x13) {
           tempcl -= ModeVGA;
@@ -2494,7 +2435,7 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
        if(SiS_Pr->SiS_VBInfo & SetInSlaveMode) tempah ^= 0x50;
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
     }
@@ -2503,7 +2444,7 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
     if(SiS_Pr->ChipType < SIS_315H) {
        SiS_SetReg(SiS_Pr->SiS_Part1Port,0x00,tempah);
     } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
        if(SiS_Pr->SiS_IF_DEF_LVDS == 1) {
           SiS_SetRegANDOR(SiS_Pr->SiS_Part1Port,0x00,0xa0,tempah);
        } else if(SiS_Pr->SiS_VBType & VB_SISVB) {
@@ -2584,7 +2525,7 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
        if(SiS_Pr->ChipType >= SIS_315H) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
           /* LVDS can only be slave in 8bpp modes */
           tempah = 0x80;
           if((modeflag & CRT2Mode) && (SiS_Pr->SiS_ModeType > ModeVGA)) {
@@ -2604,7 +2545,7 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
        } else {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
           tempah = 0;
           if( (!(SiS_Pr->SiS_VBInfo & SetInSlaveMode)) && (SiS_Pr->SiS_ModeType > ModeVGA) ) {
              tempah |= 0x02;
@@ -2626,7 +2567,7 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
     if(SiS_Pr->ChipType >= SIS_315H) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
        /* unsigned char bridgerev = SiS_GetReg(SiS_Pr->SiS_Part4Port,0x01); */
        /* The following is nearly unpreditable and varies from machine
@@ -2718,11 +2659,11 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
           SiS_SetRegANDOR(SiS_Pr->SiS_Part4Port,0x23,tempbl,tempah);
        }
-#endif /* SIS315H */
+#endif /* CONFIG_FB_SIS_315 */
     } else if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
        SiS_SetRegAND(SiS_Pr->SiS_Part4Port,0x21,0x3f);
        if((SiS_Pr->SiS_VBInfo & DisableCRT2Display) ||
@@ -2745,7 +2686,7 @@ SiS_SetCRT2ModeRegs(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
  } else {  /* LVDS */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
     if(SiS_Pr->ChipType >= SIS_315H) {
        if(SiS_Pr->SiS_IF_DEF_CH70xx != 0) {
@@ -2931,7 +2872,7 @@ SiS_GetCRT2Ptr(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
           }
        }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
        if(SiS_Pr->SiS_CustomT == CUT_COMPAQ1280) {
           if(SiS_Pr->SiS_LCDResInfo == Panel_1280x1024) {
              if(!(SiS_Pr->SiS_LCDInfo & DontExpandLCD)) {
@@ -3036,7 +2977,7 @@ SiS_GetCRT2Ptr(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
        case Panel_1280x1024: tempbx = 24; break;
        case Panel_1400x1050: tempbx = 26; break;
        case Panel_1600x1200: tempbx = 28; break;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
        case Panel_Barco1366: tempbx = 80; break;
 #endif
        }
@@ -3053,7 +2994,7 @@ SiS_GetCRT2Ptr(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
        if(SiS_Pr->SiS_LCDInfo & LCDPass11) tempbx = 30;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
        if(SiS_Pr->SiS_CustomT == CUT_BARCO1024) {
           tempbx = 82;
           if(SiS_Pr->SiS_LCDInfo & DontExpandLCD) tempbx++;
@@ -3189,7 +3130,7 @@ SiS_GetCRT2DataLVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
   if((SiS_Pr->SiS_VBType & VB_SISVB) && (SiS_Pr->SiS_VBInfo & SetCRT2ToLCDA)) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      SiS_CalcPanelLinkTiming(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex);
      SiS_CalcLCDACRT1Timing(SiS_Pr, ModeNo, ModeIdIndex);
 #endif
@@ -3214,7 +3155,7 @@ SiS_GetCRT2DataLVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
         case 16: LVDSData = SiS_Pr->SiS_LVDS800x600Data_1;    break;
         case 18: LVDSData = SiS_Pr->SiS_LVDS1024x600Data_1;   break;
         case 20: LVDSData = SiS_Pr->SiS_LVDS1024x768Data_1;   break;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
         case 80: LVDSData = SiS_Pr->SiS_LVDSBARCO1366Data_1;  break;
         case 81: LVDSData = SiS_Pr->SiS_LVDSBARCO1366Data_2;  break;
         case 82: LVDSData = SiS_Pr->SiS_LVDSBARCO1024Data_1;  break;
@@ -3248,7 +3189,7 @@ SiS_GetCRT2DataLVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned
             (SiS_Pr->SiS_SetFlag & SetDOSMode) ) {
            SiS_Pr->SiS_HDE = SiS_Pr->PanelXRes;
            SiS_Pr->SiS_VDE = SiS_Pr->PanelYRes;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
            if(SiS_Pr->SiS_CustomT == CUT_BARCO1366) {
               if(ResIndex < 0x08) {
                  SiS_Pr->SiS_HDE = 1280;
@@ -3270,7 +3211,7 @@ SiS_GetCRT2Data301(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  unsigned short resinfo, CRT2Index, ResIndex;
  const struct SiS_LCDData *LCDPtr = NULL;
  const struct SiS_TVData  *TVPtr  = NULL;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  short resinfo661;
 #endif
@@ -3283,7 +3224,7 @@ SiS_GetCRT2Data301(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  } else {
     modeflag = SiS_Pr->SiS_EModeIDTable[ModeIdIndex].Ext_ModeFlag;
     resinfo = SiS_Pr->SiS_EModeIDTable[ModeIdIndex].Ext_RESINFO;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
     resinfo661 = SiS_Pr->SiS_EModeIDTable[ModeIdIndex].ROMMODEIDX661;
     if( (SiS_Pr->SiS_VBInfo & SetCRT2ToLCD)   &&
         (SiS_Pr->SiS_SetFlag & LCDVESATiming) &&
@@ -3460,7 +3401,7 @@ SiS_GetCRT2Data301(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
        } else if( (!(SiS_Pr->SiS_LCDInfo & DontExpandLCD)) && (romptr) && (ROMAddr) ) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
           SiS_Pr->SiS_RVBHCMAX  = ROMAddr[romptr];
           SiS_Pr->SiS_RVBHCFACT = ROMAddr[romptr+1];
           SiS_Pr->SiS_VGAHT     = ROMAddr[romptr+2] | ((ROMAddr[romptr+3] & 0x0f) << 8);
@@ -3520,19 +3461,13 @@ SiS_GetCRT2Data301(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
              case Panel_1680x1050     :
              case Panel_1680x1050 + 32: LCDPtr = SiS_Pr->SiS_LCD1680x1050Data;     break;
              case 100                 : LCDPtr = SiS_Pr->SiS_NoScaleData;          break;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
              case 200                 : LCDPtr = SiS310_ExtCompaq1280x1024Data;    break;
              case 201                 : LCDPtr = SiS_Pr->SiS_St2LCD1280x1024Data;  break;
 #endif
              default                  : LCDPtr = SiS_Pr->SiS_ExtLCD1024x768Data;   break;
           }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-           xf86DrvMsg(0, X_INFO, "GetCRT2Data: Index %d ResIndex %d\n", CRT2Index, ResIndex);
-#endif
-#endif
           SiS_Pr->SiS_RVBHCMAX  = (LCDPtr+ResIndex)->RVBHCMAX;
           SiS_Pr->SiS_RVBHCFACT = (LCDPtr+ResIndex)->RVBHCFACT;
           SiS_Pr->SiS_VGAHT     = (LCDPtr+ResIndex)->VGAHT;
@@ -3624,7 +3559,7 @@ SiS_GetLVDSDesPtr(struct SiS_Private *SiS_Pr)
 {
   const struct SiS_LVDSDes *PanelDesPtr = NULL;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
   if(SiS_Pr->SiS_VBInfo & SetCRT2ToLCD) {
      if(SiS_Pr->ChipType < SIS_315H) {
@@ -3696,7 +3631,7 @@ SiS_GetLVDSDesData(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  if((SiS_Pr->SiS_VBType & VB_SIS30xBLV) && (SiS_Pr->SiS_VBInfo & SetCRT2ToLCDA)) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
     if(SiS_Pr->SiS_LCDInfo & DontExpandLCD) {
        /* non-pass 1:1 only, see above */
        if(SiS_Pr->SiS_VGAHDE != SiS_Pr->PanelXRes) {
@@ -3771,7 +3706,7 @@ SiS_GetLVDSDesData(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
     } else {
        if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
           switch(SiS_Pr->SiS_LCDResInfo) {
           case Panel_800x600:
              if(SiS_Pr->SiS_VGAVDE == SiS_Pr->PanelYRes) {
@@ -3816,7 +3751,7 @@ SiS_GetLVDSDesData(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
           }
 #endif
        } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
           switch(SiS_Pr->SiS_LCDResInfo) {
           case Panel_1024x768:
           case Panel_1280x1024:
@@ -3844,7 +3779,7 @@ SiS_GetLVDSDesData(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
                 if(SiS_Pr->ChipType < SIS_315H) {
                    if(!(modeflag & HalfDCLK)) SiS_Pr->SiS_LCDHDES = 320;
                 } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
                    if(SiS_Pr->SiS_LCDResInfo == Panel_1024x768)  SiS_Pr->SiS_LCDHDES = 480;
                    if(SiS_Pr->SiS_LCDResInfo == Panel_1400x1050) SiS_Pr->SiS_LCDHDES = 804;
                    if(SiS_Pr->SiS_LCDResInfo == Panel_1600x1200) SiS_Pr->SiS_LCDHDES = 704;
@@ -3866,7 +3801,7 @@ SiS_GetLVDSDesData(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
 /*           DISABLE VIDEO BRIDGE            */
 /*********************************************/
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static int
 SiS_HandlePWD(struct SiS_Private *SiS_Pr)
 {
@@ -3891,11 +3826,6 @@ SiS_HandlePWD(struct SiS_Private *SiS_Pr)
         ret = 1;
      }
      SiS_SetRegANDOR(SiS_Pr->SiS_Part4Port,0x27,0x7f,temp);
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-      xf86DrvMsg(0, 0, "Setting PWD %x\n", temp);
-#endif
-#endif
   }
 #endif
   return ret;
@@ -3909,7 +3839,7 @@ SiS_HandlePWD(struct SiS_Private *SiS_Pr)
 void
 SiS_DisableBridge(struct SiS_Private *SiS_Pr)
 {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  unsigned short tempah, pushax=0, modenum;
 #endif
  unsigned short temp=0;
@@ -3920,7 +3850,7 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
        if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300      /* 300 series */
+#ifdef CONFIG_FB_SIS_300           /* 300 series */
           if(!(SiS_CR36BIOSWord23b(SiS_Pr))) {
              if(SiS_Pr->SiS_VBType & VB_SISLVDS) {
@@ -3953,11 +3883,11 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
              }
           }
-#endif  /* SIS300 */
+#endif  /* CONFIG_FB_SIS_300 */
        } else {
-#ifdef SIS315H     /* 315 series */
+#ifdef CONFIG_FB_SIS_315           /* 315 series */
           int didpwd = 0;
           bool custom1 = (SiS_Pr->SiS_CustomT == CUT_COMPAQ1280) ||
@@ -4081,14 +4011,14 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
           }
-#endif /* SIS315H */
+#endif /* CONFIG_FB_SIS_315 */
        }
     } else {     /* ============ For 301 ================ */
        if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
           if(!(SiS_CR36BIOSWord23b(SiS_Pr))) {
              SiS_SetRegSR11ANDOR(SiS_Pr,0xF7,0x08);
              SiS_PanelDelay(SiS_Pr, 3);
@@ -4111,7 +4041,7 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
            SiS_SetRegOR(SiS_Pr->SiS_P3c4,0x1E,0x20);
            SiS_SetReg(SiS_Pr->SiS_Part1Port,0x00,temp);
        } else {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
            SiS_SetRegAND(SiS_Pr->SiS_P3c4,0x1E,0xDF);            /* disable CRT2 */
            if( (!(SiS_CRT2IsLCD(SiS_Pr))) ||
                (!(SiS_CR36BIOSWord23d(SiS_Pr))) ) {
@@ -4127,7 +4057,7 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
    if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300   /* 300 series */
+#ifdef CONFIG_FB_SIS_300        /* 300 series */
        if(SiS_Pr->SiS_IF_DEF_CH70xx == 1) {
           SiS_SetCH700x(SiS_Pr,0x0E,0x09);
@@ -4171,11 +4101,11 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
           SiS_SetRegSR11ANDOR(SiS_Pr,0xFB,0x04);
        }
-#endif  /* SIS300 */
+#endif  /* CONFIG_FB_SIS_300 */
    } else {
-#ifdef SIS315H  /* 315 series */
+#ifdef CONFIG_FB_SIS_315        /* 315 series */
        if(!(SiS_IsNotM650orLater(SiS_Pr))) {
           /*if(SiS_Pr->ChipType < SIS_340) { */ /* XGI needs this */
@@ -4288,7 +4218,7 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
           }
        }
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
    }  /* 315 series */
@@ -4304,14 +4234,12 @@ SiS_DisableBridge(struct SiS_Private *SiS_Pr)
 * from outside the context of a mode switch!
 * MUST call getVBType before calling this
 */
-#ifdef SIS_LINUX_KERNEL
 static
-#endif
 void
 SiS_EnableBridge(struct SiS_Private *SiS_Pr)
 {
  unsigned short temp=0, tempah;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  unsigned short temp1, pushax=0;
  bool delaylong = false;
 #endif
@@ -4322,7 +4250,7 @@ SiS_EnableBridge(struct SiS_Private *SiS_Pr)
      if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300     /* 300 series */
+#ifdef CONFIG_FB_SIS_300     /* 300 series */
         if(SiS_CRT2IsLCD(SiS_Pr)) {
            if(SiS_Pr->SiS_VBType & VB_SISLVDS) {
@@ -4385,11 +4313,11 @@ SiS_EnableBridge(struct SiS_Private *SiS_Pr)
         }
-#endif /* SIS300 */
+#endif /* CONFIG_FB_SIS_300 */
      } else {
-#ifdef SIS315H    /* 315 series */
+#ifdef CONFIG_FB_SIS_315    /* 315 series */
 #ifdef SET_EMI
         unsigned char   r30=0, r31=0, r32=0, r33=0, cr36=0;
@@ -4688,7 +4616,7 @@ SiS_EnableBridge(struct SiS_Private *SiS_Pr)
            SiS_SetRegAND(SiS_Pr->SiS_Part1Port,0x00,0x7f);
         }
-#endif /* SIS315H */
+#endif /* CONFIG_FB_SIS_315 */
      }
@@ -4739,7 +4667,7 @@ SiS_EnableBridge(struct SiS_Private *SiS_Pr)
    if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300    /* 300 series */
+#ifdef CONFIG_FB_SIS_300    /* 300 series */
       if(SiS_CRT2IsLCD(SiS_Pr)) {
          if(SiS_Pr->ChipType == SIS_730) {
@@ -4783,11 +4711,11 @@ SiS_EnableBridge(struct SiS_Private *SiS_Pr)
          }
       }
-#endif  /* SIS300 */
+#endif  /* CONFIG_FB_SIS_300 */
    } else {
-#ifdef SIS315H    /* 315 series */
+#ifdef CONFIG_FB_SIS_315    /* 315 series */
       if(!(SiS_IsNotM650orLater(SiS_Pr))) {
          /*if(SiS_Pr->ChipType < SIS_340) {*/  /* XGI needs this */
@@ -4881,7 +4809,7 @@ SiS_EnableBridge(struct SiS_Private *SiS_Pr)
          }
       }
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
    } /* 310 series */
@@ -4971,7 +4899,7 @@ SiS_SetCRT2Sync(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned shor
      if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300  /* ---- 300 series --- */
+#ifdef CONFIG_FB_SIS_300  /* ---- 300 series --- */
         if(SiS_Pr->SiS_VBType & VB_SIS30xBLV) {                        /* 630 - 301B(-DH) */
@@ -5000,11 +4928,11 @@ SiS_SetCRT2Sync(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned shor
         }
-#endif /* SIS300 */
+#endif /* CONFIG_FB_SIS_300 */
      } else {
-#ifdef SIS315H  /* ------- 315 series ------ */
+#ifdef CONFIG_FB_SIS_315  /* ------- 315 series ------ */
         if(SiS_Pr->SiS_VBType & VB_SISLVDS) {                  /* 315 - LVDS */
@@ -5076,13 +5004,13 @@ SiS_SetCRT2Sync(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned shor
            }
         }
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
      }
   }
 }
 /* Set CRT2 FIFO on 300/540/630/730 */
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static void
 SiS_SetCRT2FIFO_300(struct SiS_Private *SiS_Pr,unsigned short ModeNo)
 {
@@ -5154,13 +5082,8 @@ SiS_SetCRT2FIFO_300(struct SiS_Private *SiS_Pr,unsigned short ModeNo)
     } else {
-#ifdef SIS_LINUX_KERNEL
        pci50 = sisfb_read_nbridge_pci_dword(SiS_Pr, 0x50);
        pciA0 = sisfb_read_nbridge_pci_dword(SiS_Pr, 0xa0);
-#else
-        pci50 = pciReadLong(0x00000000, 0x50);
-        pciA0 = pciReadLong(0x00000000, 0xA0);
-#endif
        if(SiS_Pr->ChipType == SIS_730) {
@@ -5262,7 +5185,7 @@ SiS_SetCRT2FIFO_300(struct SiS_Private *SiS_Pr,unsigned short ModeNo)
 #endif
 /* Set CRT2 FIFO on 315/330 series */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void
 SiS_SetCRT2FIFO_310(struct SiS_Private *SiS_Pr)
 {
@@ -5420,27 +5343,6 @@ SiS_SetGroup1_301(struct SiS_Private *SiS_Pr, unsigned short ModeNo,unsigned sho
  temp = SiS_GetRegByte((SiS_Pr->SiS_P3ca+0x02));
  SiS_SetReg(SiS_Pr->SiS_Part1Port,0x1b,temp);                  /* ? */
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-   xf86DrvMsg(0, X_INFO, "%d %d %d %d  %d %d %d %d  (%d %d %d %d)\n",
-        SiS_Pr->CHDisplay, SiS_Pr->CHSyncStart, SiS_Pr->CHSyncEnd, SiS_Pr->CHTotal,
-        SiS_Pr->CVDisplay, SiS_Pr->CVSyncStart, SiS_Pr->CVSyncEnd, SiS_Pr->CVTotal,
-        SiS_Pr->CHBlankStart, SiS_Pr->CHBlankEnd, SiS_Pr->CVBlankStart, SiS_Pr->CVBlankEnd);
-   xf86DrvMsg(0, X_INFO, " {{0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,\n",
-        SiS_Pr->CCRT1CRTC[0], SiS_Pr->CCRT1CRTC[1],
-        SiS_Pr->CCRT1CRTC[2], SiS_Pr->CCRT1CRTC[3],
-        SiS_Pr->CCRT1CRTC[4], SiS_Pr->CCRT1CRTC[5],
-        SiS_Pr->CCRT1CRTC[6], SiS_Pr->CCRT1CRTC[7]);
-   xf86DrvMsg(0, X_INFO, "   0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,0x%02x,\n",
-        SiS_Pr->CCRT1CRTC[8], SiS_Pr->CCRT1CRTC[9],
-        SiS_Pr->CCRT1CRTC[10], SiS_Pr->CCRT1CRTC[11],
-        SiS_Pr->CCRT1CRTC[12], SiS_Pr->CCRT1CRTC[13],
-        SiS_Pr->CCRT1CRTC[14], SiS_Pr->CCRT1CRTC[15]);
-   xf86DrvMsg(0, X_INFO, "   0x%02x}},\n", SiS_Pr->CCRT1CRTC[16]);
-#endif
-#endif
 }
 /* Setup panel link
@@ -5455,17 +5357,17 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  unsigned short push2, tempax, tempbx, tempcx, temp;
  unsigned int   tempeax = 0, tempebx, tempecx, tempvcfact = 0;
  bool islvds = false, issis  = false, chkdclkfirst = false;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
  unsigned short crt2crtc = 0;
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  unsigned short pushcx;
 #endif
  if(ModeNo <= 0x13) {
     modeflag = SiS_Pr->SiS_SModeIDTable[ModeIdIndex].St_ModeFlag;
     resinfo = SiS_Pr->SiS_SModeIDTable[ModeIdIndex].St_ResInfo;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
     crt2crtc = SiS_Pr->SiS_SModeIDTable[ModeIdIndex].St_CRT2CRTC;
 #endif
  } else if(SiS_Pr->UseCustomMode) {
@@ -5473,7 +5375,7 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  } else {
     modeflag = SiS_Pr->SiS_EModeIDTable[ModeIdIndex].Ext_ModeFlag;
     resinfo = SiS_Pr->SiS_EModeIDTable[ModeIdIndex].Ext_RESINFO;
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
     crt2crtc = SiS_Pr->SiS_RefIndex[RefreshRateTableIndex].Ext_CRT2CRTC;
 #endif
  }
@@ -5494,7 +5396,7 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
     }
  }
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  if((SiS_Pr->ChipType >= SIS_315H) && (SiS_Pr->SiS_VBInfo & SetCRT2ToLCDA)) {
     if(IS_SIS330) {
        SiS_SetRegOR(SiS_Pr->SiS_Part1Port,0x2D,0x10);
@@ -5744,7 +5646,7 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300      /* 300 series */
+#ifdef CONFIG_FB_SIS_300      /* 300 series */
     tempeax = SiS_Pr->SiS_VGAVDE << 6;
     temp = (tempeax % (unsigned int)SiS_Pr->SiS_VDE);
     tempeax = tempeax / (unsigned int)SiS_Pr->SiS_VDE;
@@ -5755,11 +5657,11 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
     temp = (unsigned short)(tempeax & 0x00FF);
     SiS_SetReg(SiS_Pr->SiS_Part1Port,0x1E,temp);       /* BPLVCFACT */
     tempvcfact = temp;
-#endif /* SIS300 */
+#endif /* CONFIG_FB_SIS_300 */
  } else {
-#ifdef SIS315H  /* 315 series */
+#ifdef CONFIG_FB_SIS_315  /* 315 series */
     tempeax = SiS_Pr->SiS_VGAVDE << 18;
     tempebx = SiS_Pr->SiS_VDE;
     temp = (tempeax % tempebx);
@@ -5845,7 +5747,7 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  temp = (unsigned short)(tempecx & 0x00FF);
  SiS_SetReg(SiS_Pr->SiS_Part1Port,0x23,temp);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  if(SiS_Pr->ChipType >= SIS_315H) {
     if(SiS_Pr->SiS_VBInfo & SetCRT2ToLCDA) {
        if((islvds) || (SiS_Pr->SiS_VBInfo & VB_SISLVDS)) {
@@ -5863,7 +5765,7 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  }
 #endif
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
  if(SiS_Pr->SiS_IF_DEF_TRUMPION) {
     unsigned char *ROMAddr = SiS_Pr->VirtualRomBase;
     unsigned char *trumpdata;
@@ -5899,7 +5801,7 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
  }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  if(SiS_Pr->SiS_IF_DEF_FSTN || SiS_Pr->SiS_IF_DEF_DSTN) {
     SiS_SetReg(SiS_Pr->SiS_Part1Port,0x25,0x00);
     SiS_SetReg(SiS_Pr->SiS_Part1Port,0x26,0x00);
@@ -5999,7 +5901,7 @@ SiS_SetGroup1_LVDS(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned s
        SiS_SetReg(SiS_Pr->SiS_Part1Port,0x45,0x0a);
     }
  }
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
 }
 /* Set Part 1 */
@@ -6007,12 +5909,12 @@ static void
 SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short ModeIdIndex,
                unsigned short RefreshRateTableIndex)
 {
-#if defined(SIS300) || defined(SIS315H)
+#if defined(CONFIG_FB_SIS_300) || defined(CONFIG_FB_SIS_315)
  unsigned char   *ROMAddr = SiS_Pr->VirtualRomBase;
 #endif
  unsigned short  temp=0, tempax=0, tempbx=0, tempcx=0, bridgeadd=0;
  unsigned short  pushbx=0, CRT1Index=0, modeflag, resinfo=0;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  unsigned short  tempbl=0;
 #endif
@@ -6038,11 +5940,11 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
         (SiS_Pr->SiS_VBInfo & SetInSlaveMode)) ) {
     if(SiS_Pr->ChipType < SIS_315H ) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
        SiS_SetCRT2FIFO_300(SiS_Pr, ModeNo);
 #endif
     } else {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
        SiS_SetCRT2FIFO_310(SiS_Pr);
 #endif
     }
@@ -6051,7 +5953,7 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
     if(SiS_Pr->ChipType < SIS_315H ) {
-#ifdef SIS300   /* ------------- 300 series --------------*/
+#ifdef CONFIG_FB_SIS_300   /* ------------- 300 series --------------*/
        temp = (SiS_Pr->SiS_VGAHT - 1) & 0x0FF;                   /* BTVGA2HT 0x08,0x09 */
        SiS_SetReg(SiS_Pr->SiS_Part1Port,0x08,temp);              /* CRT2 Horizontal Total */
@@ -6070,11 +5972,11 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
        bridgeadd = 12;
-#endif /* SIS300 */
+#endif /* CONFIG_FB_SIS_300 */
     } else {
-#ifdef SIS315H  /* ------------------- 315/330 series --------------- */
+#ifdef CONFIG_FB_SIS_315  /* ------------------- 315/330 series --------------- */
        tempcx = SiS_Pr->SiS_VGAHT;                               /* BTVGA2HT 0x08,0x09 */
        if(modeflag & HalfDCLK) {
@@ -6125,7 +6027,7 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
           }
        }
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
     }  /* 315/330 series */
@@ -6256,7 +6158,7 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
     if(SiS_Pr->ChipType < SIS_315H) {
-#ifdef SIS300  /* ---------- 300 series -------------- */
+#ifdef CONFIG_FB_SIS_300  /* ---------- 300 series -------------- */
        if(SiS_Pr->SiS_VBType & VB_SISVB) {
           temp = 0x20;
@@ -6310,11 +6212,11 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
        SiS_SetRegANDOR(SiS_Pr->SiS_Part1Port,0x13,~0x3C,temp);   /* Panel Link Delay Compensation; (Software Command Reset; Power Saving) */
-#endif  /* SIS300 */
+#endif  /* CONFIG_FB_SIS_300 */
     } else {
-#ifdef SIS315H   /* --------------- 315/330 series ---------------*/
+#ifdef CONFIG_FB_SIS_315   /* --------------- 315/330 series ---------------*/
        if(SiS_Pr->ChipType < SIS_661) {
@@ -6349,7 +6251,7 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
        if(modeflag & HalfDCLK)       tempax |= 0x40;
        SiS_SetRegANDOR(SiS_Pr->SiS_Part1Port,0x2C,0x3f,tempax);
-#endif  /* SIS315H */
+#endif  /* CONFIG_FB_SIS_315 */
     }
@@ -6381,7 +6283,7 @@ SiS_SetGroup1(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
 /*         SET PART 2 REGISTER GROUP         */
 /*********************************************/
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static unsigned char *
 SiS_GetGroup2CLVXPtr(struct SiS_Private *SiS_Pr, int tabletype)
 {
@@ -6478,7 +6380,7 @@ SiS_GetCRT2Part2Ptr(struct SiS_Private *SiS_Pr,unsigned short ModeNo,unsigned sh
 }
 #endif
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static void
 SiS_Group2LCDSpecial(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short crt2crtc)
 {
@@ -6690,7 +6592,7 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
  unsigned int   longtemp, PhaseIndex;
  bool           newtvphase;
  const unsigned char *TimingPoint;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  unsigned short resindex, CRT2Index;
  const struct SiS_Part2PortTbl *CRT2Part2Ptr = NULL;
@@ -7069,7 +6971,7 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
  SiS_SetRegAND(SiS_Pr->SiS_Part2Port,0x17,0xFB);
  SiS_SetRegAND(SiS_Pr->SiS_Part2Port,0x18,0xDF);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  if(SiS_GetCRT2Part2Ptr(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex,
                                                &CRT2Index, &resindex)) {
      switch(CRT2Index) {
@@ -7130,12 +7032,6 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
    /* Non-expanding: lcdvdes = tempcx = VT-1; lcdvdee = tempbx = VDE-1 */
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-    xf86DrvMsg(0, X_INFO, "lcdvdes 0x%x lcdvdee 0x%x\n", tempcx, tempbx);
-#endif
-#endif
    SiS_SetReg(SiS_Pr->SiS_Part2Port,0x05,tempcx);      /* lcdvdes  */
    SiS_SetReg(SiS_Pr->SiS_Part2Port,0x06,tempbx);      /* lcdvdee  */
@@ -7184,12 +7080,6 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
       tempbx = SiS_Pr->CVSyncStart;
    }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-    xf86DrvMsg(0, X_INFO, "lcdvrs 0x%x\n", tempbx);
-#endif
-#endif
    SiS_SetReg(SiS_Pr->SiS_Part2Port,0x04,tempbx);          /* lcdvrs */
    temp = (tempbx >> 4) & 0xF0;
@@ -7201,15 +7091,9 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
       temp |= (SiS_Pr->CVSyncEnd & 0x0f);
    }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-    xf86DrvMsg(0, X_INFO, "lcdvre[3:0] 0x%x\n", (temp & 0x0f));
-#endif
-#endif
    SiS_SetReg(SiS_Pr->SiS_Part2Port,0x01,temp);
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
    SiS_Group2LCDSpecial(SiS_Pr, ModeNo, crt2crtc);
 #endif
@@ -7245,12 +7129,6 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
       tempax >>= 1;
    }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-    xf86DrvMsg(0, X_INFO, "lcdhdee 0x%x\n", tempbx);
-#endif
-#endif
    tempbx += bridgeoffset;
    SiS_SetReg(SiS_Pr->SiS_Part2Port,0x23,tempbx);          /* lcdhdee */
@@ -7276,12 +7154,6 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
       tempbx += bridgeoffset;
    }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-    xf86DrvMsg(0, X_INFO, "lcdhrs 0x%x\n", tempbx);
-#endif
-#endif
    SiS_SetReg(SiS_Pr->SiS_Part2Port,0x1C,tempbx);          /* lcdhrs */
    SiS_SetRegANDOR(SiS_Pr->SiS_Part2Port,0x1D,0x0F,((tempbx >> 4) & 0xf0));
@@ -7300,20 +7172,14 @@ SiS_SetGroup2(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
       tempbx += bridgeoffset;
    }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-    xf86DrvMsg(0, X_INFO, "lcdhre 0x%x\n", tempbx);
-#endif
-#endif
    SiS_SetReg(SiS_Pr->SiS_Part2Port,0x21,tempbx);          /* lcdhre */
    SiS_SetGroup2_Tail(SiS_Pr, ModeNo);
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
    SiS_Set300Part2Regs(SiS_Pr, ModeIdIndex, RefreshRateTableIndex, ModeNo);
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
  } /* CRT2-LCD from table */
 #endif
 }
@@ -7382,7 +7248,7 @@ SiS_SetGroup3(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
 /*         SET PART 4 REGISTER GROUP         */
 /*********************************************/
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 #if 0
 static void
 SiS_ShiftXPos(struct SiS_Private *SiS_Pr, int shift)
@@ -8011,7 +7877,7 @@ SiS_SetCHTVReg(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
   if(SiS_Pr->SiS_IF_DEF_CH70xx == 1) {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
      /* Chrontel 7005 - I assume that it does not come with a 315 series chip */
@@ -8124,7 +7990,7 @@ SiS_SetCHTVReg(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
      /* Chrontel 7019 - assumed that it does not come with a 300 series chip */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
      unsigned short temp;
@@ -8175,7 +8041,7 @@ SiS_SetCHTVReg(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short
 }
-#ifdef SIS315H  /* ----------- 315 series only ---------- */
+#ifdef CONFIG_FB_SIS_315  /* ----------- 315 series only ---------- */
 void
 SiS_Chrontel701xBLOn(struct SiS_Private *SiS_Pr)
@@ -8657,7 +8523,7 @@ SiS_ChrontelDoSomething1(struct SiS_Private *SiS_Pr)
 bool
 SiS_SetCRT2Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
 {
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
   unsigned char  *ROMAddr  = SiS_Pr->VirtualRomBase;
 #endif
   unsigned short ModeIdIndex, RefreshRateTableIndex;
@@ -8703,16 +8569,6 @@ SiS_SetCRT2Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
      SiS_GetLVDSDesData(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex);
   }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-  xf86DrvMsg(0, X_INFO, "(init301: LCDHDES 0x%03x LCDVDES 0x%03x)\n", SiS_Pr->SiS_LCDHDES, SiS_Pr->SiS_LCDVDES);
-  xf86DrvMsg(0, X_INFO, "(init301: HDE     0x%03x VDE     0x%03x)\n", SiS_Pr->SiS_HDE, SiS_Pr->SiS_VDE);
-  xf86DrvMsg(0, X_INFO, "(init301: VGAHDE  0x%03x VGAVDE  0x%03x)\n", SiS_Pr->SiS_VGAHDE, SiS_Pr->SiS_VGAVDE);
-  xf86DrvMsg(0, X_INFO, "(init301: HT      0x%03x VT      0x%03x)\n", SiS_Pr->SiS_HT, SiS_Pr->SiS_VT);
-  xf86DrvMsg(0, X_INFO, "(init301: VGAHT   0x%03x VGAVT   0x%03x)\n", SiS_Pr->SiS_VGAHT, SiS_Pr->SiS_VGAVT);
-#endif
-#endif
   if(SiS_Pr->SiS_SetFlag & LowModeTests) {
      SiS_SetGroup1(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex);
   }
@@ -8722,12 +8578,12 @@ SiS_SetCRT2Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
      if(SiS_Pr->SiS_SetFlag & LowModeTests) {
         SiS_SetGroup2(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
         SiS_SetGroup2_C_ELV(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex);
 #endif
         SiS_SetGroup3(SiS_Pr, ModeNo, ModeIdIndex);
         SiS_SetGroup4(SiS_Pr, ModeNo, ModeIdIndex, RefreshRateTableIndex);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
         SiS_SetGroup4_C_ELV(SiS_Pr, ModeNo, ModeIdIndex);
 #endif
         SiS_SetGroup5(SiS_Pr, ModeNo, ModeIdIndex);
@@ -8758,7 +8614,7 @@ SiS_SetCRT2Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
         if(SiS_Pr->SiS_IF_DEF_CH70xx != 0) {
            if(SiS_Pr->SiS_VBInfo & (SetCRT2ToLCD | SetCRT2ToLCDA)) {
               if(SiS_Pr->SiS_IF_DEF_CH70xx == 2) {
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
                  SiS_SetCH701xForLCD(SiS_Pr);
 #endif
               }
@@ -8771,7 +8627,7 @@ SiS_SetCRT2Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
   }
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
   if(SiS_Pr->ChipType < SIS_315H) {
      if(SiS_Pr->SiS_SetFlag & LowModeTests) {
         if(SiS_Pr->SiS_UseOEM) {
@@ -8794,7 +8650,7 @@ SiS_SetCRT2Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo)
   }
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
   if(SiS_Pr->ChipType >= SIS_315H) {
      if(SiS_Pr->SiS_SetFlag & LowModeTests) {
         if(SiS_Pr->ChipType < SIS_661) {
@@ -8873,7 +8729,7 @@ SiS_SetupDDCN(struct SiS_Private *SiS_Pr)
  }
 }
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static unsigned char *
 SiS_SetTrumpBlockLoop(struct SiS_Private *SiS_Pr, unsigned char *dataptr)
 {
@@ -8923,11 +8779,6 @@ SiS_SetTrumpionBlock(struct SiS_Private *SiS_Pr, unsigned char *dataptr)
     dataptr = SiS_SetTrumpBlockLoop(SiS_Pr, dataptr);
     if(!dataptr) return false;
  }
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-  xf86DrvMsg(0, X_INFO, "Trumpion block success\n");
-#endif
-#endif
  return true;
 }
 #endif
@@ -9002,9 +8853,7 @@ SiS_SetCH701x(struct SiS_Private *SiS_Pr, unsigned short reg, unsigned char val)
  SiS_SetChReg(SiS_Pr, reg, val, 0);
 }
-#ifdef SIS_LINUX_KERNEL
 static
-#endif
 void
 SiS_SetCH70xx(struct SiS_Private *SiS_Pr, unsigned short reg, unsigned char val)
 {
@@ -9091,9 +8940,7 @@ SiS_GetCH701x(struct SiS_Private *SiS_Pr, unsigned short tempbx)
 /* Read from Chrontel 70xx */
 /* Parameter is [Register no (S7-S0)] */
-#ifdef SIS_LINUX_KERNEL
 static
-#endif
 unsigned short
 SiS_GetCH70xx(struct SiS_Private *SiS_Pr, unsigned short tempbx)
 {
@@ -9114,9 +8961,7 @@ SiS_SetCH70xxANDOR(struct SiS_Private *SiS_Pr, unsigned short reg,
 }
 /* Our own DDC functions */
-#ifndef SIS_XORG_XF86
 static
-#endif
 unsigned short
 SiS_InitDDCRegs(struct SiS_Private *SiS_Pr, unsigned int VBFlags, int VGAEngine,
                unsigned short adaptnum, unsigned short DDCdatatype, bool checkcr32,
@@ -9224,12 +9069,6 @@ SiS_InitDDCRegs(struct SiS_Private *SiS_Pr, unsigned int VBFlags, int VGAEngine,
    SiS_SetupDDCN(SiS_Pr);
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-    xf86DrvMsg(0, X_INFO, "DDC Port %x Index %x Shift %d\n",
-                SiS_Pr->SiS_DDC_Port, SiS_Pr->SiS_DDC_Index, temp);
-#endif
-#endif
    return 0;
 }
@@ -9292,11 +9131,6 @@ SiS_DoProbeDDC(struct SiS_Private *SiS_Pr)
    SiS_SetSwitchDDC2(SiS_Pr);
    if(SiS_PrepareDDC(SiS_Pr)) {
         SiS_SetStop(SiS_Pr);
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-         xf86DrvMsg(0, X_INFO, "Probe: Prepare failed\n");
-#endif
-#endif
         return 0xFFFF;
    }
    mask = 0xf0;
@@ -9310,11 +9144,6 @@ SiS_DoProbeDDC(struct SiS_Private *SiS_Pr)
       } else {
           failed = true;
           ret = 0xFFFF;
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-           xf86DrvMsg(0, X_INFO, "Probe: Read 1 failed\n");
-#endif
-#endif
       }
    }
    if(!failed) {
@@ -9324,11 +9153,6 @@ SiS_DoProbeDDC(struct SiS_Private *SiS_Pr)
       if(temp == value) ret = 0;
       else {
          ret = 0xFFFF;
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-          xf86DrvMsg(0, X_INFO, "Probe: Read 2 failed\n");
-#endif
-#endif
          if(SiS_Pr->SiS_DDC_DeviceAddr == 0xa0) {
             if(temp == 0x30) ret = 0;
          }
@@ -9338,9 +9162,7 @@ SiS_DoProbeDDC(struct SiS_Private *SiS_Pr)
    return ret;
 }
-#ifndef SIS_XORG_XF86
 static
-#endif
 unsigned short
 SiS_ProbeDDC(struct SiS_Private *SiS_Pr)
 {
@@ -9357,9 +9179,7 @@ SiS_ProbeDDC(struct SiS_Private *SiS_Pr)
   return flag;
 }
-#ifndef SIS_XORG_XF86
 static
-#endif
 unsigned short
 SiS_ReadDDC(struct SiS_Private *SiS_Pr, unsigned short DDCdatatype, unsigned char *buffer)
 {
@@ -9606,11 +9426,6 @@ SiS_SetSCLKHigh(struct SiS_Private *SiS_Pr)
    temp = SiS_GetReg(SiS_Pr->SiS_DDC_Port,SiS_Pr->SiS_DDC_Index);
  } while((!(temp & SiS_Pr->SiS_DDC_Clk)) && --watchdog);
  if (!watchdog) {
-#ifdef SIS_XORG_XF86
-#ifdef TWDEBUG
-        xf86DrvMsg(0, X_INFO, "SetClkHigh failed\n");
-#endif
-#endif
        return 0xFFFF;
  }
  SiS_DDC2Delay(SiS_Pr,SiS_I2CDELAYSHORT);
@@ -9641,7 +9456,7 @@ SiS_CheckACK(struct SiS_Private *SiS_Pr)
 /* =============== SiS 315/330 O.E.M. ================= */
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static unsigned short
 GetRAMDACromptr(struct SiS_Private *SiS_Pr)
@@ -10829,7 +10644,7 @@ SiS_FinalizeLCD(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned shor
 /*  =================  SiS 300 O.E.M. ================== */
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static void
 SetOEMLCDData2(struct SiS_Private *SiS_Pr, unsigned short ModeNo,unsigned short ModeIdIndex,
diff --git a/drivers/video/sis/init301.h b/drivers/video/sis/init301.h
index 51d99222375d..e1fd31d0fddf 100644
--- a/drivers/video/sis/init301.h
+++ b/drivers/video/sis/init301.h
@@ -53,15 +53,8 @@
 #ifndef  _INIT301_H_
 #define  _INIT301_H_
-#include "osdef.h"
 #include "initdef.h"
-#ifdef SIS_XORG_XF86
-#include "sis.h"
-#include "sis_regs.h"
-#endif
-#ifdef SIS_LINUX_KERNEL
 #include "vgatypes.h"
 #include "vstruct.h"
 #ifdef SIS_CP
@@ -72,7 +65,6 @@
 #include <linux/fb.h>
 #include "sis.h"
 #include <video/sisfb.h>
-#endif
 static const unsigned char SiS_YPbPrTable[3][64] = {
  {
@@ -237,7 +229,7 @@ static const unsigned char SiS_Part2CLVX_6[] = {   /* 1080i */
    0xFF,0xFF,
 };
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 /* 661 et al LCD data structure (2.03.00) */
 static const unsigned char SiS_LCDStruct661[] = {
    /* 1024x768 */
@@ -279,7 +271,7 @@ static const unsigned char SiS_LCDStruct661[] = {
 };
 #endif
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static unsigned char SiS300_TrumpionData[14][80] = {
  { 0x02,0x0A,0x0A,0x01,0x04,0x01,0x00,0x03,0x0D,0x00,0x0D,0x10,0x7F,0x00,0x80,0x02,
    0x20,0x03,0x0B,0x00,0x90,0x01,0xC1,0x01,0x60,0x0C,0x30,0x10,0x00,0x00,0x04,0x23,
@@ -356,9 +348,6 @@ static unsigned char SiS300_TrumpionData[14][80] = {
 #endif
 void            SiS_UnLockCRT2(struct SiS_Private *SiS_Pr);
-#ifndef SIS_LINUX_KERNEL
-void            SiS_LockCRT2(struct SiS_Private *SiS_Pr);
-#endif
 void            SiS_EnableCRT2(struct SiS_Private *SiS_Pr);
 unsigned short  SiS_GetRatePtr(struct SiS_Private *SiS_Pr, unsigned short ModeNo, unsigned short ModeIdIndex);
 void            SiS_WaitRetrace1(struct SiS_Private *SiS_Pr);
@@ -375,9 +364,6 @@ unsigned short	SiS_GetVCLK2Ptr(struct SiS_Private *SiS_Pr, unsigned short ModeNo
                        unsigned short RefreshRateTableIndex);
 unsigned short  SiS_GetResInfo(struct SiS_Private *SiS_Pr,unsigned short ModeNo,unsigned short ModeIdIndex);
 void            SiS_DisableBridge(struct SiS_Private *SiS_Pr);
-#ifndef SIS_LINUX_KERNEL
-void            SiS_EnableBridge(struct SiS_Private *SiS_Pr);
-#endif
 bool            SiS_SetCRT2Group(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
 void            SiS_SiS30xBLOn(struct SiS_Private *SiS_Pr);
 void            SiS_SiS30xBLOff(struct SiS_Private *SiS_Pr);
@@ -386,13 +372,9 @@ void		SiS_SetCH700x(struct SiS_Private *SiS_Pr, unsigned short reg, unsigned cha
 unsigned short  SiS_GetCH700x(struct SiS_Private *SiS_Pr, unsigned short tempax);
 void            SiS_SetCH701x(struct SiS_Private *SiS_Pr, unsigned short reg, unsigned char val);
 unsigned short  SiS_GetCH701x(struct SiS_Private *SiS_Pr, unsigned short tempax);
-#ifndef SIS_LINUX_KERNEL
-void            SiS_SetCH70xx(struct SiS_Private *SiS_Pr, unsigned short reg, unsigned char val);
-unsigned short  SiS_GetCH70xx(struct SiS_Private *SiS_Pr, unsigned short tempax);
-#endif
 void            SiS_SetCH70xxANDOR(struct SiS_Private *SiS_Pr, unsigned short reg,
                        unsigned char orval,unsigned short andval);
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void     SiS_Chrontel701xOn(struct SiS_Private *SiS_Pr);
 static void     SiS_Chrontel701xOff(struct SiS_Private *SiS_Pr);
 static void     SiS_ChrontelInitTVVSync(struct SiS_Private *SiS_Pr);
@@ -401,7 +383,7 @@ void		SiS_Chrontel701xBLOn(struct SiS_Private *SiS_Pr);
 void            SiS_Chrontel701xBLOff(struct SiS_Private *SiS_Pr);
 #endif /* 315 */
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static  bool    SiS_SetTrumpionBlock(struct SiS_Private *SiS_Pr, unsigned char *dataptr);
 void            SiS_SetChrontelGPIO(struct SiS_Private *SiS_Pr, unsigned short myvbinfo);
 #endif
@@ -412,21 +394,12 @@ unsigned short	SiS_HandleDDC(struct SiS_Private *SiS_Pr, unsigned int VBFlags, i
                        unsigned short adaptnum, unsigned short DDCdatatype,
                        unsigned char *buffer, unsigned int VBFlags2);
-#ifdef SIS_XORG_XF86
-unsigned short          SiS_InitDDCRegs(struct SiS_Private *SiS_Pr, unsigned int VBFlags,
-                                int VGAEngine, unsigned short adaptnum, unsigned short DDCdatatype,
-                                bool checkcr32, unsigned int VBFlags2);
-unsigned short          SiS_ProbeDDC(struct SiS_Private *SiS_Pr);
-unsigned short          SiS_ReadDDC(struct SiS_Private *SiS_Pr, unsigned short DDCdatatype,
-                                unsigned char *buffer);
-#else
 static unsigned short   SiS_InitDDCRegs(struct SiS_Private *SiS_Pr, unsigned int VBFlags,
                                int VGAEngine, unsigned short adaptnum, unsigned short DDCdatatype,
                                bool checkcr32, unsigned int VBFlags2);
 static unsigned short   SiS_ProbeDDC(struct SiS_Private *SiS_Pr);
 static unsigned short   SiS_ReadDDC(struct SiS_Private *SiS_Pr, unsigned short DDCdatatype,
                                unsigned char *buffer);
-#endif
 static void             SiS_SetSwitchDDC2(struct SiS_Private *SiS_Pr);
 static unsigned short   SiS_SetStart(struct SiS_Private *SiS_Pr);
 static unsigned short   SiS_SetStop(struct SiS_Private *SiS_Pr);
@@ -441,13 +414,13 @@ static unsigned short	SiS_PrepareDDC(struct SiS_Private *SiS_Pr);
 static void             SiS_SendACK(struct SiS_Private *SiS_Pr, unsigned short yesno);
 static unsigned short   SiS_DoProbeDDC(struct SiS_Private *SiS_Pr);
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 static void             SiS_OEM300Setting(struct SiS_Private *SiS_Pr,
                                unsigned short ModeNo, unsigned short ModeIdIndex, unsigned short RefTabindex);
 static void             SetOEMLCDData2(struct SiS_Private *SiS_Pr,
                                unsigned short ModeNo, unsigned short ModeIdIndex,unsigned short RefTableIndex);
 #endif
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
 static void             SiS_OEM310Setting(struct SiS_Private *SiS_Pr,
                                unsigned short ModeNo,unsigned short ModeIdIndex, unsigned short RRTI);
 static void             SiS_OEM661Setting(struct SiS_Private *SiS_Pr,
@@ -482,15 +455,13 @@ extern void		SiS_CalcLCDACRT1Timing(struct SiS_Private *SiS_Pr, unsigned short M
 extern void             SiS_CalcCRRegisters(struct SiS_Private *SiS_Pr, int depth);
 extern unsigned short   SiS_GetRefCRTVCLK(struct SiS_Private *SiS_Pr, unsigned short Index, int UseWide);
 extern unsigned short   SiS_GetRefCRT1CRTC(struct SiS_Private *SiS_Pr, unsigned short Index, int UseWide);
-#ifdef SIS300
+#ifdef CONFIG_FB_SIS_300
 extern void             SiS_GetFIFOThresholdIndex300(struct SiS_Private *SiS_Pr, unsigned short *tempbx,
                                unsigned short *tempcl);
 extern unsigned short   SiS_GetFIFOThresholdB300(unsigned short tempbx, unsigned short tempcl);
 extern unsigned short   SiS_GetLatencyFactor630(struct SiS_Private *SiS_Pr, unsigned short index);
-#ifdef SIS_LINUX_KERNEL
 extern unsigned int     sisfb_read_nbridge_pci_dword(struct SiS_Private *SiS_Pr, int reg);
 extern unsigned int     sisfb_read_lpc_pci_dword(struct SiS_Private *SiS_Pr, int reg);
 #endif
-#endif
 #endif
diff --git a/drivers/video/sis/initextlfb.c b/drivers/video/sis/initextlfb.c
index 99c04a4855d1..9dec64da4015 100644
--- a/drivers/video/sis/initextlfb.c
+++ b/drivers/video/sis/initextlfb.c
@@ -25,7 +25,6 @@
 * Author:      Thomas Winischhofer <thomas@winischhofer.net>
 */
-#include "osdef.h"
 #include "initdef.h"
 #include "vgatypes.h"
 #include "vstruct.h"
@@ -59,7 +58,7 @@ sisfb_mode_rate_to_dclock(struct SiS_Private *SiS_Pr, unsigned char modeno,
    if(rateindex > 0) rateindex--;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
    switch(ModeNo) {
    case 0x5a: ModeNo = 0x50; break;
    case 0x5b: ModeNo = 0x56;
@@ -103,7 +102,7 @@ sisfb_mode_rate_to_ddata(struct SiS_Private *SiS_Pr, unsigned char modeno,
    if(rateindex > 0) rateindex--;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
    switch(ModeNo) {
       case 0x5a: ModeNo = 0x50; break;
       case 0x5b: ModeNo = 0x56;
@@ -187,7 +186,7 @@ sisfb_gettotalfrommode(struct SiS_Private *SiS_Pr, unsigned char modeno, int *ht
    if(rateindex > 0) rateindex--;
-#ifdef SIS315H
+#ifdef CONFIG_FB_SIS_315
    switch(ModeNo) {
       case 0x5a: ModeNo = 0x50; break;
       case 0x5b: ModeNo = 0x56;
diff --git a/drivers/video/sis/osdef.h b/drivers/video/sis/osdef.h
deleted file mode 100644
index 6ff8f988a1a7..000000000000
--- a/drivers/video/sis/osdef.h
+++ /dev/null
@@ -1,133 +0,0 @@
-/* $XFree86$ */
-/* $XdotOrg$ */
-/*
- * OS depending defines
- *
- * Copyright (C) 2001-2005 by Thomas Winischhofer, Vienna, Austria
- *
- * If distributed as part of the Linux kernel, the following license terms
- * apply:
- *
- * * This program is free software; you can redistribute it and/or modify
- * * it under the terms of the GNU General Public License as published by
- * * the Free Software Foundation; either version 2 of the named License,
- * * or any later version.
- * *
- * * This program is distributed in the hope that it will be useful,
- * * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * * GNU General Public License for more details.
- * *
- * * You should have received a copy of the GNU General Public License
- * * along with this program; if not, write to the Free Software
- * * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA
- *
- * Otherwise, the following license terms apply:
- *
- * * Redistribution and use in source and binary forms, with or without
- * * modification, are permitted provided that the following conditions
- * * are met:
- * * 1) Redistributions of source code must retain the above copyright
- * *    notice, this list of conditions and the following disclaimer.
- * * 2) Redistributions in binary form must reproduce the above copyright
- * *    notice, this list of conditions and the following disclaimer in the
- * *    documentation and/or other materials provided with the distribution.
- * * 3) The name of the author may not be used to endorse or promote products
- * *    derived from this software without specific prior written permission.
- * *
- * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * Author:      Thomas Winischhofer <thomas@winischhofer.net>
- *              Silicon Integrated Systems, Inc. (used by permission)
- *
- */
-#ifndef _SIS_OSDEF_H_
-#define _SIS_OSDEF_H_
-/* The choices are: */
-#define SIS_LINUX_KERNEL                /* Linux kernel framebuffer */
-#undef  SIS_XORG_XF86                   /* XFree86/X.org */
-#ifdef OutPortByte
-#undef OutPortByte
-#endif
-#ifdef OutPortWord
-#undef OutPortWord
-#endif
-#ifdef OutPortLong
-#undef OutPortLong
-#endif
-#ifdef InPortByte
-#undef InPortByte
-#endif
-#ifdef InPortWord
-#undef InPortWord
-#endif
-#ifdef InPortLong
-#undef InPortLong
-#endif
-/**********************************************************************/
-/*  LINUX KERNEL                                                      */
-/**********************************************************************/
-#ifdef SIS_LINUX_KERNEL
-#ifdef CONFIG_FB_SIS_300
-#define SIS300
-#endif
-#ifdef CONFIG_FB_SIS_315
-#define SIS315H
-#endif
-#if !defined(SIS300) && !defined(SIS315H)
-#warning Neither CONFIG_FB_SIS_300 nor CONFIG_FB_SIS_315 is set
-#warning sisfb will not work!
-#endif
-#define OutPortByte(p,v) outb((u8)(v),(SISIOADDRESS)(p))
-#define OutPortWord(p,v) outw((u16)(v),(SISIOADDRESS)(p))
-#define OutPortLong(p,v) outl((u32)(v),(SISIOADDRESS)(p))
-#define InPortByte(p)    inb((SISIOADDRESS)(p))
-#define InPortWord(p)    inw((SISIOADDRESS)(p))
-#define InPortLong(p)    inl((SISIOADDRESS)(p))
-#define SiS_SetMemory(MemoryAddress,MemorySize,value) memset_io(MemoryAddress, value, MemorySize)
-#endif /* LINUX_KERNEL */
-/**********************************************************************/
-/*  XFree86/X.org                                                    */
-/**********************************************************************/
-#ifdef SIS_XORG_XF86
-#define SIS300
-#define SIS315H
-#define OutPortByte(p,v) outSISREG((IOADDRESS)(p),(CARD8)(v))
-#define OutPortWord(p,v) outSISREGW((IOADDRESS)(p),(CARD16)(v))
-#define OutPortLong(p,v) outSISREGL((IOADDRESS)(p),(CARD32)(v))
-#define InPortByte(p)    inSISREG((IOADDRESS)(p))
-#define InPortWord(p)    inSISREGW((IOADDRESS)(p))
-#define InPortLong(p)    inSISREGL((IOADDRESS)(p))
-#define SiS_SetMemory(MemoryAddress,MemorySize,value) memset(MemoryAddress, value, MemorySize)
-#endif /* XF86 */
-#endif  /* _OSDEF_H_ */
diff --git a/drivers/video/sis/sis.h b/drivers/video/sis/sis.h
index 7c5710e3fb56..80d89d37c414 100644
--- a/drivers/video/sis/sis.h
+++ b/drivers/video/sis/sis.h
@@ -24,7 +24,6 @@
 #ifndef _SIS_H_
 #define _SIS_H_
-#include "osdef.h"
 #include <video/sisfb.h>
 #include "vgatypes.h"
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 3dde12b0ab06..7e3370f115b6 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -60,6 +60,11 @@
 #include "sis.h"
 #include "sis_main.h"
+#if !defined(CONFIG_FB_SIS_300) && !defined(CONFIG_FB_SIS_315)
+#warning Neither CONFIG_FB_SIS_300 nor CONFIG_FB_SIS_315 is set
+#warning sisfb will not work!
+#endif
 static void sisfb_handle_command(struct sis_video_info *ivideo,
                                 struct sisfb_cmd *sisfb_command);
@@ -4114,14 +4119,6 @@ sisfb_find_rom(struct pci_dev *pdev)
                        if(sisfb_check_rom(rom_base, ivideo)) {
                                if((myrombase = vmalloc(65536))) {
-                                        /* Work around bug in pci/rom.c: Folks forgot to check
-                                         * whether the size retrieved from the BIOS image eventually
-                                         * is larger than the mapped size
-                                         */
-                                        if(pci_resource_len(pdev, PCI_ROM_RESOURCE) < romsize)
-                                                romsize = pci_resource_len(pdev, PCI_ROM_RESOURCE);
                                        memcpy_fromio(myrombase, rom_base,
                                                        (romsize > 65536) ? 65536 : romsize);
                                }
@@ -4155,23 +4152,6 @@ sisfb_find_rom(struct pci_dev *pdev)
        }
-#else
-        pci_read_config_dword(pdev, PCI_ROM_ADDRESS, &temp);
-        pci_write_config_dword(pdev, PCI_ROM_ADDRESS,
-                        (ivideo->video_base & PCI_ROM_ADDRESS_MASK) | PCI_ROM_ADDRESS_ENABLE);
-        rom_base = ioremap(ivideo->video_base, 65536);
-        if(rom_base) {
-                if(sisfb_check_rom(rom_base, ivideo)) {
-                        if((myrombase = vmalloc(65536)))
-                                memcpy_fromio(myrombase, rom_base, 65536);
-                }
-                iounmap(rom_base);
-        }
-        pci_write_config_dword(pdev, PCI_ROM_ADDRESS, temp);
 #endif
        return myrombase;
diff --git a/drivers/video/sis/vgatypes.h b/drivers/video/sis/vgatypes.h
index 81a22eaabfde..12c0dfaf2518 100644
--- a/drivers/video/sis/vgatypes.h
+++ b/drivers/video/sis/vgatypes.h
@@ -55,21 +55,10 @@
 #define SISIOMEMTYPE
-#ifdef SIS_LINUX_KERNEL
 typedef unsigned long SISIOADDRESS;
 #include <linux/types.h>  /* Need __iomem */
 #undef SISIOMEMTYPE
 #define SISIOMEMTYPE __iomem
-#endif
-#ifdef SIS_XORG_XF86
-#if XF86_VERSION_CURRENT < XF86_VERSION_NUMERIC(4,2,0,0,0)
-typedef unsigned long IOADDRESS;
-typedef unsigned long SISIOADDRESS;
-#else
-typedef IOADDRESS SISIOADDRESS;
-#endif
-#endif
 typedef enum _SIS_CHIP_TYPE {
    SIS_VGALegacy = 0,
diff --git a/drivers/video/sis/vstruct.h b/drivers/video/sis/vstruct.h
index bef4aae388d0..ea94d214dcff 100644
--- a/drivers/video/sis/vstruct.h
+++ b/drivers/video/sis/vstruct.h
@@ -233,24 +233,15 @@ struct SiS_Private
 {
        unsigned char                   ChipType;
        unsigned char                   ChipRevision;
-#ifdef SIS_XORG_XF86
-        PCITAG                          PciTag;
-#endif
-#ifdef SIS_LINUX_KERNEL
        void                            *ivideo;
-#endif
        unsigned char                   *VirtualRomBase;
        bool                            UseROM;
-#ifdef SIS_LINUX_KERNEL
        unsigned char SISIOMEMTYPE      *VideoMemoryAddress;
        unsigned int                    VideoMemorySize;
-#endif
        SISIOADDRESS                    IOAddress;
        SISIOADDRESS                    IOAddress2;  /* For dual chip XGI volari */
-#ifdef SIS_LINUX_KERNEL
        SISIOADDRESS                    RelIO;
-#endif
        SISIOADDRESS                    SiS_P3c4;
        SISIOADDRESS                    SiS_P3d4;
        SISIOADDRESS                    SiS_P3c0;
@@ -280,9 +271,6 @@ struct SiS_Private
        unsigned short                  SiS_IF_DEF_FSTN;
        unsigned short                  SiS_SysFlags;
        unsigned char                   SiS_VGAINFO;
-#ifdef SIS_XORG_XF86
-        unsigned short                  SiS_CP1, SiS_CP2, SiS_CP3, SiS_CP4;
-#endif
        bool                            SiS_UseROM;
        bool                            SiS_ROMNew;
        bool                            SiS_XGIROM;
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 3a43ebf83a49..efb35aa8309a 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -9,19 +9,19 @@ static ssize_t device_show(struct device *_d,
                           struct device_attribute *attr, char *buf)
 {
        struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
-        return sprintf(buf, "%hu", dev->id.device);
+        return sprintf(buf, "0x%04x\n", dev->id.device);
 }
 static ssize_t vendor_show(struct device *_d,
                           struct device_attribute *attr, char *buf)
 {
        struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
-        return sprintf(buf, "%hu", dev->id.vendor);
+        return sprintf(buf, "0x%04x\n", dev->id.vendor);
 }
 static ssize_t status_show(struct device *_d,
                           struct device_attribute *attr, char *buf)
 {
        struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
-        return sprintf(buf, "0x%08x", dev->config->get_status(dev));
+        return sprintf(buf, "0x%08x\n", dev->config->get_status(dev));
 }
 static ssize_t modalias_show(struct device *_d,
                             struct device_attribute *attr, char *buf)
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 1475ed6b575f..cc2f73e03475 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -230,9 +230,6 @@ add_head:
        pr_debug("Added buffer head %i to %p\n", head, vq);
        END_USE(vq);
-        /* If we're indirect, we can fit many (assuming not OOM). */
-        if (vq->indirect)
-                return vq->num_free ? vq->vring.num : 0;
        return vq->num_free;
 }
 EXPORT_SYMBOL_GPL(virtqueue_add_buf_gfp);
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 4a291045ebac..a5ad77ef4266 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -558,6 +558,9 @@ config IT8712F_WDT
          This is the driver for the built-in watchdog timer on the IT8712F
          Super I/0 chipset used on many motherboards.
+          If the driver does not work, then make sure that the game port in
+          the BIOS is enabled.
          To compile this driver as a module, choose M here: the
          module will be called it8712f_wdt.
diff --git a/drivers/watchdog/bcm63xx_wdt.c b/drivers/watchdog/bcm63xx_wdt.c
index a1debc89356b..3c5045a206dd 100644
--- a/drivers/watchdog/bcm63xx_wdt.c
+++ b/drivers/watchdog/bcm63xx_wdt.c
@@ -18,7 +18,6 @@
 #include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/reboot.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
@@ -220,14 +219,6 @@ static long bcm63xx_wdt_ioctl(struct file *file, unsigned int cmd,
        }
 }
-static int bcm63xx_wdt_notify_sys(struct notifier_block *this,
-                                unsigned long code, void *unused)
-{
-        if (code == SYS_DOWN || code == SYS_HALT)
-                bcm63xx_wdt_pause();
-        return NOTIFY_DONE;
-}
 static const struct file_operations bcm63xx_wdt_fops = {
        .owner          = THIS_MODULE,
        .llseek         = no_llseek,
@@ -243,12 +234,8 @@ static struct miscdevice bcm63xx_wdt_miscdev = {
        .fops   = &bcm63xx_wdt_fops,
 };
-static struct notifier_block bcm63xx_wdt_notifier = {
-        .notifier_call = bcm63xx_wdt_notify_sys,
-};
+static int __devinit bcm63xx_wdt_probe(struct platform_device *pdev)
-static int bcm63xx_wdt_probe(struct platform_device *pdev)
 {
        int ret;
        struct resource *r;
@@ -280,16 +267,10 @@ static int bcm63xx_wdt_probe(struct platform_device *pdev)
                        wdt_time);
        }
-        ret = register_reboot_notifier(&bcm63xx_wdt_notifier);
-        if (ret) {
-                dev_err(&pdev->dev, "failed to register reboot_notifier\n");
-                goto unregister_timer;
-        }
        ret = misc_register(&bcm63xx_wdt_miscdev);
        if (ret < 0) {
                dev_err(&pdev->dev, "failed to register watchdog device\n");
-                goto unregister_reboot_notifier;
+                goto unregister_timer;
        }
        dev_info(&pdev->dev, " started, timer margin: %d sec\n",
@@ -297,8 +278,6 @@ static int bcm63xx_wdt_probe(struct platform_device *pdev)
        return 0;
-unregister_reboot_notifier:
-        unregister_reboot_notifier(&bcm63xx_wdt_notifier);
 unregister_timer:
        bcm63xx_timer_unregister(TIMER_WDT_ID);
 unmap:
@@ -306,25 +285,28 @@ unmap:
        return ret;
 }
-static int bcm63xx_wdt_remove(struct platform_device *pdev)
+static int __devexit bcm63xx_wdt_remove(struct platform_device *pdev)
 {
        if (!nowayout)
                bcm63xx_wdt_pause();
        misc_deregister(&bcm63xx_wdt_miscdev);
-        iounmap(bcm63xx_wdt_device.regs);
-        unregister_reboot_notifier(&bcm63xx_wdt_notifier);
        bcm63xx_timer_unregister(TIMER_WDT_ID);
+        iounmap(bcm63xx_wdt_device.regs);
        return 0;
 }
+static void bcm63xx_wdt_shutdown(struct platform_device *pdev)
+{
+        bcm63xx_wdt_pause();
+}
 static struct platform_driver bcm63xx_wdt = {
        .probe  = bcm63xx_wdt_probe,
-        .remove = bcm63xx_wdt_remove,
+        .remove = __devexit_p(bcm63xx_wdt_remove),
+        .shutdown = bcm63xx_wdt_shutdown,
        .driver = {
+                .owner = THIS_MODULE,
                .name = "bcm63xx-wdt",
        }
 };
diff --git a/drivers/watchdog/gef_wdt.c b/drivers/watchdog/gef_wdt.c
index 9c21d19043a6..f6bd6f10fcec 100644
--- a/drivers/watchdog/gef_wdt.c
+++ b/drivers/watchdog/gef_wdt.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/miscdevice.h>
 #include <linux/watchdog.h>
+#include <linux/fs.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/io.h>
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index f7e90fe47b71..b8838d2c67a6 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -32,6 +32,7 @@
 *      document number 322169-001, 322170-003: 5 Series, 3400 Series (PCH)
 *      document number 320066-003, 320257-008: EP80597 (IICH)
 *      document number TBD                   : Cougar Point (CPT)
+ *      document number TBD                   : Patsburg (PBG)
 */
 /*
@@ -146,7 +147,8 @@ enum iTCO_chipsets {
        TCO_CPT29,      /* Cougar Point */
        TCO_CPT30,      /* Cougar Point */
        TCO_CPT31,      /* Cougar Point */
-        TCO_PBG,        /* Patsburg */
+        TCO_PBG1,       /* Patsburg */
+        TCO_PBG2,       /* Patsburg */
 };
 static struct {
@@ -235,6 +237,7 @@ static struct {
        {"Cougar Point", 2},
        {"Cougar Point", 2},
        {"Patsburg", 2},
+        {"Patsburg", 2},
        {NULL, 0}
 };
@@ -350,7 +353,8 @@ static struct pci_device_id iTCO_wdt_pci_tbl[] = {
        { ITCO_PCI_DEVICE(0x1c5d,                               TCO_CPT29)},
        { ITCO_PCI_DEVICE(0x1c5e,                               TCO_CPT30)},
        { ITCO_PCI_DEVICE(0x1c5f,                               TCO_CPT31)},
-        { ITCO_PCI_DEVICE(0x1d40,                               TCO_PBG)},
+        { ITCO_PCI_DEVICE(0x1d40,                               TCO_PBG1)},
+        { ITCO_PCI_DEVICE(0x1d41,                               TCO_PBG2)},
        { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE(pci, iTCO_wdt_pci_tbl);
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index eb8a78d77d9d..533a199e7a3f 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -8,9 +8,12 @@ obj-$(CONFIG_BLOCK)		+= biomerge.o
 obj-$(CONFIG_HOTPLUG_CPU)       += cpu_hotplug.o
 obj-$(CONFIG_XEN_XENCOMM)       += xencomm.o
 obj-$(CONFIG_XEN_BALLOON)       += balloon.o
-obj-$(CONFIG_XEN_DEV_EVTCHN)    += evtchn.o
+obj-$(CONFIG_XEN_DEV_EVTCHN)    += xen-evtchn.o
 obj-$(CONFIG_XENFS)             += xenfs/
 obj-$(CONFIG_XEN_SYS_HYPERVISOR)        += sys-hypervisor.o
 obj-$(CONFIG_XEN_PLATFORM_PCI)  += platform-pci.o
 obj-$(CONFIG_SWIOTLB_XEN)       += swiotlb-xen.o
 obj-$(CONFIG_XEN_DOM0)          += pci.o
+xen-evtchn-y                    := evtchn.o
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 500290b150bb..43f9f02c7db0 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -50,6 +50,7 @@
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
 #include <asm/tlb.h>
+#include <asm/e820.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
@@ -119,7 +120,7 @@ static void scrub_page(struct page *page)
 }
 /* balloon_append: add the given page to the balloon. */
-static void balloon_append(struct page *page)
+static void __balloon_append(struct page *page)
 {
        /* Lowmem is re-populated first, so highmem pages go at list tail. */
        if (PageHighMem(page)) {
@@ -130,7 +131,11 @@ static void balloon_append(struct page *page)
                list_add(&page->lru, &ballooned_pages);
                balloon_stats.balloon_low++;
        }
+}
+static void balloon_append(struct page *page)
+{
+        __balloon_append(page);
        totalram_pages--;
 }
@@ -191,7 +196,7 @@ static unsigned long current_target(void)
 static int increase_reservation(unsigned long nr_pages)
 {
-        unsigned long  pfn, i, flags;
+        unsigned long  pfn, i;
        struct page   *page;
        long           rc;
        struct xen_memory_reservation reservation = {
@@ -203,8 +208,6 @@ static int increase_reservation(unsigned long nr_pages)
        if (nr_pages > ARRAY_SIZE(frame_list))
                nr_pages = ARRAY_SIZE(frame_list);
-        spin_lock_irqsave(&xen_reservation_lock, flags);
        page = balloon_first_page();
        for (i = 0; i < nr_pages; i++) {
                BUG_ON(page == NULL);
@@ -247,14 +250,12 @@ static int increase_reservation(unsigned long nr_pages)
        balloon_stats.current_pages += rc;
 out:
-        spin_unlock_irqrestore(&xen_reservation_lock, flags);
        return rc < 0 ? rc : rc != nr_pages;
 }
 static int decrease_reservation(unsigned long nr_pages)
 {
-        unsigned long  pfn, i, flags;
+        unsigned long  pfn, i;
        struct page   *page;
        int            need_sleep = 0;
        int ret;
@@ -292,8 +293,6 @@ static int decrease_reservation(unsigned long nr_pages)
        kmap_flush_unused();
        flush_tlb_all();
-        spin_lock_irqsave(&xen_reservation_lock, flags);
        /* No more mappings: invalidate P2M and add to balloon. */
        for (i = 0; i < nr_pages; i++) {
                pfn = mfn_to_pfn(frame_list[i]);
@@ -308,8 +307,6 @@ static int decrease_reservation(unsigned long nr_pages)
        balloon_stats.current_pages -= nr_pages;
-        spin_unlock_irqrestore(&xen_reservation_lock, flags);
        return need_sleep;
 }
@@ -395,7 +392,7 @@ static struct notifier_block xenstore_notifier;
 static int __init balloon_init(void)
 {
-        unsigned long pfn;
+        unsigned long pfn, extra_pfn_end;
        struct page *page;
        if (!xen_pv_domain())
@@ -415,11 +412,24 @@ static int __init balloon_init(void)
        register_balloon(&balloon_sysdev);
-        /* Initialise the balloon with excess memory space. */
+        /*
-        for (pfn = xen_start_info->nr_pages; pfn < max_pfn; pfn++) {
+         * Initialise the balloon with excess memory space.  We need
+         * to make sure we don't add memory which doesn't exist or
+         * logically exist.  The E820 map can be trimmed to be smaller
+         * than the amount of physical memory due to the mem= command
+         * line parameter.  And if this is a 32-bit non-HIGHMEM kernel
+         * on a system with memory which requires highmem to access,
+         * don't try to use it.
+         */
+        extra_pfn_end = min(min(max_pfn, e820_end_of_ram_pfn()),
+                            (unsigned long)PFN_DOWN(xen_extra_mem_start + xen_extra_mem_size));
+        for (pfn = PFN_UP(xen_extra_mem_start);
+             pfn < extra_pfn_end;
+             pfn++) {
                page = pfn_to_page(pfn);
-                if (!PageReserved(page))
+                /* totalram_pages doesn't include the boot-time
-                        balloon_append(page);
+                   balloon extension, so don't subtract from it. */
+                __balloon_append(page);
        }
        target_watch.callback = watch_target;
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 321a0c8346e5..31af0ac31a98 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -105,7 +105,6 @@ struct irq_info
 static struct irq_info *irq_info;
 static int *pirq_to_irq;
-static int nr_pirqs;
 static int *evtchn_to_irq;
 struct cpu_evtchn_s {
@@ -278,17 +277,17 @@ static void bind_evtchn_to_cpu(unsigned int chn, unsigned int cpu)
        cpumask_copy(irq_to_desc(irq)->affinity, cpumask_of(cpu));
 #endif
-        __clear_bit(chn, cpu_evtchn_mask(cpu_from_irq(irq)));
+        clear_bit(chn, cpu_evtchn_mask(cpu_from_irq(irq)));
-        __set_bit(chn, cpu_evtchn_mask(cpu));
+        set_bit(chn, cpu_evtchn_mask(cpu));
        irq_info[irq].cpu = cpu;
 }
 static void init_evtchn_cpu_bindings(void)
 {
+        int i;
 #ifdef CONFIG_SMP
        struct irq_desc *desc;
-        int i;
        /* By default all event channels notify CPU#0. */
        for_each_irq_desc(i, desc) {
@@ -296,7 +295,10 @@ static void init_evtchn_cpu_bindings(void)
        }
 #endif
-        memset(cpu_evtchn_mask(0), ~0, sizeof(struct cpu_evtchn_s));
+        for_each_possible_cpu(i)
+                memset(cpu_evtchn_mask(i),
+                       (i == 0) ? ~0 : 0, sizeof(struct cpu_evtchn_s));
 }
 static inline void clear_evtchn(int port)
@@ -382,12 +384,17 @@ static int get_nr_hw_irqs(void)
        return ret;
 }
-/* callers of this function should make sure that PHYSDEVOP_get_nr_pirqs
+static int find_unbound_pirq(int type)
- * succeeded otherwise nr_pirqs won't hold the right value */
-static int find_unbound_pirq(void)
 {
-        int i;
+        int rc, i;
-        for (i = nr_pirqs-1; i >= 0; i--) {
+        struct physdev_get_free_pirq op_get_free_pirq;
+        op_get_free_pirq.type = type;
+        rc = HYPERVISOR_physdev_op(PHYSDEVOP_get_free_pirq, &op_get_free_pirq);
+        if (!rc)
+                return op_get_free_pirq.pirq;
+        for (i = 0; i < nr_irqs; i++) {
                if (pirq_to_irq[i] < 0)
                        return i;
        }
@@ -420,7 +427,7 @@ static int find_unbound_irq(void)
        if (irq == start)
                goto no_irqs;
-        res = irq_alloc_desc_at(irq, 0);
+        res = irq_alloc_desc_at(irq, -1);
        if (WARN_ON(res != irq))
                return -1;
@@ -608,10 +615,10 @@ int xen_map_pirq_gsi(unsigned pirq, unsigned gsi, int shareable, char *name)
        spin_lock(&irq_mapping_update_lock);
-        if ((pirq > nr_pirqs) || (gsi > nr_irqs)) {
+        if ((pirq > nr_irqs) || (gsi > nr_irqs)) {
                printk(KERN_WARNING "xen_map_pirq_gsi: %s %s is incorrect!\n",
-                        pirq > nr_pirqs ? "nr_pirqs" :"",
+                        pirq > nr_irqs ? "pirq" :"",
-                        gsi > nr_irqs ? "nr_irqs" : "");
+                        gsi > nr_irqs ? "gsi" : "");
                goto out;
        }
@@ -627,7 +634,7 @@ int xen_map_pirq_gsi(unsigned pirq, unsigned gsi, int shareable, char *name)
        if (identity_mapped_irq(gsi) || (!xen_initial_domain() &&
                                xen_pv_domain())) {
                irq = gsi;
-                irq_alloc_desc_at(irq, 0);
+                irq_alloc_desc_at(irq, -1);
        } else
                irq = find_unbound_irq();
@@ -661,17 +668,21 @@ out:
 #include <linux/msi.h>
 #include "../pci/msi.h"
-void xen_allocate_pirq_msi(char *name, int *irq, int *pirq)
+void xen_allocate_pirq_msi(char *name, int *irq, int *pirq, int alloc)
 {
        spin_lock(&irq_mapping_update_lock);
-        *irq = find_unbound_irq();
+        if (alloc & XEN_ALLOC_IRQ) {
-        if (*irq == -1)
+                *irq = find_unbound_irq();
-                goto out;
+                if (*irq == -1)
+                        goto out;
+        }
-        *pirq = find_unbound_pirq();
+        if (alloc & XEN_ALLOC_PIRQ) {
-        if (*pirq == -1)
+                *pirq = find_unbound_pirq(MAP_PIRQ_TYPE_MSI);
-                goto out;
+                if (*pirq == -1)
+                        goto out;
+        }
        set_irq_chip_and_handler_name(*irq, &xen_pirq_chip,
                                      handle_level_irq, name);
@@ -752,13 +763,14 @@ int xen_destroy_irq(int irq)
                goto out;
        if (xen_initial_domain()) {
-                unmap_irq.pirq = info->u.pirq.gsi;
+                unmap_irq.pirq = info->u.pirq.pirq;
                unmap_irq.domid = DOMID_SELF;
                rc = HYPERVISOR_physdev_op(PHYSDEVOP_unmap_pirq, &unmap_irq);
                if (rc) {
                        printk(KERN_WARNING "unmap irq failed %d\n", rc);
                        goto out;
                }
+                pirq_to_irq[info->u.pirq.pirq] = -1;
        }
        irq_info[irq] = mk_unbound_info();
@@ -779,6 +791,11 @@ int xen_gsi_from_irq(unsigned irq)
        return gsi_from_irq(irq);
 }
+int xen_irq_from_pirq(unsigned pirq)
+{
+        return pirq_to_irq[pirq];
+}
 int bind_evtchn_to_irq(unsigned int evtchn)
 {
        int irq;
@@ -1276,6 +1293,42 @@ static int retrigger_dynirq(unsigned int irq)
        return ret;
 }
+static void restore_cpu_pirqs(void)
+{
+        int pirq, rc, irq, gsi;
+        struct physdev_map_pirq map_irq;
+        for (pirq = 0; pirq < nr_irqs; pirq++) {
+                irq = pirq_to_irq[pirq];
+                if (irq == -1)
+                        continue;
+                /* save/restore of PT devices doesn't work, so at this point the
+                 * only devices present are GSI based emulated devices */
+                gsi = gsi_from_irq(irq);
+                if (!gsi)
+                        continue;
+                map_irq.domid = DOMID_SELF;
+                map_irq.type = MAP_PIRQ_TYPE_GSI;
+                map_irq.index = gsi;
+                map_irq.pirq = pirq;
+                rc = HYPERVISOR_physdev_op(PHYSDEVOP_map_pirq, &map_irq);
+                if (rc) {
+                        printk(KERN_WARNING "xen map irq failed gsi=%d irq=%d pirq=%d rc=%d\n",
+                                        gsi, irq, pirq, rc);
+                        irq_info[irq] = mk_unbound_info();
+                        pirq_to_irq[pirq] = -1;
+                        continue;
+                }
+                printk(KERN_DEBUG "xen: --> irq=%d, pirq=%d\n", irq, map_irq.pirq);
+                startup_pirq(irq);
+        }
+}
 static void restore_cpu_virqs(unsigned int cpu)
 {
        struct evtchn_bind_virq bind_virq;
@@ -1419,6 +1472,8 @@ void xen_irq_resume(void)
                unmask_evtchn(evtchn);
        }
+        restore_cpu_pirqs();
 }
 static struct irq_chip xen_dynamic_chip __read_mostly = {
@@ -1503,26 +1558,17 @@ void xen_callback_vector(void) {}
 void __init xen_init_IRQ(void)
 {
-        int i, rc;
+        int i;
-        struct physdev_nr_pirqs op_nr_pirqs;
        cpu_evtchn_mask_p = kcalloc(nr_cpu_ids, sizeof(struct cpu_evtchn_s),
                                    GFP_KERNEL);
        irq_info = kcalloc(nr_irqs, sizeof(*irq_info), GFP_KERNEL);
-        rc = HYPERVISOR_physdev_op(PHYSDEVOP_get_nr_pirqs, &op_nr_pirqs);
+        /* We are using nr_irqs as the maximum number of pirq available but
-        if (rc < 0) {
+         * that number is actually chosen by Xen and we don't know exactly
-                nr_pirqs = nr_irqs;
+         * what it is. Be careful choosing high pirq numbers. */
-                if (rc != -ENOSYS)
+        pirq_to_irq = kcalloc(nr_irqs, sizeof(*pirq_to_irq), GFP_KERNEL);
-                        printk(KERN_WARNING "PHYSDEVOP_get_nr_pirqs returned rc=%d\n", rc);
+        for (i = 0; i < nr_irqs; i++)
-        } else {
-                if (xen_pv_domain() && !xen_initial_domain())
-                        nr_pirqs = max((int)op_nr_pirqs.nr_pirqs, nr_irqs);
-                else
-                        nr_pirqs = op_nr_pirqs.nr_pirqs;
-        }
-        pirq_to_irq = kcalloc(nr_pirqs, sizeof(*pirq_to_irq), GFP_KERNEL);
-        for (i = 0; i < nr_pirqs; i++)
                pirq_to_irq[i] = -1;
        evtchn_to_irq = kcalloc(NR_EVENT_CHANNELS, sizeof(*evtchn_to_irq),
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index fec6ba3c08a8..ef11daf0cafe 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -69,20 +69,51 @@ struct per_user_data {
        const char *name;
 };
-/* Who's bound to each port? */
+/*
-static struct per_user_data *port_user[NR_EVENT_CHANNELS];
+ * Who's bound to each port?  This is logically an array of struct
+ * per_user_data *, but we encode the current enabled-state in bit 0.
+ */
+static unsigned long *port_user;
 static DEFINE_SPINLOCK(port_user_lock); /* protects port_user[] and ring_prod */
-irqreturn_t evtchn_interrupt(int irq, void *data)
+static inline struct per_user_data *get_port_user(unsigned port)
+{
+        return (struct per_user_data *)(port_user[port] & ~1);
+}
+static inline void set_port_user(unsigned port, struct per_user_data *u)
+{
+        port_user[port] = (unsigned long)u;
+}
+static inline bool get_port_enabled(unsigned port)
+{
+        return port_user[port] & 1;
+}
+static inline void set_port_enabled(unsigned port, bool enabled)
+{
+        if (enabled)
+                port_user[port] |= 1;
+        else
+                port_user[port] &= ~1;
+}
+static irqreturn_t evtchn_interrupt(int irq, void *data)
 {
        unsigned int port = (unsigned long)data;
        struct per_user_data *u;
        spin_lock(&port_user_lock);
-        u = port_user[port];
+        u = get_port_user(port);
+        WARN(!get_port_enabled(port),
+             "Interrupt for port %d, but apparently not enabled; per-user %p\n",
+             port, u);
        disable_irq_nosync(irq);
+        set_port_enabled(port, false);
        if ((u->ring_prod - u->ring_cons) < EVTCHN_RING_SIZE) {
                u->ring[EVTCHN_RING_MASK(u->ring_prod)] = port;
@@ -92,9 +123,8 @@ irqreturn_t evtchn_interrupt(int irq, void *data)
                        kill_fasync(&u->evtchn_async_queue,
                                    SIGIO, POLL_IN);
                }
-        } else {
+        } else
                u->ring_overflow = 1;
-        }
        spin_unlock(&port_user_lock);
@@ -198,9 +228,18 @@ static ssize_t evtchn_write(struct file *file, const char __user *buf,
                goto out;
        spin_lock_irq(&port_user_lock);
-        for (i = 0; i < (count/sizeof(evtchn_port_t)); i++)
-                if ((kbuf[i] < NR_EVENT_CHANNELS) && (port_user[kbuf[i]] == u))
+        for (i = 0; i < (count/sizeof(evtchn_port_t)); i++) {
-                        enable_irq(irq_from_evtchn(kbuf[i]));
+                unsigned port = kbuf[i];
+                if (port < NR_EVENT_CHANNELS &&
+                    get_port_user(port) == u &&
+                    !get_port_enabled(port)) {
+                        set_port_enabled(port, true);
+                        enable_irq(irq_from_evtchn(port));
+                }
+        }
        spin_unlock_irq(&port_user_lock);
        rc = count;
@@ -222,8 +261,9 @@ static int evtchn_bind_to_user(struct per_user_data *u, int port)
         * interrupt handler yet, and our caller has already
         * serialized bind operations.)
         */
-        BUG_ON(port_user[port] != NULL);
+        BUG_ON(get_port_user(port) != NULL);
-        port_user[port] = u;
+        set_port_user(port, u);
+        set_port_enabled(port, true); /* start enabled */
        rc = bind_evtchn_to_irqhandler(port, evtchn_interrupt, IRQF_DISABLED,
                                       u->name, (void *)(unsigned long)port);
@@ -239,10 +279,7 @@ static void evtchn_unbind_from_user(struct per_user_data *u, int port)
        unbind_from_irqhandler(irq, (void *)(unsigned long)port);
-        /* make sure we unbind the irq handler before clearing the port */
+        set_port_user(port, NULL);
-        barrier();
-        port_user[port] = NULL;
 }
 static long evtchn_ioctl(struct file *file,
@@ -333,15 +370,17 @@ static long evtchn_ioctl(struct file *file,
                spin_lock_irq(&port_user_lock);
                rc = -ENOTCONN;
-                if (port_user[unbind.port] != u) {
+                if (get_port_user(unbind.port) != u) {
                        spin_unlock_irq(&port_user_lock);
                        break;
                }
-                evtchn_unbind_from_user(u, unbind.port);
+                disable_irq(irq_from_evtchn(unbind.port));
                spin_unlock_irq(&port_user_lock);
+                evtchn_unbind_from_user(u, unbind.port);
                rc = 0;
                break;
        }
@@ -355,7 +394,7 @@ static long evtchn_ioctl(struct file *file,
                if (notify.port >= NR_EVENT_CHANNELS) {
                        rc = -EINVAL;
-                } else if (port_user[notify.port] != u) {
+                } else if (get_port_user(notify.port) != u) {
                        rc = -ENOTCONN;
                } else {
                        notify_remote_via_evtchn(notify.port);
@@ -431,7 +470,7 @@ static int evtchn_open(struct inode *inode, struct file *filp)
        filp->private_data = u;
-        return 0;
+        return nonseekable_open(inode, filp);;
 }
 static int evtchn_release(struct inode *inode, struct file *filp)
@@ -444,14 +483,21 @@ static int evtchn_release(struct inode *inode, struct file *filp)
        free_page((unsigned long)u->ring);
        for (i = 0; i < NR_EVENT_CHANNELS; i++) {
-                if (port_user[i] != u)
+                if (get_port_user(i) != u)
                        continue;
-                evtchn_unbind_from_user(port_user[i], i);
+                disable_irq(irq_from_evtchn(i));
        }
        spin_unlock_irq(&port_user_lock);
+        for (i = 0; i < NR_EVENT_CHANNELS; i++) {
+                if (get_port_user(i) != u)
+                        continue;
+                evtchn_unbind_from_user(get_port_user(i), i);
+        }
        kfree(u->name);
        kfree(u);
@@ -467,12 +513,12 @@ static const struct file_operations evtchn_fops = {
        .fasync  = evtchn_fasync,
        .open    = evtchn_open,
        .release = evtchn_release,
-        .llseek = noop_llseek,
+        .llseek  = no_llseek,
 };
 static struct miscdevice evtchn_miscdev = {
        .minor        = MISC_DYNAMIC_MINOR,
-        .name         = "evtchn",
+        .name         = "xen/evtchn",
        .fops         = &evtchn_fops,
 };
 static int __init evtchn_init(void)
@@ -482,8 +528,11 @@ static int __init evtchn_init(void)
        if (!xen_domain())
                return -ENODEV;
+        port_user = kcalloc(NR_EVENT_CHANNELS, sizeof(*port_user), GFP_KERNEL);
+        if (port_user == NULL)
+                return -ENOMEM;
        spin_lock_init(&port_user_lock);
-        memset(port_user, 0, sizeof(port_user));
        /* Create '/dev/misc/evtchn'. */
        err = misc_register(&evtchn_miscdev);
@@ -499,6 +548,9 @@ static int __init evtchn_init(void)
 static void __exit evtchn_cleanup(void)
 {
+        kfree(port_user);
+        port_user = NULL;
        misc_deregister(&evtchn_miscdev);
 }
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index ef9c7db52077..db8c4c4ac880 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -49,6 +49,7 @@ static int xen_hvm_suspend(void *data)
        if (!*cancelled) {
                xen_irq_resume();
+                xen_console_resume();
                xen_timer_resume();
        }
diff --git a/drivers/xen/xenfs/privcmd.c b/drivers/xen/xenfs/privcmd.c
index 0f5d4162b22d..dbd3b16fd131 100644
--- a/drivers/xen/xenfs/privcmd.c
+++ b/drivers/xen/xenfs/privcmd.c
@@ -265,9 +265,7 @@ static int mmap_return_errors(void *data, void *state)
        xen_pfn_t *mfnp = data;
        struct mmap_batch_state *st = state;
-        put_user(*mfnp, st->user++);
+        return put_user(*mfnp, st->user++);
-        return 0;
 }
 static struct vm_operations_struct privcmd_vm_ops;
@@ -322,10 +320,8 @@ static long privcmd_ioctl_mmap_batch(void __user *udata)
        up_write(&mm->mmap_sem);
        if (state.err > 0) {
-                ret = 0;
                state.user = m.arr;
-                traverse_pages(m.num, sizeof(xen_pfn_t),
+                ret = traverse_pages(m.num, sizeof(xen_pfn_t),
                               &pagelist,
                               mmap_return_errors, &state);
        }
@@ -383,8 +379,9 @@ static int privcmd_mmap(struct file *file, struct vm_area_struct *vma)
        if (xen_feature(XENFEAT_auto_translated_physmap))
                return -ENOSYS;
-        /* DONTCOPY is essential for Xen as copy_page_range is broken. */
+        /* DONTCOPY is essential for Xen because copy_page_range doesn't know
-        vma->vm_flags |= VM_RESERVED | VM_IO | VM_DONTCOPY;
+         * how to recreate these mappings */
+        vma->vm_flags |= VM_RESERVED | VM_IO | VM_DONTCOPY | VM_PFNMAP;
        vma->vm_ops = &privcmd_vm_ops;
        vma->vm_private_data = NULL;
diff --git a/drivers/xen/xenfs/super.c b/drivers/xen/xenfs/super.c
index f6339d11d59c..1aa389719846 100644
--- a/drivers/xen/xenfs/super.c
+++ b/drivers/xen/xenfs/super.c
@@ -12,8 +12,6 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/magic.h>
-#include <linux/mm.h>
-#include <linux/backing-dev.h>
 #include <xen/xen.h>
@@ -24,28 +22,12 @@
 MODULE_DESCRIPTION("Xen filesystem");
 MODULE_LICENSE("GPL");
-static int xenfs_set_page_dirty(struct page *page)
-{
-        return !TestSetPageDirty(page);
-}
-static const struct address_space_operations xenfs_aops = {
-        .set_page_dirty = xenfs_set_page_dirty,
-};
-static struct backing_dev_info xenfs_backing_dev_info = {
-        .ra_pages       = 0,    /* No readahead */
-        .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
-};
 static struct inode *xenfs_make_inode(struct super_block *sb, int mode)
 {
        struct inode *ret = new_inode(sb);
        if (ret) {
                ret->i_mode = mode;
-                ret->i_mapping->a_ops = &xenfs_aops;
-                ret->i_mapping->backing_dev_info = &xenfs_backing_dev_info;
                ret->i_uid = ret->i_gid = 0;
                ret->i_blocks = 0;
                ret->i_atime = ret->i_mtime = ret->i_ctime = CURRENT_TIME;
@@ -121,9 +103,9 @@ static int xenfs_fill_super(struct super_block *sb, void *data, int silent)
        return rc;
 }
-static int xenfs_mount(struct file_system_type *fs_type,
+static struct dentry *xenfs_mount(struct file_system_type *fs_type,
-                        int flags, const char *dev_name,
+                                  int flags, const char *dev_name,
-                        void *data)
+                                  void *data)
 {
        return mount_single(fs_type, flags, data, xenfs_fill_super);
 }
@@ -137,25 +119,11 @@ static struct file_system_type xenfs_type = {
 static int __init xenfs_init(void)
 {
-        int err;
+        if (xen_domain())
-        if (!xen_domain()) {
+                return register_filesystem(&xenfs_type);
-                printk(KERN_INFO "xenfs: not registering filesystem on non-xen platform\n");
-                return 0;
-        }
-        err = register_filesystem(&xenfs_type);
-        if (err) {
-                printk(KERN_ERR "xenfs: Unable to register filesystem!\n");
-                goto out;
-        }
-        err = bdi_init(&xenfs_backing_dev_info);
-        if (err)
-                unregister_filesystem(&xenfs_type);
- out:
-        return err;
+        printk(KERN_INFO "XENFS: not registering filesystem on non-xen platform\n");
+        return 0;
 }
 static void __exit xenfs_exit(void)
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index d5c1401f0031..d34896cfb19f 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -980,19 +980,11 @@ static int autofs4_root_ioctl_unlocked(struct inode *inode, struct file *filp,
        }
 }
-static DEFINE_MUTEX(autofs4_ioctl_mutex);
 static long autofs4_root_ioctl(struct file *filp,
                               unsigned int cmd, unsigned long arg)
 {
-        long ret;
        struct inode *inode = filp->f_dentry->d_inode;
+        return autofs4_root_ioctl_unlocked(inode, filp, cmd, arg);
-        mutex_lock(&autofs4_ioctl_mutex);
-        ret = autofs4_root_ioctl_unlocked(inode, filp, cmd, arg);
-        mutex_unlock(&autofs4_ioctl_mutex);
-        return ret;
 }
 #ifdef CONFIG_COMPAT
@@ -1002,13 +994,11 @@ static long autofs4_root_compat_ioctl(struct file *filp,
        struct inode *inode = filp->f_path.dentry->d_inode;
        int ret;
-        mutex_lock(&autofs4_ioctl_mutex);
        if (cmd == AUTOFS_IOC_READY || cmd == AUTOFS_IOC_FAIL)
                ret = autofs4_root_ioctl_unlocked(inode, filp, cmd, arg);
        else
                ret = autofs4_root_ioctl_unlocked(inode, filp, cmd,
                        (unsigned long)compat_ptr(arg));
-        mutex_unlock(&autofs4_ioctl_mutex);
        return ret;
 }
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 7845d1f7d1d9..b50bc4bd5c56 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -91,23 +91,10 @@ static inline int compressed_bio_size(struct btrfs_root *root,
 static struct bio *compressed_bio_alloc(struct block_device *bdev,
                                        u64 first_byte, gfp_t gfp_flags)
 {
-        struct bio *bio;
        int nr_vecs;
        nr_vecs = bio_get_nr_vecs(bdev);
-        bio = bio_alloc(gfp_flags, nr_vecs);
+        return btrfs_bio_alloc(bdev, first_byte >> 9, nr_vecs, gfp_flags);
-        if (bio == NULL && (current->flags & PF_MEMALLOC)) {
-                while (!bio && (nr_vecs /= 2))
-                        bio = bio_alloc(gfp_flags, nr_vecs);
-        }
-        if (bio) {
-                bio->bi_size = 0;
-                bio->bi_bdev = bdev;
-                bio->bi_sector = first_byte >> 9;
-        }
-        return bio;
 }
 static int check_compressed_csum(struct inode *inode,
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 8db9234f6b41..af52f6d7a4d8 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -808,9 +808,9 @@ struct btrfs_block_group_cache {
        int extents_thresh;
        int free_extents;
        int total_bitmaps;
-        int ro:1;
+        unsigned int ro:1;
-        int dirty:1;
+        unsigned int dirty:1;
-        int iref:1;
+        unsigned int iref:1;
        int disk_cache_state;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index fb827d0d7181..c547cca26a26 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -28,6 +28,7 @@
 #include <linux/freezer.h>
 #include <linux/crc32c.h>
 #include <linux/slab.h>
+#include <linux/migrate.h>
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -355,6 +356,8 @@ static int csum_dirty_buffer(struct btrfs_root *root, struct page *page)
        ret = btree_read_extent_buffer_pages(root, eb, start + PAGE_CACHE_SIZE,
                                             btrfs_header_generation(eb));
        BUG_ON(ret);
+        WARN_ON(!btrfs_header_flag(eb, BTRFS_HEADER_FLAG_WRITTEN));
        found_start = btrfs_header_bytenr(eb);
        if (found_start != start) {
                WARN_ON(1);
@@ -693,6 +696,29 @@ static int btree_submit_bio_hook(struct inode *inode, int rw, struct bio *bio,
                                   __btree_submit_bio_done);
 }
+static int btree_migratepage(struct address_space *mapping,
+                        struct page *newpage, struct page *page)
+{
+        /*
+         * we can't safely write a btree page from here,
+         * we haven't done the locking hook
+         */
+        if (PageDirty(page))
+                return -EAGAIN;
+        /*
+         * Buffers may be managed in a filesystem specific way.
+         * We must have no buffers or drop them.
+         */
+        if (page_has_private(page) &&
+            !try_to_release_page(page, GFP_KERNEL))
+                return -EAGAIN;
+#ifdef CONFIG_MIGRATION
+        return migrate_page(mapping, newpage, page);
+#else
+        return -ENOSYS;
+#endif
+}
 static int btree_writepage(struct page *page, struct writeback_control *wbc)
 {
        struct extent_io_tree *tree;
@@ -707,8 +733,7 @@ static int btree_writepage(struct page *page, struct writeback_control *wbc)
        }
        redirty_page_for_writepage(wbc, page);
-        eb = btrfs_find_tree_block(root, page_offset(page),
+        eb = btrfs_find_tree_block(root, page_offset(page), PAGE_CACHE_SIZE);
-                                      PAGE_CACHE_SIZE);
        WARN_ON(!eb);
        was_dirty = test_and_set_bit(EXTENT_BUFFER_DIRTY, &eb->bflags);
@@ -799,6 +824,9 @@ static const struct address_space_operations btree_aops = {
        .releasepage    = btree_releasepage,
        .invalidatepage = btree_invalidatepage,
        .sync_page      = block_sync_page,
+#ifdef CONFIG_MIGRATION
+        .migratepage    = btree_migratepage,
+#endif
 };
 int readahead_tree_block(struct btrfs_root *root, u64 bytenr, u32 blocksize,
@@ -1538,10 +1566,8 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                                                 GFP_NOFS);
        struct btrfs_root *csum_root = kzalloc(sizeof(struct btrfs_root),
                                                 GFP_NOFS);
-        struct btrfs_root *tree_root = kzalloc(sizeof(struct btrfs_root),
+        struct btrfs_root *tree_root = btrfs_sb(sb);
-                                               GFP_NOFS);
+        struct btrfs_fs_info *fs_info = tree_root->fs_info;
-        struct btrfs_fs_info *fs_info = kzalloc(sizeof(*fs_info),
-                                                GFP_NOFS);
        struct btrfs_root *chunk_root = kzalloc(sizeof(struct btrfs_root),
                                                GFP_NOFS);
        struct btrfs_root *dev_root = kzalloc(sizeof(struct btrfs_root),
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 951ef09b82f4..6f0444473594 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -232,9 +232,85 @@ fail:
        return ERR_PTR(ret);
 }
+static int btrfs_get_name(struct dentry *parent, char *name,
+                          struct dentry *child)
+{
+        struct inode *inode = child->d_inode;
+        struct inode *dir = parent->d_inode;
+        struct btrfs_path *path;
+        struct btrfs_root *root = BTRFS_I(dir)->root;
+        struct btrfs_inode_ref *iref;
+        struct btrfs_root_ref *rref;
+        struct extent_buffer *leaf;
+        unsigned long name_ptr;
+        struct btrfs_key key;
+        int name_len;
+        int ret;
+        if (!dir || !inode)
+                return -EINVAL;
+        if (!S_ISDIR(dir->i_mode))
+                return -EINVAL;
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+        path->leave_spinning = 1;
+        if (inode->i_ino == BTRFS_FIRST_FREE_OBJECTID) {
+                key.objectid = BTRFS_I(inode)->root->root_key.objectid;
+                key.type = BTRFS_ROOT_BACKREF_KEY;
+                key.offset = (u64)-1;
+                root = root->fs_info->tree_root;
+        } else {
+                key.objectid = inode->i_ino;
+                key.offset = dir->i_ino;
+                key.type = BTRFS_INODE_REF_KEY;
+        }
+        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        if (ret < 0) {
+                btrfs_free_path(path);
+                return ret;
+        } else if (ret > 0) {
+                if (inode->i_ino == BTRFS_FIRST_FREE_OBJECTID) {
+                        path->slots[0]--;
+                } else {
+                        btrfs_free_path(path);
+                        return -ENOENT;
+                }
+        }
+        leaf = path->nodes[0];
+        if (inode->i_ino == BTRFS_FIRST_FREE_OBJECTID) {
+               rref = btrfs_item_ptr(leaf, path->slots[0],
+                                     struct btrfs_root_ref);
+               name_ptr = (unsigned long)(rref + 1);
+               name_len = btrfs_root_ref_name_len(leaf, rref);
+        } else {
+                iref = btrfs_item_ptr(leaf, path->slots[0],
+                                      struct btrfs_inode_ref);
+                name_ptr = (unsigned long)(iref + 1);
+                name_len = btrfs_inode_ref_name_len(leaf, iref);
+        }
+        read_extent_buffer(leaf, name, name_ptr, name_len);
+        btrfs_free_path(path);
+        /*
+         * have to add the null termination to make sure that reconnect_path
+         * gets the right len for strlen
+         */
+        name[name_len] = '\0';
+        return 0;
+}
 const struct export_operations btrfs_export_ops = {
        .encode_fh      = btrfs_encode_fh,
        .fh_to_dentry   = btrfs_fh_to_dentry,
        .fh_to_parent   = btrfs_fh_to_parent,
        .get_parent     = btrfs_get_parent,
+        .get_name       = btrfs_get_name,
 };
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 0c097f3aec41..bcd59c7dfb57 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3412,7 +3412,7 @@ again:
         * our reservation.
         */
        if (unused <= space_info->total_bytes) {
-                unused -= space_info->total_bytes;
+                unused = space_info->total_bytes - unused;
                if (unused >= num_bytes) {
                        if (!reserved)
                                space_info->bytes_reserved += orig_bytes;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index eac10e3260a9..3e86b9f36507 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1828,9 +1828,9 @@ static void end_bio_extent_preparewrite(struct bio *bio, int err)
        bio_put(bio);
 }
-static struct bio *
+struct bio *
-extent_bio_alloc(struct block_device *bdev, u64 first_sector, int nr_vecs,
+btrfs_bio_alloc(struct block_device *bdev, u64 first_sector, int nr_vecs,
-                 gfp_t gfp_flags)
+                gfp_t gfp_flags)
 {
        struct bio *bio;
@@ -1919,7 +1919,7 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
        else
                nr = bio_get_nr_vecs(bdev);
-        bio = extent_bio_alloc(bdev, sector, nr, GFP_NOFS | __GFP_HIGH);
+        bio = btrfs_bio_alloc(bdev, sector, nr, GFP_NOFS | __GFP_HIGH);
        bio_add_page(bio, page, page_size, offset);
        bio->bi_end_io = end_io_func;
@@ -2901,21 +2901,53 @@ out:
 int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                __u64 start, __u64 len, get_extent_t *get_extent)
 {
-        int ret;
+        int ret = 0;
        u64 off = start;
        u64 max = start + len;
        u32 flags = 0;
+        u32 found_type;
+        u64 last;
        u64 disko = 0;
+        struct btrfs_key found_key;
        struct extent_map *em = NULL;
        struct extent_state *cached_state = NULL;
+        struct btrfs_path *path;
+        struct btrfs_file_extent_item *item;
        int end = 0;
        u64 em_start = 0, em_len = 0;
        unsigned long emflags;
-        ret = 0;
+        int hole = 0;
        if (len == 0)
                return -EINVAL;
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+        path->leave_spinning = 1;
+        ret = btrfs_lookup_file_extent(NULL, BTRFS_I(inode)->root,
+                                       path, inode->i_ino, -1, 0);
+        if (ret < 0) {
+                btrfs_free_path(path);
+                return ret;
+        }
+        WARN_ON(!ret);
+        path->slots[0]--;
+        item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                              struct btrfs_file_extent_item);
+        btrfs_item_key_to_cpu(path->nodes[0], &found_key, path->slots[0]);
+        found_type = btrfs_key_type(&found_key);
+        /* No extents, just return */
+        if (found_key.objectid != inode->i_ino ||
+            found_type != BTRFS_EXTENT_DATA_KEY) {
+                btrfs_free_path(path);
+                return 0;
+        }
+        last = found_key.offset;
+        btrfs_free_path(path);
        lock_extent_bits(&BTRFS_I(inode)->io_tree, start, start + len, 0,
                         &cached_state, GFP_NOFS);
        em = get_extent(inode, NULL, 0, off, max - off, 0);
@@ -2925,11 +2957,18 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                ret = PTR_ERR(em);
                goto out;
        }
        while (!end) {
+                hole = 0;
                off = em->start + em->len;
                if (off >= max)
                        end = 1;
+                if (em->block_start == EXTENT_MAP_HOLE) {
+                        hole = 1;
+                        goto next;
+                }
                em_start = em->start;
                em_len = em->len;
@@ -2939,8 +2978,6 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                if (em->block_start == EXTENT_MAP_LAST_BYTE) {
                        end = 1;
                        flags |= FIEMAP_EXTENT_LAST;
-                } else if (em->block_start == EXTENT_MAP_HOLE) {
-                        flags |= FIEMAP_EXTENT_UNWRITTEN;
                } else if (em->block_start == EXTENT_MAP_INLINE) {
                        flags |= (FIEMAP_EXTENT_DATA_INLINE |
                                  FIEMAP_EXTENT_NOT_ALIGNED);
@@ -2953,10 +2990,10 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags))
                        flags |= FIEMAP_EXTENT_ENCODED;
+next:
                emflags = em->flags;
                free_extent_map(em);
                em = NULL;
                if (!end) {
                        em = get_extent(inode, NULL, 0, off, max - off, 0);
                        if (!em)
@@ -2967,15 +3004,23 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                        }
                        emflags = em->flags;
                }
                if (test_bit(EXTENT_FLAG_VACANCY, &emflags)) {
                        flags |= FIEMAP_EXTENT_LAST;
                        end = 1;
                }
-                ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
+                if (em_start == last) {
-                                        em_len, flags);
+                        flags |= FIEMAP_EXTENT_LAST;
-                if (ret)
+                        end = 1;
-                        goto out_free;
+                }
+                if (!hole) {
+                        ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
+                                                em_len, flags);
+                        if (ret)
+                                goto out_free;
+                }
        }
 out_free:
        free_extent_map(em);
@@ -3836,8 +3881,10 @@ int try_release_extent_buffer(struct extent_io_tree *tree, struct page *page)
        spin_lock(&tree->buffer_lock);
        eb = radix_tree_lookup(&tree->buffer, start >> PAGE_CACHE_SHIFT);
-        if (!eb)
+        if (!eb) {
-                goto out;
+                spin_unlock(&tree->buffer_lock);
+                return ret;
+        }
        if (test_bit(EXTENT_BUFFER_DIRTY, &eb->bflags)) {
                ret = 0;
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 1c6d4f342ef7..4183c8178f01 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -310,4 +310,7 @@ int extent_clear_unlock_delalloc(struct inode *inode,
                                struct extent_io_tree *tree,
                                u64 start, u64 end, struct page *locked_page,
                                unsigned long op);
+struct bio *
+btrfs_bio_alloc(struct block_device *bdev, u64 first_sector, int nr_vecs,
+                gfp_t gfp_flags);
 #endif
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index e354c33df082..c1faded5fca0 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1047,8 +1047,14 @@ out:
                if ((file->f_flags & O_DSYNC) || IS_SYNC(inode)) {
                        trans = btrfs_start_transaction(root, 0);
+                        if (IS_ERR(trans)) {
+                                num_written = PTR_ERR(trans);
+                                goto done;
+                        }
+                        mutex_lock(&inode->i_mutex);
                        ret = btrfs_log_dentry_safe(trans, root,
                                                    file->f_dentry);
+                        mutex_unlock(&inode->i_mutex);
                        if (ret == 0) {
                                ret = btrfs_sync_log(trans, root);
                                if (ret == 0)
@@ -1067,6 +1073,7 @@ out:
                             (start_pos + num_written - 1) >> PAGE_CACHE_SHIFT);
                }
        }
+done:
        current->backing_dev_info = NULL;
        return num_written ? num_written : err;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 558cac2dfa54..8039390bd6a6 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4501,6 +4501,7 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
        BTRFS_I(inode)->index_cnt = 2;
        BTRFS_I(inode)->root = root;
        BTRFS_I(inode)->generation = trans->transid;
+        inode->i_generation = BTRFS_I(inode)->generation;
        btrfs_set_inode_space_info(root, inode);
        if (mode & S_IFDIR)
@@ -4622,12 +4623,12 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
 }
 static int btrfs_add_nondir(struct btrfs_trans_handle *trans,
-                            struct dentry *dentry, struct inode *inode,
+                            struct inode *dir, struct dentry *dentry,
-                            int backref, u64 index)
+                            struct inode *inode, int backref, u64 index)
 {
-        int err = btrfs_add_link(trans, dentry->d_parent->d_inode,
+        int err = btrfs_add_link(trans, dir, inode,
-                                 inode, dentry->d_name.name,
+                                 dentry->d_name.name, dentry->d_name.len,
-                                 dentry->d_name.len, backref, index);
+                                 backref, index);
        if (!err) {
                d_instantiate(dentry, inode);
                return 0;
@@ -4668,8 +4669,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
        btrfs_set_trans_block_group(trans, dir);
        inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
-                                dentry->d_name.len,
+                                dentry->d_name.len, dir->i_ino, objectid,
-                                dentry->d_parent->d_inode->i_ino, objectid,
                                BTRFS_I(dir)->block_group, mode, &index);
        err = PTR_ERR(inode);
        if (IS_ERR(inode))
@@ -4682,7 +4682,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
        }
        btrfs_set_trans_block_group(trans, inode);
-        err = btrfs_add_nondir(trans, dentry, inode, 0, index);
+        err = btrfs_add_nondir(trans, dir, dentry, inode, 0, index);
        if (err)
                drop_inode = 1;
        else {
@@ -4730,10 +4730,8 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
        btrfs_set_trans_block_group(trans, dir);
        inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
-                                dentry->d_name.len,
+                                dentry->d_name.len, dir->i_ino, objectid,
-                                dentry->d_parent->d_inode->i_ino,
+                                BTRFS_I(dir)->block_group, mode, &index);
-                                objectid, BTRFS_I(dir)->block_group, mode,
-                                &index);
        err = PTR_ERR(inode);
        if (IS_ERR(inode))
                goto out_unlock;
@@ -4745,7 +4743,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
        }
        btrfs_set_trans_block_group(trans, inode);
-        err = btrfs_add_nondir(trans, dentry, inode, 0, index);
+        err = btrfs_add_nondir(trans, dir, dentry, inode, 0, index);
        if (err)
                drop_inode = 1;
        else {
@@ -4787,6 +4785,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                return -EPERM;
        btrfs_inc_nlink(inode);
+        inode->i_ctime = CURRENT_TIME;
        err = btrfs_set_inode_index(dir, &index);
        if (err)
@@ -4805,15 +4804,17 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
        btrfs_set_trans_block_group(trans, dir);
        ihold(inode);
-        err = btrfs_add_nondir(trans, dentry, inode, 1, index);
+        err = btrfs_add_nondir(trans, dir, dentry, inode, 1, index);
        if (err) {
                drop_inode = 1;
        } else {
+                struct dentry *parent = dget_parent(dentry);
                btrfs_update_inode_block_group(trans, dir);
                err = btrfs_update_inode(trans, root, inode);
                BUG_ON(err);
-                btrfs_log_new_name(trans, inode, NULL, dentry->d_parent);
+                btrfs_log_new_name(trans, inode, NULL, parent);
+                dput(parent);
        }
        nr = trans->blocks_used;
@@ -4853,8 +4854,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
        btrfs_set_trans_block_group(trans, dir);
        inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
-                                dentry->d_name.len,
+                                dentry->d_name.len, dir->i_ino, objectid,
-                                dentry->d_parent->d_inode->i_ino, objectid,
                                BTRFS_I(dir)->block_group, S_IFDIR | mode,
                                &index);
        if (IS_ERR(inode)) {
@@ -4877,9 +4877,8 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
        if (err)
                goto out_fail;
-        err = btrfs_add_link(trans, dentry->d_parent->d_inode,
+        err = btrfs_add_link(trans, dir, inode, dentry->d_name.name,
-                                 inode, dentry->d_name.name,
+                             dentry->d_name.len, 0, index);
-                                 dentry->d_name.len, 0, index);
        if (err)
                goto out_fail;
@@ -5535,13 +5534,21 @@ struct btrfs_dio_private {
        u64 bytes;
        u32 *csums;
        void *private;
+        /* number of bios pending for this dio */
+        atomic_t pending_bios;
+        /* IO errors */
+        int errors;
+        struct bio *orig_bio;
 };
 static void btrfs_endio_direct_read(struct bio *bio, int err)
 {
+        struct btrfs_dio_private *dip = bio->bi_private;
        struct bio_vec *bvec_end = bio->bi_io_vec + bio->bi_vcnt - 1;
        struct bio_vec *bvec = bio->bi_io_vec;
-        struct btrfs_dio_private *dip = bio->bi_private;
        struct inode *inode = dip->inode;
        struct btrfs_root *root = BTRFS_I(inode)->root;
        u64 start;
@@ -5595,15 +5602,18 @@ static void btrfs_endio_direct_write(struct bio *bio, int err)
        struct btrfs_trans_handle *trans;
        struct btrfs_ordered_extent *ordered = NULL;
        struct extent_state *cached_state = NULL;
+        u64 ordered_offset = dip->logical_offset;
+        u64 ordered_bytes = dip->bytes;
        int ret;
        if (err)
                goto out_done;
+again:
-        ret = btrfs_dec_test_ordered_pending(inode, &ordered,
+        ret = btrfs_dec_test_first_ordered_pending(inode, &ordered,
-                                             dip->logical_offset, dip->bytes);
+                                                   &ordered_offset,
+                                                   ordered_bytes);
        if (!ret)
-                goto out_done;
+                goto out_test;
        BUG_ON(!ordered);
@@ -5663,8 +5673,20 @@ out_unlock:
 out:
        btrfs_delalloc_release_metadata(inode, ordered->len);
        btrfs_end_transaction(trans, root);
+        ordered_offset = ordered->file_offset + ordered->len;
        btrfs_put_ordered_extent(ordered);
        btrfs_put_ordered_extent(ordered);
+out_test:
+        /*
+         * our bio might span multiple ordered extents.  If we haven't
+         * completed the accounting for the whole dio, go back and try again
+         */
+        if (ordered_offset < dip->logical_offset + dip->bytes) {
+                ordered_bytes = dip->logical_offset + dip->bytes -
+                        ordered_offset;
+                goto again;
+        }
 out_done:
        bio->bi_private = dip->private;
@@ -5684,6 +5706,176 @@ static int __btrfs_submit_bio_start_direct_io(struct inode *inode, int rw,
        return 0;
 }
+static void btrfs_end_dio_bio(struct bio *bio, int err)
+{
+        struct btrfs_dio_private *dip = bio->bi_private;
+        if (err) {
+                printk(KERN_ERR "btrfs direct IO failed ino %lu rw %lu "
+                      "disk_bytenr %lu len %u err no %d\n",
+                      dip->inode->i_ino, bio->bi_rw, bio->bi_sector,
+                      bio->bi_size, err);
+                dip->errors = 1;
+                /*
+                 * before atomic variable goto zero, we must make sure
+                 * dip->errors is perceived to be set.
+                 */
+                smp_mb__before_atomic_dec();
+        }
+        /* if there are more bios still pending for this dio, just exit */
+        if (!atomic_dec_and_test(&dip->pending_bios))
+                goto out;
+        if (dip->errors)
+                bio_io_error(dip->orig_bio);
+        else {
+                set_bit(BIO_UPTODATE, &dip->orig_bio->bi_flags);
+                bio_endio(dip->orig_bio, 0);
+        }
+out:
+        bio_put(bio);
+}
+static struct bio *btrfs_dio_bio_alloc(struct block_device *bdev,
+                                       u64 first_sector, gfp_t gfp_flags)
+{
+        int nr_vecs = bio_get_nr_vecs(bdev);
+        return btrfs_bio_alloc(bdev, first_sector, nr_vecs, gfp_flags);
+}
+static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
+                                         int rw, u64 file_offset, int skip_sum,
+                                         u32 *csums)
+{
+        int write = rw & REQ_WRITE;
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        int ret;
+        bio_get(bio);
+        ret = btrfs_bio_wq_end_io(root->fs_info, bio, 0);
+        if (ret)
+                goto err;
+        if (write && !skip_sum) {
+                ret = btrfs_wq_submit_bio(root->fs_info,
+                                   inode, rw, bio, 0, 0,
+                                   file_offset,
+                                   __btrfs_submit_bio_start_direct_io,
+                                   __btrfs_submit_bio_done);
+                goto err;
+        } else if (!skip_sum)
+                btrfs_lookup_bio_sums_dio(root, inode, bio,
+                                          file_offset, csums);
+        ret = btrfs_map_bio(root, rw, bio, 0, 1);
+err:
+        bio_put(bio);
+        return ret;
+}
+static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
+                                    int skip_sum)
+{
+        struct inode *inode = dip->inode;
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
+        struct bio *bio;
+        struct bio *orig_bio = dip->orig_bio;
+        struct bio_vec *bvec = orig_bio->bi_io_vec;
+        u64 start_sector = orig_bio->bi_sector;
+        u64 file_offset = dip->logical_offset;
+        u64 submit_len = 0;
+        u64 map_length;
+        int nr_pages = 0;
+        u32 *csums = dip->csums;
+        int ret = 0;
+        bio = btrfs_dio_bio_alloc(orig_bio->bi_bdev, start_sector, GFP_NOFS);
+        if (!bio)
+                return -ENOMEM;
+        bio->bi_private = dip;
+        bio->bi_end_io = btrfs_end_dio_bio;
+        atomic_inc(&dip->pending_bios);
+        map_length = orig_bio->bi_size;
+        ret = btrfs_map_block(map_tree, READ, start_sector << 9,
+                              &map_length, NULL, 0);
+        if (ret) {
+                bio_put(bio);
+                return -EIO;
+        }
+        while (bvec <= (orig_bio->bi_io_vec + orig_bio->bi_vcnt - 1)) {
+                if (unlikely(map_length < submit_len + bvec->bv_len ||
+                    bio_add_page(bio, bvec->bv_page, bvec->bv_len,
+                                 bvec->bv_offset) < bvec->bv_len)) {
+                        /*
+                         * inc the count before we submit the bio so
+                         * we know the end IO handler won't happen before
+                         * we inc the count. Otherwise, the dip might get freed
+                         * before we're done setting it up
+                         */
+                        atomic_inc(&dip->pending_bios);
+                        ret = __btrfs_submit_dio_bio(bio, inode, rw,
+                                                     file_offset, skip_sum,
+                                                     csums);
+                        if (ret) {
+                                bio_put(bio);
+                                atomic_dec(&dip->pending_bios);
+                                goto out_err;
+                        }
+                        if (!skip_sum)
+                                csums = csums + nr_pages;
+                        start_sector += submit_len >> 9;
+                        file_offset += submit_len;
+                        submit_len = 0;
+                        nr_pages = 0;
+                        bio = btrfs_dio_bio_alloc(orig_bio->bi_bdev,
+                                                  start_sector, GFP_NOFS);
+                        if (!bio)
+                                goto out_err;
+                        bio->bi_private = dip;
+                        bio->bi_end_io = btrfs_end_dio_bio;
+                        map_length = orig_bio->bi_size;
+                        ret = btrfs_map_block(map_tree, READ, start_sector << 9,
+                                              &map_length, NULL, 0);
+                        if (ret) {
+                                bio_put(bio);
+                                goto out_err;
+                        }
+                } else {
+                        submit_len += bvec->bv_len;
+                        nr_pages ++;
+                        bvec++;
+                }
+        }
+        ret = __btrfs_submit_dio_bio(bio, inode, rw, file_offset, skip_sum,
+                                     csums);
+        if (!ret)
+                return 0;
+        bio_put(bio);
+out_err:
+        dip->errors = 1;
+        /*
+         * before atomic variable goto zero, we must
+         * make sure dip->errors is perceived to be set.
+         */
+        smp_mb__before_atomic_dec();
+        if (atomic_dec_and_test(&dip->pending_bios))
+                bio_io_error(dip->orig_bio);
+        /* bio_end_io() will handle error, so we needn't return it */
+        return 0;
+}
 static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode,
                                loff_t file_offset)
 {
@@ -5723,36 +5915,18 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode,
        dip->disk_bytenr = (u64)bio->bi_sector << 9;
        bio->bi_private = dip;
+        dip->errors = 0;
+        dip->orig_bio = bio;
+        atomic_set(&dip->pending_bios, 0);
        if (write)
                bio->bi_end_io = btrfs_endio_direct_write;
        else
                bio->bi_end_io = btrfs_endio_direct_read;
-        ret = btrfs_bio_wq_end_io(root->fs_info, bio, 0);
+        ret = btrfs_submit_direct_hook(rw, dip, skip_sum);
-        if (ret)
+        if (!ret)
-                goto out_err;
-        if (write && !skip_sum) {
-                ret = btrfs_wq_submit_bio(BTRFS_I(inode)->root->fs_info,
-                                   inode, rw, bio, 0, 0,
-                                   dip->logical_offset,
-                                   __btrfs_submit_bio_start_direct_io,
-                                   __btrfs_submit_bio_done);
-                if (ret)
-                        goto out_err;
                return;
-        } else if (!skip_sum)
-                btrfs_lookup_bio_sums_dio(root, inode, bio,
-                                          dip->logical_offset, dip->csums);
-        ret = btrfs_map_bio(root, rw, bio, 0, 1);
-        if (ret)
-                goto out_err;
-        return;
-out_err:
-        kfree(dip->csums);
-        kfree(dip);
 free_ordered:
        /*
         * If this is a write, we need to clean up the reserved space and kill
@@ -6607,8 +6781,9 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        BUG_ON(ret);
        if (old_inode->i_ino != BTRFS_FIRST_FREE_OBJECTID) {
-                btrfs_log_new_name(trans, old_inode, old_dir,
+                struct dentry *parent = dget_parent(new_dentry);
-                                   new_dentry->d_parent);
+                btrfs_log_new_name(trans, old_inode, old_dir, parent);
+                dput(parent);
                btrfs_end_log_trans(root);
        }
 out_fail:
@@ -6758,8 +6933,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
        btrfs_set_trans_block_group(trans, dir);
        inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
-                                dentry->d_name.len,
+                                dentry->d_name.len, dir->i_ino, objectid,
-                                dentry->d_parent->d_inode->i_ino, objectid,
                                BTRFS_I(dir)->block_group, S_IFLNK|S_IRWXUGO,
                                &index);
        err = PTR_ERR(inode);
@@ -6773,7 +6947,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
        }
        btrfs_set_trans_block_group(trans, inode);
-        err = btrfs_add_nondir(trans, dentry, inode, 0, index);
+        err = btrfs_add_nondir(trans, dir, dentry, inode, 0, index);
        if (err)
                drop_inode = 1;
        else {
@@ -6844,6 +7018,7 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
        struct btrfs_root *root = BTRFS_I(inode)->root;
        struct btrfs_key ins;
        u64 cur_offset = start;
+        u64 i_size;
        int ret = 0;
        bool own_trans = true;
@@ -6885,11 +7060,11 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
                    (actual_len > inode->i_size) &&
                    (cur_offset > inode->i_size)) {
                        if (cur_offset > actual_len)
-                                i_size_write(inode, actual_len);
+                                i_size = actual_len;
                        else
-                                i_size_write(inode, cur_offset);
+                                i_size = cur_offset;
-                        i_size_write(inode, cur_offset);
+                        i_size_write(inode, i_size);
-                        btrfs_ordered_update_i_size(inode, cur_offset, NULL);
+                        btrfs_ordered_update_i_size(inode, i_size, NULL);
                }
                ret = btrfs_update_inode(trans, root, inode);
@@ -6943,6 +7118,10 @@ static long btrfs_fallocate(struct inode *inode, int mode,
        btrfs_wait_ordered_range(inode, alloc_start, alloc_end - alloc_start);
        mutex_lock(&inode->i_mutex);
+        ret = inode_newsize_ok(inode, alloc_end);
+        if (ret)
+                goto out;
        if (alloc_start > inode->i_size) {
                ret = btrfs_cont_expand(inode, alloc_start);
                if (ret)
@@ -7139,6 +7318,7 @@ static const struct inode_operations btrfs_symlink_inode_operations = {
        .readlink       = generic_readlink,
        .follow_link    = page_follow_link_light,
        .put_link       = page_put_link,
+        .getattr        = btrfs_getattr,
        .permission     = btrfs_permission,
        .setxattr       = btrfs_setxattr,
        .getxattr       = btrfs_getxattr,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 463d91b4dd3a..f1c9bb4079ed 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -233,7 +233,8 @@ static noinline int create_subvol(struct btrfs_root *root,
        struct btrfs_inode_item *inode_item;
        struct extent_buffer *leaf;
        struct btrfs_root *new_root;
-        struct inode *dir = dentry->d_parent->d_inode;
+        struct dentry *parent = dget_parent(dentry);
+        struct inode *dir;
        int ret;
        int err;
        u64 objectid;
@@ -242,8 +243,13 @@ static noinline int create_subvol(struct btrfs_root *root,
        ret = btrfs_find_free_objectid(NULL, root->fs_info->tree_root,
                                       0, &objectid);
-        if (ret)
+        if (ret) {
+                dput(parent);
                return ret;
+        }
+        dir = parent->d_inode;
        /*
         * 1 - inode item
         * 2 - refs
@@ -251,8 +257,10 @@ static noinline int create_subvol(struct btrfs_root *root,
         * 2 - dir items
         */
        trans = btrfs_start_transaction(root, 6);
-        if (IS_ERR(trans))
+        if (IS_ERR(trans)) {
+                dput(parent);
                return PTR_ERR(trans);
+        }
        leaf = btrfs_alloc_free_block(trans, root, root->leafsize,
                                      0, objectid, NULL, 0, 0, 0);
@@ -339,6 +347,7 @@ static noinline int create_subvol(struct btrfs_root *root,
        d_instantiate(dentry, btrfs_lookup_dentry(dir, dentry));
 fail:
+        dput(parent);
        if (async_transid) {
                *async_transid = trans->transid;
                err = btrfs_commit_transaction_async(trans, root, 1);
@@ -354,6 +363,7 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
                           char *name, int namelen, u64 *async_transid)
 {
        struct inode *inode;
+        struct dentry *parent;
        struct btrfs_pending_snapshot *pending_snapshot;
        struct btrfs_trans_handle *trans;
        int ret;
@@ -396,7 +406,9 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
        btrfs_orphan_cleanup(pending_snapshot->snap);
-        inode = btrfs_lookup_dentry(dentry->d_parent->d_inode, dentry);
+        parent = dget_parent(dentry);
+        inode = btrfs_lookup_dentry(parent->d_inode, dentry);
+        dput(parent);
        if (IS_ERR(inode)) {
                ret = PTR_ERR(inode);
                goto fail;
@@ -1669,12 +1681,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                olen = len = src->i_size - off;
        /* if we extend to eof, continue to block boundary */
        if (off + len == src->i_size)
-                len = ((src->i_size + bs-1) & ~(bs-1))
+                len = ALIGN(src->i_size, bs) - off;
-                        - off;
        /* verify the end result is block aligned */
-        if ((off & (bs-1)) ||
+        if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
-            ((off + len) & (bs-1)))
+            !IS_ALIGNED(destoff, bs))
                goto out_unlock;
        /* do any pending delalloc/csum calc on src, one way or
@@ -1874,8 +1885,8 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                         * but shouldn't round up the file size
                         */
                        endoff = new_key.offset + datal;
-                        if (endoff > off+olen)
+                        if (endoff > destoff+olen)
-                                endoff = off+olen;
+                                endoff = destoff+olen;
                        if (endoff > inode->i_size)
                                btrfs_i_size_write(inode, endoff);
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index f4621f6deca1..ae7737e352c9 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -250,6 +250,73 @@ int btrfs_add_ordered_sum(struct inode *inode,
 /*
 * this is used to account for finished IO across a given range
+ * of the file.  The IO may span ordered extents.  If
+ * a given ordered_extent is completely done, 1 is returned, otherwise
+ * 0.
+ *
+ * test_and_set_bit on a flag in the struct btrfs_ordered_extent is used
+ * to make sure this function only returns 1 once for a given ordered extent.
+ *
+ * file_offset is updated to one byte past the range that is recorded as
+ * complete.  This allows you to walk forward in the file.
+ */
+int btrfs_dec_test_first_ordered_pending(struct inode *inode,
+                                   struct btrfs_ordered_extent **cached,
+                                   u64 *file_offset, u64 io_size)
+{
+        struct btrfs_ordered_inode_tree *tree;
+        struct rb_node *node;
+        struct btrfs_ordered_extent *entry = NULL;
+        int ret;
+        u64 dec_end;
+        u64 dec_start;
+        u64 to_dec;
+        tree = &BTRFS_I(inode)->ordered_tree;
+        spin_lock(&tree->lock);
+        node = tree_search(tree, *file_offset);
+        if (!node) {
+                ret = 1;
+                goto out;
+        }
+        entry = rb_entry(node, struct btrfs_ordered_extent, rb_node);
+        if (!offset_in_entry(entry, *file_offset)) {
+                ret = 1;
+                goto out;
+        }
+        dec_start = max(*file_offset, entry->file_offset);
+        dec_end = min(*file_offset + io_size, entry->file_offset +
+                      entry->len);
+        *file_offset = dec_end;
+        if (dec_start > dec_end) {
+                printk(KERN_CRIT "bad ordering dec_start %llu end %llu\n",
+                       (unsigned long long)dec_start,
+                       (unsigned long long)dec_end);
+        }
+        to_dec = dec_end - dec_start;
+        if (to_dec > entry->bytes_left) {
+                printk(KERN_CRIT "bad ordered accounting left %llu size %llu\n",
+                       (unsigned long long)entry->bytes_left,
+                       (unsigned long long)to_dec);
+        }
+        entry->bytes_left -= to_dec;
+        if (entry->bytes_left == 0)
+                ret = test_and_set_bit(BTRFS_ORDERED_IO_DONE, &entry->flags);
+        else
+                ret = 1;
+out:
+        if (!ret && cached && entry) {
+                *cached = entry;
+                atomic_inc(&entry->refs);
+        }
+        spin_unlock(&tree->lock);
+        return ret == 0;
+}
+/*
+ * this is used to account for finished IO across a given range
 * of the file.  The IO should not span ordered extents.  If
 * a given ordered_extent is completely done, 1 is returned, otherwise
 * 0.
diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h
index 8ac365492a3f..61dca83119dd 100644
--- a/fs/btrfs/ordered-data.h
+++ b/fs/btrfs/ordered-data.h
@@ -141,6 +141,9 @@ int btrfs_remove_ordered_extent(struct inode *inode,
 int btrfs_dec_test_ordered_pending(struct inode *inode,
                                   struct btrfs_ordered_extent **cached,
                                   u64 file_offset, u64 io_size);
+int btrfs_dec_test_first_ordered_pending(struct inode *inode,
+                                   struct btrfs_ordered_extent **cached,
+                                   u64 *file_offset, u64 io_size);
 int btrfs_add_ordered_extent(struct inode *inode, u64 file_offset,
                             u64 start, u64 len, u64 disk_len, int type);
 int btrfs_add_ordered_extent_dio(struct inode *inode, u64 file_offset,
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 8299a25ffc8f..dbb51ea7a13c 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -244,6 +244,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                case Opt_space_cache:
                        printk(KERN_INFO "btrfs: enabling disk space caching\n");
                        btrfs_set_opt(info->mount_opt, SPACE_CACHE);
+                        break;
                case Opt_clear_cache:
                        printk(KERN_INFO "btrfs: force clearing of disk cache\n");
                        btrfs_set_opt(info->mount_opt, CLEAR_CACHE);
@@ -562,12 +563,26 @@ static int btrfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
 static int btrfs_test_super(struct super_block *s, void *data)
 {
-        struct btrfs_fs_devices *test_fs_devices = data;
+        struct btrfs_root *test_root = data;
        struct btrfs_root *root = btrfs_sb(s);
-        return root->fs_info->fs_devices == test_fs_devices;
+        /*
+         * If this super block is going away, return false as it
+         * can't match as an existing super block.
+         */
+        if (!atomic_read(&s->s_active))
+                return 0;
+        return root->fs_info->fs_devices == test_root->fs_info->fs_devices;
+}
+static int btrfs_set_super(struct super_block *s, void *data)
+{
+        s->s_fs_info = data;
+        return set_anon_super(s, data);
 }
 /*
 * Find a superblock for the given device / mount point.
 *
@@ -581,6 +596,8 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
        struct super_block *s;
        struct dentry *root;
        struct btrfs_fs_devices *fs_devices = NULL;
+        struct btrfs_root *tree_root = NULL;
+        struct btrfs_fs_info *fs_info = NULL;
        fmode_t mode = FMODE_READ;
        char *subvol_name = NULL;
        u64 subvol_objectid = 0;
@@ -608,8 +625,24 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                goto error_close_devices;
        }
+        /*
+         * Setup a dummy root and fs_info for test/set super.  This is because
+         * we don't actually fill this stuff out until open_ctree, but we need
+         * it for searching for existing supers, so this lets us do that and
+         * then open_ctree will properly initialize everything later.
+         */
+        fs_info = kzalloc(sizeof(struct btrfs_fs_info), GFP_NOFS);
+        tree_root = kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
+        if (!fs_info || !tree_root) {
+                error = -ENOMEM;
+                goto error_close_devices;
+        }
+        fs_info->tree_root = tree_root;
+        fs_info->fs_devices = fs_devices;
+        tree_root->fs_info = fs_info;
        bdev = fs_devices->latest_bdev;
-        s = sget(fs_type, btrfs_test_super, set_anon_super, fs_devices);
+        s = sget(fs_type, btrfs_test_super, btrfs_set_super, tree_root);
        if (IS_ERR(s))
                goto error_s;
@@ -675,6 +708,8 @@ error_s:
        error = PTR_ERR(s);
 error_close_devices:
        btrfs_close_devices(fs_devices);
+        kfree(fs_info);
+        kfree(tree_root);
 error_free_subvol_name:
        kfree(subvol_name);
        return ERR_PTR(error);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 1fffbc017bdf..f50e931fc217 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -902,6 +902,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        struct btrfs_root *root = pending->root;
        struct btrfs_root *parent_root;
        struct inode *parent_inode;
+        struct dentry *parent;
        struct dentry *dentry;
        struct extent_buffer *tmp;
        struct extent_buffer *old;
@@ -941,7 +942,8 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        trans->block_rsv = &pending->block_rsv;
        dentry = pending->dentry;
-        parent_inode = dentry->d_parent->d_inode;
+        parent = dget_parent(dentry);
+        parent_inode = parent->d_inode;
        parent_root = BTRFS_I(parent_inode)->root;
        record_root_in_trans(trans, parent_root);
@@ -989,6 +991,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
                                 parent_inode->i_ino, index,
                                 dentry->d_name.name, dentry->d_name.len);
        BUG_ON(ret);
+        dput(parent);
        key.offset = (u64)-1;
        pending->snap = btrfs_read_fs_root_no_name(root->fs_info, &key);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index a29f19384a27..054744ac5719 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2869,6 +2869,7 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
 {
        int ret = 0;
        struct btrfs_root *root;
+        struct dentry *old_parent = NULL;
        /*
         * for regular files, if its inode is already on disk, we don't
@@ -2910,10 +2911,13 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
                if (IS_ROOT(parent))
                        break;
-                parent = parent->d_parent;
+                parent = dget_parent(parent);
+                dput(old_parent);
+                old_parent = parent;
                inode = parent->d_inode;
        }
+        dput(old_parent);
 out:
        return ret;
 }
@@ -2945,6 +2949,7 @@ int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
 {
        int inode_only = exists_only ? LOG_INODE_EXISTS : LOG_INODE_ALL;
        struct super_block *sb;
+        struct dentry *old_parent = NULL;
        int ret = 0;
        u64 last_committed = root->fs_info->last_trans_committed;
@@ -3016,10 +3021,13 @@ int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
                if (IS_ROOT(parent))
                        break;
-                parent = parent->d_parent;
+                parent = dget_parent(parent);
+                dput(old_parent);
+                old_parent = parent;
        }
        ret = 0;
 end_trans:
+        dput(old_parent);
        if (ret < 0) {
                BUG_ON(ret != -ENOSPC);
                root->fs_info->last_trans_log_full_commit = trans->transid;
@@ -3039,8 +3047,13 @@ end_no_trans:
 int btrfs_log_dentry_safe(struct btrfs_trans_handle *trans,
                          struct btrfs_root *root, struct dentry *dentry)
 {
-        return btrfs_log_inode_parent(trans, root, dentry->d_inode,
+        struct dentry *parent = dget_parent(dentry);
-                                      dentry->d_parent, 0);
+        int ret;
+        ret = btrfs_log_inode_parent(trans, root, dentry->d_inode, parent, 0);
+        dput(parent);
+        return ret;
 }
 /*
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 0ed213970ced..ee45648b0d1a 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -4,6 +4,7 @@ config CIFS
        select NLS
        select CRYPTO
        select CRYPTO_MD5
+        select CRYPTO_HMAC
        select CRYPTO_ARC4
        help
          This is the client VFS module for the Common Internet File System
@@ -143,6 +144,13 @@ config CIFS_FSCACHE
            to be cached locally on disk through the general filesystem cache
            manager. If unsure, say N.
+config CIFS_ACL
+          bool "Provide CIFS ACL support (EXPERIMENTAL)"
+          depends on EXPERIMENTAL && CIFS_XATTR
+          help
+            Allows to fetch CIFS/NTFS ACL from the server.  The DACL blob
+            is handed over to the application/caller.
 config CIFS_EXPERIMENTAL
          bool "CIFS Experimental Features (EXPERIMENTAL)"
          depends on CIFS && EXPERIMENTAL
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index c9b4792ae825..c6ebea088ac7 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -560,7 +560,7 @@ static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
        if (IS_ERR(tlink))
-                return NULL;
+                return ERR_CAST(tlink);
        xid = GetXid();
        rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), fid, &pntsd, pacllen);
@@ -568,7 +568,9 @@ static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
        cifs_put_tlink(tlink);
-        cFYI(1, "GetCIFSACL rc = %d ACL len %d", rc, *pacllen);
+        cFYI(1, "%s: rc = %d ACL len %d", __func__, rc, *pacllen);
+        if (rc)
+                return ERR_PTR(rc);
        return pntsd;
 }
@@ -583,7 +585,7 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
        if (IS_ERR(tlink))
-                return NULL;
+                return ERR_CAST(tlink);
        tcon = tlink_tcon(tlink);
        xid = GetXid();
@@ -591,23 +593,22 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
        rc = CIFSSMBOpen(xid, tcon, path, FILE_OPEN, READ_CONTROL, 0,
                         &fid, &oplock, NULL, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
-        if (rc) {
+        if (!rc) {
-                cERROR(1, "Unable to open file to get ACL");
+                rc = CIFSSMBGetCIFSACL(xid, tcon, fid, &pntsd, pacllen);
-                goto out;
+                CIFSSMBClose(xid, tcon, fid);
        }
-        rc = CIFSSMBGetCIFSACL(xid, tcon, fid, &pntsd, pacllen);
-        cFYI(1, "GetCIFSACL rc = %d ACL len %d", rc, *pacllen);
-        CIFSSMBClose(xid, tcon, fid);
- out:
        cifs_put_tlink(tlink);
        FreeXid(xid);
+        cFYI(1, "%s: rc = %d ACL len %d", __func__, rc, *pacllen);
+        if (rc)
+                return ERR_PTR(rc);
        return pntsd;
 }
 /* Retrieve an ACL from the server */
-static struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
+struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
                                      struct inode *inode, const char *path,
                                      u32 *pacllen)
 {
@@ -695,7 +696,7 @@ static int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
 }
 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
-void
+int
 cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
                  struct inode *inode, const char *path, const __u16 *pfid)
 {
@@ -711,17 +712,21 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
                pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
        /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
-        if (pntsd)
+        if (IS_ERR(pntsd)) {
+                rc = PTR_ERR(pntsd);
+                cERROR(1, "%s: error %d getting sec desc", __func__, rc);
+        } else {
                rc = parse_sec_desc(pntsd, acllen, fattr);
-        if (rc)
+                kfree(pntsd);
-                cFYI(1, "parse sec desc failed rc = %d", rc);
+                if (rc)
+                        cERROR(1, "parse sec desc failed rc = %d", rc);
+        }
-        kfree(pntsd);
+        return rc;
-        return;
 }
 /* Convert mode bits to an ACL so we can update the ACL on the server */
-int mode_to_acl(struct inode *inode, const char *path, __u64 nmode)
+int mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode)
 {
        int rc = 0;
        __u32 secdesclen = 0;
@@ -736,7 +741,10 @@ int mode_to_acl(struct inode *inode, const char *path, __u64 nmode)
        /* Add three ACEs for owner, group, everyone getting rid of
           other ACEs as chmod disables ACEs and set the security descriptor */
-        if (pntsd) {
+        if (IS_ERR(pntsd)) {
+                rc = PTR_ERR(pntsd);
+                cERROR(1, "%s: error %d getting sec desc", __func__, rc);
+        } else {
                /* allocate memory for the smb header,
                   set security descriptor request security descriptor
                   parameters, and secuirty descriptor itself */
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 9c3789762ab7..76c8a906a63e 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -458,6 +458,8 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
                seq_printf(s, ",acl");
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS)
                seq_printf(s, ",mfsymlinks");
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_FSCACHE)
+                seq_printf(s, ",fsc");
        seq_printf(s, ",rsize=%d", cifs_sb->rsize);
        seq_printf(s, ",wsize=%d", cifs_sb->wsize);
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 7ed69b6b5fe6..db961dc4fd3d 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -130,10 +130,12 @@ extern int cifs_get_file_info_unix(struct file *filp);
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                        const unsigned char *search_path,
                        struct super_block *sb, int xid);
-extern void cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb,
+extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb,
                              struct cifs_fattr *fattr, struct inode *inode,
                              const char *path, const __u16 *pfid);
-extern int mode_to_acl(struct inode *inode, const char *path, __u64);
+extern int mode_to_cifs_acl(struct inode *inode, const char *path, __u64);
+extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *,
+                                        const char *, u32 *);
 extern int cifs_mount(struct super_block *, struct cifs_sb_info *, char *,
                        const char *);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 251a17c03545..32fa4d9b5dbc 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1352,6 +1352,11 @@ cifs_parse_mount_options(char *options, const char *devname,
                                "supported. Instead set "
                                "/proc/fs/cifs/LookupCacheEnabled to 0\n");
                } else if (strnicmp(data, "fsc", 3) == 0) {
+#ifndef CONFIG_CIFS_FSCACHE
+                        cERROR(1, "FS-Cache support needs CONFIG_CIFS_FSCACHE"
+                                  "kernel config option set");
+                        return 1;
+#endif
                        vol->fsc = true;
                } else if (strnicmp(data, "mfsymlinks", 10) == 0) {
                        vol->mfsymlinks = true;
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 0eb87026cad3..548f06230a6d 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -66,7 +66,7 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
        /* Search for server name delimiter */
        sep = memchr(hostname, '\\', len);
        if (sep)
-                len = sep - unc;
+                len = sep - hostname;
        else
                cFYI(1, "%s: probably server name is whole unc: %s",
                     __func__, unc);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 06c3e83fa387..b857ce5db775 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2271,8 +2271,10 @@ void cifs_oplock_break_get(struct cifsFileInfo *cfile)
 void cifs_oplock_break_put(struct cifsFileInfo *cfile)
 {
+        struct super_block *sb = cfile->dentry->d_sb;
        cifsFileInfo_put(cfile);
-        cifs_sb_deactive(cfile->dentry->d_sb);
+        cifs_sb_deactive(sb);
 }
 const struct address_space_operations cifs_addr_ops = {
diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
index a2ad94efcfe6..297a43d0ff7f 100644
--- a/fs/cifs/fscache.c
+++ b/fs/cifs/fscache.c
@@ -2,7 +2,7 @@
 *   fs/cifs/fscache.c - CIFS filesystem cache interface
 *
 *   Copyright (c) 2010 Novell, Inc.
- *   Author(s): Suresh Jayaraman (sjayaraman@suse.de>
+ *   Author(s): Suresh Jayaraman <sjayaraman@suse.de>
 *
 *   This library is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU Lesser General Public License as published
@@ -67,10 +67,12 @@ static void cifs_fscache_enable_inode_cookie(struct inode *inode)
        if (cifsi->fscache)
                return;
-        cifsi->fscache = fscache_acquire_cookie(tcon->fscache,
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_FSCACHE) {
+                cifsi->fscache = fscache_acquire_cookie(tcon->fscache,
                                &cifs_fscache_inode_object_def, cifsi);
-        cFYI(1, "CIFS: got FH cookie (0x%p/0x%p)", tcon->fscache,
+                cFYI(1, "CIFS: got FH cookie (0x%p/0x%p)", tcon->fscache,
                                cifsi->fscache);
+        }
 }
 void cifs_fscache_release_inode_cookie(struct inode *inode)
@@ -101,10 +103,8 @@ void cifs_fscache_set_inode_cookie(struct inode *inode, struct file *filp)
 {
        if ((filp->f_flags & O_ACCMODE) != O_RDONLY)
                cifs_fscache_disable_inode_cookie(inode);
-        else {
+        else
                cifs_fscache_enable_inode_cookie(inode);
-                cFYI(1, "CIFS: fscache inode cookie set");
-        }
 }
 void cifs_fscache_reset_inode_cookie(struct inode *inode)
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index ef3a55bf86b6..28cb6e735943 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -689,8 +689,13 @@ int cifs_get_inode_info(struct inode **pinode,
 #ifdef CONFIG_CIFS_EXPERIMENTAL
        /* fill in 0777 bits from ACL */
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
-                cFYI(1, "Getting mode bits from ACL");
+                rc = cifs_acl_to_fattr(cifs_sb, &fattr, *pinode, full_path,
-                cifs_acl_to_fattr(cifs_sb, &fattr, *pinode, full_path, pfid);
+                                                pfid);
+                if (rc) {
+                        cFYI(1, "%s: Getting ACL failed with error: %d",
+                                __func__, rc);
+                        goto cgii_exit;
+                }
        }
 #endif
@@ -881,8 +886,10 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
                rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
                                                xid, NULL);
-        if (!inode)
+        if (!inode) {
-                return ERR_PTR(rc);
+                inode = ERR_PTR(rc);
+                goto out;
+        }
 #ifdef CONFIG_CIFS_FSCACHE
        /* populate tcon->resource_id */
@@ -898,13 +905,11 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
                inode->i_uid = cifs_sb->mnt_uid;
                inode->i_gid = cifs_sb->mnt_gid;
        } else if (rc) {
-                kfree(full_path);
-                _FreeXid(xid);
                iget_failed(inode);
-                return ERR_PTR(rc);
+                inode = ERR_PTR(rc);
        }
+out:
        kfree(full_path);
        /* can not call macro FreeXid here since in a void func
         * TODO: This is no longer true
@@ -1670,7 +1675,9 @@ cifs_inode_needs_reval(struct inode *inode)
        return false;
 }
-/* check invalid_mapping flag and zap the cache if it's set */
+/*
+ * Zap the cache. Called when invalid_mapping flag is set.
+ */
 static void
 cifs_invalidate_mapping(struct inode *inode)
 {
@@ -2115,9 +2122,14 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
        if (attrs->ia_valid & ATTR_MODE) {
                rc = 0;
 #ifdef CONFIG_CIFS_EXPERIMENTAL
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL)
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
-                        rc = mode_to_acl(inode, full_path, mode);
+                        rc = mode_to_cifs_acl(inode, full_path, mode);
-                else
+                        if (rc) {
+                                cFYI(1, "%s: Setting ACL failed with error: %d",
+                                        __func__, rc);
+                                goto cifs_setattr_exit;
+                        }
+                } else
 #endif
                if (((mode & S_IWUGO) == 0) &&
                    (cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index ef7bb7b50f58..32d300e8f20e 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -226,26 +226,29 @@ static int initiate_cifs_search(const int xid, struct file *file)
        char *full_path = NULL;
        struct cifsFileInfo *cifsFile;
        struct cifs_sb_info *cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
-        struct tcon_link *tlink;
+        struct tcon_link *tlink = NULL;
        struct cifsTconInfo *pTcon;
-        tlink = cifs_sb_tlink(cifs_sb);
-        if (IS_ERR(tlink))
-                return PTR_ERR(tlink);
-        pTcon = tlink_tcon(tlink);
-        if (file->private_data == NULL)
-                file->private_data =
-                        kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
        if (file->private_data == NULL) {
-                rc = -ENOMEM;
+                tlink = cifs_sb_tlink(cifs_sb);
-                goto error_exit;
+                if (IS_ERR(tlink))
+                        return PTR_ERR(tlink);
+                cifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
+                if (cifsFile == NULL) {
+                        rc = -ENOMEM;
+                        goto error_exit;
+                }
+                file->private_data = cifsFile;
+                cifsFile->tlink = cifs_get_tlink(tlink);
+                pTcon = tlink_tcon(tlink);
+        } else {
+                cifsFile = file->private_data;
+                pTcon = tlink_tcon(cifsFile->tlink);
        }
-        cifsFile = file->private_data;
        cifsFile->invalidHandle = true;
        cifsFile->srch_inf.endOfSearch = false;
-        cifsFile->tlink = cifs_get_tlink(tlink);
        full_path = build_path_from_dentry(file->f_path.dentry);
        if (full_path == NULL) {
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index a264b744bb41..eae2a1491608 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -30,10 +30,11 @@
 #define MAX_EA_VALUE_SIZE 65535
 #define CIFS_XATTR_DOS_ATTRIB "user.DosAttrib"
+#define CIFS_XATTR_CIFS_ACL "system.cifs_acl"
 #define CIFS_XATTR_USER_PREFIX "user."
 #define CIFS_XATTR_SYSTEM_PREFIX "system."
 #define CIFS_XATTR_OS2_PREFIX "os2."
-#define CIFS_XATTR_SECURITY_PREFIX ".security"
+#define CIFS_XATTR_SECURITY_PREFIX "security."
 #define CIFS_XATTR_TRUSTED_PREFIX "trusted."
 #define XATTR_TRUSTED_PREFIX_LEN  8
 #define XATTR_SECURITY_PREFIX_LEN 9
@@ -277,29 +278,8 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                                cifs_sb->local_nls,
                                cifs_sb->mnt_cifs_flags &
                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-                else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
-                        __u16 fid;
-                        int oplock = 0;
-                        struct cifs_ntsd *pacl = NULL;
-                        __u32 buflen = 0;
-                        if (experimEnabled)
-                                rc = CIFSSMBOpen(xid, pTcon, full_path,
-                                        FILE_OPEN, GENERIC_READ, 0, &fid,
-                                        &oplock, NULL, cifs_sb->local_nls,
-                                        cifs_sb->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
-                        /* else rc is EOPNOTSUPP from above */
-                        if (rc == 0) {
-                                rc = CIFSSMBGetCIFSACL(xid, pTcon, fid, &pacl,
-                                                      &buflen);
-                                CIFSSMBClose(xid, pTcon, fid);
-                        }
-                }
-#endif /* EXPERIMENTAL */
 #else
-                cFYI(1, "query POSIX ACL not supported yet");
+                cFYI(1, "Query POSIX ACL not supported yet");
 #endif /* CONFIG_CIFS_POSIX */
        } else if (strncmp(ea_name, POSIX_ACL_XATTR_DEFAULT,
                          strlen(POSIX_ACL_XATTR_DEFAULT)) == 0) {
@@ -311,8 +291,33 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                                cifs_sb->mnt_cifs_flags &
                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
 #else
-                cFYI(1, "query POSIX default ACL not supported yet");
+                cFYI(1, "Query POSIX default ACL not supported yet");
-#endif
+#endif /* CONFIG_CIFS_POSIX */
+        } else if (strncmp(ea_name, CIFS_XATTR_CIFS_ACL,
+                                strlen(CIFS_XATTR_CIFS_ACL)) == 0) {
+#ifdef CONFIG_CIFS_ACL
+                        u32 acllen;
+                        struct cifs_ntsd *pacl;
+                        pacl = get_cifs_acl(cifs_sb, direntry->d_inode,
+                                                full_path, &acllen);
+                        if (IS_ERR(pacl)) {
+                                rc = PTR_ERR(pacl);
+                                cERROR(1, "%s: error %zd getting sec desc",
+                                                __func__, rc);
+                        } else {
+                                if (ea_value) {
+                                        if (acllen > buf_size)
+                                                acllen = -ERANGE;
+                                        else
+                                                memcpy(ea_value, pacl, acllen);
+                                }
+                                rc = acllen;
+                                kfree(pacl);
+                        }
+#else
+                cFYI(1, "Query CIFS ACL not supported yet");
+#endif /* CONFIG_CIFS_ACL */
        } else if (strncmp(ea_name,
                  CIFS_XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) == 0) {
                cFYI(1, "Trusted xattr namespace not supported yet");
diff --git a/fs/compat.c b/fs/compat.c
index c580c322fa6b..eb1740ac8c0a 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1350,6 +1350,10 @@ static int compat_count(compat_uptr_t __user *argv, int max)
                        argv++;
                        if (i++ >= max)
                                return -E2BIG;
+                        if (fatal_signal_pending(current))
+                                return -ERESTARTNOHAND;
+                        cond_resched();
                }
        }
        return i;
@@ -1391,6 +1395,12 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
                while (len > 0) {
                        int offset, bytes_to_copy;
+                        if (fatal_signal_pending(current)) {
+                                ret = -ERESTARTNOHAND;
+                                goto out;
+                        }
+                        cond_resched();
                        offset = pos % PAGE_SIZE;
                        if (offset == 0)
                                offset = PAGE_SIZE;
@@ -1407,18 +1417,8 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
                        if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
                                struct page *page;
-#ifdef CONFIG_STACK_GROWSUP
+                                page = get_arg_page(bprm, pos, 1);
-                                ret = expand_stack_downwards(bprm->vma, pos);
+                                if (!page) {
-                                if (ret < 0) {
-                                        /* We've exceed the stack rlimit. */
-                                        ret = -E2BIG;
-                                        goto out;
-                                }
-#endif
-                                ret = get_user_pages(current, bprm->mm, pos,
-                                                     1, 1, 1, &page, NULL);
-                                if (ret <= 0) {
-                                        /* We've exceed the stack rlimit. */
                                        ret = -E2BIG;
                                        goto out;
                                }
@@ -1539,8 +1539,10 @@ int compat_do_execve(char * filename,
        return retval;
 out:
-        if (bprm->mm)
+        if (bprm->mm) {
+                acct_arg_size(bprm, 0);
                mmput(bprm->mm);
+        }
 out_file:
        if (bprm->file) {
diff --git a/fs/exec.c b/fs/exec.c
index 99d33a1371e9..d68c378a3137 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -164,7 +164,26 @@ out:
 #ifdef CONFIG_MMU
-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+{
+        struct mm_struct *mm = current->mm;
+        long diff = (long)(pages - bprm->vma_pages);
+        if (!mm || !diff)
+                return;
+        bprm->vma_pages = pages;
+#ifdef SPLIT_RSS_COUNTING
+        add_mm_counter(mm, MM_ANONPAGES, diff);
+#else
+        spin_lock(&mm->page_table_lock);
+        add_mm_counter(mm, MM_ANONPAGES, diff);
+        spin_unlock(&mm->page_table_lock);
+#endif
+}
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                int write)
 {
        struct page *page;
@@ -186,6 +205,8 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
                struct rlimit *rlim;
+                acct_arg_size(bprm, size / PAGE_SIZE);
                /*
                 * We've historically supported up to 32 pages (ARG_MAX)
                 * of argument strings even with small stacks
@@ -276,7 +297,11 @@ static bool valid_arg_len(struct linux_binprm *bprm, long len)
 #else
-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+{
+}
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                int write)
 {
        struct page *page;
@@ -1003,6 +1028,7 @@ int flush_old_exec(struct linux_binprm * bprm)
        /*
         * Release all of the old mmap stuff
         */
+        acct_arg_size(bprm, 0);
        retval = exec_mmap(bprm->mm);
        if (retval)
                goto out;
@@ -1426,8 +1452,10 @@ int do_execve(const char * filename,
        return retval;
 out:
-        if (bprm->mm)
+        if (bprm->mm) {
-                mmput (bprm->mm);
+                acct_arg_size(bprm, 0);
+                mmput(bprm->mm);
+        }
 out_file:
        if (bprm->file) {
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c8224587123f..9242d294fe90 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -134,6 +134,7 @@ EXPORT_SYMBOL_GPL(fuse_do_open);
 void fuse_finish_open(struct inode *inode, struct file *file)
 {
        struct fuse_file *ff = file->private_data;
+        struct fuse_conn *fc = get_fuse_conn(inode);
        if (ff->open_flags & FOPEN_DIRECT_IO)
                file->f_op = &fuse_direct_io_file_operations;
@@ -141,6 +142,15 @@ void fuse_finish_open(struct inode *inode, struct file *file)
                invalidate_inode_pages2(inode->i_mapping);
        if (ff->open_flags & FOPEN_NONSEEKABLE)
                nonseekable_open(inode, file);
+        if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
+                struct fuse_inode *fi = get_fuse_inode(inode);
+                spin_lock(&fc->lock);
+                fi->attr_version = ++fc->attr_version;
+                i_size_write(inode, 0);
+                spin_unlock(&fc->lock);
+                fuse_invalidate_attr(inode);
+        }
 }
 int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 58a9b9998b42..f606baf9ba72 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -631,6 +631,7 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
                             struct fs_disk_quota *fdq)
 {
        struct inode *inode = &ip->i_inode;
+        struct gfs2_sbd *sdp = GFS2_SB(inode);
        struct address_space *mapping = inode->i_mapping;
        unsigned long index = loc >> PAGE_CACHE_SHIFT;
        unsigned offset = loc & (PAGE_CACHE_SIZE - 1);
@@ -658,11 +659,11 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
        qd->qd_qb.qb_value = qp->qu_value;
        if (fdq) {
                if (fdq->d_fieldmask & FS_DQ_BSOFT) {
-                        qp->qu_warn = cpu_to_be64(fdq->d_blk_softlimit);
+                        qp->qu_warn = cpu_to_be64(fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift);
                        qd->qd_qb.qb_warn = qp->qu_warn;
                }
                if (fdq->d_fieldmask & FS_DQ_BHARD) {
-                        qp->qu_limit = cpu_to_be64(fdq->d_blk_hardlimit);
+                        qp->qu_limit = cpu_to_be64(fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift);
                        qd->qd_qb.qb_limit = qp->qu_limit;
                }
        }
@@ -1497,9 +1498,9 @@ static int gfs2_get_dqblk(struct super_block *sb, int type, qid_t id,
        fdq->d_version = FS_DQUOT_VERSION;
        fdq->d_flags = (type == QUOTA_USER) ? FS_USER_QUOTA : FS_GROUP_QUOTA;
        fdq->d_id = id;
-        fdq->d_blk_hardlimit = be64_to_cpu(qlvb->qb_limit);
+        fdq->d_blk_hardlimit = be64_to_cpu(qlvb->qb_limit) << sdp->sd_fsb2bb_shift;
-        fdq->d_blk_softlimit = be64_to_cpu(qlvb->qb_warn);
+        fdq->d_blk_softlimit = be64_to_cpu(qlvb->qb_warn) << sdp->sd_fsb2bb_shift;
-        fdq->d_bcount = be64_to_cpu(qlvb->qb_value);
+        fdq->d_bcount = be64_to_cpu(qlvb->qb_value) << sdp->sd_fsb2bb_shift;
        gfs2_glock_dq_uninit(&q_gh);
 out:
@@ -1566,10 +1567,10 @@ static int gfs2_set_dqblk(struct super_block *sb, int type, qid_t id,
        /* If nothing has changed, this is a no-op */
        if ((fdq->d_fieldmask & FS_DQ_BSOFT) &&
-            (fdq->d_blk_softlimit == be64_to_cpu(qd->qd_qb.qb_warn)))
+            ((fdq->d_blk_softlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_warn)))
                fdq->d_fieldmask ^= FS_DQ_BSOFT;
        if ((fdq->d_fieldmask & FS_DQ_BHARD) &&
-            (fdq->d_blk_hardlimit == be64_to_cpu(qd->qd_qb.qb_limit)))
+            ((fdq->d_blk_hardlimit >> sdp->sd_fsb2bb_shift) == be64_to_cpu(qd->qd_qb.qb_limit)))
                fdq->d_fieldmask ^= FS_DQ_BHARD;
        if (fdq->d_fieldmask == 0)
                goto out_i;
diff --git a/fs/ioprio.c b/fs/ioprio.c
index 2f7d05c89922..7da2a06508e5 100644
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -103,22 +103,15 @@ SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio)
        }
        ret = -ESRCH;
-        /*
+        rcu_read_lock();
-         * We want IOPRIO_WHO_PGRP/IOPRIO_WHO_USER to be "atomic",
-         * so we can't use rcu_read_lock(). See re-copy of ->ioprio
-         * in copy_process().
-         */
-        read_lock(&tasklist_lock);
        switch (which) {
                case IOPRIO_WHO_PROCESS:
-                        rcu_read_lock();
                        if (!who)
                                p = current;
                        else
                                p = find_task_by_vpid(who);
                        if (p)
                                ret = set_task_ioprio(p, ioprio);
-                        rcu_read_unlock();
                        break;
                case IOPRIO_WHO_PGRP:
                        if (!who)
@@ -141,12 +134,7 @@ SYSCALL_DEFINE3(ioprio_set, int, which, int, who, int, ioprio)
                                break;
                        do_each_thread(g, p) {
-                                int match;
+                                if (__task_cred(p)->uid != who)
-                                rcu_read_lock();
-                                match = __task_cred(p)->uid == who;
-                                rcu_read_unlock();
-                                if (!match)
                                        continue;
                                ret = set_task_ioprio(p, ioprio);
                                if (ret)
@@ -160,7 +148,7 @@ free_uid:
                        ret = -EINVAL;
        }
-        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
        return ret;
 }
@@ -204,17 +192,15 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
        int ret = -ESRCH;
        int tmpio;
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
        switch (which) {
                case IOPRIO_WHO_PROCESS:
-                        rcu_read_lock();
                        if (!who)
                                p = current;
                        else
                                p = find_task_by_vpid(who);
                        if (p)
                                ret = get_task_ioprio(p);
-                        rcu_read_unlock();
                        break;
                case IOPRIO_WHO_PGRP:
                        if (!who)
@@ -241,12 +227,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
                                break;
                        do_each_thread(g, p) {
-                                int match;
+                                if (__task_cred(p)->uid != user->uid)
-                                rcu_read_lock();
-                                match = __task_cred(p)->uid == user->uid;
-                                rcu_read_unlock();
-                                if (!match)
                                        continue;
                                tmpio = get_task_ioprio(p);
                                if (tmpio < 0)
@@ -264,6 +245,6 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
                        ret = -EINVAL;
        }
-        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
        return ret;
 }
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 662df2a5fad5..f0a384e2ae63 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -162,6 +162,7 @@ struct nfs_cache_array_entry {
        u64 cookie;
        u64 ino;
        struct qstr string;
+        unsigned char d_type;
 };
 struct nfs_cache_array {
@@ -171,8 +172,6 @@ struct nfs_cache_array {
        struct nfs_cache_array_entry array[0];
 };
-#define MAX_READDIR_ARRAY ((PAGE_SIZE - sizeof(struct nfs_cache_array)) / sizeof(struct nfs_cache_array_entry))
 typedef __be32 * (*decode_dirent_t)(struct xdr_stream *, struct nfs_entry *, struct nfs_server *, int);
 typedef struct {
        struct file     *file;
@@ -257,13 +256,17 @@ int nfs_readdir_add_to_array(struct nfs_entry *entry, struct page *page)
        if (IS_ERR(array))
                return PTR_ERR(array);
+        cache_entry = &array->array[array->size];
+        /* Check that this entry lies within the page bounds */
        ret = -ENOSPC;
-        if (array->size >= MAX_READDIR_ARRAY)
+        if ((char *)&cache_entry[1] - (char *)page_address(page) > PAGE_SIZE)
                goto out;
-        cache_entry = &array->array[array->size];
        cache_entry->cookie = entry->prev_cookie;
        cache_entry->ino = entry->ino;
+        cache_entry->d_type = entry->d_type;
        ret = nfs_readdir_make_qstr(&cache_entry->string, entry->name, entry->len);
        if (ret)
                goto out;
@@ -392,13 +395,9 @@ int xdr_decode(nfs_readdir_descriptor_t *desc, struct nfs_entry *entry, struct x
 static
 int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
 {
-        struct nfs_inode *node;
        if (dentry->d_inode == NULL)
                goto different;
-        node = NFS_I(dentry->d_inode);
+        if (nfs_compare_fh(entry->fh, NFS_FH(dentry->d_inode)) != 0)
-        if (node->fh.size != entry->fh->size)
-                goto different;
-        if (strncmp(node->fh.data, entry->fh->data, node->fh.size) != 0)
                goto different;
        return 1;
 different:
@@ -466,8 +465,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
        struct xdr_stream stream;
        struct xdr_buf buf;
        __be32 *ptr = xdr_page;
-        int status;
        struct nfs_cache_array *array;
+        unsigned int count = 0;
+        int status;
        buf.head->iov_base = xdr_page;
        buf.head->iov_len = buflen;
@@ -488,6 +488,8 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
                        break;
                }
+                count++;
                if (desc->plus == 1)
                        nfs_prime_dcache(desc->file->f_path.dentry, entry);
@@ -496,13 +498,14 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
                        break;
        } while (!entry->eof);
-        if (status == -EBADCOOKIE && entry->eof) {
+        if (count == 0 || (status == -EBADCOOKIE && entry->eof == 1)) {
                array = nfs_readdir_get_array(page);
                if (!IS_ERR(array)) {
                        array->eof_index = array->size;
                        status = 0;
                        nfs_readdir_release_array(page);
-                }
+                } else
+                        status = PTR_ERR(array);
        }
        return status;
 }
@@ -696,21 +699,23 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc, void *dirent,
        int i = 0;
        int res = 0;
        struct nfs_cache_array *array = NULL;
-        unsigned int d_type = DT_UNKNOWN;
-        struct dentry *dentry = NULL;
        array = nfs_readdir_get_array(desc->page);
-        if (IS_ERR(array))
+        if (IS_ERR(array)) {
-                return PTR_ERR(array);
+                res = PTR_ERR(array);
+                goto out;
+        }
        for (i = desc->cache_entry_index; i < array->size; i++) {
-                d_type = DT_UNKNOWN;
+                struct nfs_cache_array_entry *ent;
-                res = filldir(dirent, array->array[i].string.name,
+                ent = &array->array[i];
-                        array->array[i].string.len, file->f_pos,
+                if (filldir(dirent, ent->string.name, ent->string.len,
-                        nfs_compat_user_ino64(array->array[i].ino), d_type);
+                    file->f_pos, nfs_compat_user_ino64(ent->ino),
-                if (res < 0)
+                    ent->d_type) < 0) {
+                        desc->eof = 1;
                        break;
+                }
                file->f_pos++;
                desc->cache_entry_index = i;
                if (i < (array->size-1))
@@ -722,9 +727,8 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc, void *dirent,
                desc->eof = 1;
        nfs_readdir_release_array(desc->page);
+out:
        cache_page_release(desc);
-        if (dentry != NULL)
-                dput(dentry);
        dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n",
                        (unsigned long long)*desc->dir_cookie, res);
        return res;
@@ -759,13 +763,13 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc, void *dirent,
                goto out;
        }
-        if (nfs_readdir_xdr_to_array(desc, page, inode) == -1) {
-                status = -EIO;
-                goto out_release;
-        }
        desc->page_index = 0;
        desc->page = page;
+        status = nfs_readdir_xdr_to_array(desc, page, inode);
+        if (status < 0)
+                goto out_release;
        status = nfs_do_filldir(desc, dirent, filldir);
 out:
@@ -816,14 +820,14 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                res = readdir_search_pagecache(desc);
                if (res == -EBADCOOKIE) {
+                        res = 0;
                        /* This means either end of directory */
                        if (*desc->dir_cookie && desc->eof == 0) {
                                /* Or that the server has 'lost' a cookie */
                                res = uncached_readdir(desc, dirent, filldir);
-                                if (res >= 0)
+                                if (res == 0)
                                        continue;
                        }
-                        res = 0;
                        break;
                }
                if (res == -ETOOSMALL && desc->plus) {
@@ -838,10 +842,8 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                        break;
                res = nfs_do_filldir(desc, dirent, filldir);
-                if (res < 0) {
+                if (res < 0)
-                        res = 0;
                        break;
-                }
        }
 out:
        nfs_unblock_sillyrename(dentry);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 84d3c8b90206..e6ace0d93c71 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -867,7 +867,7 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
                goto out;
        nfs_alloc_commit_data(dreq);
-        if (dreq->commit_data == NULL || count < wsize)
+        if (dreq->commit_data == NULL || count <= wsize)
                sync = NFS_FILE_SYNC;
        dreq->inode = inode;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index db08ff3ff454..e6356b750b77 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -362,6 +362,15 @@ unsigned int nfs_page_length(struct page *page)
 }
 /*
+ * Convert a umode to a dirent->d_type
+ */
+static inline
+unsigned char nfs_umode_to_dtype(umode_t mode)
+{
+        return (mode >> 12) & 15;
+}
+/*
 * Determine the number of pages in an array of length 'len' and
 * with a base offset of 'base'
 */
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index 2563f765c9b4..5914a1911c95 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -485,6 +485,8 @@ nfs_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_se
        entry->prev_cookie        = entry->cookie;
        entry->cookie     = ntohl(*p++);
+        entry->d_type = DT_UNKNOWN;
        p = xdr_inline_peek(xdr, 8);
        if (p != NULL)
                entry->eof = !p[0] && p[1];
@@ -495,7 +497,7 @@ nfs_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_se
 out_overflow:
        print_overflow_msg(__func__, xdr);
-        return ERR_PTR(-EIO);
+        return ERR_PTR(-EAGAIN);
 }
 /*
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 748dc91a4a14..f6cc60f06dac 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -622,11 +622,13 @@ nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_s
        entry->prev_cookie = entry->cookie;
        p = xdr_decode_hyper(p, &entry->cookie);
+        entry->d_type = DT_UNKNOWN;
        if (plus) {
                entry->fattr->valid = 0;
                p = xdr_decode_post_op_attr_stream(xdr, entry->fattr);
                if (IS_ERR(p))
                        goto out_overflow_exit;
+                entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
                /* In fact, a post_op_fh3: */
                p = xdr_inline_decode(xdr, 4);
                if (unlikely(!p))
@@ -656,7 +658,7 @@ nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_s
 out_overflow:
        print_overflow_msg(__func__, xdr);
 out_overflow_exit:
-        return ERR_PTR(-EIO);
+        return ERR_PTR(-EAGAIN);
 }
 /*
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index b7a204ff6fe1..9f1826b012e6 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -6208,6 +6208,10 @@ __be32 *nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
        if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
                entry->ino = entry->fattr->fileid;
+        entry->d_type = DT_UNKNOWN;
+        if (entry->fattr->valid & NFS_ATTR_FATTR_TYPE)
+                entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
        if (verify_attr_len(xdr, p, len) < 0)
                goto out_overflow;
@@ -6221,7 +6225,7 @@ __be32 *nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
 out_overflow:
        print_overflow_msg(__func__, xdr);
-        return ERR_PTR(-EIO);
+        return ERR_PTR(-EAGAIN);
 }
 /*
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index 49c844dab33a..59e5fe742f7b 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -335,7 +335,7 @@ int nilfs_dat_move(struct inode *dat, __u64 vblocknr, sector_t blocknr)
         * the device at this point.
         *
         * To prevent nilfs_dat_translate() from returning the
-         * uncommited block number, this makes a copy of the entry
+         * uncommitted block number, this makes a copy of the entry
         * buffer and redirects nilfs_dat_translate() to the copy.
         */
        if (!buffer_nilfs_redirected(entry_bh)) {
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 3e90f86d5bfe..e00d9457c256 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -349,8 +349,8 @@ static int nilfs_ioctl_move_blocks(struct super_block *sb,
                ino = vdesc->vd_ino;
                cno = vdesc->vd_cno;
                inode = nilfs_iget_for_gc(sb, ino, cno);
-                if (unlikely(inode == NULL)) {
+                if (IS_ERR(inode)) {
-                        ret = -ENOMEM;
+                        ret = PTR_ERR(inode);
                        goto failed;
                }
                do {
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 52c7557f3e25..9f26ac9be2a4 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1964,8 +1964,10 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
        if (reg == NULL)
                return ERR_PTR(-ENOMEM);
-        if (strlen(name) > O2HB_MAX_REGION_NAME_LEN)
+        if (strlen(name) > O2HB_MAX_REGION_NAME_LEN) {
-                return ERR_PTR(-ENAMETOOLONG);
+                ret = -ENAMETOOLONG;
+                goto free;
+        }
        spin_lock(&o2hb_live_lock);
        reg->hr_region_num = 0;
@@ -1974,7 +1976,8 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
                                                         O2NM_MAX_REGIONS);
                if (reg->hr_region_num >= O2NM_MAX_REGIONS) {
                        spin_unlock(&o2hb_live_lock);
-                        return ERR_PTR(-EFBIG);
+                        ret = -EFBIG;
+                        goto free;
                }
                set_bit(reg->hr_region_num, o2hb_region_bitmap);
        }
@@ -1986,10 +1989,13 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
        ret = o2hb_debug_region_init(reg, o2hb_debug_dir);
        if (ret) {
                config_item_put(&reg->hr_item);
-                return ERR_PTR(ret);
+                goto free;
        }
        return &reg->hr_item;
+free:
+        kfree(reg);
+        return ERR_PTR(ret);
 }
 static void o2hb_heartbeat_group_drop_item(struct config_group *group,
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index edaded48e7e9..895532ac4d98 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -476,7 +476,6 @@ static void ocfs2_dentry_iput(struct dentry *dentry, struct inode *inode)
 out:
        iput(inode);
-        ocfs2_dentry_attach_gen(dentry);
 }
 /*
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 58a93b953735..cc2aaa96cfe5 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -959,7 +959,7 @@ static int dlm_match_regions(struct dlm_ctxt *dlm,
                r += O2HB_MAX_REGION_NAME_LEN;
        }
-        local = kmalloc(sizeof(qr->qr_regions), GFP_KERNEL);
+        local = kmalloc(sizeof(qr->qr_regions), GFP_ATOMIC);
        if (!local) {
                status = -ENOMEM;
                goto bail;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 1efea3615589..70dd3b1798f1 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -159,9 +159,9 @@ struct ocfs2_lock_res {
        char                     l_name[OCFS2_LOCK_ID_MAX_LEN];
        unsigned int             l_ro_holders;
        unsigned int             l_ex_holders;
-        char                     l_level;
+        signed char              l_level;
-        char                     l_requested;
+        signed char              l_requested;
-        char                     l_blocking;
+        signed char              l_blocking;
        /* Data packed - type enum ocfs2_lock_type */
        unsigned char            l_type;
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 252e7c82f929..a5ebe421195f 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -190,7 +190,7 @@ static struct ocfs2_live_connection *ocfs2_connection_find(const char *name)
                        return c;
        }
-        return c;
+        return NULL;
 }
 /*
diff --git a/fs/pipe.c b/fs/pipe.c
index a8012a955720..04629f36e397 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1199,12 +1199,24 @@ int pipe_proc_fn(struct ctl_table *table, int write, void __user *buf,
        return ret;
 }
+/*
+ * After the inode slimming patch, i_pipe/i_bdev/i_cdev share the same
+ * location, so checking ->i_pipe is not enough to verify that this is a
+ * pipe.
+ */
+struct pipe_inode_info *get_pipe_info(struct file *file)
+{
+        struct inode *i = file->f_path.dentry->d_inode;
+        return S_ISFIFO(i->i_mode) ? i->i_pipe : NULL;
+}
 long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
 {
        struct pipe_inode_info *pipe;
        long ret;
-        pipe = file->f_path.dentry->d_inode->i_pipe;
+        pipe = get_pipe_info(file);
        if (!pipe)
                return -EBADF;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index f3d02ca461ec..182845147fe4 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1574,7 +1574,7 @@ static int do_proc_readlink(struct path *path, char __user *buffer, int buflen)
        if (!tmp)
                return -ENOMEM;
-        pathname = d_path_with_unreachable(path, tmp, PAGE_SIZE);
+        pathname = d_path(path, tmp, PAGE_SIZE);
        len = PTR_ERR(pathname);
        if (IS_ERR(pathname))
                goto out;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index da6b01d70f01..c126c83b9a45 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -706,6 +706,7 @@ static int pagemap_hugetlb_range(pte_t *pte, unsigned long hmask,
 * skip over unmapped regions.
 */
 #define PAGEMAP_WALK_SIZE       (PMD_SIZE)
+#define PAGEMAP_WALK_MASK       (PMD_MASK)
 static ssize_t pagemap_read(struct file *file, char __user *buf,
                            size_t count, loff_t *ppos)
 {
@@ -776,7 +777,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                unsigned long end;
                pm.pos = 0;
-                end = start_vaddr + PAGEMAP_WALK_SIZE;
+                end = (start_vaddr + PAGEMAP_WALK_SIZE) & PAGEMAP_WALK_MASK;
                /* overflow ? */
                if (end < start_vaddr || end > end_vaddr)
                        end = end_vaddr;
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index bd9763e76bae..79265fdc317a 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -183,12 +183,11 @@ int reiserfs_unpack(struct inode *inode, struct file *filp)
                return 0;
        }
-        /* we need to make sure nobody is changing the file size beneath
-         ** us
-         */
-        reiserfs_mutex_lock_safe(&inode->i_mutex, inode->i_sb);
        depth = reiserfs_write_lock_once(inode->i_sb);
+        /* we need to make sure nobody is changing the file size beneath us */
+        reiserfs_mutex_lock_safe(&inode->i_mutex, inode->i_sb);
        write_from = inode->i_size & (blocksize - 1);
        /* if we are on a block boundary, we are already unpacked.  */
        if (write_from == 0) {
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index 536d697a8a28..90d2fcb67a31 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -472,7 +472,9 @@ int reiserfs_acl_chmod(struct inode *inode)
                struct reiserfs_transaction_handle th;
                size_t size = reiserfs_xattr_nblocks(inode,
                                             reiserfs_acl_size(clone->a_count));
-                reiserfs_write_lock(inode->i_sb);
+                int depth;
+                depth = reiserfs_write_lock_once(inode->i_sb);
                error = journal_begin(&th, inode->i_sb, size * 2);
                if (!error) {
                        int error2;
@@ -482,7 +484,7 @@ int reiserfs_acl_chmod(struct inode *inode)
                        if (error2)
                                error = error2;
                }
-                reiserfs_write_unlock(inode->i_sb);
+                reiserfs_write_unlock_once(inode->i_sb, depth);
        }
        posix_acl_release(clone);
        return error;
diff --git a/fs/splice.c b/fs/splice.c
index 8f1dfaecc8f0..ce2f02579e35 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1311,18 +1311,6 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
 static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
                               struct pipe_inode_info *opipe,
                               size_t len, unsigned int flags);
-/*
- * After the inode slimming patch, i_pipe/i_bdev/i_cdev share the same
- * location, so checking ->i_pipe is not enough to verify that this is a
- * pipe.
- */
-static inline struct pipe_inode_info *pipe_info(struct inode *inode)
-{
-        if (S_ISFIFO(inode->i_mode))
-                return inode->i_pipe;
-        return NULL;
-}
 /*
 * Determine where to splice to/from.
@@ -1336,8 +1324,8 @@ static long do_splice(struct file *in, loff_t __user *off_in,
        loff_t offset, *off;
        long ret;
-        ipipe = pipe_info(in->f_path.dentry->d_inode);
+        ipipe = get_pipe_info(in);
-        opipe = pipe_info(out->f_path.dentry->d_inode);
+        opipe = get_pipe_info(out);
        if (ipipe && opipe) {
                if (off_in || off_out)
@@ -1555,7 +1543,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
        int error;
        long ret;
-        pipe = pipe_info(file->f_path.dentry->d_inode);
+        pipe = get_pipe_info(file);
        if (!pipe)
                return -EBADF;
@@ -1642,7 +1630,7 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
        };
        long ret;
-        pipe = pipe_info(file->f_path.dentry->d_inode);
+        pipe = get_pipe_info(file);
        if (!pipe)
                return -EBADF;
@@ -2022,8 +2010,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
 static long do_tee(struct file *in, struct file *out, size_t len,
                   unsigned int flags)
 {
-        struct pipe_inode_info *ipipe = pipe_info(in->f_path.dentry->d_inode);
+        struct pipe_inode_info *ipipe = get_pipe_info(in);
-        struct pipe_inode_info *opipe = pipe_info(out->f_path.dentry->d_inode);
+        struct pipe_inode_info *opipe = get_pipe_info(out);
        int ret = -EINVAL;
        /*
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 7d287afccde5..691f61223ed6 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -934,7 +934,6 @@ xfs_aops_discard_page(
        struct xfs_inode        *ip = XFS_I(inode);
        struct buffer_head      *bh, *head;
        loff_t                  offset = page_offset(page);
-        ssize_t                 len = 1 << inode->i_blkbits;
        if (!xfs_is_delayed_page(page, IO_DELAY))
                goto out_invalidate;
@@ -949,58 +948,14 @@ xfs_aops_discard_page(
        xfs_ilock(ip, XFS_ILOCK_EXCL);
        bh = head = page_buffers(page);
        do {
-                int             done;
-                xfs_fileoff_t   offset_fsb;
-                xfs_bmbt_irec_t imap;
-                int             nimaps = 1;
                int             error;
-                xfs_fsblock_t   firstblock;
+                xfs_fileoff_t   start_fsb;
-                xfs_bmap_free_t flist;
                if (!buffer_delay(bh))
                        goto next_buffer;
-                offset_fsb = XFS_B_TO_FSBT(ip->i_mount, offset);
+                start_fsb = XFS_B_TO_FSBT(ip->i_mount, offset);
+                error = xfs_bmap_punch_delalloc_range(ip, start_fsb, 1);
-                /*
-                 * Map the range first and check that it is a delalloc extent
-                 * before trying to unmap the range. Otherwise we will be
-                 * trying to remove a real extent (which requires a
-                 * transaction) or a hole, which is probably a bad idea...
-                 */
-                error = xfs_bmapi(NULL, ip, offset_fsb, 1,
-                                XFS_BMAPI_ENTIRE,  NULL, 0, &imap,
-                                &nimaps, NULL);
-                if (error) {
-                        /* something screwed, just bail */
-                        if (!XFS_FORCED_SHUTDOWN(ip->i_mount)) {
-                                xfs_fs_cmn_err(CE_ALERT, ip->i_mount,
-                                "page discard failed delalloc mapping lookup.");
-                        }
-                        break;
-                }
-                if (!nimaps) {
-                        /* nothing there */
-                        goto next_buffer;
-                }
-                if (imap.br_startblock != DELAYSTARTBLOCK) {
-                        /* been converted, ignore */
-                        goto next_buffer;
-                }
-                WARN_ON(imap.br_blockcount == 0);
-                /*
-                 * Note: while we initialise the firstblock/flist pair, they
-                 * should never be used because blocks should never be
-                 * allocated or freed for a delalloc extent and hence we need
-                 * don't cancel or finish them after the xfs_bunmapi() call.
-                 */
-                xfs_bmap_init(&flist, &firstblock);
-                error = xfs_bunmapi(NULL, ip, offset_fsb, 1, 0, 1, &firstblock,
-                                        &flist, &done);
-                ASSERT(!flist.xbf_count && !flist.xbf_first);
                if (error) {
                        /* something screwed, just bail */
                        if (!XFS_FORCED_SHUTDOWN(ip->i_mount)) {
@@ -1010,7 +965,7 @@ xfs_aops_discard_page(
                        break;
                }
 next_buffer:
-                offset += len;
+                offset += 1 << inode->i_blkbits;
        } while ((bh = bh->b_this_page) != head);
@@ -1505,11 +1460,42 @@ xfs_vm_write_failed(
        struct inode            *inode = mapping->host;
        if (to > inode->i_size) {
-                struct iattr    ia = {
+                /*
-                        .ia_valid       = ATTR_SIZE | ATTR_FORCE,
+                 * punch out the delalloc blocks we have already allocated. We
-                        .ia_size        = inode->i_size,
+                 * don't call xfs_setattr() to do this as we may be in the
-                };
+                 * middle of a multi-iovec write and so the vfs inode->i_size
-                xfs_setattr(XFS_I(inode), &ia, XFS_ATTR_NOLOCK);
+                 * will not match the xfs ip->i_size and so it will zero too
+                 * much. Hence we jus truncate the page cache to zero what is
+                 * necessary and punch the delalloc blocks directly.
+                 */
+                struct xfs_inode        *ip = XFS_I(inode);
+                xfs_fileoff_t           start_fsb;
+                xfs_fileoff_t           end_fsb;
+                int                     error;
+                truncate_pagecache(inode, to, inode->i_size);
+                /*
+                 * Check if there are any blocks that are outside of i_size
+                 * that need to be trimmed back.
+                 */
+                start_fsb = XFS_B_TO_FSB(ip->i_mount, inode->i_size) + 1;
+                end_fsb = XFS_B_TO_FSB(ip->i_mount, to);
+                if (end_fsb <= start_fsb)
+                        return;
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                error = xfs_bmap_punch_delalloc_range(ip, start_fsb,
+                                                        end_fsb - start_fsb);
+                if (error) {
+                        /* something screwed, just bail */
+                        if (!XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+                                xfs_fs_cmn_err(CE_ALERT, ip->i_mount,
+                        "xfs_vm_write_failed: unable to clean up ino %lld",
+                                                ip->i_ino);
+                        }
+                }
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
        }
 }
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index aa1d353def29..4c5deb6e9e31 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -488,29 +488,16 @@ found:
        spin_unlock(&pag->pag_buf_lock);
        xfs_perag_put(pag);
-        /* Attempt to get the semaphore without sleeping,
+        if (xfs_buf_cond_lock(bp)) {
-         * if this does not work then we need to drop the
+                /* failed, so wait for the lock if requested. */
-         * spinlock and do a hard attempt on the semaphore.
-         */
-        if (down_trylock(&bp->b_sema)) {
                if (!(flags & XBF_TRYLOCK)) {
-                        /* wait for buffer ownership */
                        xfs_buf_lock(bp);
                        XFS_STATS_INC(xb_get_locked_waited);
                } else {
-                        /* We asked for a trylock and failed, no need
-                         * to look at file offset and length here, we
-                         * know that this buffer at least overlaps our
-                         * buffer and is locked, therefore our buffer
-                         * either does not exist, or is this buffer.
-                         */
                        xfs_buf_rele(bp);
                        XFS_STATS_INC(xb_busy_locked);
                        return NULL;
                }
-        } else {
-                /* trylock worked */
-                XB_SET_OWNER(bp);
        }
        if (bp->b_flags & XBF_STALE) {
@@ -876,10 +863,18 @@ xfs_buf_rele(
 */
 /*
- *      Locks a buffer object, if it is not already locked.
+ *      Locks a buffer object, if it is not already locked.  Note that this in
- *      Note that this in no way locks the underlying pages, so it is only
+ *      no way locks the underlying pages, so it is only useful for
- *      useful for synchronizing concurrent use of buffer objects, not for
+ *      synchronizing concurrent use of buffer objects, not for synchronizing
- *      synchronizing independent access to the underlying pages.
+ *      independent access to the underlying pages.
+ *
+ *      If we come across a stale, pinned, locked buffer, we know that we are
+ *      being asked to lock a buffer that has been reallocated. Because it is
+ *      pinned, we know that the log has not been pushed to disk and hence it
+ *      will still be locked.  Rather than continuing to have trylock attempts
+ *      fail until someone else pushes the log, push it ourselves before
+ *      returning.  This means that the xfsaild will not get stuck trying
+ *      to push on stale inode buffers.
 */
 int
 xfs_buf_cond_lock(
@@ -890,6 +885,8 @@ xfs_buf_cond_lock(
        locked = down_trylock(&bp->b_sema) == 0;
        if (locked)
                XB_SET_OWNER(bp);
+        else if (atomic_read(&bp->b_pin_count) && (bp->b_flags & XBF_STALE))
+                xfs_log_force(bp->b_target->bt_mount, 0);
        trace_xfs_buf_cond_lock(bp, _RET_IP_);
        return locked ? 0 : -EBUSY;
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 8abd12e32e13..4111cd3966c7 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -5471,8 +5471,13 @@ xfs_getbmap(
                        if (error)
                                goto out_unlock_iolock;
                }
+                /*
-                ASSERT(ip->i_delayed_blks == 0);
+                 * even after flushing the inode, there can still be delalloc
+                 * blocks on the inode beyond EOF due to speculative
+                 * preallocation. These are not removed until the release
+                 * function is called or the inode is inactivated. Hence we
+                 * cannot assert here that ip->i_delayed_blks == 0.
+                 */
        }
        lock = xfs_ilock_map_shared(ip);
@@ -6070,3 +6075,79 @@ xfs_bmap_disk_count_leaves(
                *count += xfs_bmbt_disk_get_blockcount(frp);
        }
 }
+/*
+ * dead simple method of punching delalyed allocation blocks from a range in
+ * the inode. Walks a block at a time so will be slow, but is only executed in
+ * rare error cases so the overhead is not critical. This will alays punch out
+ * both the start and end blocks, even if the ranges only partially overlap
+ * them, so it is up to the caller to ensure that partial blocks are not
+ * passed in.
+ */
+int
+xfs_bmap_punch_delalloc_range(
+        struct xfs_inode        *ip,
+        xfs_fileoff_t           start_fsb,
+        xfs_fileoff_t           length)
+{
+        xfs_fileoff_t           remaining = length;
+        int                     error = 0;
+        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
+        do {
+                int             done;
+                xfs_bmbt_irec_t imap;
+                int             nimaps = 1;
+                xfs_fsblock_t   firstblock;
+                xfs_bmap_free_t flist;
+                /*
+                 * Map the range first and check that it is a delalloc extent
+                 * before trying to unmap the range. Otherwise we will be
+                 * trying to remove a real extent (which requires a
+                 * transaction) or a hole, which is probably a bad idea...
+                 */
+                error = xfs_bmapi(NULL, ip, start_fsb, 1,
+                                XFS_BMAPI_ENTIRE,  NULL, 0, &imap,
+                                &nimaps, NULL);
+                if (error) {
+                        /* something screwed, just bail */
+                        if (!XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+                                xfs_fs_cmn_err(CE_ALERT, ip->i_mount,
+                        "Failed delalloc mapping lookup ino %lld fsb %lld.",
+                                                ip->i_ino, start_fsb);
+                        }
+                        break;
+                }
+                if (!nimaps) {
+                        /* nothing there */
+                        goto next_block;
+                }
+                if (imap.br_startblock != DELAYSTARTBLOCK) {
+                        /* been converted, ignore */
+                        goto next_block;
+                }
+                WARN_ON(imap.br_blockcount == 0);
+                /*
+                 * Note: while we initialise the firstblock/flist pair, they
+                 * should never be used because blocks should never be
+                 * allocated or freed for a delalloc extent and hence we need
+                 * don't cancel or finish them after the xfs_bunmapi() call.
+                 */
+                xfs_bmap_init(&flist, &firstblock);
+                error = xfs_bunmapi(NULL, ip, start_fsb, 1, 0, 1, &firstblock,
+                                        &flist, &done);
+                if (error)
+                        break;
+                ASSERT(!flist.xbf_count && !flist.xbf_first);
+next_block:
+                start_fsb++;
+                remaining--;
+        } while(remaining > 0);
+        return error;
+}
diff --git a/fs/xfs/xfs_bmap.h b/fs/xfs/xfs_bmap.h
index 71ec9b6ecdfc..3651191daea1 100644
--- a/fs/xfs/xfs_bmap.h
+++ b/fs/xfs/xfs_bmap.h
@@ -394,6 +394,11 @@ xfs_bmap_count_blocks(
        int                     whichfork,
        int                     *count);
+int
+xfs_bmap_punch_delalloc_range(
+        struct xfs_inode        *ip,
+        xfs_fileoff_t           start_fsb,
+        xfs_fileoff_t           length);
 #endif  /* __KERNEL__ */
 #endif  /* __XFS_BMAP_H__ */
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 3b9582c60a22..e60490bc00a6 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -377,6 +377,19 @@ xfs_swap_extents(
        ip->i_d.di_format = tip->i_d.di_format;
        tip->i_d.di_format = tmp;
+        /*
+         * The extents in the source inode could still contain speculative
+         * preallocation beyond EOF (e.g. the file is open but not modified
+         * while defrag is in progress). In that case, we need to copy over the
+         * number of delalloc blocks the data fork in the source inode is
+         * tracking beyond EOF so that when the fork is truncated away when the
+         * temporary inode is unlinked we don't underrun the i_delayed_blks
+         * counter on that inode.
+         */
+        ASSERT(tip->i_delayed_blks == 0);
+        tip->i_delayed_blks = ip->i_delayed_blks;
+        ip->i_delayed_blks = 0;
        ilf_fields = XFS_ILOG_CORE;
        switch(ip->i_d.di_format) {
diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
index ed9990267661..c78cc6a3d87c 100644
--- a/fs/xfs/xfs_error.c
+++ b/fs/xfs/xfs_error.c
@@ -58,6 +58,7 @@ xfs_error_trap(int e)
 int     xfs_etest[XFS_NUM_INJECT_ERROR];
 int64_t xfs_etest_fsid[XFS_NUM_INJECT_ERROR];
 char *  xfs_etest_fsname[XFS_NUM_INJECT_ERROR];
+int     xfs_error_test_active;
 int
 xfs_error_test(int error_tag, int *fsidp, char *expression,
@@ -108,6 +109,7 @@ xfs_errortag_add(int error_tag, xfs_mount_t *mp)
                        len = strlen(mp->m_fsname);
                        xfs_etest_fsname[i] = kmem_alloc(len + 1, KM_SLEEP);
                        strcpy(xfs_etest_fsname[i], mp->m_fsname);
+                        xfs_error_test_active++;
                        return 0;
                }
        }
@@ -137,6 +139,7 @@ xfs_errortag_clearall(xfs_mount_t *mp, int loud)
                        xfs_etest_fsid[i] = 0LL;
                        kmem_free(xfs_etest_fsname[i]);
                        xfs_etest_fsname[i] = NULL;
+                        xfs_error_test_active--;
                }
        }
diff --git a/fs/xfs/xfs_error.h b/fs/xfs/xfs_error.h
index c2c1a072bb82..f338847f80b8 100644
--- a/fs/xfs/xfs_error.h
+++ b/fs/xfs/xfs_error.h
@@ -127,13 +127,14 @@ extern void xfs_corruption_error(const char *tag, int level,
 #define XFS_RANDOM_BMAPIFORMAT                          XFS_RANDOM_DEFAULT
 #ifdef DEBUG
+extern int xfs_error_test_active;
 extern int xfs_error_test(int, int *, char *, int, char *, unsigned long);
 #define XFS_NUM_INJECT_ERROR                            10
 #define XFS_TEST_ERROR(expr, mp, tag, rf)               \
-        ((expr) || \
+        ((expr) || (xfs_error_test_active && \
         xfs_error_test((tag), (mp)->m_fixedfsid, "expr", __LINE__, __FILE__, \
-                        (rf)))
+                        (rf))))
 extern int xfs_errortag_add(int error_tag, xfs_mount_t *mp);
 extern int xfs_errortag_clearall(xfs_mount_t *mp, int loud);
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index c7ac020705df..7c8d30c453c3 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -657,18 +657,37 @@ xfs_inode_item_unlock(
 }
 /*
- * This is called to find out where the oldest active copy of the
+ * This is called to find out where the oldest active copy of the inode log
- * inode log item in the on disk log resides now that the last log
+ * item in the on disk log resides now that the last log write of it completed
- * write of it completed at the given lsn.  Since we always re-log
+ * at the given lsn.  Since we always re-log all dirty data in an inode, the
- * all dirty data in an inode, the latest copy in the on disk log
+ * latest copy in the on disk log is the only one that matters.  Therefore,
- * is the only one that matters.  Therefore, simply return the
+ * simply return the given lsn.
- * given lsn.
+ *
+ * If the inode has been marked stale because the cluster is being freed, we
+ * don't want to (re-)insert this inode into the AIL. There is a race condition
+ * where the cluster buffer may be unpinned before the inode is inserted into
+ * the AIL during transaction committed processing. If the buffer is unpinned
+ * before the inode item has been committed and inserted, then it is possible
+ * for the buffer to be written and IO completions before the inode is inserted
+ * into the AIL. In that case, we'd be inserting a clean, stale inode into the
+ * AIL which will never get removed. It will, however, get reclaimed which
+ * triggers an assert in xfs_inode_free() complaining about freein an inode
+ * still in the AIL.
+ *
+ * To avoid this, return a lower LSN than the one passed in so that the
+ * transaction committed code will not move the inode forward in the AIL but
+ * will still unpin it properly.
 */
 STATIC xfs_lsn_t
 xfs_inode_item_committed(
        struct xfs_log_item     *lip,
        xfs_lsn_t               lsn)
 {
+        struct xfs_inode_log_item *iip = INODE_ITEM(lip);
+        struct xfs_inode        *ip = iip->ili_inode;
+        if (xfs_iflags_test(ip, XFS_ISTALE))
+                return lsn - 1;
        return lsn;
 }
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 2b3398004aa5..0f14f94ed8f4 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -1120,8 +1120,6 @@ struct drm_device {
        /*@{ */
        spinlock_t object_name_lock;
        struct idr object_name_idr;
-        uint32_t invalidate_domains;    /* domains pending invalidation */
-        uint32_t flush_domains;         /* domains pending flush */
        /*@} */
 };
@@ -1411,7 +1409,6 @@ extern int drm_agp_unbind_ioctl(struct drm_device *dev, void *data,
 extern int drm_agp_bind(struct drm_device *dev, struct drm_agp_binding *request);
 extern int drm_agp_bind_ioctl(struct drm_device *dev, void *data,
                        struct drm_file *file_priv);
-extern void drm_agp_chipset_flush(struct drm_device *dev);
                                /* Stub support (drm_stub.h) */
 extern int drm_setmaster_ioctl(struct drm_device *dev, void *data,
diff --git a/include/drm/drm_mm.h b/include/drm/drm_mm.h
index bf01531193d5..e39177778601 100644
--- a/include/drm/drm_mm.h
+++ b/include/drm/drm_mm.h
@@ -62,11 +62,14 @@ struct drm_mm {
        struct list_head unused_nodes;
        int num_unused;
        spinlock_t unused_lock;
+        unsigned int scan_check_range : 1;
        unsigned scan_alignment;
        unsigned long scan_size;
        unsigned long scan_hit_start;
        unsigned scan_hit_size;
        unsigned scanned_blocks;
+        unsigned long scan_start;
+        unsigned long scan_end;
 };
 /*
@@ -145,6 +148,10 @@ static inline struct drm_mm *drm_get_mm(struct drm_mm_node *block)
 void drm_mm_init_scan(struct drm_mm *mm, unsigned long size,
                      unsigned alignment);
+void drm_mm_init_scan_with_range(struct drm_mm *mm, unsigned long size,
+                                 unsigned alignment,
+                                 unsigned long start,
+                                 unsigned long end);
 int drm_mm_scan_add_block(struct drm_mm_node *node);
 int drm_mm_scan_remove_block(struct drm_mm_node *node);
diff --git a/include/drm/i915_drm.h b/include/drm/i915_drm.h
index 8c641bed9bbd..0039f1f97ad8 100644
--- a/include/drm/i915_drm.h
+++ b/include/drm/i915_drm.h
@@ -287,6 +287,9 @@ typedef struct drm_i915_irq_wait {
 #define I915_PARAM_HAS_EXECBUF2          9
 #define I915_PARAM_HAS_BSD               10
 #define I915_PARAM_HAS_BLT               11
+#define I915_PARAM_HAS_RELAXED_FENCING   12
+#define I915_PARAM_HAS_COHERENT_RINGS    13
+#define I915_PARAM_HAS_EXEC_CONSTANTS    14
 typedef struct drm_i915_getparam {
        int param;
@@ -633,6 +636,17 @@ struct drm_i915_gem_execbuffer2 {
 #define I915_EXEC_RENDER                 (1<<0)
 #define I915_EXEC_BSD                    (2<<0)
 #define I915_EXEC_BLT                    (3<<0)
+/* Used for switching the constants addressing mode on gen4+ RENDER ring.
+ * Gen6+ only supports relative addressing to dynamic state (default) and
+ * absolute addressing.
+ *
+ * These flags are ignored for the BSD and BLT rings.
+ */
+#define I915_EXEC_CONSTANTS_MASK        (3<<6)
+#define I915_EXEC_CONSTANTS_REL_GENERAL (0<<6) /* default */
+#define I915_EXEC_CONSTANTS_ABSOLUTE    (1<<6)
+#define I915_EXEC_CONSTANTS_REL_SURFACE (2<<6) /* gen4/5 only */
        __u64 flags;
        __u64 rsvd1;
        __u64 rsvd2;
diff --git a/include/drm/intel-gtt.h b/include/drm/intel-gtt.h
index d3c81946f613..9e343c0998b4 100644
--- a/include/drm/intel-gtt.h
+++ b/include/drm/intel-gtt.h
@@ -2,17 +2,40 @@
 #ifndef _DRM_INTEL_GTT_H
 #define _DRM_INTEL_GTT_H
-struct intel_gtt {
-        /* Number of stolen gtt entries at the beginning. */
+const struct intel_gtt {
-        unsigned int gtt_stolen_entries;
+        /* Size of memory reserved for graphics by the BIOS */
+        unsigned int stolen_size;
        /* Total number of gtt entries. */
        unsigned int gtt_total_entries;
        /* Part of the gtt that is mappable by the cpu, for those chips where
         * this is not the full gtt. */
        unsigned int gtt_mappable_entries;
-};
+        /* Whether i915 needs to use the dmar apis or not. */
+        unsigned int needs_dmar : 1;
+} *intel_gtt_get(void);
-struct intel_gtt *intel_gtt_get(void);
+void intel_gtt_chipset_flush(void);
+void intel_gtt_unmap_memory(struct scatterlist *sg_list, int num_sg);
+void intel_gtt_clear_range(unsigned int first_entry, unsigned int num_entries);
+int intel_gtt_map_memory(struct page **pages, unsigned int num_entries,
+                         struct scatterlist **sg_list, int *num_sg);
+void intel_gtt_insert_sg_entries(struct scatterlist *sg_list,
+                                 unsigned int sg_len,
+                                 unsigned int pg_start,
+                                 unsigned int flags);
+void intel_gtt_insert_pages(unsigned int first_entry, unsigned int num_entries,
+                            struct page **pages, unsigned int flags);
-#endif
+/* Special gtt memory types */
+#define AGP_DCACHE_MEMORY       1
+#define AGP_PHYS_MEMORY         2
+/* New caching attributes for gen6/sandybridge */
+#define AGP_USER_CACHED_MEMORY_LLC_MLC (AGP_USER_TYPES + 2)
+#define AGP_USER_UNCACHED_MEMORY (AGP_USER_TYPES + 4)
+/* flag for GFDT type */
+#define AGP_USER_CACHED_MEMORY_GFDT (1 << 3)
+#endif
diff --git a/include/linux/agp_backend.h b/include/linux/agp_backend.h
index 09ea4a1e9505..eaf6cd75a1b1 100644
--- a/include/linux/agp_backend.h
+++ b/include/linux/agp_backend.h
@@ -102,10 +102,8 @@ extern struct agp_memory *agp_allocate_memory(struct agp_bridge_data *, size_t,
 extern int agp_copy_info(struct agp_bridge_data *, struct agp_kern_info *);
 extern int agp_bind_memory(struct agp_memory *, off_t);
 extern int agp_unbind_memory(struct agp_memory *);
-extern int agp_rebind_memory(void);
 extern void agp_enable(struct agp_bridge_data *, u32);
 extern struct agp_bridge_data *agp_backend_acquire(struct pci_dev *);
 extern void agp_backend_release(struct agp_bridge_data *);
-extern void agp_flush_chipset(struct agp_bridge_data *);
 #endif                          /* _AGP_BACKEND_H */
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index a065612fc928..64a7114a9394 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -29,6 +29,7 @@ struct linux_binprm{
        char buf[BINPRM_BUF_SIZE];
 #ifdef CONFIG_MMU
        struct vm_area_struct *vma;
+        unsigned long vma_pages;
 #else
 # define MAX_ARG_PAGES  32
        struct page *page[MAX_ARG_PAGES];
@@ -59,6 +60,10 @@ struct linux_binprm{
        unsigned long loader, exec;
 };
+extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
+extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+                                        int write);
 #define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
 #define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 4823af64e9db..5f09323ee880 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -10,11 +10,6 @@
 *
 * CPUs are exported via sysfs in the class/cpu/devices/
 * directory. 
- *
- * Per-cpu interfaces can be implemented using a struct device_interface. 
- * See the following for how to do this: 
- * - drivers/base/intf.c 
- * - Documentation/driver-model/interface.txt
 */
 #ifndef _LINUX_CPU_H_
 #define _LINUX_CPU_H_
diff --git a/include/linux/dmar.h b/include/linux/dmar.h
index a7d9dc21391d..7b776d71d36d 100644
--- a/include/linux/dmar.h
+++ b/include/linux/dmar.h
@@ -175,10 +175,21 @@ static inline int set_msi_sid(struct irte *irte, struct pci_dev *dev)
        return 0;
 }
-#define enable_intr_remapping(mode)     (-1)
-#define disable_intr_remapping()        (0)
-#define reenable_intr_remapping(mode)   (0)
 #define intr_remapping_enabled          (0)
+static inline int enable_intr_remapping(int eim)
+{
+        return -1;
+}
+static inline void disable_intr_remapping(void)
+{
+}
+static inline int reenable_intr_remapping(int eim)
+{
+        return 0;
+}
 #endif
 /* Can't use the common MSI interrupt functions
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 7fca3dc4e475..d1631d37e9e0 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -1122,6 +1122,7 @@ extern const struct fb_videomode *fb_find_best_display(const struct fb_monspecs
 /* drivers/video/fbcmap.c */
 extern int fb_alloc_cmap(struct fb_cmap *cmap, int len, int transp);
+extern int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags);
 extern void fb_dealloc_cmap(struct fb_cmap *cmap);
 extern int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to);
 extern int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index eedc00b7b1ee..c9e06cc70dad 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -34,9 +34,9 @@
 #define SEEK_MAX        SEEK_END
 struct fstrim_range {
-        uint64_t start;
+        __u64 start;
-        uint64_t len;
+        __u64 len;
-        uint64_t minlen;
+        __u64 minlen;
 };
 /* And dynamically-tunable limits and defaults: */
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index e8713d55360a..f54adfcbec9c 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -360,7 +360,7 @@ void drain_local_pages(void *dummy);
 extern gfp_t gfp_allowed_mask;
-extern void set_gfp_allowed_mask(gfp_t mask);
+extern void pm_restrict_gfp_mask(void);
-extern gfp_t clear_gfp_allowed_mask(gfp_t mask);
+extern void pm_restore_gfp_mask(void);
 #endif /* __LINUX_GFP_H */
diff --git a/include/linux/gpio_keys.h b/include/linux/gpio_keys.h
index ce73a30113b4..dd1a56fbe924 100644
--- a/include/linux/gpio_keys.h
+++ b/include/linux/gpio_keys.h
@@ -16,6 +16,8 @@ struct gpio_keys_button {
 struct gpio_keys_platform_data {
        struct gpio_keys_button *buttons;
        int nbuttons;
+        unsigned int poll_interval;     /* polling interval in msecs -
+                                           for polling driver only */
        unsigned int rep:1;             /* enable input subsystem auto repeat */
        int (*enable)(struct device *dev);
        void (*disable)(struct device *dev);
diff --git a/include/linux/hw_breakpoint.h b/include/linux/hw_breakpoint.h
index a2d6ea49ec56..d1e55fed2c7d 100644
--- a/include/linux/hw_breakpoint.h
+++ b/include/linux/hw_breakpoint.h
@@ -33,6 +33,8 @@ enum bp_type_idx {
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
+extern int __init init_hw_breakpoint(void);
 static inline void hw_breakpoint_init(struct perf_event_attr *attr)
 {
        memset(attr, 0, sizeof(*attr));
@@ -108,6 +110,8 @@ static inline struct arch_hw_breakpoint *counter_arch_bp(struct perf_event *bp)
 #else /* !CONFIG_HAVE_HW_BREAKPOINT */
+static inline int __init init_hw_breakpoint(void) { return 0; }
 static inline struct perf_event *
 register_user_hw_breakpoint(struct perf_event_attr *attr,
                            perf_overflow_handler_t triggered,
diff --git a/include/linux/input.h b/include/linux/input.h
index 6ef44465db8d..a8af21d42bc1 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -47,6 +47,25 @@ struct input_id {
        __u16 version;
 };
+/**
+ * struct input_absinfo - used by EVIOCGABS/EVIOCSABS ioctls
+ * @value: latest reported value for the axis.
+ * @minimum: specifies minimum value for the axis.
+ * @maximum: specifies maximum value for the axis.
+ * @fuzz: specifies fuzz value that is used to filter noise from
+ *      the event stream.
+ * @flat: values that are within this value will be discarded by
+ *      joydev interface and reported as 0 instead.
+ * @resolution: specifies resolution for the values reported for
+ *      the axis.
+ *
+ * Note that input core does not clamp reported values to the
+ * [minimum, maximum] limits, such task is left to userspace.
+ *
+ * Resolution for main axes (ABS_X, ABS_Y, ABS_Z) is reported in
+ * units per millimeter (units/mm), resolution for rotational axes
+ * (ABS_RX, ABS_RY, ABS_RZ) is reported in units per radian.
+ */
 struct input_absinfo {
        __s32 value;
        __s32 minimum;
@@ -624,6 +643,10 @@ struct input_keymap_entry {
 #define KEY_CAMERA_FOCUS        0x210
 #define KEY_WPS_BUTTON          0x211   /* WiFi Protected Setup key */
+#define KEY_TOUCHPAD_TOGGLE     0x212   /* Request switch touchpad on or off */
+#define KEY_TOUCHPAD_ON         0x213
+#define KEY_TOUCHPAD_OFF        0x214
 #define BTN_TRIGGER_HAPPY               0x2c0
 #define BTN_TRIGGER_HAPPY1              0x2c0
 #define BTN_TRIGGER_HAPPY2              0x2c1
@@ -1130,7 +1153,7 @@ struct input_mt_slot {
 *      of tracked contacts
 * @mtsize: number of MT slots the device uses
 * @slot: MT slot currently being transmitted
- * @absinfo: array of &struct absinfo elements holding information
+ * @absinfo: array of &struct input_absinfo elements holding information
 *      about absolute axes (current value, min, max, flat, fuzz,
 *      resolution)
 * @key: reflects current state of device's keys/buttons
diff --git a/include/linux/intel-gtt.h b/include/linux/intel-gtt.h
deleted file mode 100644
index 1d19ab2afa39..000000000000
--- a/include/linux/intel-gtt.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Common Intel AGPGART and GTT definitions.
- */
-#ifndef _INTEL_GTT_H
-#define _INTEL_GTT_H
-#include <linux/agp_backend.h>
-/* This is for Intel only GTT controls.
- *
- * Sandybridge: AGP_USER_CACHED_MEMORY default to LLC only
- */
-#define AGP_USER_CACHED_MEMORY_LLC_MLC (AGP_USER_TYPES + 2)
-#define AGP_USER_UNCACHED_MEMORY (AGP_USER_TYPES + 4)
-/* flag for GFDT type */
-#define AGP_USER_CACHED_MEMORY_GFDT (1 << 3)
-#endif
diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
index 1ff81b51b656..dd3c34ebca9a 100644
--- a/include/linux/marvell_phy.h
+++ b/include/linux/marvell_phy.h
@@ -11,6 +11,7 @@
 #define MARVELL_PHY_ID_88E1118          0x01410e10
 #define MARVELL_PHY_ID_88E1121R         0x01410cb0
 #define MARVELL_PHY_ID_88E1145          0x01410cd0
+#define MARVELL_PHY_ID_88E1149R         0x01410e50
 #define MARVELL_PHY_ID_88E1240          0x01410e30
 #define MARVELL_PHY_ID_88E1318S         0x01410e90
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 4307231bd22f..31c237a00c48 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -161,6 +161,9 @@ extern void register_page_bootmem_info_node(struct pglist_data *pgdat);
 extern void put_page_bootmem(struct page *page);
 #endif
+void lock_memory_hotplug(void);
+void unlock_memory_hotplug(void);
 #else /* ! CONFIG_MEMORY_HOTPLUG */
 /*
 * Stub functions for when hotplug is off
@@ -192,6 +195,9 @@ static inline void register_page_bootmem_info_node(struct pglist_data *pgdat)
 {
 }
+static inline void lock_memory_hotplug(void) {}
+static inline void unlock_memory_hotplug(void) {}
 #endif /* ! CONFIG_MEMORY_HOTPLUG */
 #ifdef CONFIG_MEMORY_HOTREMOVE
diff --git a/include/linux/mfd/wm8350/audio.h b/include/linux/mfd/wm8350/audio.h
index a95141eafce3..bd581c6fa085 100644
--- a/include/linux/mfd/wm8350/audio.h
+++ b/include/linux/mfd/wm8350/audio.h
@@ -522,9 +522,6 @@
 #define WM8350_MCLK_SEL_PLL_32K                 3
 #define WM8350_MCLK_SEL_MCLK                    5
-#define WM8350_MCLK_DIR_OUT                     0
-#define WM8350_MCLK_DIR_IN                      1
 /* clock divider id's */
 #define WM8350_ADC_CLKDIV                       0
 #define WM8350_DAC_CLKDIV                       1
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 6d87f68ce4b6..30f6fad99a58 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -168,6 +168,7 @@ struct mmc_host {
                                                /* DDR mode at 1.8V */
 #define MMC_CAP_1_2V_DDR        (1 << 12)       /* can support */
                                                /* DDR mode at 1.2V */
+#define MMC_CAP_POWER_OFF_CARD  (1 << 13)       /* Can power off after boot */
        mmc_pm_flag_t           pm_caps;        /* supported pm features */
diff --git a/include/linux/module.h b/include/linux/module.h
index b29e7458b966..7575bbbdf2a2 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -517,7 +517,7 @@ static inline void __module_get(struct module *module)
 #define symbol_put_addr(p) do { } while(0)
 #endif /* CONFIG_MODULE_UNLOAD */
-int use_module(struct module *a, struct module *b);
+int ref_module(struct module *a, struct module *b);
 /* This is a #define so the string doesn't get put in every .o file */
 #define module_name(mod)                        \
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index ba6cc8f223c9..80f07198a31a 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -483,6 +483,7 @@ struct nfs_entry {
        int                     eof;
        struct nfs_fh *         fh;
        struct nfs_fattr *      fattr;
+        unsigned char           d_type;
 };
 /*
diff --git a/include/linux/node.h b/include/linux/node.h
index 06292dac3eab..1466945cc9ef 100644
--- a/include/linux/node.h
+++ b/include/linux/node.h
@@ -10,11 +10,6 @@
 *
 * Nodes are exported via driverfs in the class/node/devices/
 * directory. 
- *
- * Per-node interfaces can be implemented using a struct device_interface. 
- * See the following for how to do this: 
- * - drivers/base/intf.c 
- * - Documentation/driver-model/interface.txt
 */
 #ifndef _LINUX_NODE_H_
 #define _LINUX_NODE_H_
diff --git a/include/linux/page_cgroup.h b/include/linux/page_cgroup.h
index 5bb13b3db84d..b02195dfc1b0 100644
--- a/include/linux/page_cgroup.h
+++ b/include/linux/page_cgroup.h
@@ -59,8 +59,6 @@ static inline void ClearPageCgroup##uname(struct page_cgroup *pc)	\
 static inline int TestClearPageCgroup##uname(struct page_cgroup *pc)    \
        { return test_and_clear_bit(PCG_##lname, &pc->flags);  }
-TESTPCGFLAG(Locked, LOCK)
 /* Cache flag is set only once (at allocation) */
 TESTPCGFLAG(Cache, CACHE)
 CLEARPCGFLAG(Cache, CACHE)
@@ -104,6 +102,11 @@ static inline void unlock_page_cgroup(struct page_cgroup *pc)
        bit_spin_unlock(PCG_LOCK, &pc->flags);
 }
+static inline int page_is_cgroup_locked(struct page_cgroup *pc)
+{
+        return bit_spin_is_locked(PCG_LOCK, &pc->flags);
+}
 #else /* CONFIG_CGROUP_MEM_RES_CTLR */
 struct page_cgroup;
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index c6bcfe93b9ca..cb845c16ad7d 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2047,6 +2047,7 @@
 #define PCI_DEVICE_ID_AFAVLAB_P030      0x2182
 #define PCI_SUBDEVICE_ID_AFAVLAB_P061           0x2150
+#define PCI_VENDOR_ID_BCM_GVC          0x14a4
 #define PCI_VENDOR_ID_BROADCOM          0x14e4
 #define PCI_DEVICE_ID_TIGON3_5752       0x1600
 #define PCI_DEVICE_ID_TIGON3_5752M      0x1601
@@ -2441,6 +2442,7 @@
 #define PCI_DEVICE_ID_INTEL_MFD_SDIO2   0x0822
 #define PCI_DEVICE_ID_INTEL_MFD_EMMC0   0x0823
 #define PCI_DEVICE_ID_INTEL_MFD_EMMC1   0x0824
+#define PCI_DEVICE_ID_INTEL_MRST_SD2    0x084F
 #define PCI_DEVICE_ID_INTEL_I960        0x0960
 #define PCI_DEVICE_ID_INTEL_I960RM      0x0962
 #define PCI_DEVICE_ID_INTEL_8257X_SOL   0x1062
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 40150f345982..de2c41758e29 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -850,6 +850,7 @@ struct perf_event_context {
        int                             nr_active;
        int                             is_active;
        int                             nr_stat;
+        int                             rotate_disable;
        atomic_t                        refcount;
        struct task_struct              *task;
@@ -908,20 +909,6 @@ extern int perf_num_counters(void);
 extern const char *perf_pmu_name(void);
 extern void __perf_event_task_sched_in(struct task_struct *task);
 extern void __perf_event_task_sched_out(struct task_struct *task, struct task_struct *next);
-extern atomic_t perf_task_events;
-static inline void perf_event_task_sched_in(struct task_struct *task)
-{
-        COND_STMT(&perf_task_events, __perf_event_task_sched_in(task));
-}
-static inline
-void perf_event_task_sched_out(struct task_struct *task, struct task_struct *next)
-{
-        COND_STMT(&perf_task_events, __perf_event_task_sched_out(task, next));
-}
 extern int perf_event_init_task(struct task_struct *child);
 extern void perf_event_exit_task(struct task_struct *child);
 extern void perf_event_free_task(struct task_struct *task);
@@ -1030,6 +1017,21 @@ have_event:
        __perf_sw_event(event_id, nr, nmi, regs, addr);
 }
+extern atomic_t perf_task_events;
+static inline void perf_event_task_sched_in(struct task_struct *task)
+{
+        COND_STMT(&perf_task_events, __perf_event_task_sched_in(task));
+}
+static inline
+void perf_event_task_sched_out(struct task_struct *task, struct task_struct *next)
+{
+        perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, NULL, 0);
+        COND_STMT(&perf_task_events, __perf_event_task_sched_out(task, next));
+}
 extern void perf_event_mmap(struct vm_area_struct *vma);
 extern struct perf_guest_info_callbacks *perf_guest_cbs;
 extern int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 445796945ac9..bb27d7ec2fb9 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -160,5 +160,6 @@ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
 /* for F_SETPIPE_SZ and F_GETPIPE_SZ */
 long pipe_fcntl(struct file *, unsigned int, unsigned long arg);
+struct pipe_inode_info *get_pipe_info(struct file *file);
 #endif
diff --git a/include/linux/sh_clk.h b/include/linux/sh_clk.h
index cea0c38e7a63..9a52f72527dc 100644
--- a/include/linux/sh_clk.h
+++ b/include/linux/sh_clk.h
@@ -19,11 +19,13 @@ struct clk_mapping {
 };
 struct clk_ops {
+#ifdef CONFIG_SH_CLK_CPG_LEGACY
        void (*init)(struct clk *clk);
+#endif
        int (*enable)(struct clk *clk);
        void (*disable)(struct clk *clk);
        unsigned long (*recalc)(struct clk *clk);
-        int (*set_rate)(struct clk *clk, unsigned long rate, int algo_id);
+        int (*set_rate)(struct clk *clk, unsigned long rate);
        int (*set_parent)(struct clk *clk, struct clk *parent);
        long (*round_rate)(struct clk *clk, unsigned long rate);
 };
@@ -67,36 +69,6 @@ int clk_register(struct clk *);
 void clk_unregister(struct clk *);
 void clk_enable_init_clocks(void);
-/**
- * clk_set_rate_ex - set the clock rate for a clock source, with additional parameter
- * @clk: clock source
- * @rate: desired clock rate in Hz
- * @algo_id: algorithm id to be passed down to ops->set_rate
- *
- * Returns success (0) or negative errno.
- */
-int clk_set_rate_ex(struct clk *clk, unsigned long rate, int algo_id);
-enum clk_sh_algo_id {
-        NO_CHANGE = 0,
-        IUS_N1_N1,
-        IUS_322,
-        IUS_522,
-        IUS_N11,
-        SB_N1,
-        SB3_N1,
-        SB3_32,
-        SB3_43,
-        SB3_54,
-        BP_N1,
-        IP_N1,
-};
 struct clk_div_mult_table {
        unsigned int *divisors;
        unsigned int nr_divisors;
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 032d79ff1d9d..54e4eaaa0561 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -366,6 +366,7 @@ struct tty_file_private {
 #define TTY_HUPPED              18      /* Post driver->hangup() */
 #define TTY_FLUSHING            19      /* Flushing to ldisc in progress */
 #define TTY_FLUSHPENDING        20      /* Queued buffer flush pending */
+#define TTY_HUPPING             21      /* ->hangup() in progress */
 #define TTY_WRITE_FLUSH(tty) tty_write_flush((tty))
diff --git a/include/linux/uio_driver.h b/include/linux/uio_driver.h
index d6188e5a52df..665517c05eaf 100644
--- a/include/linux/uio_driver.h
+++ b/include/linux/uio_driver.h
@@ -3,7 +3,7 @@
 *
 * Copyright(C) 2005, Benedikt Spranger <b.spranger@linutronix.de>
 * Copyright(C) 2005, Thomas Gleixner <tglx@linutronix.de>
- * Copyright(C) 2006, Hans J. Koch <hjk@linutronix.de>
+ * Copyright(C) 2006, Hans J. Koch <hjk@hansjkoch.de>
 * Copyright(C) 2006, Greg Kroah-Hartman <greg@kroah.com>
 *
 * Userspace IO driver.
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 24300d8a1bc1..a28eb2592577 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -313,6 +313,10 @@ struct usb_bus {
        int busnum;                     /* Bus number (in order of reg) */
        const char *bus_name;           /* stable id (PCI slot_name etc) */
        u8 uses_dma;                    /* Does the host controller use DMA? */
+        u8 uses_pio_for_control;        /*
+                                         * Does the host controller use PIO
+                                         * for control transfers?
+                                         */
        u8 otg_port;                    /* 0, or number of OTG/HNP port */
        unsigned is_b_host:1;           /* true during some HNP roleswitches */
        unsigned b_hnp_enable:1;        /* OTG: did A-Host enable HNP? */
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index a03dcf62ca9d..44b54f619ac6 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -7,8 +7,6 @@
 struct vm_area_struct;          /* vma defining user mapping in mm_types.h */
-extern bool vmap_lazy_unmap;
 /* bits in flags of vmalloc's vm_struct below */
 #define VM_IOREMAP      0x00000001      /* ioremap() and friends */
 #define VM_ALLOC        0x00000002      /* vmalloc() */
diff --git a/include/media/v4l2-common.h b/include/media/v4l2-common.h
index 41dd480e45f1..239125af3ea3 100644
--- a/include/media/v4l2-common.h
+++ b/include/media/v4l2-common.h
@@ -137,31 +137,27 @@ struct v4l2_subdev_ops;
 /* Load an i2c module and return an initialized v4l2_subdev struct.
-   Only call request_module if module_name != NULL.
   The client_type argument is the name of the chip that's on the adapter. */
 struct v4l2_subdev *v4l2_i2c_new_subdev_cfg(struct v4l2_device *v4l2_dev,
-                struct i2c_adapter *adapter,
+                struct i2c_adapter *adapter, const char *client_type,
-                const char *module_name, const char *client_type,
                int irq, void *platform_data,
                u8 addr, const unsigned short *probe_addrs);
 /* Load an i2c module and return an initialized v4l2_subdev struct.
-   Only call request_module if module_name != NULL.
   The client_type argument is the name of the chip that's on the adapter. */
 static inline struct v4l2_subdev *v4l2_i2c_new_subdev(struct v4l2_device *v4l2_dev,
-                struct i2c_adapter *adapter,
+                struct i2c_adapter *adapter, const char *client_type,
-                const char *module_name, const char *client_type,
                u8 addr, const unsigned short *probe_addrs)
 {
-        return v4l2_i2c_new_subdev_cfg(v4l2_dev, adapter, module_name,
+        return v4l2_i2c_new_subdev_cfg(v4l2_dev, adapter, client_type, 0, NULL,
-                                client_type, 0, NULL, addr, probe_addrs);
+                                       addr, probe_addrs);
 }
 struct i2c_board_info;
 struct v4l2_subdev *v4l2_i2c_new_subdev_board(struct v4l2_device *v4l2_dev,
-                struct i2c_adapter *adapter, const char *module_name,
+                struct i2c_adapter *adapter, struct i2c_board_info *info,
-                struct i2c_board_info *info, const unsigned short *probe_addrs);
+                const unsigned short *probe_addrs);
 /* Initialize an v4l2_subdev with data from an i2c_client struct */
 void v4l2_i2c_subdev_init(struct v4l2_subdev *sd, struct i2c_client *client,
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 90c9e2872f27..18e5c3f67580 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *fp);
 extern void unix_notinflight(struct file *fp);
 extern void unix_gc(void);
 extern void wait_for_unix_gc(void);
+extern struct sock *unix_get_socket(struct file *filp);
 #define UNIX_HASH_SIZE  256
@@ -56,6 +57,7 @@ struct unix_sock {
        spinlock_t              lock;
        unsigned int            gc_candidate : 1;
        unsigned int            gc_maybe_cycle : 1;
+        unsigned char           recursion_level;
        struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
diff --git a/include/sound/sh_fsi.h b/include/sound/sh_fsi.h
index fa60cbda90a4..d79894192ae3 100644
--- a/include/sound/sh_fsi.h
+++ b/include/sound/sh_fsi.h
@@ -85,7 +85,9 @@
 *     ACK_MD (FSI2)
 *     CKG1   (FSI)
 *
- * err:  return value < 0
+ * err          : return value <  0
+ * no change    : return value == 0
+ * change xMD   : return value >  0
 *
 * 0x-00000AB
 *
@@ -111,7 +113,7 @@
 struct sh_fsi_platform_info {
        unsigned long porta_flags;
        unsigned long portb_flags;
-        int (*set_rate)(int is_porta, int rate); /* for master mode */
+        int (*set_rate)(struct device *dev, int is_porta, int rate, int enable);
 };
 #endif /* __SOUND_FSI_H */
diff --git a/include/video/da8xx-fb.h b/include/video/da8xx-fb.h
index 6316cdabf73f..89d43b3d4cb9 100644
--- a/include/video/da8xx-fb.h
+++ b/include/video/da8xx-fb.h
@@ -99,7 +99,6 @@ struct lcd_sync_arg {
 #define FBIPUT_COLOR            _IOW('F', 6, int)
 #define FBIPUT_HSYNC            _IOW('F', 9, int)
 #define FBIPUT_VSYNC            _IOW('F', 10, int)
-#define FBIO_WAITFORVSYNC       _IOW('F', 0x20, u_int32_t)
 #endif  /* ifndef DA8XX_FB_H */
diff --git a/include/xen/events.h b/include/xen/events.h
index 646dd17d3aa4..00f53ddcc062 100644
--- a/include/xen/events.h
+++ b/include/xen/events.h
@@ -76,7 +76,9 @@ int xen_map_pirq_gsi(unsigned pirq, unsigned gsi, int shareable, char *name);
 #ifdef CONFIG_PCI_MSI
 /* Allocate an irq and a pirq to be used with MSIs. */
-void xen_allocate_pirq_msi(char *name, int *irq, int *pirq);
+#define XEN_ALLOC_PIRQ (1 << 0)
+#define XEN_ALLOC_IRQ  (1 << 1)
+void xen_allocate_pirq_msi(char *name, int *irq, int *pirq, int alloc_mask);
 int xen_create_msi_irq(struct pci_dev *dev, struct msi_desc *msidesc, int type);
 #endif
@@ -89,4 +91,7 @@ int xen_vector_from_irq(unsigned pirq);
 /* Return gsi allocated to pirq */
 int xen_gsi_from_irq(unsigned pirq);
+/* Return irq from pirq */
+int xen_irq_from_pirq(unsigned pirq);
 #endif  /* _XEN_EVENTS_H */
diff --git a/include/xen/interface/memory.h b/include/xen/interface/memory.h
index d7a6c13bde69..eac3ce153719 100644
--- a/include/xen/interface/memory.h
+++ b/include/xen/interface/memory.h
@@ -141,6 +141,19 @@ struct xen_machphys_mfn_list {
 DEFINE_GUEST_HANDLE_STRUCT(xen_machphys_mfn_list);
 /*
+ * Returns the location in virtual address space of the machine_to_phys
+ * mapping table. Architectures which do not have a m2p table, or which do not
+ * map it by default into guest address space, do not implement this command.
+ * arg == addr of xen_machphys_mapping_t.
+ */
+#define XENMEM_machphys_mapping     12
+struct xen_machphys_mapping {
+    unsigned long v_start, v_end; /* Start and end virtual addresses.   */
+    unsigned long max_mfn;        /* Maximum MFN that can be looked up. */
+};
+DEFINE_GUEST_HANDLE_STRUCT(xen_machphys_mapping_t);
+/*
 * Sets the GPFN at which a particular page appears in the specified guest's
 * pseudophysical address space.
 * arg == addr of xen_add_to_physmap_t.
diff --git a/include/xen/interface/physdev.h b/include/xen/interface/physdev.h
index 2b2c66c3df00..534cac89a77d 100644
--- a/include/xen/interface/physdev.h
+++ b/include/xen/interface/physdev.h
@@ -188,6 +188,16 @@ struct physdev_nr_pirqs {
    uint32_t nr_pirqs;
 };
+/* type is MAP_PIRQ_TYPE_GSI or MAP_PIRQ_TYPE_MSI
+ * the hypercall returns a free pirq */
+#define PHYSDEVOP_get_free_pirq    23
+struct physdev_get_free_pirq {
+    /* IN */ 
+    int type;
+    /* OUT */
+    uint32_t pirq;
+};
 /*
 * Notify that some PIRQ-bound event channels have been unmasked.
 * ** This command is obsolete since interface version 0x00030202 and is **
diff --git a/include/xen/page.h b/include/xen/page.h
index eaf85fab1263..0be36b976f4b 100644
--- a/include/xen/page.h
+++ b/include/xen/page.h
@@ -1 +1,8 @@
+#ifndef _XEN_PAGE_H
+#define _XEN_PAGE_H
 #include <asm/xen/page.h>
+extern phys_addr_t xen_extra_mem_start, xen_extra_mem_size;
+#endif  /* _XEN_PAGE_H */
diff --git a/include/xen/privcmd.h b/include/xen/privcmd.h
index b42cdfd92fee..17857fb4d550 100644
--- a/include/xen/privcmd.h
+++ b/include/xen/privcmd.h
@@ -34,13 +34,10 @@
 #define __LINUX_PUBLIC_PRIVCMD_H__
 #include <linux/types.h>
+#include <linux/compiler.h>
 typedef unsigned long xen_pfn_t;
-#ifndef __user
-#define __user
-#endif
 struct privcmd_hypercall {
        __u64 op;
        __u64 arg[5];
diff --git a/init/Kconfig b/init/Kconfig
index 88c10468db46..c9728992a776 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -613,6 +613,19 @@ config CGROUP_MEM_RES_CTLR_SWAP
          if boot option "noswapaccount" is set, swap will not be accounted.
          Now, memory usage of swap_cgroup is 2 bytes per entry. If swap page
          size is 4096bytes, 512k per 1Gbytes of swap.
+config CGROUP_MEM_RES_CTLR_SWAP_ENABLED
+        bool "Memory Resource Controller Swap Extension enabled by default"
+        depends on CGROUP_MEM_RES_CTLR_SWAP
+        default y
+        help
+          Memory Resource Controller Swap Extension comes with its price in
+          a bigger memory consumption. General purpose distribution kernels
+          which want to enable the feautre but keep it disabled by default
+          and let the user enable it by swapaccount boot command line
+          parameter should have this option unselected.
+          For those who want to have the feature enabled by default should
+          select this option (if, for some reason, they need to disable it
+          then noswapaccount does the trick).
 menuconfig CGROUP_SCHED
        bool "Group CPU scheduler"
diff --git a/kernel/exit.c b/kernel/exit.c
index 21aa7b3001fb..676149a4ac5f 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -914,6 +914,15 @@ NORET_TYPE void do_exit(long code)
        if (unlikely(!tsk->pid))
                panic("Attempted to kill the idle task!");
+        /*
+         * If do_exit is called because this processes oopsed, it's possible
+         * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+         * continuing. Amongst other possible reasons, this is to prevent
+         * mm_release()->clear_child_tid() from writing to a user-controlled
+         * kernel address.
+         */
+        set_fs(USER_DS);
        tracehook_report_exit(&code);
        validate_creds_for_do_exit(tsk);
diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
index 2c9120f0afca..e5325825aeb6 100644
--- a/kernel/hw_breakpoint.c
+++ b/kernel/hw_breakpoint.c
@@ -620,7 +620,7 @@ static struct pmu perf_breakpoint = {
        .read           = hw_breakpoint_pmu_read,
 };
-static int __init init_hw_breakpoint(void)
+int __init init_hw_breakpoint(void)
 {
        unsigned int **task_bp_pinned;
        int cpu, err_cpu;
@@ -655,6 +655,5 @@ static int __init init_hw_breakpoint(void)
        return -ENOMEM;
 }
-core_initcall(init_hw_breakpoint);
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 01b1d3a88983..6c8a2a9f8a7b 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -214,7 +214,7 @@ static int irq_spurious_proc_show(struct seq_file *m, void *v)
 static int irq_spurious_proc_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, irq_spurious_proc_show, NULL);
+        return single_open(file, irq_spurious_proc_show, PDE(inode)->data);
 }
 static const struct file_operations irq_spurious_proc_fops = {
diff --git a/kernel/irq_work.c b/kernel/irq_work.c
index f16763ff8481..90f881904bb1 100644
--- a/kernel/irq_work.c
+++ b/kernel/irq_work.c
@@ -145,7 +145,9 @@ void irq_work_run(void)
                 * Clear the BUSY bit and return to the free state if
                 * no-one else claimed it meanwhile.
                 */
-                cmpxchg(&entry->next, next_flags(NULL, IRQ_WORK_BUSY), NULL);
+                (void)cmpxchg(&entry->next,
+                              next_flags(NULL, IRQ_WORK_BUSY),
+                              NULL);
        }
 }
 EXPORT_SYMBOL_GPL(irq_work_run);
diff --git a/kernel/module.c b/kernel/module.c
index 437a74a7524a..d190664f25ff 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2326,6 +2326,18 @@ static void find_module_sections(struct module *mod, struct load_info *info)
        kmemleak_scan_area(mod->trace_events, sizeof(*mod->trace_events) *
                           mod->num_trace_events, GFP_KERNEL);
 #endif
+#ifdef CONFIG_TRACING
+        mod->trace_bprintk_fmt_start = section_objs(info, "__trace_printk_fmt",
+                                         sizeof(*mod->trace_bprintk_fmt_start),
+                                         &mod->num_trace_bprintk_fmt);
+        /*
+         * This section contains pointers to allocated objects in the trace
+         * code and not scanning it leads to false positives.
+         */
+        kmemleak_scan_area(mod->trace_bprintk_fmt_start,
+                           sizeof(*mod->trace_bprintk_fmt_start) *
+                           mod->num_trace_bprintk_fmt, GFP_KERNEL);
+#endif
 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
        /* sechdrs[0].sh_size is always zero */
        mod->ftrace_callsites = section_objs(info, "__mcount_loc",
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index cb6c0d2af68f..eac7e3364335 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -31,6 +31,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/perf_event.h>
 #include <linux/ftrace_event.h>
+#include <linux/hw_breakpoint.h>
 #include <asm/irq_regs.h>
@@ -1286,8 +1287,6 @@ void __perf_event_task_sched_out(struct task_struct *task,
 {
        int ctxn;
-        perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, 1, NULL, 0);
        for_each_task_context_nr(ctxn)
                perf_event_context_sched_out(task, ctxn, next);
 }
@@ -1621,8 +1620,12 @@ static void rotate_ctx(struct perf_event_context *ctx)
 {
        raw_spin_lock(&ctx->lock);
-        /* Rotate the first entry last of non-pinned groups */
+        /*
-        list_rotate_left(&ctx->flexible_groups);
+         * Rotate the first entry last of non-pinned groups. Rotation might be
+         * disabled by the inheritance code.
+         */
+        if (!ctx->rotate_disable)
+                list_rotate_left(&ctx->flexible_groups);
        raw_spin_unlock(&ctx->lock);
 }
@@ -2234,11 +2237,6 @@ int perf_event_release_kernel(struct perf_event *event)
        raw_spin_unlock_irq(&ctx->lock);
        mutex_unlock(&ctx->mutex);
-        mutex_lock(&event->owner->perf_event_mutex);
-        list_del_init(&event->owner_entry);
-        mutex_unlock(&event->owner->perf_event_mutex);
-        put_task_struct(event->owner);
        free_event(event);
        return 0;
@@ -2251,9 +2249,43 @@ EXPORT_SYMBOL_GPL(perf_event_release_kernel);
 static int perf_release(struct inode *inode, struct file *file)
 {
        struct perf_event *event = file->private_data;
+        struct task_struct *owner;
        file->private_data = NULL;
+        rcu_read_lock();
+        owner = ACCESS_ONCE(event->owner);
+        /*
+         * Matches the smp_wmb() in perf_event_exit_task(). If we observe
+         * !owner it means the list deletion is complete and we can indeed
+         * free this event, otherwise we need to serialize on
+         * owner->perf_event_mutex.
+         */
+        smp_read_barrier_depends();
+        if (owner) {
+                /*
+                 * Since delayed_put_task_struct() also drops the last
+                 * task reference we can safely take a new reference
+                 * while holding the rcu_read_lock().
+                 */
+                get_task_struct(owner);
+        }
+        rcu_read_unlock();
+        if (owner) {
+                mutex_lock(&owner->perf_event_mutex);
+                /*
+                 * We have to re-check the event->owner field, if it is cleared
+                 * we raced with perf_event_exit_task(), acquiring the mutex
+                 * ensured they're done, and we can proceed with freeing the
+                 * event.
+                 */
+                if (event->owner)
+                        list_del_init(&event->owner_entry);
+                mutex_unlock(&owner->perf_event_mutex);
+                put_task_struct(owner);
+        }
        return perf_event_release_kernel(event);
 }
@@ -5677,7 +5709,7 @@ SYSCALL_DEFINE5(perf_event_open,
        mutex_unlock(&ctx->mutex);
        event->owner = current;
-        get_task_struct(current);
        mutex_lock(&current->perf_event_mutex);
        list_add_tail(&event->owner_entry, &current->perf_event_list);
        mutex_unlock(&current->perf_event_mutex);
@@ -5745,12 +5777,6 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
        ++ctx->generation;
        mutex_unlock(&ctx->mutex);
-        event->owner = current;
-        get_task_struct(current);
-        mutex_lock(&current->perf_event_mutex);
-        list_add_tail(&event->owner_entry, &current->perf_event_list);
-        mutex_unlock(&current->perf_event_mutex);
        return event;
 err_free:
@@ -5901,8 +5927,24 @@ again:
 */
 void perf_event_exit_task(struct task_struct *child)
 {
+        struct perf_event *event, *tmp;
        int ctxn;
+        mutex_lock(&child->perf_event_mutex);
+        list_for_each_entry_safe(event, tmp, &child->perf_event_list,
+                                 owner_entry) {
+                list_del_init(&event->owner_entry);
+                /*
+                 * Ensure the list deletion is visible before we clear
+                 * the owner, closes a race against perf_release() where
+                 * we need to serialize on the owner->perf_event_mutex.
+                 */
+                smp_wmb();
+                event->owner = NULL;
+        }
+        mutex_unlock(&child->perf_event_mutex);
        for_each_task_context_nr(ctxn)
                perf_event_exit_task_context(child, ctxn);
 }
@@ -6122,6 +6164,7 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
        struct perf_event *event;
        struct task_struct *parent = current;
        int inherited_all = 1;
+        unsigned long flags;
        int ret = 0;
        child->perf_event_ctxp[ctxn] = NULL;
@@ -6162,6 +6205,15 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
                        break;
        }
+        /*
+         * We can't hold ctx->lock when iterating the ->flexible_group list due
+         * to allocations, but we need to prevent rotation because
+         * rotate_ctx() will change the list from interrupt context.
+         */
+        raw_spin_lock_irqsave(&parent_ctx->lock, flags);
+        parent_ctx->rotate_disable = 1;
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
        list_for_each_entry(event, &parent_ctx->flexible_groups, group_entry) {
                ret = inherit_task_group(event, parent, parent_ctx,
                                         child, ctxn, &inherited_all);
@@ -6169,6 +6221,10 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
                        break;
        }
+        raw_spin_lock_irqsave(&parent_ctx->lock, flags);
+        parent_ctx->rotate_disable = 0;
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
        child_ctx = child->perf_event_ctxp[ctxn];
        if (child_ctx && inherited_all) {
@@ -6321,6 +6377,8 @@ perf_cpu_notify(struct notifier_block *self, unsigned long action, void *hcpu)
 void __init perf_event_init(void)
 {
+        int ret;
        perf_event_init_all_cpus();
        init_srcu_struct(&pmus_srcu);
        perf_pmu_register(&perf_swevent);
@@ -6328,4 +6386,7 @@ void __init perf_event_init(void)
        perf_pmu_register(&perf_task_clock);
        perf_tp_register();
        perf_cpu_notifier(perf_cpu_notify);
+        ret = init_hw_breakpoint();
+        WARN(ret, "hw_breakpoint initialization failed with: %d", ret);
 }
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 6842eeba5879..05bb7173850e 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -37,13 +37,13 @@ static int check_clock(const clockid_t which_clock)
        if (pid == 0)
                return 0;
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
        p = find_task_by_vpid(pid);
        if (!p || !(CPUCLOCK_PERTHREAD(which_clock) ?
-                   same_thread_group(p, current) : thread_group_leader(p))) {
+                   same_thread_group(p, current) : has_group_leader_pid(p))) {
                error = -EINVAL;
        }
-        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
        return error;
 }
@@ -390,7 +390,7 @@ int posix_cpu_timer_create(struct k_itimer *new_timer)
        INIT_LIST_HEAD(&new_timer->it.cpu.entry);
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
        if (CPUCLOCK_PERTHREAD(new_timer->it_clock)) {
                if (pid == 0) {
                        p = current;
@@ -404,7 +404,7 @@ int posix_cpu_timer_create(struct k_itimer *new_timer)
                        p = current->group_leader;
                } else {
                        p = find_task_by_vpid(pid);
-                        if (p && !thread_group_leader(p))
+                        if (p && !has_group_leader_pid(p))
                                p = NULL;
                }
        }
@@ -414,7 +414,7 @@ int posix_cpu_timer_create(struct k_itimer *new_timer)
        } else {
                ret = -EINVAL;
        }
-        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
        return ret;
 }
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 657272e91d0a..048d0b514831 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -327,7 +327,6 @@ static int create_image(int platform_mode)
 int hibernation_snapshot(int platform_mode)
 {
        int error;
-        gfp_t saved_mask;
        error = platform_begin(platform_mode);
        if (error)
@@ -339,7 +338,7 @@ int hibernation_snapshot(int platform_mode)
                goto Close;
        suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
        error = dpm_suspend_start(PMSG_FREEZE);
        if (error)
                goto Recover_platform;
@@ -348,7 +347,10 @@ int hibernation_snapshot(int platform_mode)
                goto Recover_platform;
        error = create_image(platform_mode);
-        /* Control returns here after successful restore */
+        /*
+         * Control returns here (1) after the image has been created or the
+         * image creation has failed and (2) after a successful restore.
+         */
 Resume_devices:
        /* We may need to release the preallocated image pages here. */
@@ -357,7 +359,10 @@ int hibernation_snapshot(int platform_mode)
        dpm_resume_end(in_suspend ?
                (error ? PMSG_RECOVER : PMSG_THAW) : PMSG_RESTORE);
-        set_gfp_allowed_mask(saved_mask);
+        if (error || !in_suspend)
+                pm_restore_gfp_mask();
        resume_console();
 Close:
        platform_end(platform_mode);
@@ -452,17 +457,16 @@ static int resume_target_kernel(bool platform_mode)
 int hibernation_restore(int platform_mode)
 {
        int error;
-        gfp_t saved_mask;
        pm_prepare_console();
        suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
        error = dpm_suspend_start(PMSG_QUIESCE);
        if (!error) {
                error = resume_target_kernel(platform_mode);
                dpm_resume_end(PMSG_RECOVER);
        }
-        set_gfp_allowed_mask(saved_mask);
+        pm_restore_gfp_mask();
        resume_console();
        pm_restore_console();
        return error;
@@ -476,7 +480,6 @@ int hibernation_restore(int platform_mode)
 int hibernation_platform_enter(void)
 {
        int error;
-        gfp_t saved_mask;
        if (!hibernation_ops)
                return -ENOSYS;
@@ -492,7 +495,6 @@ int hibernation_platform_enter(void)
        entering_platform_hibernation = true;
        suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
        error = dpm_suspend_start(PMSG_HIBERNATE);
        if (error) {
                if (hibernation_ops->recover)
@@ -536,7 +538,6 @@ int hibernation_platform_enter(void)
 Resume_devices:
        entering_platform_hibernation = false;
        dpm_resume_end(PMSG_RESTORE);
-        set_gfp_allowed_mask(saved_mask);
        resume_console();
 Close:
@@ -646,6 +647,7 @@ int hibernate(void)
                swsusp_free();
                if (!error)
                        power_down();
+                pm_restore_gfp_mask();
        } else {
                pr_debug("PM: Image restored successfully.\n");
        }
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 7335952ee473..ecf770509d0d 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -197,7 +197,6 @@ static int suspend_enter(suspend_state_t state)
 int suspend_devices_and_enter(suspend_state_t state)
 {
        int error;
-        gfp_t saved_mask;
        if (!suspend_ops)
                return -ENOSYS;
@@ -208,7 +207,7 @@ int suspend_devices_and_enter(suspend_state_t state)
                        goto Close;
        }
        suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
        suspend_test_start();
        error = dpm_suspend_start(PMSG_SUSPEND);
        if (error) {
@@ -225,7 +224,7 @@ int suspend_devices_and_enter(suspend_state_t state)
        suspend_test_start();
        dpm_resume_end(PMSG_RESUME);
        suspend_test_finish("resume devices");
-        set_gfp_allowed_mask(saved_mask);
+        pm_restore_gfp_mask();
        resume_console();
 Close:
        if (suspend_ops->end)
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index a0e4a86ccf94..baf667bb2794 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -6,6 +6,7 @@
 *
 * Copyright (C) 1998,2001-2005 Pavel Machek <pavel@ucw.cz>
 * Copyright (C) 2006 Rafael J. Wysocki <rjw@sisk.pl>
+ * Copyright (C) 2010 Bojan Smojver <bojan@rexursive.com>
 *
 * This file is released under the GPLv2.
 *
@@ -753,30 +754,43 @@ static int load_image_lzo(struct swap_map_handle *handle,
 {
        unsigned int m;
        int error = 0;
+        struct bio *bio;
        struct timeval start;
        struct timeval stop;
        unsigned nr_pages;
-        size_t off, unc_len, cmp_len;
+        size_t i, off, unc_len, cmp_len;
-        unsigned char *unc, *cmp, *page;
+        unsigned char *unc, *cmp, *page[LZO_CMP_PAGES];
-        page = (void *)__get_free_page(__GFP_WAIT | __GFP_HIGH);
+        for (i = 0; i < LZO_CMP_PAGES; i++) {
-        if (!page) {
+                page[i] = (void *)__get_free_page(__GFP_WAIT | __GFP_HIGH);
-                printk(KERN_ERR "PM: Failed to allocate LZO page\n");
+                if (!page[i]) {
-                return -ENOMEM;
+                        printk(KERN_ERR "PM: Failed to allocate LZO page\n");
+                        while (i)
+                                free_page((unsigned long)page[--i]);
+                        return -ENOMEM;
+                }
        }
        unc = vmalloc(LZO_UNC_SIZE);
        if (!unc) {
                printk(KERN_ERR "PM: Failed to allocate LZO uncompressed\n");
-                free_page((unsigned long)page);
+                for (i = 0; i < LZO_CMP_PAGES; i++)
+                        free_page((unsigned long)page[i]);
                return -ENOMEM;
        }
        cmp = vmalloc(LZO_CMP_SIZE);
        if (!cmp) {
                printk(KERN_ERR "PM: Failed to allocate LZO compressed\n");
                vfree(unc);
-                free_page((unsigned long)page);
+                for (i = 0; i < LZO_CMP_PAGES; i++)
+                        free_page((unsigned long)page[i]);
                return -ENOMEM;
        }
@@ -787,6 +801,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
        if (!m)
                m = 1;
        nr_pages = 0;
+        bio = NULL;
        do_gettimeofday(&start);
        error = snapshot_write_next(snapshot);
@@ -794,11 +809,11 @@ static int load_image_lzo(struct swap_map_handle *handle,
                goto out_finish;
        for (;;) {
-                error = swap_read_page(handle, page, NULL); /* sync */
+                error = swap_read_page(handle, page[0], NULL); /* sync */
                if (error)
                        break;
-                cmp_len = *(size_t *)page;
+                cmp_len = *(size_t *)page[0];
                if (unlikely(!cmp_len ||
                             cmp_len > lzo1x_worst_compress(LZO_UNC_SIZE))) {
                        printk(KERN_ERR "PM: Invalid LZO compressed length\n");
@@ -806,13 +821,20 @@ static int load_image_lzo(struct swap_map_handle *handle,
                        break;
                }
-                memcpy(cmp, page, PAGE_SIZE);
+                for (off = PAGE_SIZE, i = 1;
-                for (off = PAGE_SIZE; off < LZO_HEADER + cmp_len; off += PAGE_SIZE) {
+                     off < LZO_HEADER + cmp_len; off += PAGE_SIZE, i++) {
-                        error = swap_read_page(handle, page, NULL); /* sync */
+                        error = swap_read_page(handle, page[i], &bio);
                        if (error)
                                goto out_finish;
+                }
-                        memcpy(cmp + off, page, PAGE_SIZE);
+                error = hib_wait_on_bio_chain(&bio); /* need all data now */
+                if (error)
+                        goto out_finish;
+                for (off = 0, i = 0;
+                     off < LZO_HEADER + cmp_len; off += PAGE_SIZE, i++) {
+                        memcpy(cmp + off, page[i], PAGE_SIZE);
                }
                unc_len = LZO_UNC_SIZE;
@@ -857,7 +879,8 @@ out_finish:
        vfree(cmp);
        vfree(unc);
-        free_page((unsigned long)page);
+        for (i = 0; i < LZO_CMP_PAGES; i++)
+                free_page((unsigned long)page[i]);
        return error;
 }
diff --git a/kernel/power/user.c b/kernel/power/user.c
index e819e17877ca..1b2ea31e6bd8 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -263,6 +263,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
        case SNAPSHOT_UNFREEZE:
                if (!data->frozen || data->ready)
                        break;
+                pm_restore_gfp_mask();
                thaw_processes();
                usermodehelper_enable();
                data->frozen = 0;
@@ -275,6 +276,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                        error = -EPERM;
                        break;
                }
+                pm_restore_gfp_mask();
                error = hibernation_snapshot(data->platform_support);
                if (!error)
                        error = put_user(in_suspend, (int __user *)arg);
diff --git a/kernel/printk.c b/kernel/printk.c
index 9a2264fc42ca..a23315dc4498 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1082,13 +1082,15 @@ void printk_tick(void)
 int printk_needs_cpu(int cpu)
 {
+        if (unlikely(cpu_is_offline(cpu)))
+                printk_tick();
        return per_cpu(printk_pending, cpu);
 }
 void wake_up_klogd(void)
 {
        if (waitqueue_active(&log_wait))
-                __raw_get_cpu_var(printk_pending) = 1;
+                this_cpu_write(printk_pending, 1);
 }
 /**
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 52ab113d8bb9..00ebd7686676 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -1758,10 +1758,6 @@ static void pull_task(struct rq *src_rq, struct task_struct *p,
        set_task_cpu(p, this_cpu);
        activate_task(this_rq, p, 0);
        check_preempt_curr(this_rq, p, 0);
-        /* re-arm NEWIDLE balancing when moving tasks */
-        src_rq->avg_idle = this_rq->avg_idle = 2*sysctl_sched_migration_cost;
-        this_rq->idle_stamp = 0;
 }
 /*
@@ -3219,8 +3215,10 @@ static void idle_balance(int this_cpu, struct rq *this_rq)
                interval = msecs_to_jiffies(sd->balance_interval);
                if (time_after(next_balance, sd->last_balance + interval))
                        next_balance = sd->last_balance + interval;
-                if (pulled_task)
+                if (pulled_task) {
+                        this_rq->idle_stamp = 0;
                        break;
+                }
        }
        raw_spin_lock(&this_rq->lock);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 042084157980..c380612273bf 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1283,6 +1283,8 @@ void trace_dump_stack(void)
        __ftrace_trace_stack(global_trace.buffer, flags, 3, preempt_count());
 }
+static DEFINE_PER_CPU(int, user_stack_count);
 void
 ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
 {
@@ -1301,6 +1303,18 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
        if (unlikely(in_nmi()))
                return;
+        /*
+         * prevent recursion, since the user stack tracing may
+         * trigger other kernel events.
+         */
+        preempt_disable();
+        if (__this_cpu_read(user_stack_count))
+                goto out;
+        __this_cpu_inc(user_stack_count);
        event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
                                          sizeof(*entry), flags, pc);
        if (!event)
@@ -1318,6 +1332,11 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
        save_stack_trace_user(&trace);
        if (!filter_check_discard(call, entry, buffer, event))
                ring_buffer_unlock_commit(buffer, event);
+        __this_cpu_dec(user_stack_count);
+ out:
+        preempt_enable();
 }
 #ifdef UNUSED
diff --git a/lib/debug_locks.c b/lib/debug_locks.c
index 5bf0020b9248..b1c177307677 100644
--- a/lib/debug_locks.c
+++ b/lib/debug_locks.c
@@ -8,7 +8,6 @@
 *
 *  Copyright (C) 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
 */
-#include <linux/kernel.h>
 #include <linux/rwsem.h>
 #include <linux/mutex.h>
 #include <linux/module.h>
@@ -39,7 +38,6 @@ int debug_locks_off(void)
 {
        if (__debug_locks_off()) {
                if (!debug_locks_silent) {
-                        oops_in_progress = 1;
                        console_verbose();
                        return 1;
                }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c4a3558589ab..85855240933d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2738,7 +2738,8 @@ out_page_table_lock:
                unlock_page(pagecache_page);
                put_page(pagecache_page);
        }
-        unlock_page(page);
+        if (page != pagecache_page)
+                unlock_page(page);
 out_mutex:
        mutex_unlock(&hugetlb_instantiation_mutex);
diff --git a/mm/ksm.c b/mm/ksm.c
index 65ab5c7067d9..43bc893470b4 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1724,8 +1724,13 @@ static int ksm_memory_callback(struct notifier_block *self,
                /*
                 * Keep it very simple for now: just lock out ksmd and
                 * MADV_UNMERGEABLE while any memory is going offline.
+                 * mutex_lock_nested() is necessary because lockdep was alarmed
+                 * that here we take ksm_thread_mutex inside notifier chain
+                 * mutex, and later take notifier chain mutex inside
+                 * ksm_thread_mutex to unlock it.   But that's safe because both
+                 * are inside mem_hotplug_mutex.
                 */
-                mutex_lock(&ksm_thread_mutex);
+                mutex_lock_nested(&ksm_thread_mutex, SINGLE_DEPTH_NESTING);
                break;
        case MEM_OFFLINE:
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 2efa8ea07ff7..7a22b4129211 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -61,7 +61,14 @@ struct mem_cgroup *root_mem_cgroup __read_mostly;
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 /* Turned on only when memory cgroup is enabled && really_do_swap_account = 1 */
 int do_swap_account __read_mostly;
-static int really_do_swap_account __initdata = 1; /* for remember boot option*/
+/* for remember boot option*/
+#ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP_ENABLED
+static int really_do_swap_account __initdata = 1;
+#else
+static int really_do_swap_account __initdata = 0;
+#endif
 #else
 #define do_swap_account         (0)
 #endif
@@ -278,13 +285,14 @@ enum move_type {
 /* "mc" and its members are protected by cgroup_mutex */
 static struct move_charge_struct {
-        spinlock_t        lock; /* for from, to, moving_task */
+        spinlock_t        lock; /* for from, to */
        struct mem_cgroup *from;
        struct mem_cgroup *to;
        unsigned long precharge;
        unsigned long moved_charge;
        unsigned long moved_swap;
        struct task_struct *moving_task;        /* a task moving charges */
+        struct mm_struct *mm;
        wait_queue_head_t waitq;                /* a waitq for other context */
 } mc = {
        .lock = __SPIN_LOCK_UNLOCKED(mc.lock),
@@ -2152,7 +2160,7 @@ static void __mem_cgroup_move_account(struct page_cgroup *pc,
 {
        VM_BUG_ON(from == to);
        VM_BUG_ON(PageLRU(pc->page));
-        VM_BUG_ON(!PageCgroupLocked(pc));
+        VM_BUG_ON(!page_is_cgroup_locked(pc));
        VM_BUG_ON(!PageCgroupUsed(pc));
        VM_BUG_ON(pc->mem_cgroup != from);
@@ -4631,7 +4639,7 @@ static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm)
        unsigned long precharge;
        struct vm_area_struct *vma;
-        down_read(&mm->mmap_sem);
+        /* We've already held the mmap_sem */
        for (vma = mm->mmap; vma; vma = vma->vm_next) {
                struct mm_walk mem_cgroup_count_precharge_walk = {
                        .pmd_entry = mem_cgroup_count_precharge_pte_range,
@@ -4643,7 +4651,6 @@ static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm)
                walk_page_range(vma->vm_start, vma->vm_end,
                                        &mem_cgroup_count_precharge_walk);
        }
-        up_read(&mm->mmap_sem);
        precharge = mc.precharge;
        mc.precharge = 0;
@@ -4694,11 +4701,16 @@ static void mem_cgroup_clear_mc(void)
                mc.moved_swap = 0;
        }
+        if (mc.mm) {
+                up_read(&mc.mm->mmap_sem);
+                mmput(mc.mm);
+        }
        spin_lock(&mc.lock);
        mc.from = NULL;
        mc.to = NULL;
-        mc.moving_task = NULL;
        spin_unlock(&mc.lock);
+        mc.moving_task = NULL;
+        mc.mm = NULL;
        mem_cgroup_end_move(from);
        memcg_oom_recover(from);
        memcg_oom_recover(to);
@@ -4724,12 +4736,21 @@ static int mem_cgroup_can_attach(struct cgroup_subsys *ss,
                        return 0;
                /* We move charges only when we move a owner of the mm */
                if (mm->owner == p) {
+                        /*
+                         * We do all the move charge works under one mmap_sem to
+                         * avoid deadlock with down_write(&mmap_sem)
+                         * -> try_charge() -> if (mc.moving_task) -> sleep.
+                         */
+                        down_read(&mm->mmap_sem);
                        VM_BUG_ON(mc.from);
                        VM_BUG_ON(mc.to);
                        VM_BUG_ON(mc.precharge);
                        VM_BUG_ON(mc.moved_charge);
                        VM_BUG_ON(mc.moved_swap);
                        VM_BUG_ON(mc.moving_task);
+                        VM_BUG_ON(mc.mm);
                        mem_cgroup_start_move(from);
                        spin_lock(&mc.lock);
                        mc.from = from;
@@ -4737,14 +4758,16 @@ static int mem_cgroup_can_attach(struct cgroup_subsys *ss,
                        mc.precharge = 0;
                        mc.moved_charge = 0;
                        mc.moved_swap = 0;
-                        mc.moving_task = current;
                        spin_unlock(&mc.lock);
+                        mc.moving_task = current;
+                        mc.mm = mm;
                        ret = mem_cgroup_precharge_mc(mm);
                        if (ret)
                                mem_cgroup_clear_mc();
-                }
+                        /* We call up_read() and mmput() in clear_mc(). */
-                mmput(mm);
+                } else
+                        mmput(mm);
        }
        return ret;
 }
@@ -4832,7 +4855,7 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
        struct vm_area_struct *vma;
        lru_add_drain_all();
-        down_read(&mm->mmap_sem);
+        /* We've already held the mmap_sem */
        for (vma = mm->mmap; vma; vma = vma->vm_next) {
                int ret;
                struct mm_walk mem_cgroup_move_charge_walk = {
@@ -4851,7 +4874,6 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
                         */
                        break;
        }
-        up_read(&mm->mmap_sem);
 }
 static void mem_cgroup_move_task(struct cgroup_subsys *ss,
@@ -4860,17 +4882,11 @@ static void mem_cgroup_move_task(struct cgroup_subsys *ss,
                                struct task_struct *p,
                                bool threadgroup)
 {
-        struct mm_struct *mm;
+        if (!mc.mm)
-        if (!mc.to)
                /* no need to move charge */
                return;
-        mm = get_task_mm(p);
+        mem_cgroup_move_charge(mc.mm);
-        if (mm) {
-                mem_cgroup_move_charge(mm);
-                mmput(mm);
-        }
        mem_cgroup_clear_mc();
 }
 #else   /* !CONFIG_MMU */
@@ -4911,10 +4927,20 @@ struct cgroup_subsys mem_cgroup_subsys = {
 };
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
+static int __init enable_swap_account(char *s)
+{
+        /* consider enabled if no parameter or 1 is given */
+        if (!s || !strcmp(s, "1"))
+                really_do_swap_account = 1;
+        else if (!strcmp(s, "0"))
+                really_do_swap_account = 0;
+        return 1;
+}
+__setup("swapaccount", enable_swap_account);
 static int __init disable_swap_account(char *s)
 {
-        really_do_swap_account = 0;
+        enable_swap_account("0");
        return 1;
 }
 __setup("noswapaccount", disable_swap_account);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 124324134ff6..46ab2c044b0e 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -51,6 +51,7 @@
 #include <linux/slab.h>
 #include <linux/swapops.h>
 #include <linux/hugetlb.h>
+#include <linux/memory_hotplug.h>
 #include "internal.h"
 int sysctl_memory_failure_early_kill __read_mostly = 0;
@@ -1230,11 +1231,10 @@ static int get_any_page(struct page *p, unsigned long pfn, int flags)
                return 1;
        /*
-         * The lock_system_sleep prevents a race with memory hotplug,
+         * The lock_memory_hotplug prevents a race with memory hotplug.
-         * because the isolation assumes there's only a single user.
         * This is a big hammer, a better would be nicer.
         */
-        lock_system_sleep();
+        lock_memory_hotplug();
        /*
         * Isolate the page, so that it doesn't get reallocated if it
@@ -1264,7 +1264,7 @@ static int get_any_page(struct page *p, unsigned long pfn, int flags)
                ret = 1;
        }
        unset_migratetype_isolate(p);
-        unlock_system_sleep();
+        unlock_memory_hotplug();
        return ret;
 }
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9260314a221e..2c6523af5473 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -34,6 +34,23 @@
 #include "internal.h"
+DEFINE_MUTEX(mem_hotplug_mutex);
+void lock_memory_hotplug(void)
+{
+        mutex_lock(&mem_hotplug_mutex);
+        /* for exclusive hibernation if CONFIG_HIBERNATION=y */
+        lock_system_sleep();
+}
+void unlock_memory_hotplug(void)
+{
+        unlock_system_sleep();
+        mutex_unlock(&mem_hotplug_mutex);
+}
 /* add this memory to iomem resource */
 static struct resource *register_memory_resource(u64 start, u64 size)
 {
@@ -493,7 +510,7 @@ int mem_online_node(int nid)
        pg_data_t       *pgdat;
        int     ret;
-        lock_system_sleep();
+        lock_memory_hotplug();
        pgdat = hotadd_new_pgdat(nid, 0);
        if (pgdat) {
                ret = -ENOMEM;
@@ -504,7 +521,7 @@ int mem_online_node(int nid)
        BUG_ON(ret);
 out:
-        unlock_system_sleep();
+        unlock_memory_hotplug();
        return ret;
 }
@@ -516,7 +533,7 @@ int __ref add_memory(int nid, u64 start, u64 size)
        struct resource *res;
        int ret;
-        lock_system_sleep();
+        lock_memory_hotplug();
        res = register_memory_resource(start, size);
        ret = -EEXIST;
@@ -563,7 +580,7 @@ error:
                release_memory_resource(res);
 out:
-        unlock_system_sleep();
+        unlock_memory_hotplug();
        return ret;
 }
 EXPORT_SYMBOL_GPL(add_memory);
@@ -791,7 +808,7 @@ static int offline_pages(unsigned long start_pfn,
        if (!test_pages_in_a_zone(start_pfn, end_pfn))
                return -EINVAL;
-        lock_system_sleep();
+        lock_memory_hotplug();
        zone = page_zone(pfn_to_page(start_pfn));
        node = zone_to_nid(zone);
@@ -880,7 +897,7 @@ repeat:
        writeback_set_ratelimit();
        memory_notify(MEM_OFFLINE, &arg);
-        unlock_system_sleep();
+        unlock_memory_hotplug();
        return 0;
 failed_removal:
@@ -891,7 +908,7 @@ failed_removal:
        undo_isolate_page_range(start_pfn, end_pfn);
 out:
-        unlock_system_sleep();
+        unlock_memory_hotplug();
        return ret;
 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 4a57f135b76e..11ff260fb282 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1307,15 +1307,18 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
                goto out;
        /* Find the mm_struct */
+        rcu_read_lock();
        read_lock(&tasklist_lock);
        task = pid ? find_task_by_vpid(pid) : current;
        if (!task) {
                read_unlock(&tasklist_lock);
+                rcu_read_unlock();
                err = -ESRCH;
                goto out;
        }
        mm = get_task_mm(task);
        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
        err = -EINVAL;
        if (!mm)
diff --git a/mm/nommu.c b/mm/nommu.c
index 3613517c7592..27a9ac588516 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1717,6 +1717,7 @@ void exit_mmap(struct mm_struct *mm)
                mm->mmap = vma->vm_next;
                delete_vma_from_mm(vma);
                delete_vma(mm, vma);
+                cond_resched();
        }
        kleave("");
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 07a654486f75..ff7e15872398 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -104,19 +104,24 @@ gfp_t gfp_allowed_mask __read_mostly = GFP_BOOT_MASK;
 * only be modified with pm_mutex held, unless the suspend/hibernate code is
 * guaranteed not to run in parallel with that modification).
 */
-void set_gfp_allowed_mask(gfp_t mask)
+static gfp_t saved_gfp_mask;
+void pm_restore_gfp_mask(void)
 {
        WARN_ON(!mutex_is_locked(&pm_mutex));
-        gfp_allowed_mask = mask;
+        if (saved_gfp_mask) {
+                gfp_allowed_mask = saved_gfp_mask;
+                saved_gfp_mask = 0;
+        }
 }
-gfp_t clear_gfp_allowed_mask(gfp_t mask)
+void pm_restrict_gfp_mask(void)
 {
-        gfp_t ret = gfp_allowed_mask;
        WARN_ON(!mutex_is_locked(&pm_mutex));
-        gfp_allowed_mask &= ~mask;
+        WARN_ON(saved_gfp_mask);
-        return ret;
+        saved_gfp_mask = gfp_allowed_mask;
+        gfp_allowed_mask &= ~GFP_IOFS;
 }
 #endif /* CONFIG_PM_SLEEP */
@@ -3008,14 +3013,6 @@ static __init_refok int __build_all_zonelists(void *data)
                build_zonelist_cache(pgdat);
        }
-#ifdef CONFIG_MEMORY_HOTPLUG
-        /* Setup real pagesets for the new zone */
-        if (data) {
-                struct zone *zone = data;
-                setup_zone_pageset(zone);
-        }
-#endif
        /*
         * Initialize the boot_pagesets that are going to be used
         * for bootstrapping processors. The real pagesets for
@@ -3064,7 +3061,11 @@ void build_all_zonelists(void *data)
        } else {
                /* we have to stop all cpus to guarantee there is no user
                   of zonelist */
-                stop_machine(__build_all_zonelists, data, NULL);
+#ifdef CONFIG_MEMORY_HOTPLUG
+                if (data)
+                        setup_zone_pageset((struct zone *)data);
+#endif
+                stop_machine(__build_all_zonelists, NULL, NULL);
                /* cpuset refresh routine should be here */
        }
        vm_total_pages = nr_free_pagecache_pages();
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 8b1a2ce21ee5..38cc58b8b2b0 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -139,7 +139,6 @@ int walk_page_range(unsigned long addr, unsigned long end,
        pgd_t *pgd;
        unsigned long next;
        int err = 0;
-        struct vm_area_struct *vma;
        if (addr >= end)
                return err;
@@ -149,15 +148,17 @@ int walk_page_range(unsigned long addr, unsigned long end,
        pgd = pgd_offset(walk->mm, addr);
        do {
+                struct vm_area_struct *uninitialized_var(vma);
                next = pgd_addr_end(addr, end);
+#ifdef CONFIG_HUGETLB_PAGE
                /*
                 * handle hugetlb vma individually because pagetable walk for
                 * the hugetlb page is dependent on the architecture and
                 * we can't handled it in the same manner as non-huge pages.
                 */
                vma = find_vma(walk->mm, addr);
-#ifdef CONFIG_HUGETLB_PAGE
                if (vma && is_vm_hugetlb_page(vma)) {
                        if (vma->vm_end < next)
                                next = vma->vm_end;
diff --git a/mm/slub.c b/mm/slub.c
index 981fb730aa04..bec0e355fbad 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3401,13 +3401,13 @@ static int validate_slab(struct kmem_cache *s, struct page *page,
        for_each_free_object(p, s, page->freelist) {
                set_bit(slab_index(p, s, addr), map);
-                if (!check_object(s, page, p, 0))
+                if (!check_object(s, page, p, SLUB_RED_INACTIVE))
                        return 0;
        }
        for_each_object(p, s, addr, page->objects)
                if (!test_bit(slab_index(p, s, addr), map))
-                        if (!check_object(s, page, p, 1))
+                        if (!check_object(s, page, p, SLUB_RED_ACTIVE))
                                return 0;
        return 1;
 }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index a3d66b3dc5cb..eb5cc7d00c5a 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -31,8 +31,6 @@
 #include <asm/tlbflush.h>
 #include <asm/shmparam.h>
-bool vmap_lazy_unmap __read_mostly = true;
 /*** Page table manipulation functions ***/
 static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -503,9 +501,6 @@ static unsigned long lazy_max_pages(void)
 {
        unsigned int log;
-        if (!vmap_lazy_unmap)
-                return 0;
        log = fls(num_online_cpus());
        return log * (32UL * 1024 * 1024 / PAGE_SIZE);
@@ -566,7 +561,6 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
                        if (va->va_end > *end)
                                *end = va->va_end;
                        nr += (va->va_end - va->va_start) >> PAGE_SHIFT;
-                        unmap_vmap_area(va);
                        list_add_tail(&va->purge_list, &valist);
                        va->flags |= VM_LAZY_FREEING;
                        va->flags &= ~VM_LAZY_FREE;
@@ -611,10 +605,11 @@ static void purge_vmap_area_lazy(void)
 }
 /*
- * Free and unmap a vmap area, caller ensuring flush_cache_vunmap had been
+ * Free a vmap area, caller ensuring that the area has been unmapped
- * called for the correct range previously.
+ * and flush_cache_vunmap had been called for the correct range
+ * previously.
 */
-static void free_unmap_vmap_area_noflush(struct vmap_area *va)
+static void free_vmap_area_noflush(struct vmap_area *va)
 {
        va->flags |= VM_LAZY_FREE;
        atomic_add((va->va_end - va->va_start) >> PAGE_SHIFT, &vmap_lazy_nr);
@@ -623,6 +618,16 @@ static void free_unmap_vmap_area_noflush(struct vmap_area *va)
 }
 /*
+ * Free and unmap a vmap area, caller ensuring flush_cache_vunmap had been
+ * called for the correct range previously.
+ */
+static void free_unmap_vmap_area_noflush(struct vmap_area *va)
+{
+        unmap_vmap_area(va);
+        free_vmap_area_noflush(va);
+}
+/*
 * Free and unmap a vmap area
 */
 static void free_unmap_vmap_area(struct vmap_area *va)
@@ -798,7 +803,7 @@ static void free_vmap_block(struct vmap_block *vb)
        spin_unlock(&vmap_block_tree_lock);
        BUG_ON(tmp != vb);
-        free_unmap_vmap_area_noflush(vb->va);
+        free_vmap_area_noflush(vb->va);
        call_rcu(&vb->rcu_head, rcu_free_vb);
 }
@@ -936,6 +941,8 @@ static void vb_free(const void *addr, unsigned long size)
        rcu_read_unlock();
        BUG_ON(!vb);
+        vunmap_page_range((unsigned long)addr, (unsigned long)addr + size);
        spin_lock(&vb->lock);
        BUG_ON(bitmap_allocate_region(vb->dirty_map, offset >> PAGE_SHIFT, order));
@@ -988,7 +995,6 @@ void vm_unmap_aliases(void)
                                s = vb->va->va_start + (i << PAGE_SHIFT);
                                e = vb->va->va_start + (j << PAGE_SHIFT);
-                                vunmap_page_range(s, e);
                                flush = 1;
                                if (s < start)
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 42eac4d33216..8f62f17ee1c7 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -750,8 +750,6 @@ static const char * const vmstat_text[] = {
        "nr_shmem",
        "nr_dirtied",
        "nr_written",
-        "nr_dirty_threshold",
-        "nr_dirty_background_threshold",
 #ifdef CONFIG_NUMA
        "numa_hit",
@@ -761,6 +759,8 @@ static const char * const vmstat_text[] = {
        "numa_local",
        "numa_other",
 #endif
+        "nr_dirty_threshold",
+        "nr_dirty_background_threshold",
 #ifdef CONFIG_VM_EVENT_COUNTERS
        "pgpgin",
diff --git a/net/ceph/Makefile b/net/ceph/Makefile
index aab1cabb8035..5f19415ec9c0 100644
--- a/net/ceph/Makefile
+++ b/net/ceph/Makefile
@@ -1,9 +1,6 @@
 #
 # Makefile for CEPH filesystem.
 #
-ifneq ($(KERNELRELEASE),)
 obj-$(CONFIG_CEPH_LIB) += libceph.o
 libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
@@ -16,22 +13,3 @@ libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
        ceph_fs.o ceph_strings.o ceph_hash.o \
        pagevec.o
-else
-#Otherwise we were called directly from the command
-# line; invoke the kernel build system.
-KERNELDIR ?= /lib/modules/$(shell uname -r)/build
-PWD := $(shell pwd)
-default: all
-all:
-        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules
-modules_install:
-        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules_install
-clean:
-        $(MAKE) -C $(KERNELDIR) M=$(PWD) clean
-endif
diff --git a/net/ceph/buffer.c b/net/ceph/buffer.c
index 53d8abfa25d5..bf3e6a13c215 100644
--- a/net/ceph/buffer.c
+++ b/net/ceph/buffer.c
@@ -19,7 +19,7 @@ struct ceph_buffer *ceph_buffer_new(size_t len, gfp_t gfp)
        if (b->vec.iov_base) {
                b->is_vmalloc = false;
        } else {
-                b->vec.iov_base = __vmalloc(len, gfp, PAGE_KERNEL);
+                b->vec.iov_base = __vmalloc(len, gfp | __GFP_HIGHMEM, PAGE_KERNEL);
                if (!b->vec.iov_base) {
                        kfree(b);
                        return NULL;
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 7552495aff7a..fceeb37d7161 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -45,9 +45,7 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
        nr_table_entries = roundup_pow_of_two(nr_table_entries + 1);
        lopt_size += nr_table_entries * sizeof(struct request_sock *);
        if (lopt_size > PAGE_SIZE)
-                lopt = __vmalloc(lopt_size,
+                lopt = vzalloc(lopt_size);
-                        GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
-                        PAGE_KERNEL);
        else
                lopt = kzalloc(lopt_size, GFP_KERNEL);
        if (lopt == NULL)
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 265985370fa1..e424a09e83f6 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -239,7 +239,8 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
                dccp_update_gsr(sk, seqno);
                if (dh->dccph_type != DCCP_PKT_SYNC &&
-                    (ackno != DCCP_PKT_WITHOUT_ACK_SEQ))
+                    ackno != DCCP_PKT_WITHOUT_ACK_SEQ &&
+                    after48(ackno, dp->dccps_gar))
                        dp->dccps_gar = ackno;
        } else {
                unsigned long now = jiffies;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index a76b78de679f..6f97268ed85f 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1556,6 +1556,8 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                        if (r_len > sizeof(struct linkinfo_dn))
                                r_len = sizeof(struct linkinfo_dn);
+                        memset(&link, 0, sizeof(link));
                        switch(sock->state) {
                                case SS_CONNECTING:
                                        link.idn_linkstate = LL_CONNECTING;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index f8c1ae4b41f0..13992e1d2726 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -31,6 +31,7 @@
 #include <linux/skbuff.h>
 #include <linux/udp.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <net/sock.h>
 #include <net/inet_common.h>
 #include <linux/stat.h>
@@ -276,12 +277,12 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 #endif
 #ifdef CONFIG_ECONET_AUNUDP
        struct msghdr udpmsg;
-        struct iovec iov[msg->msg_iovlen+1];
+        struct iovec iov[2];
        struct aunhdr ah;
        struct sockaddr_in udpdest;
        __kernel_size_t size;
-        int i;
        mm_segment_t oldfs;
+        char *userbuf;
 #endif
        /*
@@ -297,23 +298,14 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
        mutex_lock(&econet_mutex);
-        if (saddr == NULL) {
+        if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
-                struct econet_sock *eo = ec_sk(sk);
+                mutex_unlock(&econet_mutex);
+                return -EINVAL;
-                addr.station = eo->station;
+        }
-                addr.net     = eo->net;
+        addr.station = saddr->addr.station;
-                port         = eo->port;
+        addr.net = saddr->addr.net;
-                cb           = eo->cb;
+        port = saddr->port;
-        } else {
+        cb = saddr->cb;
-                if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {
-                        mutex_unlock(&econet_mutex);
-                        return -EINVAL;
-                }
-                addr.station = saddr->addr.station;
-                addr.net = saddr->addr.net;
-                port = saddr->port;
-                cb = saddr->cb;
-        }
        /* Look for a device with the right network number. */
        dev = net2dev_map[addr.net];
@@ -328,17 +320,17 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                }
        }
-        if (len + 15 > dev->mtu) {
-                mutex_unlock(&econet_mutex);
-                return -EMSGSIZE;
-        }
        if (dev->type == ARPHRD_ECONET) {
                /* Real hardware Econet.  We're not worthy etc. */
 #ifdef CONFIG_ECONET_NATIVE
                unsigned short proto = 0;
                int res;
+                if (len + 15 > dev->mtu) {
+                        mutex_unlock(&econet_mutex);
+                        return -EMSGSIZE;
+                }
                dev_hold(dev);
                skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev),
@@ -351,7 +343,6 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                eb = (struct ec_cb *)&skb->cb;
-                /* BUG: saddr may be NULL */
                eb->cookie = saddr->cookie;
                eb->sec = *saddr;
                eb->sent = ec_tx_done;
@@ -415,6 +406,11 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                return -ENETDOWN;               /* No socket - can't send */
        }
+        if (len > 32768) {
+                err = -E2BIG;
+                goto error;
+        }
        /* Make up a UDP datagram and hand it off to some higher intellect. */
        memset(&udpdest, 0, sizeof(udpdest));
@@ -446,36 +442,26 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
        /* tack our header on the front of the iovec */
        size = sizeof(struct aunhdr);
-        /*
-         * XXX: that is b0rken.  We can't mix userland and kernel pointers
-         * in iovec, since on a lot of platforms copy_from_user() will
-         * *not* work with the kernel and userland ones at the same time,
-         * regardless of what we do with set_fs().  And we are talking about
-         * econet-over-ethernet here, so "it's only ARM anyway" doesn't
-         * apply.  Any suggestions on fixing that code?         -- AV
-         */
        iov[0].iov_base = (void *)&ah;
        iov[0].iov_len = size;
-        for (i = 0; i < msg->msg_iovlen; i++) {
-                void __user *base = msg->msg_iov[i].iov_base;
+        userbuf = vmalloc(len);
-                size_t iov_len = msg->msg_iov[i].iov_len;
+        if (userbuf == NULL) {
-                /* Check it now since we switch to KERNEL_DS later. */
+                err = -ENOMEM;
-                if (!access_ok(VERIFY_READ, base, iov_len)) {
+                goto error;
-                        mutex_unlock(&econet_mutex);
-                        return -EFAULT;
-                }
-                iov[i+1].iov_base = base;
-                iov[i+1].iov_len = iov_len;
-                size += iov_len;
        }
+        iov[1].iov_base = userbuf;
+        iov[1].iov_len = len;
+        err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
+        if (err)
+                goto error_free_buf;
        /* Get a skbuff (no data, just holds our cb information) */
        if ((skb = sock_alloc_send_skb(sk, 0,
                                       msg->msg_flags & MSG_DONTWAIT,
-                                       &err)) == NULL) {
+                                       &err)) == NULL)
-                mutex_unlock(&econet_mutex);
+                goto error_free_buf;
-                return err;
-        }
        eb = (struct ec_cb *)&skb->cb;
@@ -491,7 +477,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
        udpmsg.msg_name = (void *)&udpdest;
        udpmsg.msg_namelen = sizeof(udpdest);
        udpmsg.msg_iov = &iov[0];
-        udpmsg.msg_iovlen = msg->msg_iovlen + 1;
+        udpmsg.msg_iovlen = 2;
        udpmsg.msg_control = NULL;
        udpmsg.msg_controllen = 0;
        udpmsg.msg_flags=0;
@@ -499,9 +485,13 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
        oldfs = get_fs(); set_fs(KERNEL_DS);    /* More privs :-) */
        err = sock_sendmsg(udpsock, &udpmsg, size);
        set_fs(oldfs);
+error_free_buf:
+        vfree(userbuf);
 #else
        err = -EPROTOTYPE;
 #endif
+        error:
        mutex_unlock(&econet_mutex);
        return err;
@@ -671,6 +661,9 @@ static int ec_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
        err = 0;
        switch (cmd) {
        case SIOCSIFADDR:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
                edev = dev->ec_ptr;
                if (edev == NULL) {
                        /* Magic up a new one. */
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 200eb538fbb3..0f280348e0fd 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -365,7 +365,7 @@ static struct tnode *tnode_alloc(size_t size)
        if (size <= PAGE_SIZE)
                return kzalloc(size, GFP_KERNEL);
        else
-                return __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+                return vzalloc(size);
 }
 static void __tnode_vfree(struct work_struct *arg)
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 1b344f30b463..3c0369a3a663 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -133,8 +133,7 @@ int __inet_inherit_port(struct sock *sk, struct sock *child)
                        }
                }
        }
-        sk_add_bind_node(child, &tb->owners);
+        inet_bind_hash(child, tb, port);
-        inet_csk(child)->icsk_bind_hash = tb;
        spin_unlock(&head->lock);
        return 0;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index e91911d7aae2..1b4ec21497a4 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -26,6 +26,8 @@ static int zero;
 static int tcp_retr1_max = 255;
 static int ip_local_port_range_min[] = { 1, 1 };
 static int ip_local_port_range_max[] = { 65535, 65535 };
+static int tcp_adv_win_scale_min = -31;
+static int tcp_adv_win_scale_max = 31;
 /* Update system visible IP port range */
 static void set_local_port_range(int range[2])
@@ -426,7 +428,9 @@ static struct ctl_table ipv4_table[] = {
                .data           = &sysctl_tcp_adv_win_scale,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_adv_win_scale_min,
+                .extra2         = &tcp_adv_win_scale_max,
        },
        {
                .procname       = "tcp_tw_reuse",
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 081419969485..f15c36a706ec 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                /* Values greater than interface MTU won't take effect. However
                 * at the point when this call is done we typically don't yet
                 * know which interface is going to be used */
-                if (val < 64 || val > MAX_TCP_WINDOW) {
+                if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
                        err = -EINVAL;
                        break;
                }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 69ccbc1dde9c..e13da6de1fc7 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2043,7 +2043,9 @@ get_req:
        }
 get_sk:
        sk_nulls_for_each_from(sk, node) {
-                if (sk->sk_family == st->family && net_eq(sock_net(sk), net)) {
+                if (!net_eq(sock_net(sk), net))
+                        continue;
+                if (sk->sk_family == st->family) {
                        cur = sk;
                        goto out;
                }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2fc35b32df9e..23cc8e1ce8d4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2758,13 +2758,13 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                        ifa->state = INET6_IFADDR_STATE_DEAD;
                        spin_unlock_bh(&ifa->state_lock);
-                        if (state == INET6_IFADDR_STATE_DEAD) {
+                        if (state != INET6_IFADDR_STATE_DEAD) {
-                                in6_ifa_put(ifa);
-                        } else {
                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
                                atomic_notifier_call_chain(&inet6addr_chain,
                                                           NETDEV_DOWN, ifa);
                        }
+                        in6_ifa_put(ifa);
                        write_lock_bh(&idev->lock);
                }
        }
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 4d6f8653ec88..8e8ea9cb7093 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -92,7 +92,7 @@ config MAC80211_MESH
 config MAC80211_LEDS
        bool "Enable LED triggers"
        depends on MAC80211
-        select NEW_LEDS
+        depends on LEDS_CLASS
        select LEDS_TRIGGERS
        ---help---
          This option enables a few LED triggers for different
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 9dab9573be41..92ce94f5146b 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -989,20 +989,26 @@ call_refreshresult(struct rpc_task *task)
        dprint_status(task);
        task->tk_status = 0;
-        task->tk_action = call_allocate;
+        task->tk_action = call_refresh;
-        if (status >= 0 && rpcauth_uptodatecred(task))
-                return;
        switch (status) {
-        case -EACCES:
+        case 0:
-                rpc_exit(task, -EACCES);
+                if (rpcauth_uptodatecred(task))
-                return;
+                        task->tk_action = call_allocate;
-        case -ENOMEM:
-                rpc_exit(task, -ENOMEM);
                return;
        case -ETIMEDOUT:
                rpc_delay(task, 3*HZ);
+        case -EAGAIN:
+                status = -EACCES;
+                if (!task->tk_cred_retry)
+                        break;
+                task->tk_cred_retry--;
+                dprintk("RPC: %5u %s: retry refresh creds\n",
+                                task->tk_pid, __func__);
+                return;
        }
-        task->tk_action = call_refresh;
+        dprintk("RPC: %5u %s: refresh creds failed with error %d\n",
+                                task->tk_pid, __func__, status);
+        rpc_exit(task, status);
 }
 /*
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 3c95304a0817..2268e6798124 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1343,9 +1343,25 @@ static void unix_destruct_scm(struct sk_buff *skb)
        sock_wfree(skb);
 }
+#define MAX_RECURSION_LEVEL 4
 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
        int i;
+        unsigned char max_level = 0;
+        int unix_sock_count = 0;
+        for (i = scm->fp->count - 1; i >= 0; i--) {
+                struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+                if (sk) {
+                        unix_sock_count++;
+                        max_level = max(max_level,
+                                        unix_sk(sk)->recursion_level);
+                }
+        }
+        if (unlikely(max_level > MAX_RECURSION_LEVEL))
+                return -ETOOMANYREFS;
        /*
         * Need to duplicate file references for the sake of garbage
@@ -1356,9 +1372,11 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
        if (!UNIXCB(skb).fp)
                return -ENOMEM;
-        for (i = scm->fp->count-1; i >= 0; i--)
+        if (unix_sock_count) {
-                unix_inflight(scm->fp->fp[i]);
+                for (i = scm->fp->count - 1; i >= 0; i--)
-        return 0;
+                        unix_inflight(scm->fp->fp[i]);
+        }
+        return max_level;
 }
 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
@@ -1393,6 +1411,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
        struct sk_buff *skb;
        long timeo;
        struct scm_cookie tmp_scm;
+        int max_level;
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
@@ -1431,8 +1450,9 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                goto out;
        err = unix_scm_to_skb(siocb->scm, skb, true);
-        if (err)
+        if (err < 0)
                goto out_free;
+        max_level = err + 1;
        unix_get_secdata(siocb->scm, skb);
        skb_reset_transport_header(skb);
@@ -1514,6 +1534,8 @@ restart:
        if (sock_flag(other, SOCK_RCVTSTAMP))
                __net_timestamp(skb);
        skb_queue_tail(&other->sk_receive_queue, skb);
+        if (max_level > unix_sk(other)->recursion_level)
+                unix_sk(other)->recursion_level = max_level;
        unix_state_unlock(other);
        other->sk_data_ready(other, len);
        sock_put(other);
@@ -1544,6 +1566,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
        int sent = 0;
        struct scm_cookie tmp_scm;
        bool fds_sent = false;
+        int max_level;
        if (NULL == siocb->scm)
                siocb->scm = &tmp_scm;
@@ -1607,10 +1630,11 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                /* Only send the fds in the first buffer */
                err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
-                if (err) {
+                if (err < 0) {
                        kfree_skb(skb);
                        goto out_err;
                }
+                max_level = err + 1;
                fds_sent = true;
                err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
@@ -1626,6 +1650,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                        goto pipe_err_free;
                skb_queue_tail(&other->sk_receive_queue, skb);
+                if (max_level > unix_sk(other)->recursion_level)
+                        unix_sk(other)->recursion_level = max_level;
                unix_state_unlock(other);
                other->sk_data_ready(other, size);
                sent += size;
@@ -1845,6 +1871,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                unix_state_lock(sk);
                skb = skb_dequeue(&sk->sk_receive_queue);
                if (skb == NULL) {
+                        unix_sk(sk)->recursion_level = 0;
                        if (copied >= target)
                                goto unlock;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index c8df6fda0b1f..f89f83bf828e 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 unsigned int unix_tot_inflight;
-static struct sock *unix_get_socket(struct file *filp)
+struct sock *unix_get_socket(struct file *filp)
 {
        struct sock *u_sock = NULL;
        struct inode *inode = filp->f_path.dentry->d_inode;
@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
 }
 static bool gc_in_progress = false;
+#define UNIX_INFLIGHT_TRIGGER_GC 16000
 void wait_for_unix_gc(void)
 {
+        /*
+         * If number of inflight sockets is insane,
+         * force a garbage collect right now.
+         */
+        if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
+                unix_gc();
        wait_event(unix_gc_wait, gc_in_progress == false);
 }
diff --git a/net/xfrm/xfrm_hash.c b/net/xfrm/xfrm_hash.c
index a2023ec52329..1e98bc0fe0a5 100644
--- a/net/xfrm/xfrm_hash.c
+++ b/net/xfrm/xfrm_hash.c
@@ -19,7 +19,7 @@ struct hlist_head *xfrm_hash_alloc(unsigned int sz)
        if (sz <= PAGE_SIZE)
                n = kzalloc(sz, GFP_KERNEL);
        else if (hashdist)
-                n = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+                n = vzalloc(sz);
        else
                n = (struct hlist_head *)
                        __get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,
diff --git a/scripts/gfp-translate b/scripts/gfp-translate
index d81b968d864e..c9230e158a8f 100644
--- a/scripts/gfp-translate
+++ b/scripts/gfp-translate
@@ -63,7 +63,12 @@ fi
 # Extract GFP flags from the kernel source
 TMPFILE=`mktemp -t gfptranslate-XXXXXX` || exit 1
-grep "^#define __GFP" $SOURCE/include/linux/gfp.h | sed -e 's/(__force gfp_t)//' | sed -e 's/u)/)/' | grep -v GFP_BITS | sed -e 's/)\//) \//' > $TMPFILE
+grep -q ___GFP $SOURCE/include/linux/gfp.h
+if [ $? -eq 0 ]; then
+        grep "^#define ___GFP" $SOURCE/include/linux/gfp.h | sed -e 's/u$//' | grep -v GFP_BITS > $TMPFILE
+else
+        grep "^#define __GFP" $SOURCE/include/linux/gfp.h | sed -e 's/(__force gfp_t)//' | sed -e 's/u)/)/' | grep -v GFP_BITS | sed -e 's/)\//) \//' > $TMPFILE
+fi
 # Parse the flags
 IFS="
diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
index 184eb6a0b505..e57826ced380 100644
--- a/scripts/kconfig/expr.h
+++ b/scripts/kconfig/expr.h
@@ -164,6 +164,7 @@ struct menu {
        struct menu *list;
        struct symbol *sym;
        struct property *prompt;
+        struct expr *visibility;
        struct expr *dep;
        unsigned int flags;
        char *help;
diff --git a/scripts/kconfig/lkc.h b/scripts/kconfig/lkc.h
index 753cdbd7b805..3f7240df0f3b 100644
--- a/scripts/kconfig/lkc.h
+++ b/scripts/kconfig/lkc.h
@@ -107,6 +107,7 @@ void menu_end_menu(void);
 void menu_add_entry(struct symbol *sym);
 void menu_end_entry(void);
 void menu_add_dep(struct expr *dep);
+void menu_add_visibility(struct expr *dep);
 struct property *menu_add_prop(enum prop_type type, char *prompt, struct expr *expr, struct expr *dep);
 struct property *menu_add_prompt(enum prop_type type, char *prompt, struct expr *dep);
 void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep);
diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 7e83aef42c6d..b9d9aa18e6d6 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -152,6 +152,12 @@ struct property *menu_add_prompt(enum prop_type type, char *prompt, struct expr
        return menu_add_prop(type, prompt, NULL, dep);
 }
+void menu_add_visibility(struct expr *expr)
+{
+        current_entry->visibility = expr_alloc_and(current_entry->visibility,
+            expr);
+}
 void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep)
 {
        menu_add_prop(type, NULL, expr, dep);
@@ -410,6 +416,11 @@ bool menu_is_visible(struct menu *menu)
        if (!menu->prompt)
                return false;
+        if (menu->visibility) {
+                if (expr_calc_value(menu->visibility) == no)
+                        return no;
+        }
        sym = menu->sym;
        if (sym) {
                sym_calc_value(sym);
diff --git a/scripts/kconfig/zconf.gperf b/scripts/kconfig/zconf.gperf
index d8bc74249622..c9e690eb7545 100644
--- a/scripts/kconfig/zconf.gperf
+++ b/scripts/kconfig/zconf.gperf
@@ -38,6 +38,7 @@ hex,		T_TYPE,		TF_COMMAND, S_HEX
 string,         T_TYPE,         TF_COMMAND, S_STRING
 select,         T_SELECT,       TF_COMMAND
 range,          T_RANGE,        TF_COMMAND
+visible,        T_VISIBLE,      TF_COMMAND
 option,         T_OPTION,       TF_COMMAND
 on,             T_ON,           TF_PARAM
 modules,        T_OPT_MODULES,  TF_OPTION
diff --git a/scripts/kconfig/zconf.hash.c_shipped b/scripts/kconfig/zconf.hash.c_shipped
index c1748faf4634..4055d5de1750 100644
--- a/scripts/kconfig/zconf.hash.c_shipped
+++ b/scripts/kconfig/zconf.hash.c_shipped
@@ -32,7 +32,7 @@
 struct kconf_id;
 static struct kconf_id *kconf_id_lookup(register const char *str, register unsigned int len);
-/* maximum key range = 47, duplicates = 0 */
+/* maximum key range = 50, duplicates = 0 */
 #ifdef __GNUC__
 __inline
@@ -46,32 +46,32 @@ kconf_id_hash (register const char *str, register unsigned int len)
 {
  static unsigned char asso_values[] =
    {
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 11,  5,
+      52, 52, 52, 52, 52, 52, 52, 52, 40,  5,
-       0,  0,  5, 49,  5, 20, 49, 49,  5, 20,
+       0,  0,  5, 52,  0, 20, 52, 52, 10, 20,
-       5,  0, 30, 49,  0, 15,  0, 10,  0, 49,
+       5,  0, 35, 52,  0, 30,  0, 15,  0, 52,
-      25, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      15, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49, 49, 49, 49, 49,
+      52, 52, 52, 52, 52, 52, 52, 52, 52, 52,
-      49, 49, 49, 49, 49, 49
+      52, 52, 52, 52, 52, 52
    };
  register int hval = len;
@@ -102,25 +102,26 @@ struct kconf_id_strings_t
    char kconf_id_strings_str12[sizeof("default")];
    char kconf_id_strings_str13[sizeof("def_bool")];
    char kconf_id_strings_str14[sizeof("help")];
-    char kconf_id_strings_str15[sizeof("bool")];
    char kconf_id_strings_str16[sizeof("config")];
    char kconf_id_strings_str17[sizeof("def_tristate")];
-    char kconf_id_strings_str18[sizeof("boolean")];
+    char kconf_id_strings_str18[sizeof("hex")];
    char kconf_id_strings_str19[sizeof("defconfig_list")];
-    char kconf_id_strings_str21[sizeof("string")];
    char kconf_id_strings_str22[sizeof("if")];
    char kconf_id_strings_str23[sizeof("int")];
-    char kconf_id_strings_str26[sizeof("select")];
    char kconf_id_strings_str27[sizeof("modules")];
    char kconf_id_strings_str28[sizeof("tristate")];
    char kconf_id_strings_str29[sizeof("menu")];
-    char kconf_id_strings_str31[sizeof("source")];
    char kconf_id_strings_str32[sizeof("comment")];
-    char kconf_id_strings_str33[sizeof("hex")];
    char kconf_id_strings_str35[sizeof("menuconfig")];
-    char kconf_id_strings_str36[sizeof("prompt")];
+    char kconf_id_strings_str36[sizeof("string")];
-    char kconf_id_strings_str37[sizeof("depends")];
+    char kconf_id_strings_str37[sizeof("visible")];
+    char kconf_id_strings_str41[sizeof("prompt")];
+    char kconf_id_strings_str42[sizeof("depends")];
+    char kconf_id_strings_str44[sizeof("bool")];
+    char kconf_id_strings_str46[sizeof("select")];
+    char kconf_id_strings_str47[sizeof("boolean")];
    char kconf_id_strings_str48[sizeof("mainmenu")];
+    char kconf_id_strings_str51[sizeof("source")];
  };
 static struct kconf_id_strings_t kconf_id_strings_contents =
  {
@@ -136,25 +137,26 @@ static struct kconf_id_strings_t kconf_id_strings_contents =
    "default",
    "def_bool",
    "help",
-    "bool",
    "config",
    "def_tristate",
-    "boolean",
+    "hex",
    "defconfig_list",
-    "string",
    "if",
    "int",
-    "select",
    "modules",
    "tristate",
    "menu",
-    "source",
    "comment",
-    "hex",
    "menuconfig",
+    "string",
+    "visible",
    "prompt",
    "depends",
-    "mainmenu"
+    "bool",
+    "select",
+    "boolean",
+    "mainmenu",
+    "source"
  };
 #define kconf_id_strings ((const char *) &kconf_id_strings_contents)
 #ifdef __GNUC__
@@ -168,11 +170,11 @@ kconf_id_lookup (register const char *str, register unsigned int len)
 {
  enum
    {
-      TOTAL_KEYWORDS = 31,
+      TOTAL_KEYWORDS = 32,
      MIN_WORD_LENGTH = 2,
      MAX_WORD_LENGTH = 14,
      MIN_HASH_VALUE = 2,
-      MAX_HASH_VALUE = 48
+      MAX_HASH_VALUE = 51
    };
  static struct kconf_id wordlist[] =
@@ -191,31 +193,35 @@ kconf_id_lookup (register const char *str, register unsigned int len)
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str12,    T_DEFAULT,      TF_COMMAND, S_UNKNOWN},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str13,    T_DEFAULT,      TF_COMMAND, S_BOOLEAN},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str14,            T_HELP,         TF_COMMAND},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str15,            T_TYPE,         TF_COMMAND, S_BOOLEAN},
+      {-1},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str16,            T_CONFIG,       TF_COMMAND},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str17,    T_DEFAULT,      TF_COMMAND, S_TRISTATE},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str18,    T_TYPE,         TF_COMMAND, S_BOOLEAN},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str18,            T_TYPE,         TF_COMMAND, S_HEX},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str19,    T_OPT_DEFCONFIG_LIST,TF_OPTION},
-      {-1},
+      {-1}, {-1},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str21,            T_TYPE,         TF_COMMAND, S_STRING},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str22,            T_IF,           TF_COMMAND|TF_PARAM},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str23,            T_TYPE,         TF_COMMAND, S_INT},
-      {-1}, {-1},
+      {-1}, {-1}, {-1},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str26,            T_SELECT,       TF_COMMAND},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str27,    T_OPT_MODULES,  TF_OPTION},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str28,    T_TYPE,         TF_COMMAND, S_TRISTATE},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str29,            T_MENU,         TF_COMMAND},
-      {-1},
+      {-1}, {-1},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str31,            T_SOURCE,       TF_COMMAND},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str32,    T_COMMENT,      TF_COMMAND},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str33,            T_TYPE,         TF_COMMAND, S_HEX},
+      {-1}, {-1},
-      {-1},
      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str35,    T_MENUCONFIG,   TF_COMMAND},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str36,            T_PROMPT,       TF_COMMAND},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str36,            T_TYPE,         TF_COMMAND, S_STRING},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str37,    T_DEPENDS,      TF_COMMAND},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str37,    T_VISIBLE,      TF_COMMAND},
-      {-1}, {-1}, {-1}, {-1}, {-1}, {-1}, {-1}, {-1}, {-1},
+      {-1}, {-1}, {-1},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str41,            T_PROMPT,       TF_COMMAND},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str42,    T_DEPENDS,      TF_COMMAND},
      {-1},
-      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str48,    T_MAINMENU,     TF_COMMAND}
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str44,            T_TYPE,         TF_COMMAND, S_BOOLEAN},
+      {-1},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str46,            T_SELECT,       TF_COMMAND},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str47,    T_TYPE,         TF_COMMAND, S_BOOLEAN},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str48,    T_MAINMENU,     TF_COMMAND},
+      {-1}, {-1},
+      {(int)(long)&((struct kconf_id_strings_t *)0)->kconf_id_strings_str51,            T_SOURCE,       TF_COMMAND}
    };
  if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
diff --git a/scripts/kconfig/zconf.tab.c_shipped b/scripts/kconfig/zconf.tab.c_shipped
index 699d4b265186..4c5495ea205e 100644
--- a/scripts/kconfig/zconf.tab.c_shipped
+++ b/scripts/kconfig/zconf.tab.c_shipped
@@ -160,18 +160,19 @@ static struct menu *current_menu, *current_entry;
     T_DEFAULT = 275,
     T_SELECT = 276,
     T_RANGE = 277,
-     T_OPTION = 278,
+     T_VISIBLE = 278,
-     T_ON = 279,
+     T_OPTION = 279,
-     T_WORD = 280,
+     T_ON = 280,
-     T_WORD_QUOTE = 281,
+     T_WORD = 281,
-     T_UNEQUAL = 282,
+     T_WORD_QUOTE = 282,
-     T_CLOSE_PAREN = 283,
+     T_UNEQUAL = 283,
-     T_OPEN_PAREN = 284,
+     T_CLOSE_PAREN = 284,
-     T_EOL = 285,
+     T_OPEN_PAREN = 285,
-     T_OR = 286,
+     T_EOL = 286,
-     T_AND = 287,
+     T_OR = 287,
-     T_EQUAL = 288,
+     T_AND = 288,
-     T_NOT = 289
+     T_EQUAL = 289,
+     T_NOT = 290
   };
 #endif
@@ -419,20 +420,20 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  11
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   277
+#define YYLAST   290
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  35
+#define YYNTOKENS  36
 /* YYNNTS -- Number of nonterminals.  */
-#define YYNNTS  48
+#define YYNNTS  50
 /* YYNRULES -- Number of rules.  */
-#define YYNRULES  113
+#define YYNRULES  118
 /* YYNRULES -- Number of states.  */
-#define YYNSTATES  185
+#define YYNSTATES  191
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   289
+#define YYMAXUTOK   290
 #define YYTRANSLATE(YYX)                                                \
  ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -468,7 +469,8 @@ static const yytype_uint8 yytranslate[] =
       2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
       5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
-      25,    26,    27,    28,    29,    30,    31,    32,    33,    34
+      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
+      35
 };
 #if YYDEBUG
@@ -478,72 +480,73 @@ static const yytype_uint16 yyprhs[] =
 {
       0,     0,     3,     6,     8,    11,    13,    14,    17,    20,
      23,    26,    31,    36,    40,    42,    44,    46,    48,    50,
-      52,    54,    56,    58,    60,    62,    64,    66,    70,    73,
+      52,    54,    56,    58,    60,    62,    64,    66,    68,    72,
-      77,    80,    84,    87,    88,    91,    94,    97,   100,   103,
+      75,    79,    82,    86,    89,    90,    93,    96,    99,   102,
-     106,   110,   115,   120,   125,   131,   135,   136,   140,   141,
+     105,   108,   112,   117,   122,   127,   133,   137,   138,   142,
-     144,   148,   151,   153,   157,   158,   161,   164,   167,   170,
+     143,   146,   150,   153,   155,   159,   160,   163,   166,   169,
-     173,   178,   182,   185,   190,   191,   194,   198,   200,   204,
+     172,   175,   180,   184,   187,   192,   193,   196,   200,   202,
-     205,   208,   211,   214,   218,   222,   225,   227,   231,   232,
+     206,   207,   210,   213,   216,   220,   224,   228,   230,   234,
-     235,   238,   241,   245,   249,   252,   255,   258,   259,   262,
+     235,   238,   241,   244,   248,   252,   255,   258,   261,   262,
-     265,   268,   273,   274,   277,   279,   281,   284,   287,   290,
+     265,   268,   271,   276,   277,   280,   283,   286,   287,   290,
-     292,   295,   296,   299,   301,   305,   309,   313,   316,   320,
+     292,   294,   297,   300,   303,   305,   308,   309,   312,   314,
-     324,   326,   328,   329
+     318,   322,   326,   329,   333,   337,   339,   341,   342
 };
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int8 yyrhs[] =
 {
-      36,     0,    -1,    78,    37,    -1,    37,    -1,    62,    38,
+      37,     0,    -1,    81,    38,    -1,    38,    -1,    63,    39,
-      -1,    38,    -1,    -1,    38,    40,    -1,    38,    54,    -1,
+      -1,    39,    -1,    -1,    39,    41,    -1,    39,    55,    -1,
-      38,    66,    -1,    38,    77,    -1,    38,    25,     1,    30,
+      39,    67,    -1,    39,    80,    -1,    39,    26,     1,    31,
-      -1,    38,    39,     1,    30,    -1,    38,     1,    30,    -1,
+      -1,    39,    40,     1,    31,    -1,    39,     1,    31,    -1,
      16,    -1,    18,    -1,    19,    -1,    21,    -1,    17,    -1,
-      22,    -1,    20,    -1,    30,    -1,    60,    -1,    70,    -1,
+      22,    -1,    20,    -1,    23,    -1,    31,    -1,    61,    -1,
-      43,    -1,    45,    -1,    68,    -1,    25,     1,    30,    -1,
+      71,    -1,    44,    -1,    46,    -1,    69,    -1,    26,     1,
-       1,    30,    -1,    10,    25,    30,    -1,    42,    46,    -1,
+      31,    -1,     1,    31,    -1,    10,    26,    31,    -1,    43,
-      11,    25,    30,    -1,    44,    46,    -1,    -1,    46,    47,
+      47,    -1,    11,    26,    31,    -1,    45,    47,    -1,    -1,
-      -1,    46,    48,    -1,    46,    74,    -1,    46,    72,    -1,
+      47,    48,    -1,    47,    49,    -1,    47,    75,    -1,    47,
-      46,    41,    -1,    46,    30,    -1,    19,    75,    30,    -1,
+      73,    -1,    47,    42,    -1,    47,    31,    -1,    19,    78,
-      18,    76,    79,    30,    -1,    20,    80,    79,    30,    -1,
+      31,    -1,    18,    79,    82,    31,    -1,    20,    83,    82,
-      21,    25,    79,    30,    -1,    22,    81,    81,    79,    30,
+      31,    -1,    21,    26,    82,    31,    -1,    22,    84,    84,
-      -1,    23,    49,    30,    -1,    -1,    49,    25,    50,    -1,
+      82,    31,    -1,    24,    50,    31,    -1,    -1,    50,    26,
-      -1,    33,    76,    -1,     7,    82,    30,    -1,    51,    55,
+      51,    -1,    -1,    34,    79,    -1,     7,    85,    31,    -1,
-      -1,    77,    -1,    52,    57,    53,    -1,    -1,    55,    56,
+      52,    56,    -1,    80,    -1,    53,    58,    54,    -1,    -1,
-      -1,    55,    74,    -1,    55,    72,    -1,    55,    30,    -1,
+      56,    57,    -1,    56,    75,    -1,    56,    73,    -1,    56,
-      55,    41,    -1,    18,    76,    79,    30,    -1,    19,    75,
+      31,    -1,    56,    42,    -1,    18,    79,    82,    31,    -1,
-      30,    -1,    17,    30,    -1,    20,    25,    79,    30,    -1,
+      19,    78,    31,    -1,    17,    31,    -1,    20,    26,    82,
-      -1,    57,    40,    -1,    14,    80,    78,    -1,    77,    -1,
+      31,    -1,    -1,    58,    41,    -1,    14,    83,    81,    -1,
-      58,    61,    59,    -1,    -1,    61,    40,    -1,    61,    66,
+      80,    -1,    59,    62,    60,    -1,    -1,    62,    41,    -1,
-      -1,    61,    54,    -1,     3,    76,    78,    -1,     4,    76,
+      62,    67,    -1,    62,    55,    -1,     3,    79,    81,    -1,
-      30,    -1,    63,    73,    -1,    77,    -1,    64,    67,    65,
+       4,    79,    31,    -1,    64,    76,    74,    -1,    80,    -1,
-      -1,    -1,    67,    40,    -1,    67,    66,    -1,    67,    54,
+      65,    68,    66,    -1,    -1,    68,    41,    -1,    68,    67,
-      -1,     6,    76,    30,    -1,     9,    76,    30,    -1,    69,
+      -1,    68,    55,    -1,     6,    79,    31,    -1,     9,    79,
-      73,    -1,    12,    30,    -1,    71,    13,    -1,    -1,    73,
+      31,    -1,    70,    74,    -1,    12,    31,    -1,    72,    13,
-      74,    -1,    73,    30,    -1,    73,    41,    -1,    16,    24,
+      -1,    -1,    74,    75,    -1,    74,    31,    -1,    74,    42,
-      80,    30,    -1,    -1,    76,    79,    -1,    25,    -1,    26,
+      -1,    16,    25,    83,    31,    -1,    -1,    76,    77,    -1,
-      -1,     5,    30,    -1,     8,    30,    -1,    15,    30,    -1,
+      76,    31,    -1,    23,    82,    -1,    -1,    79,    82,    -1,
-      30,    -1,    78,    30,    -1,    -1,    14,    80,    -1,    81,
+      26,    -1,    27,    -1,     5,    31,    -1,     8,    31,    -1,
-      -1,    81,    33,    81,    -1,    81,    27,    81,    -1,    29,
+      15,    31,    -1,    31,    -1,    81,    31,    -1,    -1,    14,
-      80,    28,    -1,    34,    80,    -1,    80,    31,    80,    -1,
+      83,    -1,    84,    -1,    84,    34,    84,    -1,    84,    28,
-      80,    32,    80,    -1,    25,    -1,    26,    -1,    -1,    25,
+      84,    -1,    30,    83,    29,    -1,    35,    83,    -1,    83,
-      -1
+      32,    83,    -1,    83,    33,    83,    -1,    26,    -1,    27,
+      -1,    -1,    26,    -1
 };
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   107,   107,   107,   109,   109,   111,   113,   114,   115,
+       0,   108,   108,   108,   110,   110,   112,   114,   115,   116,
-     116,   117,   118,   122,   126,   126,   126,   126,   126,   126,
+     117,   118,   119,   123,   127,   127,   127,   127,   127,   127,
-     126,   130,   131,   132,   133,   134,   135,   139,   140,   146,
+     127,   127,   131,   132,   133,   134,   135,   136,   140,   141,
-     154,   160,   168,   178,   180,   181,   182,   183,   184,   185,
+     147,   155,   161,   169,   179,   181,   182,   183,   184,   185,
-     188,   196,   202,   212,   218,   224,   227,   229,   240,   241,
+     186,   189,   197,   203,   213,   219,   225,   228,   230,   241,
-     246,   255,   260,   268,   271,   273,   274,   275,   276,   277,
+     242,   247,   256,   261,   269,   272,   274,   275,   276,   277,
-     280,   286,   297,   303,   313,   315,   320,   328,   336,   339,
+     278,   281,   287,   298,   304,   314,   316,   321,   329,   337,
-     341,   342,   343,   348,   355,   362,   367,   375,   378,   380,
+     340,   342,   343,   344,   349,   356,   363,   368,   376,   379,
-     381,   382,   385,   393,   400,   407,   413,   420,   422,   423,
+     381,   382,   383,   386,   394,   401,   408,   414,   421,   423,
-     424,   427,   435,   437,   442,   443,   446,   447,   448,   452,
+     424,   425,   428,   436,   438,   439,   442,   449,   451,   456,
-     453,   456,   457,   460,   461,   462,   463,   464,   465,   466,
+     457,   460,   461,   462,   466,   467,   470,   471,   474,   475,
-     469,   470,   473,   474
+     476,   477,   478,   479,   480,   483,   484,   487,   488
 };
 #endif
@@ -556,7 +559,7 @@ static const char *const yytname[] =
  "T_SOURCE", "T_CHOICE", "T_ENDCHOICE", "T_COMMENT", "T_CONFIG",
  "T_MENUCONFIG", "T_HELP", "T_HELPTEXT", "T_IF", "T_ENDIF", "T_DEPENDS",
  "T_OPTIONAL", "T_PROMPT", "T_TYPE", "T_DEFAULT", "T_SELECT", "T_RANGE",
-  "T_OPTION", "T_ON", "T_WORD", "T_WORD_QUOTE", "T_UNEQUAL",
+  "T_VISIBLE", "T_OPTION", "T_ON", "T_WORD", "T_WORD_QUOTE", "T_UNEQUAL",
  "T_CLOSE_PAREN", "T_OPEN_PAREN", "T_EOL", "T_OR", "T_AND", "T_EQUAL",
  "T_NOT", "$accept", "input", "start", "stmt_list", "option_name",
  "common_stmt", "option_error", "config_entry_start", "config_stmt",
@@ -567,8 +570,8 @@ static const char *const yytname[] =
  "if_entry", "if_end", "if_stmt", "if_block", "mainmenu_stmt", "menu",
  "menu_entry", "menu_end", "menu_stmt", "menu_block", "source_stmt",
  "comment", "comment_stmt", "help_start", "help", "depends_list",
-  "depends", "prompt_stmt_opt", "prompt", "end", "nl", "if_expr", "expr",
+  "depends", "visibility_list", "visible", "prompt_stmt_opt", "prompt",
-  "symbol", "word_opt", 0
+  "end", "nl", "if_expr", "expr", "symbol", "word_opt", 0
 };
 #endif
@@ -580,25 +583,25 @@ static const yytype_uint16 yytoknum[] =
       0,   256,   257,   258,   259,   260,   261,   262,   263,   264,
     265,   266,   267,   268,   269,   270,   271,   272,   273,   274,
     275,   276,   277,   278,   279,   280,   281,   282,   283,   284,
-     285,   286,   287,   288,   289
+     285,   286,   287,   288,   289,   290
 };
 # endif
 /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint8 yyr1[] =
 {
-       0,    35,    36,    36,    37,    37,    38,    38,    38,    38,
+       0,    36,    37,    37,    38,    38,    39,    39,    39,    39,
-      38,    38,    38,    38,    39,    39,    39,    39,    39,    39,
+      39,    39,    39,    39,    40,    40,    40,    40,    40,    40,
-      39,    40,    40,    40,    40,    40,    40,    41,    41,    42,
+      40,    40,    41,    41,    41,    41,    41,    41,    42,    42,
-      43,    44,    45,    46,    46,    46,    46,    46,    46,    46,
+      43,    44,    45,    46,    47,    47,    47,    47,    47,    47,
-      47,    47,    47,    47,    47,    48,    49,    49,    50,    50,
+      47,    48,    48,    48,    48,    48,    49,    50,    50,    51,
-      51,    52,    53,    54,    55,    55,    55,    55,    55,    55,
+      51,    52,    53,    54,    55,    56,    56,    56,    56,    56,
-      56,    56,    56,    56,    57,    57,    58,    59,    60,    61,
+      56,    57,    57,    57,    57,    58,    58,    59,    60,    61,
-      61,    61,    61,    62,    63,    64,    65,    66,    67,    67,
+      62,    62,    62,    62,    63,    64,    65,    66,    67,    68,
-      67,    67,    68,    69,    70,    71,    72,    73,    73,    73,
+      68,    68,    68,    69,    70,    71,    72,    73,    74,    74,
-      73,    74,    75,    75,    76,    76,    77,    77,    77,    78,
+      74,    74,    75,    76,    76,    76,    77,    78,    78,    79,
-      78,    79,    79,    80,    80,    80,    80,    80,    80,    80,
+      79,    80,    80,    80,    81,    81,    82,    82,    83,    83,
-      81,    81,    82,    82
+      83,    83,    83,    83,    83,    84,    84,    85,    85
 };
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
@@ -606,16 +609,16 @@ static const yytype_uint8 yyr2[] =
 {
       0,     2,     2,     1,     2,     1,     0,     2,     2,     2,
       2,     4,     4,     3,     1,     1,     1,     1,     1,     1,
-       1,     1,     1,     1,     1,     1,     1,     3,     2,     3,
+       1,     1,     1,     1,     1,     1,     1,     1,     3,     2,
-       2,     3,     2,     0,     2,     2,     2,     2,     2,     2,
+       3,     2,     3,     2,     0,     2,     2,     2,     2,     2,
-       3,     4,     4,     4,     5,     3,     0,     3,     0,     2,
+       2,     3,     4,     4,     4,     5,     3,     0,     3,     0,
-       3,     2,     1,     3,     0,     2,     2,     2,     2,     2,
+       2,     3,     2,     1,     3,     0,     2,     2,     2,     2,
-       4,     3,     2,     4,     0,     2,     3,     1,     3,     0,
+       2,     4,     3,     2,     4,     0,     2,     3,     1,     3,
-       2,     2,     2,     3,     3,     2,     1,     3,     0,     2,
+       0,     2,     2,     2,     3,     3,     3,     1,     3,     0,
-       2,     2,     3,     3,     2,     2,     2,     0,     2,     2,
+       2,     2,     2,     3,     3,     2,     2,     2,     0,     2,
-       2,     4,     0,     2,     1,     1,     2,     2,     2,     1,
+       2,     2,     4,     0,     2,     2,     2,     0,     2,     1,
-       2,     0,     2,     1,     3,     3,     3,     2,     3,     3,
+       1,     2,     2,     2,     1,     2,     0,     2,     1,     3,
-       1,     1,     0,     1
+       3,     3,     2,     3,     3,     1,     1,     0,     1
 };
 /* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state
@@ -623,165 +626,172 @@ static const yytype_uint8 yyr2[] =
   means the default is an error.  */
 static const yytype_uint8 yydefact[] =
 {
-       6,     0,    99,     0,     3,     0,     6,     6,    94,    95,
+       6,     0,   104,     0,     3,     0,     6,     6,    99,   100,
-       0,     1,     0,     0,     0,     0,   112,     0,     0,     0,
+       0,     1,     0,     0,     0,     0,   117,     0,     0,     0,
       0,     0,     0,    14,    18,    15,    16,    20,    17,    19,
-       0,    21,     0,     7,    33,    24,    33,    25,    54,    64,
+      21,     0,    22,     0,     7,    34,    25,    34,    26,    55,
-       8,    69,    22,    87,    78,     9,    26,    87,    23,    10,
+      65,     8,    70,    23,    93,    79,     9,    27,    88,    24,
-       0,   100,     2,    73,    13,     0,    96,     0,   113,     0,
+      10,     0,   105,     2,    74,    13,     0,   101,     0,   118,
-      97,     0,     0,     0,   110,   111,     0,     0,     0,   103,
+       0,   102,     0,     0,     0,   115,   116,     0,     0,     0,
-      98,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+     108,   103,     0,     0,     0,     0,     0,     0,     0,    88,
-       0,    74,    82,    50,    83,    29,    31,     0,   107,     0,
+       0,     0,    75,    83,    51,    84,    30,    32,     0,   112,
-       0,    66,     0,     0,    11,    12,     0,     0,     0,     0,
+       0,     0,    67,     0,     0,    11,    12,     0,     0,     0,
-      92,     0,     0,     0,    46,     0,    39,    38,    34,    35,
+       0,    97,     0,     0,     0,    47,     0,    40,    39,    35,
-       0,    37,    36,     0,     0,    92,     0,    58,    59,    55,
+      36,     0,    38,    37,     0,     0,    97,     0,    59,    60,
-      57,    56,    65,    53,    52,    70,    72,    68,    71,    67,
+      56,    58,    57,    66,    54,    53,    71,    73,    69,    72,
-      89,    90,    88,    79,    81,    77,    80,    76,   106,   108,
+      68,   106,    95,     0,    94,    80,    82,    78,    81,    77,
-     109,   105,   104,    28,    85,     0,   101,     0,   101,   101,
+      90,    91,    89,   111,   113,   114,   110,   109,    29,    86,
-     101,     0,     0,     0,    86,    62,   101,     0,   101,     0,
+       0,   106,     0,   106,   106,   106,     0,     0,     0,    87,
-       0,     0,    40,    93,     0,     0,   101,    48,    45,    27,
+      63,   106,     0,   106,     0,    96,     0,     0,    41,    98,
-       0,    61,     0,    91,   102,    41,    42,    43,     0,     0,
+       0,     0,   106,    49,    46,    28,     0,    62,     0,   107,
-      47,    60,    63,    44,    49
+      92,    42,    43,    44,     0,     0,    48,    61,    64,    45,
+      50
 };
 /* YYDEFGOTO[NTERM-NUM].  */
 static const yytype_int16 yydefgoto[] =
 {
-      -1,     3,     4,     5,    32,    33,   107,    34,    35,    36,
+      -1,     3,     4,     5,    33,    34,   108,    35,    36,    37,
-      37,    73,   108,   109,   152,   180,    38,    39,   123,    40,
+      38,    74,   109,   110,   157,   186,    39,    40,   124,    41,
-      75,   119,    76,    41,   127,    42,    77,     6,    43,    44,
+      76,   120,    77,    42,   128,    43,    78,     6,    44,    45,
-     135,    45,    79,    46,    47,    48,   110,   111,    78,   112,
+     137,    46,    80,    47,    48,    49,   111,   112,    81,   113,
-     147,   148,    49,     7,   161,    68,    69,    59
+      79,   134,   152,   153,    50,     7,   165,    69,    70,    60
 };
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
   STATE-NUM.  */
-#define YYPACT_NINF -89
+#define YYPACT_NINF -90
 static const yytype_int16 yypact[] =
 {
-       3,     4,   -89,    20,   -89,   100,   -89,     7,   -89,   -89,
+       4,    42,   -90,    96,   -90,   111,   -90,    15,   -90,   -90,
-      -8,   -89,    17,     4,    28,     4,    37,    36,     4,    68,
+      75,   -90,    82,    42,   104,    42,   110,   107,    42,   115,
-      87,   -18,    69,   -89,   -89,   -89,   -89,   -89,   -89,   -89,
+     125,    -4,   121,   -90,   -90,   -90,   -90,   -90,   -90,   -90,
-     128,   -89,   138,   -89,   -89,   -89,   -89,   -89,   -89,   -89,
+     -90,   162,   -90,   163,   -90,   -90,   -90,   -90,   -90,   -90,
-     -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,
+     -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,
-     127,   -89,   -89,   110,   -89,   126,   -89,   136,   -89,   137,
+     -90,   139,   -90,   -90,   138,   -90,   142,   -90,   143,   -90,
-     -89,   147,   150,   152,   -89,   -89,   -18,   -18,   171,   -14,
+     152,   -90,   164,   167,   168,   -90,   -90,    -4,    -4,    77,
-     -89,   153,   157,    34,    67,   180,   233,   220,   207,   220,
+     -18,   -90,   177,   185,    33,    71,   195,   247,   236,    -2,
-     154,   -89,   -89,   -89,   -89,   -89,   -89,     0,   -89,   -18,
+     236,   171,   -90,   -90,   -90,   -90,   -90,   -90,    41,   -90,
-     -18,   110,    44,    44,   -89,   -89,   163,   174,   182,     4,
+      -4,    -4,   138,    97,    97,   -90,   -90,   186,   187,   194,
-       4,   -18,   194,    44,   -89,   219,   -89,   -89,   -89,   -89,
+      42,    42,    -4,   196,    97,   -90,   219,   -90,   -90,   -90,
-     223,   -89,   -89,   203,     4,     4,   215,   -89,   -89,   -89,
+     -90,   210,   -90,   -90,   204,    42,    42,   199,   -90,   -90,
-     -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,
+     -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,
-     -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   213,
+     -90,   222,   -90,   223,   -90,   -90,   -90,   -90,   -90,   -90,
-     -89,   -89,   -89,   -89,   -89,   -18,   232,   227,   232,    -5,
+     -90,   -90,   -90,   -90,   215,   -90,   -90,   -90,   -90,   -90,
-     232,    44,    35,   234,   -89,   -89,   232,   235,   232,   224,
+      -4,   222,   228,   222,    -5,   222,    97,    35,   229,   -90,
-     -18,   236,   -89,   -89,   237,   238,   232,   216,   -89,   -89,
+     -90,   222,   232,   222,    -4,   -90,   135,   233,   -90,   -90,
-     240,   -89,   241,   -89,    71,   -89,   -89,   -89,   242,     4,
+     234,   235,   222,   240,   -90,   -90,   237,   -90,   239,   -13,
-     -89,   -89,   -89,   -89,   -89
+     -90,   -90,   -90,   -90,   244,    42,   -90,   -90,   -90,   -90,
+     -90
 };
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-     -89,   -89,   255,   267,   -89,    47,   -57,   -89,   -89,   -89,
+     -90,   -90,   269,   271,   -90,    23,   -70,   -90,   -90,   -90,
-     -89,   239,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   130,
+     -90,   243,   -90,   -90,   -90,   -90,   -90,   -90,   -90,   -48,
-     -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,   -89,
+     -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,   -90,
-     -89,   181,   -89,   -89,   -89,   -89,   -89,   199,   229,    16,
+     -90,   -20,   -90,   -90,   -90,   -90,   -90,   206,   205,   -68,
-     162,    -1,    74,    -7,   103,   -65,   -88,   -89
+     -90,   -90,   169,    -1,    27,    -7,   118,   -66,   -89,   -90
 };
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
   positive, shift that token.  If negative, reduce the rule which
   number is the opposite.  If zero, do what YYDEFACT says.
   If YYTABLE_NINF, syntax error.  */
-#define YYTABLE_NINF -85
+#define YYTABLE_NINF -86
 static const yytype_int16 yytable[] =
 {
-      10,    87,    88,    53,   141,   142,     1,    64,    65,   160,
+      10,    88,    89,    54,   146,   147,   119,     1,   122,   164,
-       1,    66,    55,    92,    57,   151,    67,    61,   118,    93,
+      93,   141,    56,   142,    58,   156,    94,    62,     1,    90,
-      11,   131,     2,   131,   139,   140,    89,    90,   138,     8,
+      91,   131,    65,    66,   144,   145,    67,    90,    91,   132,
-       9,    89,    90,     2,   -30,    96,   149,    51,   -30,   -30,
+     127,    68,   136,   -31,    97,     2,   154,   -31,   -31,   -31,
-     -30,   -30,   -30,   -30,   -30,   -30,    97,    54,   -30,   -30,
+     -31,   -31,   -31,   -31,   -31,    98,    52,   -31,   -31,    99,
-      98,   -30,    99,   100,   101,   102,   103,   104,    56,   105,
+     -31,   100,   101,   102,   103,   104,   -31,   105,   129,   106,
-     167,    91,    58,   166,   106,   168,    60,   -32,    96,    64,
+     138,   173,    92,   141,   107,   142,   174,   172,     8,     9,
-      65,   -32,   -32,   -32,   -32,   -32,   -32,   -32,   -32,    97,
+     143,   -33,    97,    90,    91,   -33,   -33,   -33,   -33,   -33,
-     159,   -32,   -32,    98,   -32,    99,   100,   101,   102,   103,
+     -33,   -33,   -33,    98,   166,   -33,   -33,    99,   -33,   100,
-     104,   121,   105,    62,   132,   174,   132,   106,   146,    70,
+     101,   102,   103,   104,   -33,   105,    11,   106,   179,   151,
-      -5,    12,    89,    90,    13,    14,    15,    16,    17,    18,
+     123,   126,   107,   135,   125,   130,     2,   139,     2,    90,
-      19,    20,    63,   156,    21,    22,    23,    24,    25,    26,
+      91,    -5,    12,    55,   161,    13,    14,    15,    16,    17,
-      27,    28,    29,   122,   125,    30,   133,    -4,    12,    71,
+      18,    19,    20,    65,    66,    21,    22,    23,    24,    25,
-      31,    13,    14,    15,    16,    17,    18,    19,    20,    72,
+      26,    27,    28,    29,    30,    57,    59,    31,    61,    -4,
-      51,    21,    22,    23,    24,    25,    26,    27,    28,    29,
+      12,    63,    32,    13,    14,    15,    16,    17,    18,    19,
-     124,   129,    30,   137,   -84,    96,    81,    31,   -84,   -84,
+      20,    64,    71,    21,    22,    23,    24,    25,    26,    27,
-     -84,   -84,   -84,   -84,   -84,   -84,    82,    83,   -84,   -84,
+      28,    29,    30,    72,    73,    31,   180,    90,    91,    52,
-      98,   -84,   -84,   -84,   -84,   -84,   -84,    84,   184,   105,
+      32,   -85,    97,    82,    83,   -85,   -85,   -85,   -85,   -85,
-      85,    96,    86,    94,   130,   -51,   -51,    95,   -51,   -51,
+     -85,   -85,   -85,    84,   190,   -85,   -85,    99,   -85,   -85,
-     -51,   -51,    97,   143,   -51,   -51,    98,   113,   114,   115,
+     -85,   -85,   -85,   -85,   -85,    85,    97,   106,    86,    87,
-     116,     2,    89,    90,   144,   105,   145,   126,    96,   134,
+     -52,   -52,   140,   -52,   -52,   -52,   -52,    98,    95,   -52,
-     117,   -75,   -75,   -75,   -75,   -75,   -75,   -75,   -75,   150,
+     -52,    99,   114,   115,   116,   117,    96,   148,   149,   150,
-     153,   -75,   -75,    98,    13,    14,    15,    16,    17,    18,
+     158,   106,   155,   159,    97,   163,   118,   -76,   -76,   -76,
-      19,    20,   105,   155,    21,    22,   154,   130,    14,    15,
+     -76,   -76,   -76,   -76,   -76,   160,   164,   -76,   -76,    99,
-     158,    17,    18,    19,    20,    90,   160,    21,    22,   179,
+      13,    14,    15,    16,    17,    18,    19,    20,    91,   106,
-      31,   163,   164,   165,   173,    89,    90,   162,   128,   170,
+      21,    22,    14,    15,   140,    17,    18,    19,    20,   168,
-     136,   172,    52,    31,   169,   171,   175,   176,   177,   178,
+     175,    21,    22,   177,   181,   182,   183,    32,   187,   167,
-     181,   182,   183,    50,   120,    74,    80,   157
+     188,   169,   170,   171,   185,   189,    53,    51,    32,   176,
+      75,   178,   121,     0,   133,   162,     0,     0,     0,     0,
+     184
 };
-static const yytype_uint8 yycheck[] =
+static const yytype_int16 yycheck[] =
 {
-       1,    66,    67,    10,    92,    93,     3,    25,    26,    14,
+       1,    67,    68,    10,    93,    94,    76,     3,    76,    14,
-       3,    29,    13,    27,    15,   103,    34,    18,    75,    33,
+      28,    81,    13,    81,    15,   104,    34,    18,     3,    32,
-       0,    78,    30,    80,    89,    90,    31,    32,    28,    25,
+      33,    23,    26,    27,    90,    91,    30,    32,    33,    31,
-      26,    31,    32,    30,     0,     1,   101,    30,     4,     5,
+      78,    35,    80,     0,     1,    31,   102,     4,     5,     6,
-       6,     7,     8,     9,    10,    11,    12,    30,    14,    15,
+       7,     8,     9,    10,    11,    12,    31,    14,    15,    16,
-      16,    17,    18,    19,    20,    21,    22,    23,    30,    25,
+      17,    18,    19,    20,    21,    22,    23,    24,    78,    26,
-      25,    68,    25,   151,    30,    30,    30,     0,     1,    25,
+      80,    26,    69,   133,    31,   133,    31,   156,    26,    27,
-      26,     4,     5,     6,     7,     8,     9,    10,    11,    12,
+      29,     0,     1,    32,    33,     4,     5,     6,     7,     8,
-     145,    14,    15,    16,    17,    18,    19,    20,    21,    22,
+       9,    10,    11,    12,   150,    14,    15,    16,    17,    18,
-      23,    75,    25,    25,    78,   160,    80,    30,    99,    30,
+      19,    20,    21,    22,    23,    24,     0,    26,   164,   100,
-       0,     1,    31,    32,     4,     5,     6,     7,     8,     9,
+      77,    78,    31,    80,    77,    78,    31,    80,    31,    32,
-      10,    11,    25,   114,    14,    15,    16,    17,    18,    19,
+      33,     0,     1,    31,   115,     4,     5,     6,     7,     8,
-      20,    21,    22,    76,    77,    25,    79,     0,     1,     1,
+       9,    10,    11,    26,    27,    14,    15,    16,    17,    18,
-      30,     4,     5,     6,     7,     8,     9,    10,    11,     1,
+      19,    20,    21,    22,    23,    31,    26,    26,    31,     0,
-      30,    14,    15,    16,    17,    18,    19,    20,    21,    22,
+       1,    26,    31,     4,     5,     6,     7,     8,     9,    10,
-      76,    77,    25,    79,     0,     1,    30,    30,     4,     5,
+      11,    26,    31,    14,    15,    16,    17,    18,    19,    20,
-       6,     7,     8,     9,    10,    11,    30,    30,    14,    15,
+      21,    22,    23,     1,     1,    26,    31,    32,    33,    31,
-      16,    17,    18,    19,    20,    21,    22,    30,   179,    25,
+      31,     0,     1,    31,    31,     4,     5,     6,     7,     8,
-      30,     1,    30,    30,    30,     5,     6,    30,     8,     9,
+       9,    10,    11,    31,   185,    14,    15,    16,    17,    18,
-      10,    11,    12,    30,    14,    15,    16,    17,    18,    19,
+      19,    20,    21,    22,    23,    31,     1,    26,    31,    31,
-      20,    30,    31,    32,    30,    25,    24,    77,     1,    79,
+       5,     6,    31,     8,     9,    10,    11,    12,    31,    14,
-      30,     4,     5,     6,     7,     8,     9,    10,    11,    25,
+      15,    16,    17,    18,    19,    20,    31,    31,    31,    25,
-       1,    14,    15,    16,     4,     5,     6,     7,     8,     9,
+       1,    26,    26,    13,     1,    26,    31,     4,     5,     6,
-      10,    11,    25,    30,    14,    15,    13,    30,     5,     6,
+       7,     8,     9,    10,    11,    31,    14,    14,    15,    16,
-      25,     8,     9,    10,    11,    32,    14,    14,    15,    33,
+       4,     5,     6,     7,     8,     9,    10,    11,    33,    26,
-      30,   148,   149,   150,    30,    31,    32,    30,    77,   156,
+      14,    15,     5,     6,    31,     8,     9,    10,    11,    31,
-      79,   158,     7,    30,    30,    30,    30,    30,    30,   166,
+      31,    14,    15,    31,    31,    31,    31,    31,    31,   151,
-      30,    30,    30,     6,    75,    36,    47,   115
+      31,   153,   154,   155,    34,    31,     7,     6,    31,   161,
+      37,   163,    76,    -1,    79,   116,    -1,    -1,    -1,    -1,
+     172
 };
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
   symbol of state STATE-NUM.  */
 static const yytype_uint8 yystos[] =
 {
-       0,     3,    30,    36,    37,    38,    62,    78,    25,    26,
+       0,     3,    31,    37,    38,    39,    63,    81,    26,    27,
-      76,     0,     1,     4,     5,     6,     7,     8,     9,    10,
+      79,     0,     1,     4,     5,     6,     7,     8,     9,    10,
      11,    14,    15,    16,    17,    18,    19,    20,    21,    22,
-      25,    30,    39,    40,    42,    43,    44,    45,    51,    52,
+      23,    26,    31,    40,    41,    43,    44,    45,    46,    52,
-      54,    58,    60,    63,    64,    66,    68,    69,    70,    77,
+      53,    55,    59,    61,    64,    65,    67,    69,    70,    71,
-      38,    30,    37,    78,    30,    76,    30,    76,    25,    82,
+      80,    39,    31,    38,    81,    31,    79,    31,    79,    26,
-      30,    76,    25,    25,    25,    26,    29,    34,    80,    81,
+      85,    31,    79,    26,    26,    26,    27,    30,    35,    83,
-      30,     1,     1,    46,    46,    55,    57,    61,    73,    67,
+      84,    31,     1,     1,    47,    47,    56,    58,    62,    76,
-      73,    30,    30,    30,    30,    30,    30,    80,    80,    31,
+      68,    74,    31,    31,    31,    31,    31,    31,    83,    83,
-      32,    78,    27,    33,    30,    30,     1,    12,    16,    18,
+      32,    33,    81,    28,    34,    31,    31,     1,    12,    16,
-      19,    20,    21,    22,    23,    25,    30,    41,    47,    48,
+      18,    19,    20,    21,    22,    24,    26,    31,    42,    48,
-      71,    72,    74,    17,    18,    19,    20,    30,    41,    56,
+      49,    72,    73,    75,    17,    18,    19,    20,    31,    42,
-      72,    74,    40,    53,    77,    40,    54,    59,    66,    77,
+      57,    73,    75,    41,    54,    80,    41,    55,    60,    67,
-      30,    41,    74,    40,    54,    65,    66,    77,    28,    80,
+      80,    23,    31,    74,    77,    41,    55,    66,    67,    80,
-      80,    81,    81,    30,    30,    24,    76,    75,    76,    80,
+      31,    42,    75,    29,    83,    83,    84,    84,    31,    31,
-      25,    81,    49,     1,    13,    30,    76,    75,    25,    80,
+      25,    79,    78,    79,    83,    26,    84,    50,     1,    13,
-      14,    79,    30,    79,    79,    79,    81,    25,    30,    30,
+      31,    79,    78,    26,    14,    82,    83,    82,    31,    82,
-      79,    30,    79,    30,    80,    30,    30,    30,    79,    33,
+      82,    82,    84,    26,    31,    31,    82,    31,    82,    83,
-      50,    30,    30,    30,    76
+      31,    31,    31,    31,    82,    34,    51,    31,    31,    31,
+      79
 };
 #define yyerrok         (yyerrstatus = 0)
@@ -1292,7 +1302,7 @@ yydestruct (yymsg, yytype, yyvaluep)
  switch (yytype)
    {
-      case 52: /* "choice_entry" */
+      case 53: /* "choice_entry" */
        {
        fprintf(stderr, "%s:%d: missing end statement for this entry\n",
@@ -1302,7 +1312,7 @@ yydestruct (yymsg, yytype, yyvaluep)
 };
        break;
-      case 58: /* "if_entry" */
+      case 59: /* "if_entry" */
        {
        fprintf(stderr, "%s:%d: missing end statement for this entry\n",
@@ -1312,7 +1322,7 @@ yydestruct (yymsg, yytype, yyvaluep)
 };
        break;
-      case 64: /* "menu_entry" */
+      case 65: /* "menu_entry" */
        {
        fprintf(stderr, "%s:%d: missing end statement for this entry\n",
@@ -1644,17 +1654,17 @@ yyreduce:
    { zconf_error("invalid statement"); ;}
    break;
-  case 27:
+  case 28:
    { zconf_error("unknown option \"%s\"", (yyvsp[(1) - (3)].string)); ;}
    break;
-  case 28:
+  case 29:
    { zconf_error("invalid option"); ;}
    break;
-  case 29:
+  case 30:
    {
        struct symbol *sym = sym_lookup((yyvsp[(2) - (3)].string), 0);
@@ -1664,7 +1674,7 @@ yyreduce:
 ;}
    break;
-  case 30:
+  case 31:
    {
        menu_end_entry();
@@ -1672,7 +1682,7 @@ yyreduce:
 ;}
    break;
-  case 31:
+  case 32:
    {
        struct symbol *sym = sym_lookup((yyvsp[(2) - (3)].string), 0);
@@ -1682,7 +1692,7 @@ yyreduce:
 ;}
    break;
-  case 32:
+  case 33:
    {
        if (current_entry->prompt)
@@ -1694,7 +1704,7 @@ yyreduce:
 ;}
    break;
-  case 40:
+  case 41:
    {
        menu_set_type((yyvsp[(1) - (3)].id)->stype);
@@ -1704,7 +1714,7 @@ yyreduce:
 ;}
    break;
-  case 41:
+  case 42:
    {
        menu_add_prompt(P_PROMPT, (yyvsp[(2) - (4)].string), (yyvsp[(3) - (4)].expr));
@@ -1712,7 +1722,7 @@ yyreduce:
 ;}
    break;
-  case 42:
+  case 43:
    {
        menu_add_expr(P_DEFAULT, (yyvsp[(2) - (4)].expr), (yyvsp[(3) - (4)].expr));
@@ -1724,7 +1734,7 @@ yyreduce:
 ;}
    break;
-  case 43:
+  case 44:
    {
        menu_add_symbol(P_SELECT, sym_lookup((yyvsp[(2) - (4)].string), 0), (yyvsp[(3) - (4)].expr));
@@ -1732,7 +1742,7 @@ yyreduce:
 ;}
    break;
-  case 44:
+  case 45:
    {
        menu_add_expr(P_RANGE, expr_alloc_comp(E_RANGE,(yyvsp[(2) - (5)].symbol), (yyvsp[(3) - (5)].symbol)), (yyvsp[(4) - (5)].expr));
@@ -1740,7 +1750,7 @@ yyreduce:
 ;}
    break;
-  case 47:
+  case 48:
    {
        struct kconf_id *id = kconf_id_lookup((yyvsp[(2) - (3)].string), strlen((yyvsp[(2) - (3)].string)));
@@ -1752,17 +1762,17 @@ yyreduce:
 ;}
    break;
-  case 48:
+  case 49:
    { (yyval.string) = NULL; ;}
    break;
-  case 49:
+  case 50:
    { (yyval.string) = (yyvsp[(2) - (2)].string); ;}
    break;
-  case 50:
+  case 51:
    {
        struct symbol *sym = sym_lookup((yyvsp[(2) - (3)].string), SYMBOL_CHOICE);
@@ -1773,14 +1783,14 @@ yyreduce:
 ;}
    break;
-  case 51:
+  case 52:
    {
        (yyval.menu) = menu_add_menu();
 ;}
    break;
-  case 52:
+  case 53:
    {
        if (zconf_endtoken((yyvsp[(1) - (1)].id), T_CHOICE, T_ENDCHOICE)) {
@@ -1790,7 +1800,7 @@ yyreduce:
 ;}
    break;
-  case 60:
+  case 61:
    {
        menu_add_prompt(P_PROMPT, (yyvsp[(2) - (4)].string), (yyvsp[(3) - (4)].expr));
@@ -1798,7 +1808,7 @@ yyreduce:
 ;}
    break;
-  case 61:
+  case 62:
    {
        if ((yyvsp[(1) - (3)].id)->stype == S_BOOLEAN || (yyvsp[(1) - (3)].id)->stype == S_TRISTATE) {
@@ -1811,7 +1821,7 @@ yyreduce:
 ;}
    break;
-  case 62:
+  case 63:
    {
        current_entry->sym->flags |= SYMBOL_OPTIONAL;
@@ -1819,7 +1829,7 @@ yyreduce:
 ;}
    break;
-  case 63:
+  case 64:
    {
        if ((yyvsp[(1) - (4)].id)->stype == S_UNKNOWN) {
@@ -1831,7 +1841,7 @@ yyreduce:
 ;}
    break;
-  case 66:
+  case 67:
    {
        printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno());
@@ -1841,7 +1851,7 @@ yyreduce:
 ;}
    break;
-  case 67:
+  case 68:
    {
        if (zconf_endtoken((yyvsp[(1) - (1)].id), T_IF, T_ENDIF)) {
@@ -1851,14 +1861,14 @@ yyreduce:
 ;}
    break;
-  case 73:
+  case 74:
    {
        menu_add_prompt(P_MENU, (yyvsp[(2) - (3)].string), NULL);
 ;}
    break;
-  case 74:
+  case 75:
    {
        menu_add_entry(NULL);
@@ -1867,14 +1877,14 @@ yyreduce:
 ;}
    break;
-  case 75:
+  case 76:
    {
        (yyval.menu) = menu_add_menu();
 ;}
    break;
-  case 76:
+  case 77:
    {
        if (zconf_endtoken((yyvsp[(1) - (1)].id), T_MENU, T_ENDMENU)) {
@@ -1884,7 +1894,7 @@ yyreduce:
 ;}
    break;
-  case 82:
+  case 83:
    {
        printd(DEBUG_PARSE, "%s:%d:source %s\n", zconf_curname(), zconf_lineno(), (yyvsp[(2) - (3)].string));
@@ -1892,7 +1902,7 @@ yyreduce:
 ;}
    break;
-  case 83:
+  case 84:
    {
        menu_add_entry(NULL);
@@ -1901,14 +1911,14 @@ yyreduce:
 ;}
    break;
-  case 84:
+  case 85:
    {
        menu_end_entry();
 ;}
    break;
-  case 85:
+  case 86:
    {
        printd(DEBUG_PARSE, "%s:%d:help\n", zconf_curname(), zconf_lineno());
@@ -1916,14 +1926,14 @@ yyreduce:
 ;}
    break;
-  case 86:
+  case 87:
    {
        current_entry->help = (yyvsp[(2) - (2)].string);
 ;}
    break;
-  case 91:
+  case 92:
    {
        menu_add_dep((yyvsp[(3) - (4)].expr));
@@ -1931,84 +1941,91 @@ yyreduce:
 ;}
    break;
-  case 93:
+  case 96:
+    {
+        menu_add_visibility((yyvsp[(2) - (2)].expr));
+;}
+    break;
+  case 98:
    {
        menu_add_prompt(P_PROMPT, (yyvsp[(1) - (2)].string), (yyvsp[(2) - (2)].expr));
 ;}
    break;
-  case 96:
+  case 101:
    { (yyval.id) = (yyvsp[(1) - (2)].id); ;}
    break;
-  case 97:
+  case 102:
    { (yyval.id) = (yyvsp[(1) - (2)].id); ;}
    break;
-  case 98:
+  case 103:
    { (yyval.id) = (yyvsp[(1) - (2)].id); ;}
    break;
-  case 101:
+  case 106:
    { (yyval.expr) = NULL; ;}
    break;
-  case 102:
+  case 107:
    { (yyval.expr) = (yyvsp[(2) - (2)].expr); ;}
    break;
-  case 103:
+  case 108:
    { (yyval.expr) = expr_alloc_symbol((yyvsp[(1) - (1)].symbol)); ;}
    break;
-  case 104:
+  case 109:
    { (yyval.expr) = expr_alloc_comp(E_EQUAL, (yyvsp[(1) - (3)].symbol), (yyvsp[(3) - (3)].symbol)); ;}
    break;
-  case 105:
+  case 110:
    { (yyval.expr) = expr_alloc_comp(E_UNEQUAL, (yyvsp[(1) - (3)].symbol), (yyvsp[(3) - (3)].symbol)); ;}
    break;
-  case 106:
+  case 111:
    { (yyval.expr) = (yyvsp[(2) - (3)].expr); ;}
    break;
-  case 107:
+  case 112:
    { (yyval.expr) = expr_alloc_one(E_NOT, (yyvsp[(2) - (2)].expr)); ;}
    break;
-  case 108:
+  case 113:
    { (yyval.expr) = expr_alloc_two(E_OR, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr)); ;}
    break;
-  case 109:
+  case 114:
    { (yyval.expr) = expr_alloc_two(E_AND, (yyvsp[(1) - (3)].expr), (yyvsp[(3) - (3)].expr)); ;}
    break;
-  case 110:
+  case 115:
    { (yyval.symbol) = sym_lookup((yyvsp[(1) - (1)].string), 0); free((yyvsp[(1) - (1)].string)); ;}
    break;
-  case 111:
+  case 116:
    { (yyval.symbol) = sym_lookup((yyvsp[(1) - (1)].string), SYMBOL_CONST); free((yyvsp[(1) - (1)].string)); ;}
    break;
-  case 112:
+  case 117:
    { (yyval.string) = NULL; ;}
    break;
@@ -2278,6 +2295,7 @@ static const char *zconf_tokenname(int token)
        case T_IF:              return "if";
        case T_ENDIF:           return "endif";
        case T_DEPENDS:         return "depends";
+        case T_VISIBLE:         return "visible";
        }
        return "<token>";
 }
diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y
index 2abd3c7ff15d..49fb4ab664c3 100644
--- a/scripts/kconfig/zconf.y
+++ b/scripts/kconfig/zconf.y
@@ -36,7 +36,7 @@ static struct menu *current_menu, *current_entry;
 #define YYERROR_VERBOSE
 #endif
 %}
-%expect 28
+%expect 30
 %union
 {
@@ -68,6 +68,7 @@ static struct menu *current_menu, *current_entry;
 %token <id>T_DEFAULT
 %token <id>T_SELECT
 %token <id>T_RANGE
+%token <id>T_VISIBLE
 %token <id>T_OPTION
 %token <id>T_ON
 %token <string> T_WORD
@@ -123,7 +124,7 @@ stmt_list:
 ;
 option_name:
-        T_DEPENDS | T_PROMPT | T_TYPE | T_SELECT | T_OPTIONAL | T_RANGE | T_DEFAULT
+        T_DEPENDS | T_PROMPT | T_TYPE | T_SELECT | T_OPTIONAL | T_RANGE | T_DEFAULT | T_VISIBLE
 ;
 common_stmt:
@@ -359,7 +360,7 @@ menu: T_MENU prompt T_EOL
        printd(DEBUG_PARSE, "%s:%d:menu\n", zconf_curname(), zconf_lineno());
 };
-menu_entry: menu depends_list
+menu_entry: menu visibility_list depends_list
 {
        $$ = menu_add_menu();
 };
@@ -430,6 +431,19 @@ depends: T_DEPENDS T_ON expr T_EOL
        printd(DEBUG_PARSE, "%s:%d:depends on\n", zconf_curname(), zconf_lineno());
 };
+/* visibility option */
+visibility_list:
+          /* empty */
+        | visibility_list visible
+        | visibility_list T_EOL
+;
+visible: T_VISIBLE if_expr
+{
+        menu_add_visibility($2);
+};
 /* prompt statement */
 prompt_stmt_opt:
@@ -526,6 +540,7 @@ static const char *zconf_tokenname(int token)
        case T_IF:              return "if";
        case T_ENDIF:           return "endif";
        case T_DEPENDS:         return "depends";
+        case T_VISIBLE:         return "visible";
        }
        return "<token>";
 }
diff --git a/sound/atmel/abdac.c b/sound/atmel/abdac.c
index f2f41c854221..6e2409181895 100644
--- a/sound/atmel/abdac.c
+++ b/sound/atmel/abdac.c
@@ -420,9 +420,9 @@ static int __devinit atmel_abdac_probe(struct platform_device *pdev)
                return PTR_ERR(pclk);
        }
        sample_clk = clk_get(&pdev->dev, "sample_clk");
-        if (IS_ERR(pclk)) {
+        if (IS_ERR(sample_clk)) {
                dev_dbg(&pdev->dev, "no sample clock\n");
-                retval = PTR_ERR(pclk);
+                retval = PTR_ERR(sample_clk);
                goto out_put_pclk;
        }
        clk_enable(pclk);
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 5c8c7dff8ede..b753ec661fcf 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1510,16 +1510,19 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
 static int snd_pcm_oss_reset(struct snd_pcm_oss_file *pcm_oss_file)
 {
        struct snd_pcm_substream *substream;
+        struct snd_pcm_runtime *runtime;
+        int i;
-        substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
+        for (i = 0; i < 2; i++) { 
-        if (substream != NULL) {
+                substream = pcm_oss_file->streams[i];
-                snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+                if (!substream)
-                substream->runtime->oss.prepare = 1;
+                        continue;
-        }
+                runtime = substream->runtime;
-        substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
-        if (substream != NULL) {
                snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
-                substream->runtime->oss.prepare = 1;
+                runtime->oss.prepare = 1;
+                runtime->oss.buffer_used = 0;
+                runtime->oss.prev_hw_ptr_period = 0;
+                runtime->oss.period_ptr = 0;
        }
        return 0;
 }
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index a1707cca9c66..b75db8e9cc0f 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -223,7 +223,7 @@ static void xrun_log(struct snd_pcm_substream *substream,
        entry->jiffies = jiffies;
        entry->pos = pos;
        entry->period_size = runtime->period_size;
-        entry->buffer_size = runtime->buffer_size;;
+        entry->buffer_size = runtime->buffer_size;
        entry->old_hw_ptr = runtime->status->hw_ptr;
        entry->hw_ptr_base = runtime->hw_ptr_base;
        log->idx = (log->idx + 1) % XRUN_LOG_CNT;
diff --git a/sound/oss/dev_table.c b/sound/oss/dev_table.c
index 727bdb9ba2dc..d8cf3e58dc76 100644
--- a/sound/oss/dev_table.c
+++ b/sound/oss/dev_table.c
@@ -71,7 +71,7 @@ int sound_install_audiodrv(int vers, char *name, struct audio_driver *driver,
        if (sound_nblocks >= MAX_MEM_BLOCKS)
                sound_nblocks = MAX_MEM_BLOCKS - 1;
-        op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations)));
+        op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vzalloc(sizeof(struct audio_operations)));
        sound_nblocks++;
        if (sound_nblocks >= MAX_MEM_BLOCKS)
                sound_nblocks = MAX_MEM_BLOCKS - 1;
@@ -81,7 +81,6 @@ int sound_install_audiodrv(int vers, char *name, struct audio_driver *driver,
                sound_unload_audiodev(num);
                return -(ENOMEM);
        }
-        memset((char *) op, 0, sizeof(struct audio_operations));
        init_waitqueue_head(&op->in_sleeper);
        init_waitqueue_head(&op->out_sleeper);  
        init_waitqueue_head(&op->poll_sleeper);
@@ -128,7 +127,7 @@ int sound_install_mixer(int vers, char *name, struct mixer_operations *driver,
        /* FIXME: This leaks a mixer_operations struct every time its called
           until you unload sound! */
           
-        op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations)));
+        op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vzalloc(sizeof(struct mixer_operations)));
        sound_nblocks++;
        if (sound_nblocks >= MAX_MEM_BLOCKS)
                sound_nblocks = MAX_MEM_BLOCKS - 1;
@@ -137,7 +136,6 @@ int sound_install_mixer(int vers, char *name, struct mixer_operations *driver,
                printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name);
                return -ENOMEM;
        }
-        memset((char *) op, 0, sizeof(struct mixer_operations));
        memcpy((char *) op, (char *) driver, driver_size);
        strlcpy(op->name, name, sizeof(op->name));
diff --git a/sound/oss/midibuf.c b/sound/oss/midibuf.c
index 782b3b84dac6..ceedb1eff203 100644
--- a/sound/oss/midibuf.c
+++ b/sound/oss/midibuf.c
@@ -178,7 +178,7 @@ int MIDIbuf_open(int dev, struct file *file)
                return err;
        parms[dev].prech_timeout = MAX_SCHEDULE_TIMEOUT;
-        midi_in_buf[dev] = (struct midi_buf *) vmalloc(sizeof(struct midi_buf));
+        midi_in_buf[dev] = vmalloc(sizeof(struct midi_buf));
        if (midi_in_buf[dev] == NULL)
        {
@@ -188,7 +188,7 @@ int MIDIbuf_open(int dev, struct file *file)
        }
        midi_in_buf[dev]->len = midi_in_buf[dev]->head = midi_in_buf[dev]->tail = 0;
-        midi_out_buf[dev] = (struct midi_buf *) vmalloc(sizeof(struct midi_buf));
+        midi_out_buf[dev] = vmalloc(sizeof(struct midi_buf));
        if (midi_out_buf[dev] == NULL)
        {
diff --git a/sound/oss/pss.c b/sound/oss/pss.c
index e19dd5dcc2de..9b800ce5100e 100644
--- a/sound/oss/pss.c
+++ b/sound/oss/pss.c
@@ -859,7 +859,7 @@ static int pss_coproc_ioctl(void *dev_info, unsigned int cmd, void __user *arg,
                        return 0;
                case SNDCTL_COPR_LOAD:
-                        buf = (copr_buffer *) vmalloc(sizeof(copr_buffer));
+                        buf = vmalloc(sizeof(copr_buffer));
                        if (buf == NULL)
                                return -ENOSPC;
                        if (copy_from_user(buf, arg, sizeof(copr_buffer))) {
@@ -871,7 +871,7 @@ static int pss_coproc_ioctl(void *dev_info, unsigned int cmd, void __user *arg,
                        return err;
                
                case SNDCTL_COPR_SENDMSG:
-                        mbuf = (copr_msg *)vmalloc(sizeof(copr_msg));
+                        mbuf = vmalloc(sizeof(copr_msg));
                        if (mbuf == NULL)
                                return -ENOSPC;
                        if (copy_from_user(mbuf, arg, sizeof(copr_msg))) {
@@ -895,7 +895,7 @@ static int pss_coproc_ioctl(void *dev_info, unsigned int cmd, void __user *arg,
                case SNDCTL_COPR_RCVMSG:
                        err = 0;
-                        mbuf = (copr_msg *)vmalloc(sizeof(copr_msg));
+                        mbuf = vmalloc(sizeof(copr_msg));
                        if (mbuf == NULL)
                                return -ENOSPC;
                        data = (unsigned short *)mbuf->data;
diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
index e85789e53816..5ea1098ac427 100644
--- a/sound/oss/sequencer.c
+++ b/sound/oss/sequencer.c
@@ -1646,13 +1646,13 @@ void sequencer_init(void)
 {
        if (sequencer_ok)
                return;
-        queue = (unsigned char *)vmalloc(SEQ_MAX_QUEUE * EV_SZ);
+        queue = vmalloc(SEQ_MAX_QUEUE * EV_SZ);
        if (queue == NULL)
        {
                printk(KERN_ERR "sequencer: Can't allocate memory for sequencer output queue\n");
                return;
        }
-        iqueue = (unsigned char *)vmalloc(SEQ_MAX_QUEUE * IEV_SZ);
+        iqueue = vmalloc(SEQ_MAX_QUEUE * IEV_SZ);
        if (iqueue == NULL)
        {
                printk(KERN_ERR "sequencer: Can't allocate memory for sequencer input queue\n");
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index 62895a719fcb..22dbd91811a4 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -435,7 +435,7 @@ void __devexit asihpi_adapter_remove(struct pci_dev *pci_dev)
        struct hpi_message hm;
        struct hpi_response hr;
        struct hpi_adapter *pa;
-        pa = (struct hpi_adapter *)pci_get_drvdata(pci_dev);
+        pa = pci_get_drvdata(pci_dev);
        hpi_init_message_response(&hm, &hr, HPI_OBJ_SUBSYSTEM,
                HPI_SUBSYS_DELETE_ADAPTER);
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 4679ed83a43b..2f3cacbd5528 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -1129,10 +1129,11 @@ snd_azf3328_codec_setdmaa(struct snd_azf3328 *chip,
                count_areas = size/2;
                addr_area2 = addr+count_areas;
-                count_areas--; /* max. index */
                snd_azf3328_dbgcodec("setdma: buffers %08lx[%u] / %08lx[%u]\n",
                                addr, count_areas, addr_area2, count_areas);
+                count_areas--; /* max. index */
                /* build combined I/O buffer length word */
                lengths = (count_areas << 16) | (count_areas);
                spin_lock_irqsave(&chip->reg_lock, flags);
@@ -1740,11 +1741,15 @@ static const struct snd_pcm_hardware snd_azf3328_hardware =
        .rate_max =             AZF_FREQ_66200,
        .channels_min =         1,
        .channels_max =         2,
-        .buffer_bytes_max =     65536,
+        .buffer_bytes_max =     (64*1024),
-        .period_bytes_min =     64,
+        .period_bytes_min =     1024,
-        .period_bytes_max =     65536,
+        .period_bytes_max =     (32*1024),
-        .periods_min =          1,
+        /* We simply have two DMA areas (instead of a list of descriptors
-        .periods_max =          1024,
+           such as other cards); I believe that this is a fixed hardware
+           attribute and there isn't much driver magic to be done to expand it.
+           Thus indicate that we have at least and at most 2 periods. */
+        .periods_min =          2,
+        .periods_max =          2,
        /* FIXME: maybe that card actually has a FIFO?
         * Hmm, it seems newer revisions do have one, but we still don't know
         * its size... */
@@ -1980,8 +1985,13 @@ snd_azf3328_timer_stop(struct snd_timer *timer)
        chip = snd_timer_chip(timer);
        spin_lock_irqsave(&chip->reg_lock, flags);
        /* disable timer countdown and interrupt */
-        /* FIXME: should we write TIMER_IRQ_ACK here? */
+        /* Hmm, should we write TIMER_IRQ_ACK here?
-        snd_azf3328_ctrl_outb(chip, IDX_IO_TIMER_VALUE + 3, 0);
+           YES indeed, otherwise a rogue timer operation - which prompts
+           ALSA(?) to call repeated stop() in vain, but NOT start() -
+           will never end (value 0x03 is kept shown in control byte).
+           Simply manually poking 0x04 _once_ immediately successfully stops
+           the hardware/ALSA interrupt activity. */
+        snd_azf3328_ctrl_outb(chip, IDX_IO_TIMER_VALUE + 3, 0x04);
        spin_unlock_irqrestore(&chip->reg_lock, flags);
        snd_azf3328_dbgcallleave();
        return 0;
diff --git a/sound/pci/ctxfi/ctpcm.c b/sound/pci/ctxfi/ctpcm.c
index 85ab43e89212..457d21189b0d 100644
--- a/sound/pci/ctxfi/ctpcm.c
+++ b/sound/pci/ctxfi/ctpcm.c
@@ -129,8 +129,6 @@ static int ct_pcm_playback_open(struct snd_pcm_substream *substream)
        apcm->substream = substream;
        apcm->interrupt = ct_atc_pcm_interrupt;
-        runtime->private_data = apcm;
-        runtime->private_free = ct_atc_pcm_free_substream;
        if (IEC958 == substream->pcm->device) {
                runtime->hw = ct_spdif_passthru_playback_hw;
                atc->spdif_out_passthru(atc, 1);
@@ -155,8 +153,12 @@ static int ct_pcm_playback_open(struct snd_pcm_substream *substream)
        }
        apcm->timer = ct_timer_instance_new(atc->timer, apcm);
-        if (!apcm->timer)
+        if (!apcm->timer) {
+                kfree(apcm);
                return -ENOMEM;
+        }
+        runtime->private_data = apcm;
+        runtime->private_free = ct_atc_pcm_free_substream;
        return 0;
 }
@@ -278,8 +280,6 @@ static int ct_pcm_capture_open(struct snd_pcm_substream *substream)
        apcm->started = 0;
        apcm->substream = substream;
        apcm->interrupt = ct_atc_pcm_interrupt;
-        runtime->private_data = apcm;
-        runtime->private_free = ct_atc_pcm_free_substream;
        runtime->hw = ct_pcm_capture_hw;
        runtime->hw.rate_max = atc->rsr * atc->msr;
@@ -298,8 +298,12 @@ static int ct_pcm_capture_open(struct snd_pcm_substream *substream)
        }
        apcm->timer = ct_timer_instance_new(atc->timer, apcm);
-        if (!apcm->timer)
+        if (!apcm->timer) {
+                kfree(apcm);
                return -ENOMEM;
+        }
+        runtime->private_data = apcm;
+        runtime->private_free = ct_atc_pcm_free_substream;
        return 0;
 }
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 6361f752b5f3..846d1ead47fd 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3100,6 +3100,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTRO),
        SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
+        SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_HP_LAPTOP),
        SND_PCI_QUIRK(0x1179, 0xff1e, "Toshiba Satellite C650D", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
        SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
@@ -3110,6 +3111,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x21b2, "Thinkpad X100e", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x21b3, "Thinkpad Edge 13 (197)", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x21b4, "Thinkpad Edge", CXT5066_IDEAPAD),
+        SND_PCI_QUIRK(0x17aa, 0x21c8, "Thinkpad Edge 11", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G series", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x390a, "Lenovo S10-3t", CXT5066_IDEAPAD),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 5f00589cb791..8fddc9d08726 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1614,6 +1614,7 @@ do_sku:
                spec->init_amp = ALC_INIT_GPIO3;
                break;
        case 5:
+        default:
                spec->init_amp = ALC_INIT_DEFAULT;
                break;
        }
@@ -2014,6 +2015,36 @@ static struct hda_verb alc888_acer_aspire_6530g_verbs[] = {
 };
 /*
+ *ALC888 Acer Aspire 7730G model
+ */
+static struct hda_verb alc888_acer_aspire_7730G_verbs[] = {
+/* Bias voltage on for external mic port */
+        {0x18, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN | PIN_VREF80},
+/* Front Mic: set to PIN_IN (empty by default) */
+        {0x12, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
+/* Unselect Front Mic by default in input mixer 3 */
+        {0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0xb)},
+/* Enable unsolicited event for HP jack */
+        {0x15, AC_VERB_SET_UNSOLICITED_ENABLE, ALC880_HP_EVENT | AC_USRSP_EN},
+/* Enable speaker output */
+        {0x14, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
+        {0x14, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        {0x14, AC_VERB_SET_EAPD_BTLENABLE, 2},
+/* Enable headphone output */
+        {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT | PIN_HP},
+        {0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        {0x15, AC_VERB_SET_CONNECT_SEL, 0x00},
+        {0x15, AC_VERB_SET_EAPD_BTLENABLE, 2},
+/*Enable internal subwoofer */
+        {0x17, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
+        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        {0x17, AC_VERB_SET_CONNECT_SEL, 0x02},
+        {0x17, AC_VERB_SET_EAPD_BTLENABLE, 2},
+        { }
+};
+/*
 * ALC889 Acer Aspire 8930G model
 */
@@ -2200,6 +2231,16 @@ static void alc888_acer_aspire_6530g_setup(struct hda_codec *codec)
        spec->autocfg.speaker_pins[2] = 0x17;
 }
+static void alc888_acer_aspire_7730g_setup(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        spec->autocfg.hp_pins[0] = 0x15;
+        spec->autocfg.speaker_pins[0] = 0x14;
+        spec->autocfg.speaker_pins[1] = 0x16;
+        spec->autocfg.speaker_pins[2] = 0x17;
+}
 static void alc889_acer_aspire_8930g_setup(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
@@ -9524,13 +9565,6 @@ static struct hda_verb alc883_acer_eapd_verbs[] = {
        { }
 };
-static struct hda_verb alc888_acer_aspire_7730G_verbs[] = {
-        {0x15, AC_VERB_SET_CONNECT_SEL, 0x00},
-        {0x17, AC_VERB_SET_CONNECT_SEL, 0x02},
-        {0x15, AC_VERB_SET_UNSOLICITED_ENABLE, ALC880_HP_EVENT | AC_USRSP_EN},
-        { } /* end */
-};
 static void alc888_6st_dell_setup(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
@@ -9831,7 +9865,6 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x3bfc, "Lenovo NB0763", ALC883_LENOVO_NB0763),
        SND_PCI_QUIRK(0x17aa, 0x3bfd, "Lenovo NB0763", ALC883_LENOVO_NB0763),
        SND_PCI_QUIRK(0x17aa, 0x101d, "Lenovo Sky", ALC888_LENOVO_SKY),
-        SND_PCI_QUIRK(0x17c0, 0x4071, "MEDION MD2", ALC883_MEDION_MD2),
        SND_PCI_QUIRK(0x17c0, 0x4085, "MEDION MD96630", ALC888_LENOVO_MS7195_DIG),
        SND_PCI_QUIRK(0x17f2, 0x5000, "Albatron KI690-AM2", ALC883_6ST_DIG),
        SND_PCI_QUIRK(0x1991, 0x5625, "Haier W66", ALC883_HAIER_W66),
@@ -10328,7 +10361,7 @@ static struct alc_config_preset alc882_presets[] = {
                .const_channel_count = 6,
                .input_mux = &alc883_capture_source,
                .unsol_event = alc_automute_amp_unsol_event,
-                .setup = alc888_acer_aspire_6530g_setup,
+                .setup = alc888_acer_aspire_7730g_setup,
                .init_hook = alc_automute_amp,
        },
        [ALC883_MEDION] = {
@@ -14623,7 +14656,10 @@ static int alc275_setup_dual_adc(struct hda_codec *codec)
 /* different alc269-variants */
 enum {
        ALC269_TYPE_NORMAL,
+        ALC269_TYPE_ALC258,
        ALC269_TYPE_ALC259,
+        ALC269_TYPE_ALC269VB,
+        ALC269_TYPE_ALC270,
        ALC269_TYPE_ALC271X,
 };
@@ -15023,7 +15059,7 @@ static int alc269_fill_coef(struct hda_codec *codec)
 static int patch_alc269(struct hda_codec *codec)
 {
        struct alc_spec *spec;
-        int board_config;
+        int board_config, coef;
        int err;
        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
@@ -15034,14 +15070,23 @@ static int patch_alc269(struct hda_codec *codec)
        alc_auto_parse_customize_define(codec);
-        if ((alc_read_coef_idx(codec, 0) & 0x00f0) == 0x0010){
+        coef = alc_read_coef_idx(codec, 0);
+        if ((coef & 0x00f0) == 0x0010) {
                if (codec->bus->pci->subsystem_vendor == 0x1025 &&
                    spec->cdefine.platform_type == 1) {
                        alc_codec_rename(codec, "ALC271X");
                        spec->codec_variant = ALC269_TYPE_ALC271X;
-                } else {
+                } else if ((coef & 0xf000) == 0x1000) {
+                        spec->codec_variant = ALC269_TYPE_ALC270;
+                } else if ((coef & 0xf000) == 0x2000) {
                        alc_codec_rename(codec, "ALC259");
                        spec->codec_variant = ALC269_TYPE_ALC259;
+                } else if ((coef & 0xf000) == 0x3000) {
+                        alc_codec_rename(codec, "ALC258");
+                        spec->codec_variant = ALC269_TYPE_ALC258;
+                } else {
+                        alc_codec_rename(codec, "ALC269VB");
+                        spec->codec_variant = ALC269_TYPE_ALC269VB;
                }
        } else
                alc_fix_pll_init(codec, 0x20, 0x04, 15);
@@ -15104,7 +15149,7 @@ static int patch_alc269(struct hda_codec *codec)
        spec->stream_digital_capture = &alc269_pcm_digital_capture;
        if (!spec->adc_nids) { /* wasn't filled automatically? use default */
-                if (spec->codec_variant != ALC269_TYPE_NORMAL) {
+                if (spec->codec_variant == ALC269_TYPE_NORMAL) {
                        spec->adc_nids = alc269_adc_nids;
                        spec->num_adc_nids = ARRAY_SIZE(alc269_adc_nids);
                        spec->capsrc_nids = alc269_capsrc_nids;
@@ -16898,7 +16943,7 @@ static struct alc_config_preset alc861vd_presets[] = {
 static int alc861vd_auto_create_input_ctls(struct hda_codec *codec,
                                                const struct auto_pin_cfg *cfg)
 {
-        return alc_auto_create_input_ctls(codec, cfg, 0x15, 0x09, 0);
+        return alc_auto_create_input_ctls(codec, cfg, 0x0b, 0x22, 0);
 }
@@ -18952,6 +18997,8 @@ static inline hda_nid_t alc662_mix_to_dac(hda_nid_t nid)
                return 0x02;
        else if (nid >= 0x0c && nid <= 0x0e)
                return nid - 0x0c + 0x02;
+        else if (nid == 0x26) /* ALC887-VD has this DAC too */
+                return 0x25;
        else
                return 0;
 }
@@ -18960,7 +19007,7 @@ static inline hda_nid_t alc662_mix_to_dac(hda_nid_t nid)
 static hda_nid_t alc662_dac_to_mix(struct hda_codec *codec, hda_nid_t pin,
                                   hda_nid_t dac)
 {
-        hda_nid_t mix[4];
+        hda_nid_t mix[5];
        int i, num;
        num = snd_hda_get_connections(codec, pin, mix, ARRAY_SIZE(mix));
@@ -19298,6 +19345,7 @@ static const struct alc_fixup alc662_fixups[] = {
 static struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+        SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
        {}
@@ -19419,7 +19467,10 @@ static int patch_alc888(struct hda_codec *codec)
 {
        if ((alc_read_coef_idx(codec, 0) & 0x00f0)==0x0030){
                kfree(codec->chip_name);
-                codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
+                if (codec->vendor_id == 0x10ec0887)
+                        codec->chip_name = kstrdup("ALC887-VD", GFP_KERNEL);
+                else
+                        codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
                if (!codec->chip_name) {
                        alc_free(codec);
                        return -ENOMEM;
@@ -19909,7 +19960,7 @@ static struct hda_codec_preset snd_hda_preset_realtek[] = {
        { .id = 0x10ec0885, .rev = 0x100103, .name = "ALC889A",
          .patch = patch_alc882 },
        { .id = 0x10ec0885, .name = "ALC885", .patch = patch_alc882 },
-        { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc882 },
+        { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc888 },
        { .id = 0x10ec0888, .rev = 0x100101, .name = "ALC1200",
          .patch = patch_alc882 },
        { .id = 0x10ec0888, .name = "ALC888", .patch = patch_alc888 },
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 93fa59cc60ef..efa4225f5fd6 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -389,6 +389,11 @@ static hda_nid_t stac92hd83xxx_dmic_nids[STAC92HD83XXX_NUM_DMICS + 1] = {
        0x11, 0x20, 0
 };
+#define STAC92HD87B_NUM_DMICS    1
+static hda_nid_t stac92hd87b_dmic_nids[STAC92HD87B_NUM_DMICS + 1] = {
+        0x11, 0
+};
 #define STAC92HD83XXX_NUM_CAPS  2
 static unsigned long stac92hd83xxx_capvols[] = {
        HDA_COMPOSE_AMP_VAL(0x17, 3, 0, HDA_OUTPUT),
@@ -1622,6 +1627,8 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
 static struct snd_pci_quirk stac92hd73xx_codec_id_cfg_tbl[] = {
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02a1,
                      "Alienware M17x", STAC_ALIENWARE_M17X),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x043a,
+                      "Alienware M17x", STAC_ALIENWARE_M17X),
        {} /* terminator */
 };
@@ -3486,10 +3493,8 @@ static int stac92xx_auto_create_dmic_input_ctls(struct hda_codec *codec,
                                return err;
                }
-                if (snd_hda_get_bool_hint(codec, "separate_dmux") != 1) {
+                if (snd_hda_get_bool_hint(codec, "separate_dmux") != 1)
                        snd_hda_add_imux_item(imux, label, index, NULL);
-                        spec->num_analog_muxes++;
-                }
        }
        return 0;
@@ -5452,12 +5457,17 @@ again:
                                stac92hd83xxx_brd_tbl[spec->board_config]);
        switch (codec->vendor_id) {
+        case 0x111d76d1:
+        case 0x111d76d9:
+                spec->dmic_nids = stac92hd87b_dmic_nids;
+                spec->num_dmics = stac92xx_connected_ports(codec,
+                                stac92hd87b_dmic_nids,
+                                STAC92HD87B_NUM_DMICS);
+                /* Fall through */
        case 0x111d7666:
        case 0x111d7667:
        case 0x111d7668:
        case 0x111d7669:
-        case 0x111d76d1:
-        case 0x111d76d9:
                spec->num_pins = ARRAY_SIZE(stac92hd88xxx_pin_nids);
                spec->pin_nids = stac92hd88xxx_pin_nids;
                spec->mono_nid = 0;
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 400f9ebd243e..629a5494347a 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -1866,6 +1866,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
        },
        {
                .subvendor = 0x1028,
+                .subdevice = 0x0182,
+                .name = "Dell Latitude D610",   /* STAC9750/51 */
+                .type = AC97_TUNE_HP_ONLY
+        },
+        {
+                .subvendor = 0x1028,
                .subdevice = 0x0186,
                .name = "Dell Latitude D810", /* cf. Malone #41015 */
                .type = AC97_TUNE_HP_MUTE_LED
diff --git a/sound/pci/mixart/mixart_hwdep.h b/sound/pci/mixart/mixart_hwdep.h
index a46f5083db99..812e288ef2e7 100644
--- a/sound/pci/mixart/mixart_hwdep.h
+++ b/sound/pci/mixart/mixart_hwdep.h
@@ -25,11 +25,21 @@
 #include <sound/hwdep.h>
+#ifndef readl_be
 #define readl_be(x) be32_to_cpu(__raw_readl(x))
+#endif
+#ifndef writel_be
 #define writel_be(data,addr) __raw_writel(cpu_to_be32(data),addr)
+#endif
+#ifndef readl_le
 #define readl_le(x) le32_to_cpu(__raw_readl(x))
+#endif
+#ifndef writel_le
 #define writel_le(data,addr) __raw_writel(cpu_to_le32(data),addr)
+#endif
 #define MIXART_MEM(mgr,x)       ((mgr)->mem[0].virt + (x))
 #define MIXART_REG(mgr,x)       ((mgr)->mem[1].virt + (x))
diff --git a/sound/ppc/pmac.c b/sound/ppc/pmac.c
index 85081172403f..b47cfd45b3b9 100644
--- a/sound/ppc/pmac.c
+++ b/sound/ppc/pmac.c
@@ -1228,10 +1228,8 @@ int __devinit snd_pmac_new(struct snd_card *card, struct snd_pmac **chip_return)
                                               chip->rsrc[i].start + 1,
                                               rnames[i]) == NULL) {
                                printk(KERN_ERR "snd: can't request rsrc "
-                                       " %d (%s: 0x%016llx:%016llx)\n",
+                                       " %d (%s: %pR)\n",
-                                       i, rnames[i],
+                                       i, rnames[i], &chip->rsrc[i]);
-                                       (unsigned long long)chip->rsrc[i].start,
-                                       (unsigned long long)chip->rsrc[i].end);
                                err = -ENODEV;
                                goto __error;
                        }
@@ -1256,10 +1254,8 @@ int __devinit snd_pmac_new(struct snd_card *card, struct snd_pmac **chip_return)
                                               chip->rsrc[i].start + 1,
                                               rnames[i]) == NULL) {
                                printk(KERN_ERR "snd: can't request rsrc "
-                                       " %d (%s: 0x%016llx:%016llx)\n",
+                                       " %d (%s: %pR)\n",
-                                       i, rnames[i],
+                                       i, rnames[i], &chip->rsrc[i]);
-                                       (unsigned long long)chip->rsrc[i].start,
-                                       (unsigned long long)chip->rsrc[i].end);
                                err = -ENODEV;
                                goto __error;
                        }
diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
index e720d5e6f04c..bee3c94f58b0 100644
--- a/sound/soc/atmel/Kconfig
+++ b/sound/soc/atmel/Kconfig
@@ -16,7 +16,8 @@ config SND_ATMEL_SOC_SSC
 config SND_AT91_SOC_SAM9G20_WM8731
        tristate "SoC Audio support for WM8731-based At91sam9g20 evaluation board"
-        depends on ATMEL_SSC && ARCH_AT91SAM9G20 && SND_ATMEL_SOC
+        depends on ATMEL_SSC && ARCH_AT91SAM9G20 && SND_ATMEL_SOC && \
+                   AT91_PROGRAMMABLE_CLOCKS
        select SND_ATMEL_SOC_SSC
        select SND_SOC_WM8731
        help
@@ -25,7 +26,7 @@ config SND_AT91_SOC_SAM9G20_WM8731
 config SND_AT32_SOC_PLAYPAQ
        tristate "SoC Audio support for PlayPaq with WM8510"
-        depends on SND_ATMEL_SOC && BOARD_PLAYPAQ
+        depends on SND_ATMEL_SOC && BOARD_PLAYPAQ && AT91_PROGRAMMABLE_CLOCKS
        select SND_ATMEL_SOC_SSC
        select SND_SOC_WM8510
        help
diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c
index 293569dfd0ed..e521ada80542 100644
--- a/sound/soc/atmel/sam9g20_wm8731.c
+++ b/sound/soc/atmel/sam9g20_wm8731.c
@@ -222,9 +222,9 @@ static int __init at91sam9g20ek_init(void)
        }
        pllb = clk_get(NULL, "pllb");
-        if (IS_ERR(mclk)) {
+        if (IS_ERR(pllb)) {
                printk(KERN_ERR "ASoC: Failed to get PLLB\n");
-                ret = PTR_ERR(mclk);
+                ret = PTR_ERR(pllb);
                goto err_mclk;
        }
        ret = clk_set_parent(mclk, pllb);
@@ -240,6 +240,7 @@ static int __init at91sam9g20ek_init(void)
        if (!at91sam9g20ek_snd_device) {
                printk(KERN_ERR "ASoC: Platform device allocation failed\n");
                ret = -ENOMEM;
+                goto err_mclk;
        }
        platform_set_drvdata(at91sam9g20ek_snd_device,
@@ -248,11 +249,13 @@ static int __init at91sam9g20ek_init(void)
        ret = platform_device_add(at91sam9g20ek_snd_device);
        if (ret) {
                printk(KERN_ERR "ASoC: Platform device allocation failed\n");
-                platform_device_put(at91sam9g20ek_snd_device);
+                goto err_device_add;
        }
        return ret;
+err_device_add:
+        platform_device_put(at91sam9g20ek_snd_device);
 err_mclk:
        clk_put(mclk);
        mclk = NULL;
diff --git a/sound/soc/atmel/snd-soc-afeb9260.c b/sound/soc/atmel/snd-soc-afeb9260.c
index e3d283561c19..86e0f8586dc3 100644
--- a/sound/soc/atmel/snd-soc-afeb9260.c
+++ b/sound/soc/atmel/snd-soc-afeb9260.c
@@ -167,7 +167,6 @@ static int __init afeb9260_soc_init(void)
        return 0;
 err1:
-        platform_device_del(afeb9260_snd_device);
        platform_device_put(afeb9260_snd_device);
        return err;
 }
diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
index bc22ee93a75d..d63e28773eb1 100644
--- a/sound/soc/codecs/max98088.c
+++ b/sound/soc/codecs/max98088.c
@@ -28,6 +28,11 @@
 #include <sound/max98088.h>
 #include "max98088.h"
+enum max98088_type {
+       MAX98088,
+       MAX98089,
+};
 struct max98088_cdata {
       unsigned int rate;
       unsigned int fmt;
@@ -36,6 +41,7 @@ struct max98088_cdata {
 struct max98088_priv {
       u8 reg_cache[M98088_REG_CNT];
+       enum max98088_type devtype;
       void *control_data;
       struct max98088_pdata *pdata;
       unsigned int sysclk;
@@ -2013,7 +2019,10 @@ err_access:
 static int max98088_remove(struct snd_soc_codec *codec)
 {
+       struct max98088_priv *max98088 = snd_soc_codec_get_drvdata(codec);
       max98088_set_bias_level(codec, SND_SOC_BIAS_OFF);
+       kfree(max98088->eq_texts);
       return 0;
 }
@@ -2040,6 +2049,8 @@ static int max98088_i2c_probe(struct i2c_client *i2c,
       if (max98088 == NULL)
               return -ENOMEM;
+       max98088->devtype = id->driver_data;
       i2c_set_clientdata(i2c, max98088);
       max98088->control_data = i2c;
       max98088->pdata = i2c->dev.platform_data;
@@ -2059,7 +2070,8 @@ static int __devexit max98088_i2c_remove(struct i2c_client *client)
 }
 static const struct i2c_device_id max98088_i2c_id[] = {
-       { "max98088", 0 },
+       { "max98088", MAX98088 },
+       { "max98089", MAX98089 },
       { }
 };
 MODULE_DEVICE_TABLE(i2c, max98088_i2c_id);
diff --git a/sound/soc/codecs/stac9766.c b/sound/soc/codecs/stac9766.c
index 00d67cc8e206..061f9e5a497b 100644
--- a/sound/soc/codecs/stac9766.c
+++ b/sound/soc/codecs/stac9766.c
@@ -383,6 +383,7 @@ static struct snd_soc_codec_driver soc_codec_dev_stac9766 = {
        .reg_cache_size = sizeof(stac9766_reg),
        .reg_word_size = sizeof(u16),
        .reg_cache_step = 2,
+        .reg_cache_default = stac9766_reg,
 };
 static __devinit int stac9766_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index fc687790188b..77b8f9ae29be 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1176,7 +1176,7 @@ EXPORT_SYMBOL_GPL(aic3x_set_gpio);
 int aic3x_get_gpio(struct snd_soc_codec *codec, int gpio)
 {
        u8 reg = gpio ? AIC3X_GPIO2_REG : AIC3X_GPIO1_REG;
-        u8 val, bit = gpio ? 2: 1;
+        u8 val = 0, bit = gpio ? 2 : 1;
        aic3x_read(codec, reg, &val);
        return (val >> bit) & 1;
@@ -1204,7 +1204,7 @@ EXPORT_SYMBOL_GPL(aic3x_set_headset_detection);
 int aic3x_headset_detected(struct snd_soc_codec *codec)
 {
-        u8 val;
+        u8 val = 0;
        aic3x_read(codec, AIC3X_HEADSET_DETECT_CTRL_B, &val);
        return (val >> 4) & 1;
 }
@@ -1212,7 +1212,7 @@ EXPORT_SYMBOL_GPL(aic3x_headset_detected);
 int aic3x_button_pressed(struct snd_soc_codec *codec)
 {
-        u8 val;
+        u8 val = 0;
        aic3x_read(codec, AIC3X_HEADSET_DETECT_CTRL_B, &val);
        return (val >> 5) & 1;
 }
diff --git a/sound/soc/codecs/tpa6130a2.c b/sound/soc/codecs/tpa6130a2.c
index ee4fb201de60..d2c243095673 100644
--- a/sound/soc/codecs/tpa6130a2.c
+++ b/sound/soc/codecs/tpa6130a2.c
@@ -78,8 +78,10 @@ static int tpa6130a2_i2c_write(int reg, u8 value)
        if (data->power_state) {
                val = i2c_smbus_write_byte_data(tpa6130a2_client, reg, value);
-                if (val < 0)
+                if (val < 0) {
                        dev_err(&tpa6130a2_client->dev, "Write failed\n");
+                        return val;
+                }
        }
        /* Either powered on or off, we save the context */
diff --git a/sound/soc/codecs/uda134x.c b/sound/soc/codecs/uda134x.c
index 7540a509a6f5..464f0cfa4c7a 100644
--- a/sound/soc/codecs/uda134x.c
+++ b/sound/soc/codecs/uda134x.c
@@ -597,6 +597,7 @@ static struct snd_soc_codec_driver soc_codec_dev_uda134x = {
        .resume =       uda134x_soc_resume,
        .reg_cache_size = sizeof(uda134x_reg),
        .reg_word_size = sizeof(u8),
+        .reg_cache_default = uda134x_reg,
        .reg_cache_step = 1,
        .read = uda134x_read_reg_cache,
        .write = uda134x_write,
diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
index f4f1fba38eb9..7611add7f8c3 100644
--- a/sound/soc/codecs/wm8350.c
+++ b/sound/soc/codecs/wm8350.c
@@ -831,7 +831,7 @@ static int wm8350_set_dai_sysclk(struct snd_soc_dai *codec_dai,
        }
        /* MCLK direction */
-        if (dir == WM8350_MCLK_DIR_OUT)
+        if (dir == SND_SOC_CLOCK_OUT)
                wm8350_set_bits(wm8350, WM8350_CLOCK_CONTROL_2,
                                WM8350_MCLK_DIR);
        else
@@ -1586,6 +1586,13 @@ static  int wm8350_codec_probe(struct snd_soc_codec *codec)
        wm8350_set_bits(wm8350, WM8350_ROUT2_VOLUME,
                        WM8350_OUT2_VU | WM8350_OUT2R_MUTE);
+        /* Make sure AIF tristating is disabled by default */
+        wm8350_clear_bits(wm8350, WM8350_AI_FORMATING, WM8350_AIF_TRI);
+        /* Make sure we've got a sane companding setup too */
+        wm8350_clear_bits(wm8350, WM8350_ADC_DAC_COMP,
+                          WM8350_DAC_COMP | WM8350_LOOPBACK);
        /* Make sure jack detect is disabled to start off with */
        wm8350_clear_bits(wm8350, WM8350_JACK_DETECT,
                          WM8350_JDL_ENA | WM8350_JDR_ENA);
diff --git a/sound/soc/codecs/wm8523.c b/sound/soc/codecs/wm8523.c
index 712ef7c76f90..9a433a5396cb 100644
--- a/sound/soc/codecs/wm8523.c
+++ b/sound/soc/codecs/wm8523.c
@@ -146,7 +146,6 @@ static int wm8523_startup(struct snd_pcm_substream *substream,
                return -EINVAL;
        }
-        return 0;
        snd_pcm_hw_constraint_list(substream->runtime, 0,
                                   SNDRV_PCM_HW_PARAM_RATE,
                                   &wm8523->rate_constraint);
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index 631385802eb4..e725c09a3e79 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -526,7 +526,7 @@ static int wm8731_probe(struct snd_soc_codec *codec)
        snd_soc_update_bits(codec, WM8731_RINVOL, 0x100, 0);
        /* Disable bypass path by default */
-        snd_soc_update_bits(codec, WM8731_APANA, 0x4, 0);
+        snd_soc_update_bits(codec, WM8731_APANA, 0x8, 0);
        snd_soc_add_controls(codec, wm8731_snd_controls,
                             ARRAY_SIZE(wm8731_snd_controls));
diff --git a/sound/soc/codecs/wm8776.c b/sound/soc/codecs/wm8776.c
index 04182c464e35..0132a27140ae 100644
--- a/sound/soc/codecs/wm8776.c
+++ b/sound/soc/codecs/wm8776.c
@@ -34,7 +34,6 @@
 /* codec private data */
 struct wm8776_priv {
        enum snd_soc_control_type control_type;
-        u16 reg_cache[WM8776_CACHEREGNUM];
        int sysclk[2];
 };
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index 33be84e506ea..fca60a0b57b8 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -2498,6 +2498,8 @@ static int wm8904_remove(struct snd_soc_codec *codec)
        wm8904_set_bias_level(codec, SND_SOC_BIAS_OFF);
        regulator_bulk_free(ARRAY_SIZE(wm8904->supplies), wm8904->supplies);
+        kfree(wm8904->retune_mobile_texts);
+        kfree(wm8904->drc_texts);
        return 0;
 }
diff --git a/sound/soc/codecs/wm8961.c b/sound/soc/codecs/wm8961.c
index 4f326f604104..8340485c9851 100644
--- a/sound/soc/codecs/wm8961.c
+++ b/sound/soc/codecs/wm8961.c
@@ -711,7 +711,7 @@ static int wm8961_hw_params(struct snd_pcm_substream *substream,
        if (fs <= 24000)
                reg |= WM8961_DACSLOPE;
        else
-                reg &= WM8961_DACSLOPE;
+                reg &= ~WM8961_DACSLOPE;
        snd_soc_write(codec, WM8961_ADC_DAC_CONTROL_2, reg);
        return 0;
@@ -736,7 +736,7 @@ static int wm8961_set_sysclk(struct snd_soc_dai *dai, int clk_id,
                freq /= 2;
        } else {
                dev_dbg(codec->dev, "Using MCLK/1 for %dHz MCLK\n", freq);
-                reg &= WM8961_MCLKDIV;
+                reg &= ~WM8961_MCLKDIV;
        }
        snd_soc_write(codec, WM8961_CLOCKING1, reg);
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 894d0cd3aa9b..e8092745a207 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -3500,8 +3500,11 @@ static ssize_t wm8962_beep_set(struct device *dev,
 {
        struct wm8962_priv *wm8962 = dev_get_drvdata(dev);
        long int time;
+        int ret;
-        strict_strtol(buf, 10, &time);
+        ret = strict_strtol(buf, 10, &time);
+        if (ret != 0)
+                return ret;
        input_event(wm8962->beep, EV_SND, SND_TONE, time);
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 0db59c3aa5d4..4d3e6f1ac584 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3903,6 +3903,8 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
                return -ENOMEM;
        snd_soc_codec_set_drvdata(codec, wm8994);
+        codec->reg_cache = &wm8994->reg_cache;
        wm8994->pdata = dev_get_platdata(codec->dev->parent);
        wm8994->codec = codec;
@@ -4059,6 +4061,8 @@ static int  wm8994_codec_remove(struct snd_soc_codec *codec)
        wm8994_free_irq(codec->control_data, WM8994_IRQ_MIC2_DET, wm8994);
        wm8994_free_irq(codec->control_data, WM8994_IRQ_MIC1_SHRT, wm8994);
        wm8994_free_irq(codec->control_data, WM8994_IRQ_MIC1_DET, wm8994);
+        kfree(wm8994->retune_mobile_texts);
+        kfree(wm8994->drc_texts);
        kfree(wm8994);
        return 0;
@@ -4071,6 +4075,8 @@ static struct snd_soc_codec_driver soc_codec_dev_wm8994 = {
        .resume =       wm8994_resume,
        .read = wm8994_read,
        .write = wm8994_write,
+        .readable_register = wm8994_readable,
+        .volatile_register = wm8994_volatile,
        .set_bias_level = wm8994_set_bias_level,
 };
diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c
index 2b07b17a6b2d..bc9e6b0b3f6f 100644
--- a/sound/soc/davinci/davinci-evm.c
+++ b/sound/soc/davinci/davinci-evm.c
@@ -157,12 +157,23 @@ static int evm_aic3x_init(struct snd_soc_pcm_runtime *rtd)
 }
 /* davinci-evm digital audio interface glue - connects codec <--> CPU */
-static struct snd_soc_dai_link evm_dai = {
+static struct snd_soc_dai_link dm6446_evm_dai = {
        .name = "TLV320AIC3X",
        .stream_name = "AIC3X",
-        .cpu_dai_name = "davinci-mcasp.0",
+        .cpu_dai_name = "davinci-mcbsp",
        .codec_dai_name = "tlv320aic3x-hifi",
-        .codec_name = "tlv320aic3x-codec.0-001a",
+        .codec_name = "tlv320aic3x-codec.1-001b",
+        .platform_name = "davinci-pcm-audio",
+        .init = evm_aic3x_init,
+        .ops = &evm_ops,
+};
+static struct snd_soc_dai_link dm355_evm_dai = {
+        .name = "TLV320AIC3X",
+        .stream_name = "AIC3X",
+        .cpu_dai_name = "davinci-mcbsp.1",
+        .codec_dai_name = "tlv320aic3x-hifi",
+        .codec_name = "tlv320aic3x-codec.1-001b",
        .platform_name = "davinci-pcm-audio",
        .init = evm_aic3x_init,
        .ops = &evm_ops,
@@ -172,10 +183,10 @@ static struct snd_soc_dai_link dm365_evm_dai = {
 #ifdef CONFIG_SND_DM365_AIC3X_CODEC
        .name = "TLV320AIC3X",
        .stream_name = "AIC3X",
-        .cpu_dai_name = "davinci-i2s",
+        .cpu_dai_name = "davinci-mcbsp",
        .codec_dai_name = "tlv320aic3x-hifi",
        .init = evm_aic3x_init,
-        .codec_name = "tlv320aic3x-codec.0-001a",
+        .codec_name = "tlv320aic3x-codec.1-0018",
        .ops = &evm_ops,
 #elif defined(CONFIG_SND_DM365_VOICE_CODEC)
        .name = "Voice Codec - CQ93VC",
@@ -219,10 +230,17 @@ static struct snd_soc_dai_link da8xx_evm_dai = {
        .ops = &evm_ops,
 };
-/* davinci dm6446, dm355 evm audio machine driver */
+/* davinci dm6446 evm audio machine driver */
-static struct snd_soc_card snd_soc_card_evm = {
+static struct snd_soc_card dm6446_snd_soc_card_evm = {
-        .name = "DaVinci EVM",
+        .name = "DaVinci DM6446 EVM",
-        .dai_link = &evm_dai,
+        .dai_link = &dm6446_evm_dai,
+        .num_links = 1,
+};
+/* davinci dm355 evm audio machine driver */
+static struct snd_soc_card dm355_snd_soc_card_evm = {
+        .name = "DaVinci DM355 EVM",
+        .dai_link = &dm355_evm_dai,
        .num_links = 1,
 };
@@ -261,10 +279,10 @@ static int __init evm_init(void)
        int ret;
        if (machine_is_davinci_evm()) {
-                evm_snd_dev_data = &snd_soc_card_evm;
+                evm_snd_dev_data = &dm6446_snd_soc_card_evm;
                index = 0;
        } else if (machine_is_davinci_dm355_evm()) {
-                evm_snd_dev_data = &snd_soc_card_evm;
+                evm_snd_dev_data = &dm355_snd_soc_card_evm;
                index = 1;
        } else if (machine_is_davinci_dm365_evm()) {
                evm_snd_dev_data = &dm365_snd_soc_card_evm;
diff --git a/sound/soc/davinci/davinci-i2s.c b/sound/soc/davinci/davinci-i2s.c
index d46b545d41f4..9e0e565e6ed9 100644
--- a/sound/soc/davinci/davinci-i2s.c
+++ b/sound/soc/davinci/davinci-i2s.c
@@ -426,9 +426,6 @@ static int davinci_i2s_hw_params(struct snd_pcm_substream *substream,
        snd_pcm_format_t fmt;
        unsigned element_cnt = 1;
-        dai->capture_dma_data = dev->dma_params;
-        dai->playback_dma_data = dev->dma_params;
        /* general line settings */
        spcr = davinci_mcbsp_read_reg(dev, DAVINCI_MCBSP_SPCR_REG);
        if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
@@ -601,6 +598,15 @@ static int davinci_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
        return ret;
 }
+static int davinci_i2s_startup(struct snd_pcm_substream *substream,
+                               struct snd_soc_dai *dai)
+{
+        struct davinci_mcbsp_dev *dev = snd_soc_dai_get_drvdata(dai);
+        snd_soc_dai_set_dma_data(dai, substream, dev->dma_params);
+        return 0;
+}
 static void davinci_i2s_shutdown(struct snd_pcm_substream *substream,
                struct snd_soc_dai *dai)
 {
@@ -612,6 +618,7 @@ static void davinci_i2s_shutdown(struct snd_pcm_substream *substream,
 #define DAVINCI_I2S_RATES       SNDRV_PCM_RATE_8000_96000
 static struct snd_soc_dai_ops davinci_i2s_dai_ops = {
+        .startup        = davinci_i2s_startup,
        .shutdown       = davinci_i2s_shutdown,
        .prepare        = davinci_i2s_prepare,
        .trigger        = davinci_i2s_trigger,
@@ -749,7 +756,7 @@ static struct platform_driver davinci_mcbsp_driver = {
        .probe          = davinci_i2s_probe,
        .remove         = davinci_i2s_remove,
        .driver         = {
-                .name   = "davinci-i2s",
+                .name   = "davinci-mcbsp",
                .owner  = THIS_MODULE,
        },
 };
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 86918ee12419..fb55d2c5d704 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -715,9 +715,6 @@ static int davinci_mcasp_hw_params(struct snd_pcm_substream *substream,
        int word_length;
        u8 fifo_level;
-        cpu_dai->capture_dma_data = dev->dma_params;
-        cpu_dai->playback_dma_data = dev->dma_params;
        davinci_hw_common_param(dev, substream->stream);
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                fifo_level = dev->txnumevt;
@@ -799,7 +796,17 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream,
        return ret;
 }
+static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+                                 struct snd_soc_dai *dai)
+{
+        struct davinci_audio_dev *dev = snd_soc_dai_get_drvdata(dai);
+        snd_soc_dai_set_dma_data(dai, substream, dev->dma_params);
+        return 0;
+}
 static struct snd_soc_dai_ops davinci_mcasp_dai_ops = {
+        .startup        = davinci_mcasp_startup,
        .trigger        = davinci_mcasp_trigger,
        .hw_params      = davinci_mcasp_hw_params,
        .set_fmt        = davinci_mcasp_set_dai_fmt,
diff --git a/sound/soc/davinci/davinci-sffsdr.c b/sound/soc/davinci/davinci-sffsdr.c
index 009b6521a1bf..6c6666a1f942 100644
--- a/sound/soc/davinci/davinci-sffsdr.c
+++ b/sound/soc/davinci/davinci-sffsdr.c
@@ -84,7 +84,7 @@ static struct snd_soc_ops sffsdr_ops = {
 static struct snd_soc_dai_link sffsdr_dai = {
        .name = "PCM3008", /* Codec name */
        .stream_name = "PCM3008 HiFi",
-        .cpu_dai_name = "davinci-asp.0",
+        .cpu_dai_name = "davinci-mcbsp",
        .codec_dai_name = "pcm3008-hifi",
        .codec_name = "pcm3008-codec",
        .platform_name = "davinci-pcm-audio",
diff --git a/sound/soc/davinci/davinci-vcif.c b/sound/soc/davinci/davinci-vcif.c
index ea232f6a2c21..9d2afccc3a2d 100644
--- a/sound/soc/davinci/davinci-vcif.c
+++ b/sound/soc/davinci/davinci-vcif.c
@@ -97,9 +97,6 @@ static int davinci_vcif_hw_params(struct snd_pcm_substream *substream,
                        &davinci_vcif_dev->dma_params[substream->stream];
        u32 w;
-        dai->capture_dma_data = davinci_vcif_dev->dma_params;
-        dai->playback_dma_data = davinci_vcif_dev->dma_params;
        /* Restart the codec before setup */
        davinci_vcif_stop(substream);
        davinci_vcif_start(substream);
@@ -174,9 +171,19 @@ static int davinci_vcif_trigger(struct snd_pcm_substream *substream, int cmd,
        return ret;
 }
+static int davinci_vcif_startup(struct snd_pcm_substream *substream,
+                                struct snd_soc_dai *dai)
+{
+        struct davinci_vcif_dev *dev = snd_soc_dai_get_drvdata(dai);
+        snd_soc_dai_set_dma_data(dai, substream, dev->dma_params);
+        return 0;
+}
 #define DAVINCI_VCIF_RATES      SNDRV_PCM_RATE_8000_48000
 static struct snd_soc_dai_ops davinci_vcif_dai_ops = {
+        .startup        = davinci_vcif_startup,
        .trigger        = davinci_vcif_trigger,
        .hw_params      = davinci_vcif_hw_params,
 };
@@ -240,7 +247,10 @@ fail:
 static int davinci_vcif_remove(struct platform_device *pdev)
 {
+        struct davinci_vcif_dev *davinci_vcif_dev = dev_get_drvdata(&pdev->dev);
        snd_soc_unregister_dai(&pdev->dev);
+        kfree(davinci_vcif_dev);
        return 0;
 }
diff --git a/sound/soc/ep93xx/simone.c b/sound/soc/ep93xx/simone.c
index 4b0d19913728..286817946c56 100644
--- a/sound/soc/ep93xx/simone.c
+++ b/sound/soc/ep93xx/simone.c
@@ -54,24 +54,26 @@ static int __init simone_init(void)
        ret = platform_device_add(simone_snd_ac97_device);
        if (ret)
-                goto fail;
+                goto fail1;
        simone_snd_device = platform_device_alloc("soc-audio", -1);
        if (!simone_snd_device) {
                ret = -ENOMEM;
-                goto fail;
+                goto fail2;
        }
        platform_set_drvdata(simone_snd_device, &snd_soc_simone);
        ret = platform_device_add(simone_snd_device);
-        if (ret) {
+        if (ret)
-                platform_device_put(simone_snd_device);
+                goto fail3;
-                goto fail;
-        }
-        return ret;
+        return 0;
-fail:
+fail3:
+        platform_device_put(simone_snd_device);
+fail2:
+        platform_device_del(simone_snd_ac97_device);
+fail1:
        platform_device_put(simone_snd_ac97_device);
        return ret;
 }
diff --git a/sound/soc/fsl/efika-audio-fabric.c b/sound/soc/fsl/efika-audio-fabric.c
index 53251e6b5bd5..108b5d8bd0e9 100644
--- a/sound/soc/fsl/efika-audio-fabric.c
+++ b/sound/soc/fsl/efika-audio-fabric.c
@@ -76,6 +76,7 @@ static __init int efika_fabric_init(void)
        rc = platform_device_add(pdev);
        if (rc) {
                pr_err("efika_fabric_init: platform_device_add() failed\n");
+                platform_device_put(pdev);
                return -ENODEV;
        }
        return 0;
diff --git a/sound/soc/fsl/mpc5200_dma.c b/sound/soc/fsl/mpc5200_dma.c
index dce6b551cd78..f92dca07cd35 100644
--- a/sound/soc/fsl/mpc5200_dma.c
+++ b/sound/soc/fsl/mpc5200_dma.c
@@ -9,7 +9,6 @@
 #include <linux/module.h>
 #include <linux/of_device.h>
 #include <linux/slab.h>
-#include <linux/of_device.h>
 #include <linux/of_platform.h>
 #include <sound/soc.h>
diff --git a/sound/soc/fsl/mpc5200_psc_i2s.c b/sound/soc/fsl/mpc5200_psc_i2s.c
index 74ffed41340f..9018fa5bf0db 100644
--- a/sound/soc/fsl/mpc5200_psc_i2s.c
+++ b/sound/soc/fsl/mpc5200_psc_i2s.c
@@ -160,7 +160,7 @@ static int __devinit psc_i2s_of_probe(struct platform_device *op,
        rc = snd_soc_register_dais(&op->dev, psc_i2s_dai, ARRAY_SIZE(psc_i2s_dai));
        if (rc != 0) {
                pr_err("Failed to register DAI\n");
-                return 0;
+                return rc;
        }
        psc_dma = dev_get_drvdata(&op->dev);
diff --git a/sound/soc/fsl/mpc8610_hpcd.c b/sound/soc/fsl/mpc8610_hpcd.c
index 0d7dcf1e4863..7d7847a1e66b 100644
--- a/sound/soc/fsl/mpc8610_hpcd.c
+++ b/sound/soc/fsl/mpc8610_hpcd.c
@@ -498,6 +498,7 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "platform device add failed\n");
                goto error;
        }
+        dev_set_drvdata(&pdev->dev, sound_device);
        of_node_put(codec_np);
diff --git a/sound/soc/fsl/p1022_ds.c b/sound/soc/fsl/p1022_ds.c
index 63b9eaa1ebc2..026b756961e0 100644
--- a/sound/soc/fsl/p1022_ds.c
+++ b/sound/soc/fsl/p1022_ds.c
@@ -498,6 +498,7 @@ static int p1022_ds_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "platform device add failed\n");
                goto error;
        }
+        dev_set_drvdata(&pdev->dev, sound_device);
        of_node_put(codec_np);
diff --git a/sound/soc/fsl/pcm030-audio-fabric.c b/sound/soc/fsl/pcm030-audio-fabric.c
index 25f27ec1dd6e..ba4d85e317ed 100644
--- a/sound/soc/fsl/pcm030-audio-fabric.c
+++ b/sound/soc/fsl/pcm030-audio-fabric.c
@@ -76,6 +76,7 @@ static __init int pcm030_fabric_init(void)
        rc = platform_device_add(pdev);
        if (rc) {
                pr_err("pcm030_fabric_init: platform_device_add() failed\n");
+                platform_device_put(pdev);
                return -ENODEV;
        }
        return 0;
diff --git a/sound/soc/imx/eukrea-tlv320.c b/sound/soc/imx/eukrea-tlv320.c
index b59675257ce5..dd4fffdbd177 100644
--- a/sound/soc/imx/eukrea-tlv320.c
+++ b/sound/soc/imx/eukrea-tlv320.c
@@ -34,8 +34,8 @@ static int eukrea_tlv320_hw_params(struct snd_pcm_substream *substream,
                            struct snd_pcm_hw_params *params)
 {
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct snd_soc_dai *codec_dai = rtd->dai->codec_dai;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        struct snd_soc_dai *cpu_dai = rtd->dai->cpu_dai;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
        int ret;
        ret = snd_soc_dai_set_fmt(cpu_dai, SND_SOC_DAIFMT_I2S |
@@ -79,10 +79,10 @@ static struct snd_soc_ops eukrea_tlv320_snd_ops = {
 static struct snd_soc_dai_link eukrea_tlv320_dai = {
        .name           = "tlv320aic23",
        .stream_name    = "TLV320AIC23",
-        .codec_dai      = "tlv320aic23-hifi",
+        .codec_dai_name = "tlv320aic23-hifi",
        .platform_name  = "imx-pcm-audio.0",
        .codec_name     = "tlv320aic23-codec.0-001a",
-        .cpu_dai = "imx-ssi.0",
+        .cpu_dai_name   = "imx-ssi.0",
        .ops            = &eukrea_tlv320_snd_ops,
 };
diff --git a/sound/soc/imx/imx-pcm-dma-mx2.c b/sound/soc/imx/imx-pcm-dma-mx2.c
index fd493ee1428e..671ef8dd524c 100644
--- a/sound/soc/imx/imx-pcm-dma-mx2.c
+++ b/sound/soc/imx/imx-pcm-dma-mx2.c
@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
+#include <linux/dmaengine.h>
 #include <sound/core.h>
 #include <sound/initval.h>
@@ -27,165 +28,146 @@
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
-#include <mach/dma-mx1-mx2.h>
+#include <mach/dma.h>
 #include "imx-ssi.h"
 struct imx_pcm_runtime_data {
-        int sg_count;
+        int period_bytes;
-        struct scatterlist *sg_list;
-        int period;
        int periods;
-        unsigned long dma_addr;
        int dma;
-        struct snd_pcm_substream *substream;
        unsigned long offset;
        unsigned long size;
-        unsigned long period_cnt;
        void *buf;
        int period_time;
+        struct dma_async_tx_descriptor *desc;
+        struct dma_chan *dma_chan;
+        struct imx_dma_data dma_data;
 };
-/* Called by the DMA framework when a period has elapsed */
+static void audio_dma_irq(void *data)
-static void imx_ssi_dma_progression(int channel, void *data,
-                                        struct scatterlist *sg)
 {
-        struct snd_pcm_substream *substream = data;
+        struct snd_pcm_substream *substream = (struct snd_pcm_substream *)data;
        struct snd_pcm_runtime *runtime = substream->runtime;
        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
-        if (!sg)
+        iprtd->offset += iprtd->period_bytes;
-                return;
+        iprtd->offset %= iprtd->period_bytes * iprtd->periods;
-        runtime = iprtd->substream->runtime;
-        iprtd->offset = sg->dma_address - runtime->dma_addr;
+        snd_pcm_period_elapsed(substream);
-        snd_pcm_period_elapsed(iprtd->substream);
 }
-static void imx_ssi_dma_callback(int channel, void *data)
+static bool filter(struct dma_chan *chan, void *param)
 {
-        pr_err("%s shouldn't be called\n", __func__);
+        struct imx_pcm_runtime_data *iprtd = param;
-}
-static void snd_imx_dma_err_callback(int channel, void *data, int err)
+        if (!imx_dma_is_general_purpose(chan))
-{
+                return false;
-        struct snd_pcm_substream *substream = data;
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct imx_pcm_dma_params *dma_params = 
-                snd_soc_dai_get_dma_data(rtd->dai->cpu_dai, substream);
-        struct snd_pcm_runtime *runtime = substream->runtime;
-        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
-        int ret;
-        pr_err("DMA timeout on channel %d -%s%s%s%s\n",
+        chan->private = &iprtd->dma_data;
-                 channel,
-                 err & IMX_DMA_ERR_BURST ?    " burst" : "",
-                 err & IMX_DMA_ERR_REQUEST ?  " request" : "",
-                 err & IMX_DMA_ERR_TRANSFER ? " transfer" : "",
-                 err & IMX_DMA_ERR_BUFFER ?   " buffer" : "");
-        imx_dma_disable(iprtd->dma);
+        return true;
-        ret = imx_dma_setup_sg(iprtd->dma, iprtd->sg_list, iprtd->sg_count,
-                        IMX_DMA_LENGTH_LOOP, dma_params->dma_addr,
-                        substream->stream == SNDRV_PCM_STREAM_PLAYBACK ?
-                        DMA_MODE_WRITE : DMA_MODE_READ);
-        if (!ret)
-                imx_dma_enable(iprtd->dma);
 }
-static int imx_ssi_dma_alloc(struct snd_pcm_substream *substream)
+static int imx_ssi_dma_alloc(struct snd_pcm_substream *substream,
+                                struct snd_pcm_hw_params *params)
 {
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct imx_pcm_dma_params *dma_params;
        struct snd_pcm_runtime *runtime = substream->runtime;
        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
+        struct dma_slave_config slave_config;
+        dma_cap_mask_t mask;
+        enum dma_slave_buswidth buswidth;
        int ret;
        dma_params = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
-        iprtd->dma = imx_dma_request_by_prio(DRV_NAME, DMA_PRIO_HIGH);
+        iprtd->dma_data.peripheral_type = IMX_DMATYPE_SSI;
-        if (iprtd->dma < 0) {
+        iprtd->dma_data.priority = DMA_PRIO_HIGH;
-                pr_err("Failed to claim the audio DMA\n");
+        iprtd->dma_data.dma_request = dma_params->dma;
-                return -ENODEV;
-        }
-        ret = imx_dma_setup_handlers(iprtd->dma,
+        /* Try to grab a DMA channel */
-                                imx_ssi_dma_callback,
+        dma_cap_zero(mask);
-                                snd_imx_dma_err_callback, substream);
+        dma_cap_set(DMA_SLAVE, mask);
-        if (ret)
+        iprtd->dma_chan = dma_request_channel(mask, filter, iprtd);
-                goto out;
+        if (!iprtd->dma_chan)
+                return -EINVAL;
-        ret = imx_dma_setup_progression_handler(iprtd->dma,
+        switch (params_format(params)) {
-                        imx_ssi_dma_progression);
+        case SNDRV_PCM_FORMAT_S16_LE:
-        if (ret) {
+                buswidth = DMA_SLAVE_BUSWIDTH_2_BYTES;
-                pr_err("Failed to setup the DMA handler\n");
+                break;
-                goto out;
+        case SNDRV_PCM_FORMAT_S20_3LE:
+        case SNDRV_PCM_FORMAT_S24_LE:
+                buswidth = DMA_SLAVE_BUSWIDTH_4_BYTES;
+                break;
+        default:
+                return 0;
        }
-        ret = imx_dma_config_channel(iprtd->dma,
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                        IMX_DMA_MEMSIZE_16 | IMX_DMA_TYPE_FIFO,
+                slave_config.direction = DMA_TO_DEVICE;
-                        IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_LINEAR,
+                slave_config.dst_addr = dma_params->dma_addr;
-                        dma_params->dma, 1);
+                slave_config.dst_addr_width = buswidth;
-        if (ret < 0) {
+                slave_config.dst_maxburst = dma_params->burstsize;
-                pr_err("Cannot configure DMA channel: %d\n", ret);
+        } else {
-                goto out;
+                slave_config.direction = DMA_FROM_DEVICE;
+                slave_config.src_addr = dma_params->dma_addr;
+                slave_config.src_addr_width = buswidth;
+                slave_config.src_maxburst = dma_params->burstsize;
        }
-        imx_dma_config_burstlen(iprtd->dma, dma_params->burstsize * 2);
+        ret = dmaengine_slave_config(iprtd->dma_chan, &slave_config);
+        if (ret)
+                return ret;
        return 0;
-out:
-        imx_dma_free(iprtd->dma);
-        return ret;
 }
 static int snd_imx_pcm_hw_params(struct snd_pcm_substream *substream,
                                struct snd_pcm_hw_params *params)
 {
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct snd_pcm_runtime *runtime = substream->runtime;
        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
-        int i;
        unsigned long dma_addr;
+        struct dma_chan *chan;
+        struct imx_pcm_dma_params *dma_params;
+        int ret;
-        imx_ssi_dma_alloc(substream);
+        dma_params = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
+        ret = imx_ssi_dma_alloc(substream, params);
+        if (ret)
+                return ret;
+        chan = iprtd->dma_chan;
        iprtd->size = params_buffer_bytes(params);
        iprtd->periods = params_periods(params);
-        iprtd->period = params_period_bytes(params);
+        iprtd->period_bytes = params_period_bytes(params);
        iprtd->offset = 0;
        iprtd->period_time = HZ / (params_rate(params) /
                        params_period_size(params));
        snd_pcm_set_runtime_buffer(substream, &substream->dma_buffer);
-        if (iprtd->sg_count != iprtd->periods) {
-                kfree(iprtd->sg_list);
-                iprtd->sg_list = kcalloc(iprtd->periods + 1,
-                                sizeof(struct scatterlist), GFP_KERNEL);
-                if (!iprtd->sg_list)
-                        return -ENOMEM;
-                iprtd->sg_count = iprtd->periods + 1;
-        }
-        sg_init_table(iprtd->sg_list, iprtd->sg_count);
        dma_addr = runtime->dma_addr;
-        for (i = 0; i < iprtd->periods; i++) {
+        iprtd->buf = (unsigned int *)substream->dma_buffer.area;
-                iprtd->sg_list[i].page_link = 0;
-                iprtd->sg_list[i].offset = 0;
+        iprtd->desc = chan->device->device_prep_dma_cyclic(chan, dma_addr,
-                iprtd->sg_list[i].dma_address = dma_addr;
+                        iprtd->period_bytes * iprtd->periods,
-                iprtd->sg_list[i].length = iprtd->period;
+                        iprtd->period_bytes,
-                dma_addr += iprtd->period;
+                        substream->stream == SNDRV_PCM_STREAM_PLAYBACK ?
+                        DMA_TO_DEVICE : DMA_FROM_DEVICE);
+        if (!iprtd->desc) {
+                dev_err(&chan->dev->device, "cannot prepare slave dma\n");
+                return -EINVAL;
        }
-        /* close the loop */
+        iprtd->desc->callback = audio_dma_irq;
-        iprtd->sg_list[iprtd->sg_count - 1].offset = 0;
+        iprtd->desc->callback_param = substream;
-        iprtd->sg_list[iprtd->sg_count - 1].length = 0;
-        iprtd->sg_list[iprtd->sg_count - 1].page_link =
-                        ((unsigned long) iprtd->sg_list | 0x01) & ~0x02;
        return 0;
 }
@@ -194,41 +176,21 @@ static int snd_imx_pcm_hw_free(struct snd_pcm_substream *substream)
        struct snd_pcm_runtime *runtime = substream->runtime;
        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
-        if (iprtd->dma >= 0) {
+        if (iprtd->dma_chan) {
-                imx_dma_free(iprtd->dma);
+                dma_release_channel(iprtd->dma_chan);
-                iprtd->dma = -EINVAL;
+                iprtd->dma_chan = NULL;
        }
-        kfree(iprtd->sg_list);
-        iprtd->sg_list = NULL;
        return 0;
 }
 static int snd_imx_pcm_prepare(struct snd_pcm_substream *substream)
 {
-        struct snd_pcm_runtime *runtime = substream->runtime;
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct imx_pcm_dma_params *dma_params;
-        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
-        int err;
        dma_params = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
-        iprtd->substream = substream;
-        iprtd->buf = (unsigned int *)substream->dma_buffer.area;
-        iprtd->period_cnt = 0;
-        pr_debug("%s: buf: %p period: %d periods: %d\n",
-                        __func__, iprtd->buf, iprtd->period, iprtd->periods);
-        err = imx_dma_setup_sg(iprtd->dma, iprtd->sg_list, iprtd->sg_count,
-                        IMX_DMA_LENGTH_LOOP, dma_params->dma_addr,
-                        substream->stream == SNDRV_PCM_STREAM_PLAYBACK ?
-                        DMA_MODE_WRITE : DMA_MODE_READ);
-        if (err)
-                return err;
        return 0;
 }
@@ -241,14 +203,14 @@ static int snd_imx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
        case SNDRV_PCM_TRIGGER_START:
        case SNDRV_PCM_TRIGGER_RESUME:
        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                imx_dma_enable(iprtd->dma);
+                dmaengine_submit(iprtd->desc);
                break;
        case SNDRV_PCM_TRIGGER_STOP:
        case SNDRV_PCM_TRIGGER_SUSPEND:
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-                imx_dma_disable(iprtd->dma);
+                dmaengine_terminate_all(iprtd->dma_chan);
                break;
        default:
@@ -263,6 +225,9 @@ static snd_pcm_uframes_t snd_imx_pcm_pointer(struct snd_pcm_substream *substream
        struct snd_pcm_runtime *runtime = substream->runtime;
        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
+        pr_debug("%s: %ld %ld\n", __func__, iprtd->offset,
+                        bytes_to_frames(substream->runtime, iprtd->offset));
        return bytes_to_frames(substream->runtime, iprtd->offset);
 }
@@ -279,7 +244,7 @@ static struct snd_pcm_hardware snd_imx_hardware = {
        .channels_max = 2,
        .buffer_bytes_max = IMX_SSI_DMABUF_SIZE,
        .period_bytes_min = 128,
-        .period_bytes_max = 16 * 1024,
+        .period_bytes_max = 65535, /* Limited by SDMA engine */
        .periods_min = 2,
        .periods_max = 255,
        .fifo_size = 0,
@@ -304,11 +269,23 @@ static int snd_imx_open(struct snd_pcm_substream *substream)
        }
        snd_soc_set_runtime_hwparams(substream, &snd_imx_hardware);
+        return 0;
+}
+static int snd_imx_close(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
+        kfree(iprtd);
        return 0;
 }
 static struct snd_pcm_ops imx_pcm_ops = {
        .open           = snd_imx_open,
+        .close          = snd_imx_close,
        .ioctl          = snd_pcm_lib_ioctl,
        .hw_params      = snd_imx_pcm_hw_params,
        .hw_free        = snd_imx_pcm_hw_free,
@@ -340,7 +317,6 @@ static struct platform_driver imx_pcm_driver = {
                        .name = "imx-pcm-audio",
                        .owner = THIS_MODULE,
        },
        .probe = imx_soc_platform_probe,
        .remove = __devexit_p(imx_soc_platform_remove),
 };
@@ -356,4 +332,3 @@ static void __exit snd_imx_pcm_exit(void)
        platform_driver_unregister(&imx_pcm_driver);
 }
 module_exit(snd_imx_pcm_exit);
diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
index d4bd345b0a8d..390b6ffc2658 100644
--- a/sound/soc/imx/imx-ssi.c
+++ b/sound/soc/imx/imx-ssi.c
@@ -439,7 +439,22 @@ void imx_pcm_free(struct snd_pcm *pcm)
 }
 EXPORT_SYMBOL_GPL(imx_pcm_free);
+static int imx_ssi_dai_probe(struct snd_soc_dai *dai)
+{
+        struct imx_ssi *ssi = dev_get_drvdata(dai->dev);
+        uint32_t val;
+        snd_soc_dai_set_drvdata(dai, ssi);
+        val = SSI_SFCSR_TFWM0(ssi->dma_params_tx.burstsize) |
+                SSI_SFCSR_RFWM0(ssi->dma_params_rx.burstsize);
+        writel(val, ssi->base + SSI_SFCSR);
+        return 0;
+}
 static struct snd_soc_dai_driver imx_ssi_dai = {
+        .probe = imx_ssi_dai_probe,
        .playback = {
                .channels_min = 2,
                .channels_max = 2,
@@ -455,20 +470,6 @@ static struct snd_soc_dai_driver imx_ssi_dai = {
        .ops = &imx_ssi_pcm_dai_ops,
 };
-static int imx_ssi_dai_probe(struct snd_soc_dai *dai)
-{
-        struct imx_ssi *ssi = dev_get_drvdata(dai->dev);
-        uint32_t val;
-        snd_soc_dai_set_drvdata(dai, ssi);
-        val = SSI_SFCSR_TFWM0(ssi->dma_params_tx.burstsize) |
-                SSI_SFCSR_RFWM0(ssi->dma_params_rx.burstsize);
-        writel(val, ssi->base + SSI_SFCSR);
-        return 0;
-}
 static struct snd_soc_dai_driver imx_ac97_dai = {
        .probe = imx_ssi_dai_probe,
        .ac97_control = 1,
@@ -677,9 +678,25 @@ static int imx_ssi_probe(struct platform_device *pdev)
                goto failed_register;
        }
-        ssi->soc_platform_pdev = platform_device_alloc("imx-fiq-pcm-audio", pdev->id);
+        ssi->soc_platform_pdev_fiq = platform_device_alloc("imx-fiq-pcm-audio", pdev->id);
-        if (!ssi->soc_platform_pdev)
+        if (!ssi->soc_platform_pdev_fiq) {
+                ret = -ENOMEM;
+                goto failed_pdev_fiq_alloc;
+        }
+        platform_set_drvdata(ssi->soc_platform_pdev_fiq, ssi);
+        ret = platform_device_add(ssi->soc_platform_pdev_fiq);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to add platform device\n");
+                goto failed_pdev_fiq_add;
+        }
+        ssi->soc_platform_pdev = platform_device_alloc("imx-pcm-audio", pdev->id);
+        if (!ssi->soc_platform_pdev) {
+                ret = -ENOMEM;
                goto failed_pdev_alloc;
+        }
        platform_set_drvdata(ssi->soc_platform_pdev, ssi);
        ret = platform_device_add(ssi->soc_platform_pdev);
        if (ret) {
@@ -692,6 +709,10 @@ static int imx_ssi_probe(struct platform_device *pdev)
 failed_pdev_add:
        platform_device_put(ssi->soc_platform_pdev);
 failed_pdev_alloc:
+        platform_device_del(ssi->soc_platform_pdev_fiq);
+failed_pdev_fiq_add:
+        platform_device_put(ssi->soc_platform_pdev_fiq);
+failed_pdev_fiq_alloc:
        snd_soc_unregister_dai(&pdev->dev);
 failed_register:
 failed_ac97:
@@ -712,8 +733,8 @@ static int __devexit imx_ssi_remove(struct platform_device *pdev)
        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        struct imx_ssi *ssi = platform_get_drvdata(pdev);
-        platform_device_del(ssi->soc_platform_pdev);
+        platform_device_unregister(ssi->soc_platform_pdev);
-        platform_device_put(ssi->soc_platform_pdev);
+        platform_device_unregister(ssi->soc_platform_pdev_fiq);
        snd_soc_unregister_dai(&pdev->dev);
diff --git a/sound/soc/imx/imx-ssi.h b/sound/soc/imx/imx-ssi.h
index 53b780d9b2b0..a4406a134892 100644
--- a/sound/soc/imx/imx-ssi.h
+++ b/sound/soc/imx/imx-ssi.h
@@ -185,6 +185,9 @@
 #define DRV_NAME "imx-ssi"
+#include <linux/dmaengine.h>
+#include <mach/dma.h>
 struct imx_pcm_dma_params {
        int dma;
        unsigned long dma_addr;
@@ -212,6 +215,7 @@ struct imx_ssi {
        int enabled;
        struct platform_device *soc_platform_pdev;
+        struct platform_device *soc_platform_pdev_fiq;
 };
 struct snd_soc_platform *imx_ssi_fiq_init(struct platform_device *pdev,
diff --git a/sound/soc/imx/phycore-ac97.c b/sound/soc/imx/phycore-ac97.c
index 6a65dd705519..9eabc28667e6 100644
--- a/sound/soc/imx/phycore-ac97.c
+++ b/sound/soc/imx/phycore-ac97.c
@@ -20,9 +20,6 @@
 #include <sound/soc-dapm.h>
 #include <asm/mach-types.h>
-#include "../codecs/wm9712.h"
-#include "imx-ssi.h"
 static struct snd_soc_card imx_phycore;
 static struct snd_soc_ops imx_phycore_hifi_ops = {
@@ -41,11 +38,12 @@ static struct snd_soc_dai_link imx_phycore_dai_ac97[] = {
 };
 static struct snd_soc_card imx_phycore = {
-        .name           = "PhyCORE-audio",
+        .name           = "PhyCORE-ac97-audio",
        .dai_link       = imx_phycore_dai_ac97,
        .num_links      = ARRAY_SIZE(imx_phycore_dai_ac97),
 };
+static struct platform_device *imx_phycore_snd_ac97_device;
 static struct platform_device *imx_phycore_snd_device;
 static int __init imx_phycore_init(void)
@@ -56,29 +54,42 @@ static int __init imx_phycore_init(void)
                /* return happy. We might run on a totally different machine */
                return 0;
-        imx_phycore_snd_device = platform_device_alloc("soc-audio", -1);
+        imx_phycore_snd_ac97_device = platform_device_alloc("soc-audio", -1);
-        if (!imx_phycore_snd_device)
+        if (!imx_phycore_snd_ac97_device)
                return -ENOMEM;
-        platform_set_drvdata(imx_phycore_snd_device, &imx_phycore);
+        platform_set_drvdata(imx_phycore_snd_ac97_device, &imx_phycore);
-        ret = platform_device_add(imx_phycore_snd_device);
+        ret = platform_device_add(imx_phycore_snd_ac97_device);
+        if (ret)
+                goto fail1;
        imx_phycore_snd_device = platform_device_alloc("wm9712-codec", -1);
-        if (!imx_phycore_snd_device)
+        if (!imx_phycore_snd_device) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail2;
+        }
        ret = platform_device_add(imx_phycore_snd_device);
        if (ret) {
                printk(KERN_ERR "ASoC: Platform device allocation failed\n");
-                platform_device_put(imx_phycore_snd_device);
+                goto fail3;
        }
+        return 0;
+fail3:
+        platform_device_put(imx_phycore_snd_device);
+fail2:
+        platform_device_del(imx_phycore_snd_ac97_device);
+fail1:
+        platform_device_put(imx_phycore_snd_ac97_device);
        return ret;
 }
 static void __exit imx_phycore_exit(void)
 {
        platform_device_unregister(imx_phycore_snd_device);
+        platform_device_unregister(imx_phycore_snd_ac97_device);
 }
 late_initcall(imx_phycore_init);
diff --git a/sound/soc/nuc900/nuc900-ac97.c b/sound/soc/nuc900/nuc900-ac97.c
index 293dc748797c..dac6732da969 100644
--- a/sound/soc/nuc900/nuc900-ac97.c
+++ b/sound/soc/nuc900/nuc900-ac97.c
@@ -49,7 +49,7 @@ static unsigned short nuc900_ac97_read(struct snd_ac97 *ac97,
        mutex_lock(&ac97_mutex);
        val = nuc900_checkready();
-        if (!!val) {
+        if (val) {
                dev_err(nuc900_audio->dev, "AC97 codec is not ready\n");
                goto out;
        }
@@ -102,7 +102,7 @@ static void nuc900_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
        mutex_lock(&ac97_mutex);
        tmp = nuc900_checkready();
-        if (!!tmp)
+        if (tmp)
                dev_err(nuc900_audio->dev, "AC97 codec is not ready\n");
        /* clear the R_WB bit and write register index */
@@ -149,7 +149,7 @@ static void nuc900_ac97_warm_reset(struct snd_ac97 *ac97)
        udelay(100);
        val = nuc900_checkready();
-        if (!!val)
+        if (val)
                dev_err(nuc900_audio->dev, "AC97 codec is not ready\n");
        mutex_unlock(&ac97_mutex);
@@ -263,8 +263,7 @@ static int nuc900_ac97_trigger(struct snd_pcm_substream *substream,
        return ret;
 }
-static int nuc900_ac97_probe(struct platform_device *pdev,
+static int nuc900_ac97_probe(struct snd_soc_dai *dai)
-                                        struct snd_soc_dai *dai)
 {
        struct nuc900_audio *nuc900_audio = nuc900_ac97_data;
        unsigned long val;
@@ -284,12 +283,12 @@ static int nuc900_ac97_probe(struct platform_device *pdev,
        return 0;
 }
-static void nuc900_ac97_remove(struct platform_device *pdev,
+static int nuc900_ac97_remove(struct snd_soc_dai *dai)
-                                                struct snd_soc_dai *dai)
 {
        struct nuc900_audio *nuc900_audio = nuc900_ac97_data;
        clk_disable(nuc900_audio->clk);
+        return 0;
 }
 static struct snd_soc_dai_ops nuc900_ac97_dai_ops = {
@@ -313,7 +312,7 @@ static struct snd_soc_dai_driver nuc900_ac97_dai = {
                .channels_max   = 2,
        },
        .ops = &nuc900_ac97_dai_ops,
-}
+};
 static int __devinit nuc900_ac97_drvprobe(struct platform_device *pdev)
 {
@@ -384,7 +383,6 @@ out0:
 static int __devexit nuc900_ac97_drvremove(struct platform_device *pdev)
 {
        snd_soc_unregister_dai(&pdev->dev);
        clk_put(nuc900_ac97_data->clk);
@@ -392,6 +390,7 @@ static int __devexit nuc900_ac97_drvremove(struct platform_device *pdev)
        release_mem_region(nuc900_ac97_data->res->start,
                                resource_size(nuc900_ac97_data->res));
+        kfree(nuc900_ac97_data);
        nuc900_ac97_data = NULL;
        return 0;
diff --git a/sound/soc/nuc900/nuc900-audio.h b/sound/soc/nuc900/nuc900-audio.h
index aeed8ead2b2b..59f7e8ed1a68 100644
--- a/sound/soc/nuc900/nuc900-audio.h
+++ b/sound/soc/nuc900/nuc900-audio.h
@@ -110,4 +110,6 @@ struct nuc900_audio {
 };
+extern struct nuc900_audio *nuc900_ac97_data;
 #endif /*end _NUC900_AUDIO_H */
diff --git a/sound/soc/nuc900/nuc900-pcm.c b/sound/soc/nuc900/nuc900-pcm.c
index 195d1ac94771..8263f56dc665 100644
--- a/sound/soc/nuc900/nuc900-pcm.c
+++ b/sound/soc/nuc900/nuc900-pcm.c
@@ -50,12 +50,12 @@ static int nuc900_dma_hw_params(struct snd_pcm_substream *substream,
        unsigned long flags;
        int ret = 0;
-        spin_lock_irqsave(&nuc900_audio->lock, flags);
        ret = snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
        if (ret < 0)
                return ret;
+        spin_lock_irqsave(&nuc900_audio->lock, flags);
        nuc900_audio->substream = substream;
        nuc900_audio->dma_addr[substream->stream] = runtime->dma_addr;
        nuc900_audio->buffersize[substream->stream] =
@@ -169,6 +169,7 @@ static int nuc900_dma_prepare(struct snd_pcm_substream *substream)
        struct snd_pcm_runtime *runtime = substream->runtime;
        struct nuc900_audio *nuc900_audio = runtime->private_data;
        unsigned long flags, val;
+        int ret = 0;
        spin_lock_irqsave(&nuc900_audio->lock, flags);
@@ -197,10 +198,10 @@ static int nuc900_dma_prepare(struct snd_pcm_substream *substream)
                AUDIO_WRITE(nuc900_audio->mmio + ACTL_RESET, val);
                break;
        default:
-                return -EINVAL;
+                ret = -EINVAL;
        }
        spin_unlock_irqrestore(&nuc900_audio->lock, flags);
-        return 0;
+        return ret;
 }
 static int nuc900_dma_trigger(struct snd_pcm_substream *substream, int cmd)
@@ -332,7 +333,7 @@ static struct snd_soc_platform_driver nuc900_soc_platform = {
        .ops            = &nuc900_dma_ops,
        .pcm_new        = nuc900_dma_new,
        .pcm_free       = nuc900_dma_free_dma_buffers,
-}
+};
 static int __devinit nuc900_soc_platform_probe(struct platform_device *pdev)
 {
diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig
index d542ea2ff6be..a088db6d5091 100644
--- a/sound/soc/omap/Kconfig
+++ b/sound/soc/omap/Kconfig
@@ -12,8 +12,8 @@ config SND_OMAP_SOC_MCPDM
 config SND_OMAP_SOC_N810
        tristate "SoC Audio support for Nokia N810"
        depends on SND_OMAP_SOC && MACH_NOKIA_N810 && I2C
+        depends on OMAP_MUX
        select SND_OMAP_SOC_MCBSP
-        select OMAP_MUX
        select SND_SOC_TLV320AIC3X
        help
          Say Y if you want to add support for SoC audio on Nokia N810.
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index d211c9fa5a91..7e84f24b9a88 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -644,15 +644,23 @@ static int omap_mcbsp_dai_set_dai_sysclk(struct snd_soc_dai *cpu_dai,
        case OMAP_MCBSP_CLKR_SRC_CLKR:
+                if (cpu_class_is_omap1())
+                        break;
                omap2_mcbsp1_mux_clkr_src(CLKR_SRC_CLKR);
                break;
        case OMAP_MCBSP_CLKR_SRC_CLKX:
+                if (cpu_class_is_omap1())
+                        break;
                omap2_mcbsp1_mux_clkr_src(CLKR_SRC_CLKX);
                break;
        case OMAP_MCBSP_FSR_SRC_FSR:
+                if (cpu_class_is_omap1())
+                        break;
                omap2_mcbsp1_mux_fsr_src(FSR_SRC_FSR);
                break;
        case OMAP_MCBSP_FSR_SRC_FSX:
+                if (cpu_class_is_omap1())
+                        break;
                omap2_mcbsp1_mux_fsr_src(FSR_SRC_FSX);
                break;
        default:
diff --git a/sound/soc/omap/omap3pandora.c b/sound/soc/omap/omap3pandora.c
index dbd9d96b5f92..4ee33ce2cb98 100644
--- a/sound/soc/omap/omap3pandora.c
+++ b/sound/soc/omap/omap3pandora.c
@@ -306,6 +306,7 @@ static int __init omap3pandora_soc_init(void)
                pr_err(PREFIX "Failed to get DAC regulator from %s: %ld\n",
                        dev_name(&omap3pandora_snd_device->dev),
                        PTR_ERR(omap3pandora_dac_reg));
+                ret = PTR_ERR(omap3pandora_dac_reg);
                goto fail3;
        }
diff --git a/sound/soc/omap/osk5912.c b/sound/soc/omap/osk5912.c
index f0e662556428..65ae00e976ef 100644
--- a/sound/soc/omap/osk5912.c
+++ b/sound/soc/omap/osk5912.c
@@ -177,7 +177,8 @@ static int __init osk_soc_init(void)
        tlv320aic23_mclk = clk_get(dev, "mclk");
        if (IS_ERR(tlv320aic23_mclk)) {
                printk(KERN_ERR "Could not get mclk clock\n");
-                return -ENODEV;
+                err = PTR_ERR(tlv320aic23_mclk);
+                goto err2;
        }
        /*
@@ -188,7 +189,7 @@ static int __init osk_soc_init(void)
                if (clk_set_rate(tlv320aic23_mclk, CODEC_CLOCK)) {
                        printk(KERN_ERR "Cannot set MCLK for AIC23 CODEC\n");
                        err = -ECANCELED;
-                        goto err1;
+                        goto err3;
                }
        }
@@ -196,9 +197,12 @@ static int __init osk_soc_init(void)
               (uint) clk_get_rate(tlv320aic23_mclk), CODEC_CLOCK);
        return 0;
-err1:
+err3:
        clk_put(tlv320aic23_mclk);
+err2:
        platform_device_del(osk_snd_device);
+err1:
        platform_device_put(osk_snd_device);
        return err;
@@ -207,6 +211,7 @@ err1:
 static void __exit osk_soc_exit(void)
 {
+        clk_put(tlv320aic23_mclk);
        platform_device_unregister(osk_snd_device);
 }
diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
index 37f191bbfdd9..580f48571303 100644
--- a/sound/soc/pxa/Kconfig
+++ b/sound/soc/pxa/Kconfig
@@ -1,6 +1,7 @@
 config SND_PXA2XX_SOC
        tristate "SoC Audio for the Intel PXA2xx chip"
        depends on ARCH_PXA
+        select SND_ARM
        select SND_PXA2XX_LIB
        help
          Say Y or M if you want to add support for codecs attached to
diff --git a/sound/soc/pxa/corgi.c b/sound/soc/pxa/corgi.c
index 97e9423615c9..f451acd4935b 100644
--- a/sound/soc/pxa/corgi.c
+++ b/sound/soc/pxa/corgi.c
@@ -100,8 +100,13 @@ static int corgi_startup(struct snd_pcm_substream *substream)
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct snd_soc_codec *codec = rtd->codec;
+        mutex_lock(&codec->mutex);
        /* check the jack status at stream startup */
        corgi_ext_control(codec);
+        mutex_unlock(&codec->mutex);
        return 0;
 }
diff --git a/sound/soc/pxa/magician.c b/sound/soc/pxa/magician.c
index b8207ced4072..5ef0526924b9 100644
--- a/sound/soc/pxa/magician.c
+++ b/sound/soc/pxa/magician.c
@@ -72,9 +72,13 @@ static int magician_startup(struct snd_pcm_substream *substream)
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct snd_soc_codec *codec = rtd->codec;
+        mutex_lock(&codec->mutex);
        /* check the jack status at stream startup */
        magician_ext_control(codec);
+        mutex_unlock(&codec->mutex);
        return 0;
 }
diff --git a/sound/soc/pxa/poodle.c b/sound/soc/pxa/poodle.c
index af84ee9c5e11..84edd0385a21 100644
--- a/sound/soc/pxa/poodle.c
+++ b/sound/soc/pxa/poodle.c
@@ -77,8 +77,13 @@ static int poodle_startup(struct snd_pcm_substream *substream)
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct snd_soc_codec *codec = rtd->codec;
+        mutex_lock(&codec->mutex);
        /* check the jack status at stream startup */
        poodle_ext_control(codec);
+        mutex_unlock(&codec->mutex);
        return 0;
 }
diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
index f470f360f4dd..0b30d7de24ec 100644
--- a/sound/soc/pxa/spitz.c
+++ b/sound/soc/pxa/spitz.c
@@ -108,8 +108,13 @@ static int spitz_startup(struct snd_pcm_substream *substream)
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct snd_soc_codec *codec = rtd->codec;
+        mutex_lock(&codec->mutex);
        /* check the jack status at stream startup */
        spitz_ext_control(codec);
+        mutex_unlock(&codec->mutex);
        return 0;
 }
diff --git a/sound/soc/pxa/tosa.c b/sound/soc/pxa/tosa.c
index 73d0edd8ded9..7b983f935454 100644
--- a/sound/soc/pxa/tosa.c
+++ b/sound/soc/pxa/tosa.c
@@ -81,8 +81,13 @@ static int tosa_startup(struct snd_pcm_substream *substream)
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct snd_soc_codec *codec = rtd->codec;
+        mutex_lock(&codec->mutex);
        /* check the jack status at stream startup */
        tosa_ext_control(codec);
+        mutex_unlock(&codec->mutex);
        return 0;
 }
diff --git a/sound/soc/s3c24xx/Kconfig b/sound/soc/s3c24xx/Kconfig
index 8a6b53ccd203..d85bf8a0abb2 100644
--- a/sound/soc/s3c24xx/Kconfig
+++ b/sound/soc/s3c24xx/Kconfig
@@ -2,6 +2,7 @@ config SND_S3C24XX_SOC
        tristate "SoC Audio for the Samsung S3CXXXX chips"
        depends on ARCH_S3C2410 || ARCH_S3C64XX || ARCH_S5PC100 || ARCH_S5PV210
        select S3C64XX_DMA if ARCH_S3C64XX
+        select S3C2410_DMA if ARCH_S3C2410
        help
          Say Y or M if you want to add support for codecs attached to
          the S3C24XX AC97 or I2S interfaces. You will also need to
diff --git a/sound/soc/s3c24xx/rx1950_uda1380.c b/sound/soc/s3c24xx/rx1950_uda1380.c
index ffd5cf2fb0a9..468cc11fdf47 100644
--- a/sound/soc/s3c24xx/rx1950_uda1380.c
+++ b/sound/soc/s3c24xx/rx1950_uda1380.c
@@ -50,7 +50,6 @@ static unsigned int rates[] = {
        16000,
        44100,
        48000,
-        88200,
 };
 static struct snd_pcm_hw_constraint_list hw_rates = {
@@ -130,7 +129,6 @@ static const struct snd_soc_dapm_route audio_map[] = {
 };
 static struct platform_device *s3c24xx_snd_device;
-static struct clk *xtal;
 static int rx1950_startup(struct snd_pcm_substream *substream)
 {
@@ -179,10 +177,8 @@ static int rx1950_hw_params(struct snd_pcm_substream *substream,
        case 44100:
        case 88200:
                clk_source = S3C24XX_CLKSRC_MPLL;
-                fs_mode = S3C2410_IISMOD_256FS;
+                fs_mode = S3C2410_IISMOD_384FS;
-                div = clk_get_rate(xtal) / (256 * rate);
+                div = 1;
-                if (clk_get_rate(xtal) % (256 * rate) > (128 * rate))
-                        div++;
                break;
        default:
                printk(KERN_ERR "%s: rate %d is not supported\n",
@@ -210,7 +206,7 @@ static int rx1950_hw_params(struct snd_pcm_substream *substream,
        /* set MCLK division for sample rate */
        ret = snd_soc_dai_set_clkdiv(cpu_dai, S3C24XX_DIV_MCLK,
-                S3C2410_IISMOD_384FS);
+                fs_mode);
        if (ret < 0)
                return ret;
@@ -295,17 +291,8 @@ static int __init rx1950_init(void)
                goto err_plat_add;
        }
-        xtal = clk_get(&s3c24xx_snd_device->dev, "xtal");
-        if (IS_ERR(xtal)) {
-                ret = PTR_ERR(xtal);
-                platform_device_unregister(s3c24xx_snd_device);
-                goto err_clk;
-        }
        return 0;
-err_clk:
 err_plat_add:
 err_plat_alloc:
 err_gpio_conf:
@@ -320,7 +307,6 @@ static void __exit rx1950_exit(void)
        platform_device_unregister(s3c24xx_snd_device);
        snd_soc_jack_free_gpios(&hp_jack, ARRAY_SIZE(hp_jack_gpios),
                hp_jack_gpios);
-        clk_put(xtal);
        gpio_free(S3C2410_GPA(1));
 }
diff --git a/sound/soc/s3c24xx/smdk_spdif.c b/sound/soc/s3c24xx/smdk_spdif.c
index f31d22ad7c88..c8bd90488a87 100644
--- a/sound/soc/s3c24xx/smdk_spdif.c
+++ b/sound/soc/s3c24xx/smdk_spdif.c
@@ -38,7 +38,7 @@ static int set_audio_clock_heirachy(struct platform_device *pdev)
        }
        mout_epll = clk_get(NULL, "mout_epll");
-        if (IS_ERR(fout_epll)) {
+        if (IS_ERR(mout_epll)) {
                printk(KERN_WARNING "%s: Cannot find mout_epll.\n",
                                __func__);
                ret = -EINVAL;
@@ -54,7 +54,7 @@ static int set_audio_clock_heirachy(struct platform_device *pdev)
        }
        sclk_spdif = clk_get(NULL, "sclk_spdif");
-        if (IS_ERR(fout_epll)) {
+        if (IS_ERR(sclk_spdif)) {
                printk(KERN_WARNING "%s: Cannot find sclk_spdif.\n",
                                __func__);
                ret = -EINVAL;
diff --git a/sound/soc/s6000/s6000-i2s.c b/sound/soc/s6000/s6000-i2s.c
index 8778faa174a6..3052f64b2403 100644
--- a/sound/soc/s6000/s6000-i2s.c
+++ b/sound/soc/s6000/s6000-i2s.c
@@ -434,7 +434,7 @@ static struct snd_soc_dai_driver s6000_i2s_dai = {
                .rate_max = 1562500,
        },
        .ops = &s6000_i2s_dai_ops,
-}
+};
 static int __devinit s6000_i2s_probe(struct platform_device *pdev)
 {
diff --git a/sound/soc/s6000/s6000-pcm.c b/sound/soc/s6000/s6000-pcm.c
index 271fd222bf19..ab3ccaec72d2 100644
--- a/sound/soc/s6000/s6000-pcm.c
+++ b/sound/soc/s6000/s6000-pcm.c
@@ -473,7 +473,7 @@ static int s6000_pcm_new(struct snd_card *card,
        }
        res = request_irq(params->irq, s6000_pcm_irq, IRQF_SHARED,
-                          s6000_soc_platform.name, pcm);
+                          "s6000-audio", pcm);
        if (res) {
                printk(KERN_ERR "s6000-pcm couldn't get IRQ\n");
                return res;
diff --git a/sound/soc/s6000/s6105-ipcam.c b/sound/soc/s6000/s6105-ipcam.c
index 96c05e137538..c1244c5bc730 100644
--- a/sound/soc/s6000/s6105-ipcam.c
+++ b/sound/soc/s6000/s6105-ipcam.c
@@ -167,7 +167,7 @@ static int s6105_aic3x_init(struct snd_soc_pcm_runtime *rtd)
        snd_soc_dapm_sync(codec);
-        snd_ctl_add(codec->snd_card, snd_ctl_new1(&audio_out_mux, codec));
+        snd_ctl_add(codec->card->snd_card, snd_ctl_new1(&audio_out_mux, codec));
        return 0;
 }
diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
index 507e709f2807..4c2404b1b862 100644
--- a/sound/soc/sh/fsi.c
+++ b/sound/soc/sh/fsi.c
@@ -132,6 +132,8 @@ struct fsi_priv {
        struct fsi_stream playback;
        struct fsi_stream capture;
+        long rate;
        u32 mst_ctrl;
 };
@@ -854,10 +856,17 @@ static void fsi_dai_shutdown(struct snd_pcm_substream *substream,
 {
        struct fsi_priv *fsi = fsi_get_priv(substream);
        int is_play = fsi_is_play(substream);
+        struct fsi_master *master = fsi_get_master(fsi);
+        int (*set_rate)(struct device *dev, int is_porta, int rate, int enable);
        fsi_irq_disable(fsi, is_play);
        fsi_clk_ctrl(fsi, 0);
+        set_rate = master->info->set_rate;
+        if (set_rate && fsi->rate)
+                set_rate(dai->dev, fsi_is_port_a(fsi), fsi->rate, 0);
+        fsi->rate = 0;
        pm_runtime_put_sync(dai->dev);
 }
@@ -891,20 +900,20 @@ static int fsi_dai_hw_params(struct snd_pcm_substream *substream,
 {
        struct fsi_priv *fsi = fsi_get_priv(substream);
        struct fsi_master *master = fsi_get_master(fsi);
-        int (*set_rate)(int is_porta, int rate) = master->info->set_rate;
+        int (*set_rate)(struct device *dev, int is_porta, int rate, int enable);
        int fsi_ver = master->core->ver;
-        int is_play = fsi_is_play(substream);
+        long rate = params_rate(params);
        int ret;
-        /* if slave mode, set_rate is not needed */
+        set_rate = master->info->set_rate;
-        if (!fsi_is_master_mode(fsi, is_play))
+        if (!set_rate)
                return 0;
-        /* it is error if no set_rate */
+        ret = set_rate(dai->dev, fsi_is_port_a(fsi), rate, 1);
-        if (!set_rate)
+        if (ret < 0) /* error */
-                return -EIO;
+                return ret;
-        ret = set_rate(fsi_is_port_a(fsi), params_rate(params));
+        fsi->rate = rate;
        if (ret > 0) {
                u32 data = 0;
diff --git a/sound/soc/sh/ssi.c b/sound/soc/sh/ssi.c
index 40bbdf1591dc..05192d97b377 100644
--- a/sound/soc/sh/ssi.c
+++ b/sound/soc/sh/ssi.c
@@ -387,7 +387,7 @@ static int __devinit sh4_soc_dai_probe(struct platform_device *pdev)
 static int __devexit sh4_soc_dai_remove(struct platform_device *pdev)
 {
-        snd_soc_unregister_dai(&pdev->dev, ARRAY_SIZE(sh4_ssi_dai));
+        snd_soc_unregister_dais(&pdev->dev, ARRAY_SIZE(sh4_ssi_dai));
        return 0;
 }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 614a8b30d87b..441285ade024 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3043,8 +3043,10 @@ int snd_soc_register_dais(struct device *dev,
        for (i = 0; i < count; i++) {
                dai = kzalloc(sizeof(struct snd_soc_dai), GFP_KERNEL);
-                if (dai == NULL)
+                if (dai == NULL) {
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto err;
+                }
                /* create DAI component name */
                dai->name = fmt_multiple_name(dev, &dai_drv[i]);
@@ -3263,9 +3265,6 @@ int snd_soc_register_codec(struct device *dev,
        return 0;
 error:
-        for (i--; i >= 0; i--)
-                snd_soc_unregister_dai(dev);
        if (codec->reg_cache)
                kfree(codec->reg_cache);
        kfree(codec->name);
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 7d85c6496afa..75ed6491222d 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -683,12 +683,12 @@ static int dapm_seq_compare(struct snd_soc_dapm_widget *a,
                            struct snd_soc_dapm_widget *b,
                            int sort[])
 {
-        if (a->codec != b->codec)
-                return (unsigned long)a - (unsigned long)b;
        if (sort[a->id] != sort[b->id])
                return sort[a->id] - sort[b->id];
        if (a->reg != b->reg)
                return a->reg - b->reg;
+        if (a->codec != b->codec)
+                return (unsigned long)a->codec - (unsigned long)b->codec;
        return 0;
 }
diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c
index 1bc56b2b94e2..337a00241a1f 100644
--- a/sound/spi/at73c213.c
+++ b/sound/spi/at73c213.c
@@ -155,7 +155,7 @@ static int snd_at73c213_set_bitrate(struct snd_at73c213 *chip)
        if (max_tries < 1)
                max_tries = 1;
-        /* ssc_div must be a power of 2. */
+        /* ssc_div must be even. */
        ssc_div = (ssc_div + 1) & ~1UL;
        if ((ssc_rate / (ssc_div * 2 * 16)) < BITRATE_MIN) {
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 93bd2ff001fb..564491fa18b2 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -197,7 +197,7 @@ static void sig_atexit(void)
        if (child_pid > 0)
                kill(child_pid, SIGTERM);
-        if (signr == -1)
+        if (signr == -1 || signr == SIGUSR1)
                return;
        signal(signr, SIG_DFL);
@@ -515,6 +515,7 @@ static int __cmd_record(int argc, const char **argv)
        atexit(sig_atexit);
        signal(SIGCHLD, sig_handler);
        signal(SIGINT, sig_handler);
+        signal(SIGUSR1, sig_handler);
        if (forks && (pipe(child_ready_pipe) < 0 || pipe(go_pipe) < 0)) {
                perror("failed to create pipes");
@@ -606,6 +607,7 @@ static int __cmd_record(int argc, const char **argv)
                        execvp(argv[0], (char **)argv);
                        perror(argv[0]);
+                        kill(getppid(), SIGUSR1);
                        exit(-1);
                }
@@ -697,17 +699,18 @@ static int __cmd_record(int argc, const char **argv)
        if (err < 0)
                err = event__synthesize_kernel_mmap(process_synthesized_event,
                                                    session, machine, "_stext");
-        if (err < 0) {
+        if (err < 0)
-                pr_err("Couldn't record kernel reference relocation symbol.\n");
+                pr_err("Couldn't record kernel reference relocation symbol\n"
-                return err;
+                       "Symbol resolution may be skewed if relocation was used (e.g. kexec).\n"
-        }
+                       "Check /proc/kallsyms permission or run as root.\n");
        err = event__synthesize_modules(process_synthesized_event,
                                        session, machine);
-        if (err < 0) {
+        if (err < 0)
-                pr_err("Couldn't record kernel reference relocation symbol.\n");
+                pr_err("Couldn't record kernel module information.\n"
-                return err;
+                       "Symbol resolution may be skewed if relocation was used (e.g. kexec).\n"
-        }
+                       "Check /proc/modules permission or run as root.\n");
        if (perf_guest)
                perf_session__process_machines(session, event__synthesize_guest_os);
@@ -761,7 +764,7 @@ static int __cmd_record(int argc, const char **argv)
                }
        }
-        if (quiet)
+        if (quiet || signr == SIGUSR1)
                return 0;
        fprintf(stderr, "[ perf record: Woken up %ld times to write data ]\n", waking);
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index d7e67b167ea3..64a85bafde63 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -946,11 +946,16 @@ perf_header__find_attr(u64 id, struct perf_header *header)
        /*
         * We set id to -1 if the data file doesn't contain sample
-         * ids. Check for this and avoid walking through the entire
+         * ids. This can happen when the data file contains one type
-         * list of ids which may be large.
+         * of event and in that case, the header can still store the
+         * event attribute information. Check for this and avoid
+         * walking through the entire list of ids which may be large.
         */
-        if (id == -1ULL)
+        if (id == -1ULL) {
+                if (header->attrs > 0)
+                        return &header->attr[0]->attr;
                return NULL;
+        }
        for (i = 0; i < header->attrs; i++) {
                struct perf_header_attr *attr = header->attr[i];
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index b39f499e575a..d628c8d1cf5e 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -295,7 +295,9 @@ static void symbols__insert_by_name(struct rb_root *self, struct symbol *sym)
 {
        struct rb_node **p = &self->rb_node;
        struct rb_node *parent = NULL;
-        struct symbol_name_rb_node *symn = ((void *)sym) - sizeof(*parent), *s;
+        struct symbol_name_rb_node *symn, *s;
+        symn = container_of(sym, struct symbol_name_rb_node, sym);
        while (*p != NULL) {
                parent = *p;
@@ -530,7 +532,7 @@ static int dso__split_kallsyms(struct dso *self, struct map *map,
        struct machine *machine = kmaps->machine;
        struct map *curr_map = map;
        struct symbol *pos;
-        int count = 0;
+        int count = 0, moved = 0;       
        struct rb_root *root = &self->symbols[map->type];
        struct rb_node *next = rb_first(root);
        int kernel_range = 0;
@@ -588,6 +590,11 @@ static int dso__split_kallsyms(struct dso *self, struct map *map,
                        char dso_name[PATH_MAX];
                        struct dso *dso;
+                        if (count == 0) {
+                                curr_map = map;
+                                goto filter_symbol;
+                        }
                        if (self->kernel == DSO_TYPE_GUEST_KERNEL)
                                snprintf(dso_name, sizeof(dso_name),
                                        "[guest.kernel].%d",
@@ -613,7 +620,7 @@ static int dso__split_kallsyms(struct dso *self, struct map *map,
                        map_groups__insert(kmaps, curr_map);
                        ++kernel_range;
                }
+filter_symbol:
                if (filter && filter(curr_map, pos)) {
 discard_symbol:         rb_erase(&pos->rb_node, root);
                        symbol__delete(pos);
@@ -621,8 +628,9 @@ discard_symbol:		rb_erase(&pos->rb_node, root);
                        if (curr_map != map) {
                                rb_erase(&pos->rb_node, root);
                                symbols__insert(&curr_map->dso->symbols[curr_map->type], pos);
-                        }
+                                ++moved;
-                        count++;
+                        } else
+                                ++count;
                }
        }
@@ -632,7 +640,7 @@ discard_symbol:		rb_erase(&pos->rb_node, root);
                dso__set_loaded(curr_map->dso, curr_map->type);
        }
-        return count;
+        return count + moved;
 }
 int dso__load_kallsyms(struct dso *self, const char *filename,
@@ -2123,14 +2131,55 @@ static struct dso *machine__create_kernel(struct machine *self)
        return kernel;
 }
+struct process_args {
+        u64 start;
+};
+static int symbol__in_kernel(void *arg, const char *name,
+                             char type __used, u64 start)
+{
+        struct process_args *args = arg;
+        if (strchr(name, '['))
+                return 0;
+        args->start = start;
+        return 1;
+}
+/* Figure out the start address of kernel map from /proc/kallsyms */
+static u64 machine__get_kernel_start_addr(struct machine *machine)
+{
+        const char *filename;
+        char path[PATH_MAX];
+        struct process_args args;
+        if (machine__is_host(machine)) {
+                filename = "/proc/kallsyms";
+        } else {
+                if (machine__is_default_guest(machine))
+                        filename = (char *)symbol_conf.default_guest_kallsyms;
+                else {
+                        sprintf(path, "%s/proc/kallsyms", machine->root_dir);
+                        filename = path;
+                }
+        }
+        if (kallsyms__parse(filename, &args, symbol__in_kernel) <= 0)
+                return 0;
+        return args.start;
+}
 int __machine__create_kernel_maps(struct machine *self, struct dso *kernel)
 {
        enum map_type type;
+        u64 start = machine__get_kernel_start_addr(self);
        for (type = 0; type < MAP__NR_TYPES; ++type) {
                struct kmap *kmap;
-                self->vmlinux_maps[type] = map__new2(0, kernel, type);
+                self->vmlinux_maps[type] = map__new2(start, kernel, type);
                if (self->vmlinux_maps[type] == NULL)
                        return -1;
diff --git a/usr/initramfs_data.S b/usr/initramfs_data.S
index 792a750d9441..c14322d1c0cf 100644
--- a/usr/initramfs_data.S
+++ b/usr/initramfs_data.S
@@ -22,14 +22,15 @@
 */
 #include <linux/stringify.h>
+#include <asm-generic/vmlinux.lds.h>
 .section .init.ramfs,"a"
 __irf_start:
 .incbin __stringify(INITRAMFS_IMAGE)
 __irf_end:
 .section .init.ramfs.info,"a"
-.globl __initramfs_size
+.globl VMLINUX_SYMBOL(__initramfs_size)
-__initramfs_size:
+VMLINUX_SYMBOL(__initramfs_size):
 #ifdef CONFIG_64BIT
        .quad __irf_end - __irf_start
 #else