300 files changed, 10056 insertions, 5896 deletions

diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt
index 7e81e37c0b1e..b245d524d568 100644
--- a/Documentation/filesystems/sysfs.txt
+++ b/Documentation/filesystems/sysfs.txt
@@ -23,7 +23,8 @@ interface.
 Using sysfs
 ~~~~~~~~~~~
 
-sysfs is always compiled in. You can access it by doing:
+sysfs is always compiled in if CONFIG_SYSFS is defined. You can access
+it by doing:
 
     mount -t sysfs sysfs /sys 
 
diff --git a/Documentation/sound/alsa/Procfile.txt b/Documentation/sound/alsa/Procfile.txt
index 381908d8ca42..719a819f8cc2 100644
--- a/Documentation/sound/alsa/Procfile.txt
+++ b/Documentation/sound/alsa/Procfile.txt
@@ -101,6 +101,8 @@ card*/pcm*/xrun_debug
           bit 0 = Enable XRUN/jiffies debug messages
           bit 1 = Show stack trace at XRUN / jiffies check
           bit 2 = Enable additional jiffies check
+          bit 3 = Log hwptr update at each period interrupt
+          bit 4 = Log hwptr update at each snd_pcm_update_hw_ptr()
 
         When the bit 0 is set, the driver will show the messages to
         kernel log when an xrun is detected.  The debug message is
@@ -117,6 +119,9 @@ card*/pcm*/xrun_debug
         buggy) hardware that doesn't give smooth pointer updates.
         This feature is enabled via the bit 2.
 
+        Bits 3 and 4 are for logging the hwptr records.  Note that
+        these will give flood of kernel messages.
+
 card*/pcm*/sub*/info
         The general information of this PCM sub-stream.
 
diff --git a/Documentation/video4linux/CARDLIST.em28xx b/Documentation/video4linux/CARDLIST.em28xx
index 014d255231fc..68c236c01846 100644
--- a/Documentation/video4linux/CARDLIST.em28xx
+++ b/Documentation/video4linux/CARDLIST.em28xx
@@ -20,7 +20,7 @@
  19 -> EM2860/SAA711X Reference Design          (em2860)
  20 -> AMD ATI TV Wonder HD 600                 (em2880)        [0438:b002]
  21 -> eMPIA Technology, Inc. GrabBeeX+ Video Encoder (em2800)        [eb1a:2801]
- 22 -> Unknown EM2750/EM2751 webcam grabber     (em2750)        [eb1a:2750,eb1a:2751]
+ 22 -> EM2710/EM2750/EM2751 webcam grabber      (em2750)        [eb1a:2750,eb1a:2751]
  23 -> Huaqi DLCW-130                           (em2750)
  24 -> D-Link DUB-T210 TV Tuner                 (em2820/em2840) [2001:f112]
  25 -> Gadmei UTV310                            (em2820/em2840)
diff --git a/Documentation/video4linux/gspca.txt b/Documentation/video4linux/gspca.txt
index 2bcf78896e22..573f95b58807 100644
--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -44,7 +44,9 @@ zc3xx		0458:7007	Genius VideoCam V2
 zc3xx           0458:700c       Genius VideoCam V3
 zc3xx           0458:700f       Genius VideoCam Web V2
 sonixj          0458:7025       Genius Eye 311Q
+sn9c20x         0458:7029       Genius Look 320s
 sonixj          0458:702e       Genius Slim 310 NB
+sn9c20x         045e:00f4       LifeCam VX-6000 (SN9C20x + OV9650)
 sonixj          045e:00f5       MicroSoft VX3000
 sonixj          045e:00f7       MicroSoft VX1000
 ov519           045e:028c       Micro$oft xbox cam
@@ -282,6 +284,28 @@ sonixj		0c45:613a	Microdia Sonix PC Camera
 sonixj          0c45:613b       Surfer SN-206
 sonixj          0c45:613c       Sonix Pccam168
 sonixj          0c45:6143       Sonix Pccam168
+sn9c20x         0c45:6240       PC Camera (SN9C201 + MT9M001)
+sn9c20x         0c45:6242       PC Camera (SN9C201 + MT9M111)
+sn9c20x         0c45:6248       PC Camera (SN9C201 + OV9655)
+sn9c20x         0c45:624e       PC Camera (SN9C201 + SOI968)
+sn9c20x         0c45:624f       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6251       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6253       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6260       PC Camera (SN9C201 + OV7670)
+sn9c20x         0c45:6270       PC Camera (SN9C201 + MT9V011/MT9V111/MT9V112)
+sn9c20x         0c45:627b       PC Camera (SN9C201 + OV7660)
+sn9c20x         0c45:627c       PC Camera (SN9C201 + HV7131R)
+sn9c20x         0c45:627f       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6280       PC Camera (SN9C202 + MT9M001)
+sn9c20x         0c45:6282       PC Camera (SN9C202 + MT9M111)
+sn9c20x         0c45:6288       PC Camera (SN9C202 + OV9655)
+sn9c20x         0c45:628e       PC Camera (SN9C202 + SOI968)
+sn9c20x         0c45:628f       PC Camera (SN9C202 + OV9650)
+sn9c20x         0c45:62a0       PC Camera (SN9C202 + OV7670)
+sn9c20x         0c45:62b0       PC Camera (SN9C202 + MT9V011/MT9V111/MT9V112)
+sn9c20x         0c45:62b3       PC Camera (SN9C202 + OV9655)
+sn9c20x         0c45:62bb       PC Camera (SN9C202 + OV7660)
+sn9c20x         0c45:62bc       PC Camera (SN9C202 + HV7131R)
 sunplus         0d64:0303       Sunplus FashionCam DXG
 etoms           102c:6151       Qcam Sangha CIF
 etoms           102c:6251       Qcam xxxxxx VGA
@@ -290,6 +314,7 @@ spca561		10fd:7e50	FlyCam Usb 100
 zc3xx           10fd:8050       Typhoon Webshot II USB 300k
 ov534           1415:2000       Sony HD Eye for PS3 (SLEH 00201)
 pac207          145f:013a       Trust WB-1300N
+sn9c20x         145f:013d       Trust WB-3600R
 vc032x          15b8:6001       HP 2.0 Megapixel
 vc032x          15b8:6002       HP 2.0 Megapixel rz406aa
 spca501         1776:501c       Arowana 300K CMOS Camera
@@ -300,4 +325,11 @@ spca500		2899:012c	Toptro Industrial
 spca508         8086:0110       Intel Easy PC Camera
 spca500         8086:0630       Intel Pocket PC Camera
 spca506         99fa:8988       Grandtec V.cap
+sn9c20x         a168:0610       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0611       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0613       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0618       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0614       Dino-Lite Digital Microscope (SN9C201 + MT9M111)
+sn9c20x         a168:0615       Dino-Lite Digital Microscope (SN9C201 + MT9M111)
+sn9c20x         a168:0617       Dino-Lite Digital Microscope (SN9C201 + MT9M111)
 spca561         abcd:cdee       Petcam
diff --git a/arch/alpha/include/asm/tlb.h b/arch/alpha/include/asm/tlb.h
index c13636575fba..42866759f3fa 100644
--- a/arch/alpha/include/asm/tlb.h
+++ b/arch/alpha/include/asm/tlb.h
@@ -9,7 +9,7 @@
 
 #include <asm-generic/tlb.h>
 
-#define __pte_free_tlb(tlb, pte)                        pte_free((tlb)->mm, pte)
-#define __pmd_free_tlb(tlb, pmd)                        pmd_free((tlb)->mm, pmd)
+#define __pte_free_tlb(tlb, pte, address)               pte_free((tlb)->mm, pte)
+#define __pmd_free_tlb(tlb, pmd, address)               pmd_free((tlb)->mm, pmd)
  
 #endif
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 321c83e43a1e..f41a6f57cd12 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -102,8 +102,8 @@ tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vma)
 }
 
 #define tlb_remove_page(tlb,page)       free_page_and_swap_cache(page)
-#define pte_free_tlb(tlb, ptep)         pte_free((tlb)->mm, ptep)
-#define pmd_free_tlb(tlb, pmdp)         pmd_free((tlb)->mm, pmdp)
+#define pte_free_tlb(tlb, ptep, addr)   pte_free((tlb)->mm, ptep)
+#define pmd_free_tlb(tlb, pmdp, addr)   pmd_free((tlb)->mm, pmdp)
 
 #define tlb_migrate_finish(mm)          do { } while (0)
 
diff --git a/arch/arm/mach-s3c2410/include/mach/gpio-core.h b/arch/arm/mach-s3c2410/include/mach/gpio-core.h
index 8fe192081d3a..f8b879a7973c 100644
--- a/arch/arm/mach-s3c2410/include/mach/gpio-core.h
+++ b/arch/arm/mach-s3c2410/include/mach/gpio-core.h
@@ -28,7 +28,7 @@ static inline struct s3c_gpio_chip *s3c_gpiolib_getchip(unsigned int pin)
                 return NULL;
 
         chip = &s3c24xx_gpios[pin/32];
-        return (S3C2410_GPIO_OFFSET(pin) > chip->chip.ngpio) ? chip : NULL;
+        return (S3C2410_GPIO_OFFSET(pin) < chip->chip.ngpio) ? chip : NULL;
 }
 
 #endif /* __ASM_ARCH_GPIO_CORE_H */
diff --git a/arch/arm/plat-s3c64xx/s3c6400-clock.c b/arch/arm/plat-s3c64xx/s3c6400-clock.c
index 1debc1f9f987..febac1950d8e 100644
--- a/arch/arm/plat-s3c64xx/s3c6400-clock.c
+++ b/arch/arm/plat-s3c64xx/s3c6400-clock.c
@@ -153,7 +153,7 @@ static unsigned long s3c64xx_clk_arm_round_rate(struct clk *clk,
         u32 div;
 
         if (parent < rate)
-                return rate;
+                return parent;
 
         div = (parent / rate) - 1;
         if (div > armclk_mask)
@@ -175,7 +175,7 @@ static int s3c64xx_clk_arm_set_rate(struct clk *clk, unsigned long rate)
         div = clk_get_rate(clk->parent) / rate;
 
         val = __raw_readl(S3C_CLK_DIV0);
-        val &= armclk_mask;
+        val &= ~armclk_mask;
         val |= (div - 1);
         __raw_writel(val, S3C_CLK_DIV0);
 
diff --git a/arch/avr32/include/asm/pgalloc.h b/arch/avr32/include/asm/pgalloc.h
index 640821323943..92ecd8446ef8 100644
--- a/arch/avr32/include/asm/pgalloc.h
+++ b/arch/avr32/include/asm/pgalloc.h
@@ -83,7 +83,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         quicklist_free_page(QUICK_PT, NULL, pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,addr)                    \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
diff --git a/arch/cris/include/asm/pgalloc.h b/arch/cris/include/asm/pgalloc.h
index a1ba761d0573..6da975db112f 100644
--- a/arch/cris/include/asm/pgalloc.h
+++ b/arch/cris/include/asm/pgalloc.h
@@ -47,7 +47,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,address)                 \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
diff --git a/arch/frv/include/asm/pgalloc.h b/arch/frv/include/asm/pgalloc.h
index 971e6addb009..416d19a632f2 100644
--- a/arch/frv/include/asm/pgalloc.h
+++ b/arch/frv/include/asm/pgalloc.h
@@ -49,7 +49,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,address)                 \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb),(pte));                   \
@@ -62,7 +62,7 @@ do {							\
  */
 #define pmd_alloc_one(mm, addr)         ({ BUG(); ((pmd_t *) 2); })
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb,x)           do { } while (0)
+#define __pmd_free_tlb(tlb,x,a)         do { } while (0)
 
 #endif /* CONFIG_MMU */
 
diff --git a/arch/frv/include/asm/pgtable.h b/arch/frv/include/asm/pgtable.h
index 33233011b1c1..22c60692b551 100644
--- a/arch/frv/include/asm/pgtable.h
+++ b/arch/frv/include/asm/pgtable.h
@@ -225,7 +225,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
  */
 #define pud_alloc_one(mm, address)              NULL
 #define pud_free(mm, x)                         do { } while (0)
-#define __pud_free_tlb(tlb, x)                  do { } while (0)
+#define __pud_free_tlb(tlb, x, address)         do { } while (0)
 
 /*
  * The "pud_xxx()" functions here are trivial for a folded two-level
diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
index b9ac1a6fc216..96a8d927db28 100644
--- a/arch/ia64/include/asm/pgalloc.h
+++ b/arch/ia64/include/asm/pgalloc.h
@@ -48,7 +48,7 @@ static inline void pud_free(struct mm_struct *mm, pud_t *pud)
 {
         quicklist_free(0, NULL, pud);
 }
-#define __pud_free_tlb(tlb, pud)        pud_free((tlb)->mm, pud)
+#define __pud_free_tlb(tlb, pud, address)       pud_free((tlb)->mm, pud)
 #endif /* CONFIG_PGTABLE_4 */
 
 static inline void
@@ -67,7 +67,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         quicklist_free(0, NULL, pmd);
 }
 
-#define __pmd_free_tlb(tlb, pmd)        pmd_free((tlb)->mm, pmd)
+#define __pmd_free_tlb(tlb, pmd, address)       pmd_free((tlb)->mm, pmd)
 
 static inline void
 pmd_populate(struct mm_struct *mm, pmd_t * pmd_entry, pgtable_t pte)
@@ -117,6 +117,6 @@ static inline void check_pgt_cache(void)
         quicklist_trim(0, NULL, 25, 16);
 }
 
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, pte)
+#define __pte_free_tlb(tlb, pte, address)       pte_free((tlb)->mm, pte)
 
 #endif                          /* _ASM_IA64_PGALLOC_H */
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index 20d8a39680c2..85d965cb19a0 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -236,22 +236,22 @@ do {							\
         __tlb_remove_tlb_entry(tlb, ptep, addr);        \
 } while (0)
 
-#define pte_free_tlb(tlb, ptep)                         \
+#define pte_free_tlb(tlb, ptep, address)                \
 do {                                                    \
         tlb->need_flush = 1;                            \
-        __pte_free_tlb(tlb, ptep);                      \
+        __pte_free_tlb(tlb, ptep, address);             \
 } while (0)
 
-#define pmd_free_tlb(tlb, ptep)                         \
+#define pmd_free_tlb(tlb, ptep, address)                \
 do {                                                    \
         tlb->need_flush = 1;                            \
-        __pmd_free_tlb(tlb, ptep);                      \
+        __pmd_free_tlb(tlb, ptep, address);             \
 } while (0)
 
-#define pud_free_tlb(tlb, pudp)                         \
+#define pud_free_tlb(tlb, pudp, address)                \
 do {                                                    \
         tlb->need_flush = 1;                            \
-        __pud_free_tlb(tlb, pudp);                      \
+        __pud_free_tlb(tlb, pudp, address);             \
 } while (0)
 
 #endif /* _ASM_IA64_TLB_H */
diff --git a/arch/m32r/include/asm/pgalloc.h b/arch/m32r/include/asm/pgalloc.h
index f11a2b909cdb..0fc736198979 100644
--- a/arch/m32r/include/asm/pgalloc.h
+++ b/arch/m32r/include/asm/pgalloc.h
@@ -58,7 +58,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, (pte))
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, (pte))
 
 /*
  * allocating and freeing a pmd is trivial: the 1-entry pmd is
@@ -68,7 +68,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
 
 #define pmd_alloc_one(mm, addr)         ({ BUG(); ((pmd_t *)2); })
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
+#define __pmd_free_tlb(tlb, x, addr)    do { } while (0)
 #define pgd_populate(mm, pmd, pte)      BUG()
 
 #define check_pgt_cache()       do { } while (0)
diff --git a/arch/m68k/include/asm/motorola_pgalloc.h b/arch/m68k/include/asm/motorola_pgalloc.h
index d08bf6261df8..15ee4c74a9f0 100644
--- a/arch/m68k/include/asm/motorola_pgalloc.h
+++ b/arch/m68k/include/asm/motorola_pgalloc.h
@@ -54,7 +54,8 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t page)
         __free_page(page);
 }
 
-static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page)
+static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
+                                  unsigned long address)
 {
         pgtable_page_dtor(page);
         cache_page(kmap(page));
@@ -73,7 +74,8 @@ static inline int pmd_free(struct mm_struct *mm, pmd_t *pmd)
         return free_pointer_table(pmd);
 }
 
-static inline int __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
+static inline int __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+                                 unsigned long address)
 {
         return free_pointer_table(pmd);
 }
diff --git a/arch/m68k/include/asm/sun3_pgalloc.h b/arch/m68k/include/asm/sun3_pgalloc.h
index d4c83f143816..48d80d5a666f 100644
--- a/arch/m68k/include/asm/sun3_pgalloc.h
+++ b/arch/m68k/include/asm/sun3_pgalloc.h
@@ -32,7 +32,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t page)
         __free_page(page);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,addr)                    \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
@@ -80,7 +80,7 @@ static inline void pmd_populate(struct mm_struct *mm, pmd_t *pmd, pgtable_t page
  * inside the pgd, so has no extra memory associated with it.
  */
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
+#define __pmd_free_tlb(tlb, x, addr)    do { } while (0)
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 {
diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
index d0bcf80a1136..8439598d4655 100644
--- a/arch/microblaze/Makefile
+++ b/arch/microblaze/Makefile
@@ -6,14 +6,16 @@ endif
 
 # What CPU vesion are we building for, and crack it open
 # as major.minor.rev
-CPU_VER=$(subst ",,$(CONFIG_XILINX_MICROBLAZE0_HW_VER) )
-CPU_MAJOR=$(shell echo $(CPU_VER) | cut -d '.' -f 1)
-CPU_MINOR=$(shell echo $(CPU_VER) | cut -d '.' -f 2)
-CPU_REV=$(shell echo $(CPU_VER) | cut -d '.' -f 3)
+CPU_VER   := $(shell echo $(CONFIG_XILINX_MICROBLAZE0_HW_VER))
+CPU_MAJOR := $(shell echo $(CPU_VER) | cut -d '.' -f 1)
+CPU_MINOR := $(shell echo $(CPU_VER) | cut -d '.' -f 2)
+CPU_REV   := $(shell echo $(CPU_VER) | cut -d '.' -f 3)
 
 export CPU_VER CPU_MAJOR CPU_MINOR CPU_REV
 
 # Use cpu-related CONFIG_ vars to set compile options.
+# The various CONFIG_XILINX cpu features options are integers 0/1/2...
+# rather than bools y/n
 
 # Work out HW multipler support.  This is icky.
 # 1. Spartan2 has no HW multiplers.
@@ -34,30 +36,29 @@ CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR) += -mxl-pattern-compare
 
 CPUFLAGS-1 += $(call cc-option,-mcpu=v$(CPU_VER))
 
-# The various CONFIG_XILINX cpu features options are integers 0/1/2...
-# rather than bools y/n
-
 # r31 holds current when in kernel mode
-CFLAGS_KERNEL += -ffixed-r31 $(CPUFLAGS-1) $(CPUFLAGS-2)
+KBUILD_KERNEL += -ffixed-r31 $(CPUFLAGS-1) $(CPUFLAGS-2)
 
 LDFLAGS         :=
 LDFLAGS_vmlinux :=
-LDFLAGS_BLOB := --format binary --oformat elf32-microblaze
 
-LIBGCC := $(shell $(CC) $(CFLAGS_KERNEL) -print-libgcc-file-name)
+LIBGCC := $(shell $(CC) $(KBUILD_KERNEL) -print-libgcc-file-name)
 
-head-y          := arch/microblaze/kernel/head.o
-libs-y          += arch/microblaze/lib/ $(LIBGCC)
-core-y          += arch/microblaze/kernel/ arch/microblaze/mm/ \
-                   arch/microblaze/platform/
+head-y := arch/microblaze/kernel/head.o
+libs-y += arch/microblaze/lib/
+libs-y += $(LIBGCC)
+core-y += arch/microblaze/kernel/
+core-y += arch/microblaze/mm/
+core-y += arch/microblaze/platform/
 
-boot := arch/$(ARCH)/boot
+boot := arch/microblaze/boot
 
 # defines filename extension depending memory management type
 ifeq ($(CONFIG_MMU),)
-MMUEXT          := -nommu
+MMU := -nommu
 endif
-export  MMUEXT
+
+export MMU
 
 all: linux.bin
 
diff --git a/arch/microblaze/include/asm/io.h b/arch/microblaze/include/asm/io.h
index 5c173424d074..7c3ec13b44d8 100644
--- a/arch/microblaze/include/asm/io.h
+++ b/arch/microblaze/include/asm/io.h
@@ -14,7 +14,6 @@
 #include <asm/byteorder.h>
 #include <asm/page.h>
 #include <linux/types.h>
-#include <asm/byteorder.h>
 #include <linux/mm.h>          /* Get struct page {...} */
 
 
diff --git a/arch/microblaze/include/asm/pgalloc.h b/arch/microblaze/include/asm/pgalloc.h
index 59a757e46ba5..b0131da1387b 100644
--- a/arch/microblaze/include/asm/pgalloc.h
+++ b/arch/microblaze/include/asm/pgalloc.h
@@ -180,7 +180,7 @@ extern inline void pte_free(struct mm_struct *mm, struct page *ptepage)
         __free_page(ptepage);
 }
 
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, (pte))
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, (pte))
 
 #define pmd_populate(mm, pmd, pte)      (pmd_val(*(pmd)) = page_address(pte))
 
@@ -193,7 +193,7 @@ extern inline void pte_free(struct mm_struct *mm, struct page *ptepage)
  */
 #define pmd_alloc_one(mm, address)      ({ BUG(); ((pmd_t *)2); })
 /*#define pmd_free(mm, x)                       do { } while (0)*/
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
+#define __pmd_free_tlb(tlb, x, addr)    do { } while (0)
 #define pgd_populate(mm, pmd, pte)      BUG()
 
 extern int do_check_pgt_cache(int, int);
diff --git a/arch/microblaze/include/asm/pgtable.h b/arch/microblaze/include/asm/pgtable.h
index 4c57a586a989..cc3a4dfc3eaa 100644
--- a/arch/microblaze/include/asm/pgtable.h
+++ b/arch/microblaze/include/asm/pgtable.h
@@ -185,6 +185,7 @@ static inline pte_t pte_mkspecial(pte_t pte)	{ return pte; }
 
 /* Definitions for MicroBlaze. */
 #define _PAGE_GUARDED   0x001   /* G: page is guarded from prefetch */
+#define _PAGE_FILE      0x001   /* when !present: nonlinear file mapping */
 #define _PAGE_PRESENT   0x002   /* software: PTE contains a translation */
 #define _PAGE_NO_CACHE  0x004   /* I: caching is inhibited */
 #define _PAGE_WRITETHRU 0x008   /* W: caching is write-through */
@@ -320,8 +321,7 @@ static inline int pte_write(pte_t pte) { return pte_val(pte) & _PAGE_RW; }
 static inline int pte_exec(pte_t pte)  { return pte_val(pte) & _PAGE_EXEC; }
 static inline int pte_dirty(pte_t pte) { return pte_val(pte) & _PAGE_DIRTY; }
 static inline int pte_young(pte_t pte) { return pte_val(pte) & _PAGE_ACCESSED; }
-/* FIXME */
-static inline int pte_file(pte_t pte)           { return 0; }
+static inline int pte_file(pte_t pte)  { return pte_val(pte) & _PAGE_FILE; }
 
 static inline void pte_uncache(pte_t pte) { pte_val(pte) |= _PAGE_NO_CACHE; }
 static inline void pte_cache(pte_t pte)   { pte_val(pte) &= ~_PAGE_NO_CACHE; }
@@ -488,7 +488,7 @@ static inline pmd_t *pmd_offset(pgd_t *dir, unsigned long address)
 /* Encode and decode a nonlinear file mapping entry */
 #define PTE_FILE_MAX_BITS       29
 #define pte_to_pgoff(pte)       (pte_val(pte) >> 3)
-#define pgoff_to_pte(off)       ((pte_t) { ((off) << 3) })
+#define pgoff_to_pte(off)       ((pte_t) { ((off) << 3) | _PAGE_FILE })
 
 extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 
diff --git a/arch/microblaze/include/asm/prom.h b/arch/microblaze/include/asm/prom.h
index 20f7b3a926e8..37e6f305a68e 100644
--- a/arch/microblaze/include/asm/prom.h
+++ b/arch/microblaze/include/asm/prom.h
@@ -16,6 +16,18 @@
 #define _ASM_MICROBLAZE_PROM_H
 #ifdef __KERNEL__
 
+/* Definitions used by the flattened device tree */
+#define OF_DT_HEADER            0xd00dfeed /* marker */
+#define OF_DT_BEGIN_NODE        0x1 /* Start of node, full name */
+#define OF_DT_END_NODE          0x2 /* End node */
+#define OF_DT_PROP              0x3 /* Property: name off, size, content */
+#define OF_DT_NOP               0x4 /* nop */
+#define OF_DT_END               0x9
+
+#define OF_DT_VERSION           0x10
+
+#ifndef __ASSEMBLY__
+
 #include <linux/types.h>
 #include <linux/proc_fs.h>
 #include <linux/platform_device.h>
@@ -29,16 +41,6 @@
 #define of_prop_cmp(s1, s2)             strcmp((s1), (s2))
 #define of_node_cmp(s1, s2)             strcasecmp((s1), (s2))
 
-/* Definitions used by the flattened device tree */
-#define OF_DT_HEADER            0xd00dfeed /* marker */
-#define OF_DT_BEGIN_NODE        0x1 /* Start of node, full name */
-#define OF_DT_END_NODE          0x2 /* End node */
-#define OF_DT_PROP              0x3 /* Property: name off, size, content */
-#define OF_DT_NOP               0x4 /* nop */
-#define OF_DT_END               0x9
-
-#define OF_DT_VERSION           0x10
-
 /*
  * This is what gets passed to the kernel by prom_init or kexec
  *
@@ -309,5 +311,6 @@ extern void __iomem *of_iomap(struct device_node *device, int index);
  */
 #include <linux/of.h>
 
+#endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_MICROBLAZE_PROM_H */
diff --git a/arch/microblaze/include/asm/tlb.h b/arch/microblaze/include/asm/tlb.h
index c472d2801132..e8abd4a0349c 100644
--- a/arch/microblaze/include/asm/tlb.h
+++ b/arch/microblaze/include/asm/tlb.h
@@ -11,7 +11,7 @@
 #ifndef _ASM_MICROBLAZE_TLB_H
 #define _ASM_MICROBLAZE_TLB_H
 
-#define tlb_flush(tlb)  do {} while (0)
+#define tlb_flush(tlb)  flush_tlb_mm((tlb)->mm)
 
 #include <asm-generic/tlb.h>
 
diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
index 65adad61e7e9..5431b4631a7a 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -189,7 +189,7 @@ extern long strnlen_user(const char *src, long count);
 
 #define __put_user(x, ptr)                                              \
 ({                                                                      \
-        __typeof__(*(ptr)) __gu_val = x;                                \
+        __typeof__(*(ptr)) volatile __gu_val = (x);                     \
         long __gu_err = 0;                                              \
         switch (sizeof(__gu_val)) {                                     \
         case 1:                                                         \
diff --git a/arch/microblaze/kernel/Makefile b/arch/microblaze/kernel/Makefile
index f4a5e19a20eb..d487729683de 100644
--- a/arch/microblaze/kernel/Makefile
+++ b/arch/microblaze/kernel/Makefile
@@ -17,4 +17,4 @@ obj-$(CONFIG_HEART_BEAT)	+= heartbeat.o
 obj-$(CONFIG_MODULES)           += microblaze_ksyms.o module.o
 obj-$(CONFIG_MMU)               += misc.o
 
-obj-y   += entry$(MMUEXT).o
+obj-y   += entry$(MMU).o
diff --git a/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c b/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c
index 153f57c57b6d..c259786e7faa 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c
@@ -22,7 +22,7 @@
 
 #define CI(c, p) { ci->c = PVR_##p(pvr); }
 #define err_printk(x) \
-        early_printk("ERROR: Microblaze " x " - different for PVR and DTS\n");
+        early_printk("ERROR: Microblaze " x "-different for PVR and DTS\n");
 
 void set_cpuinfo_pvr_full(struct cpuinfo *ci, struct device_node *cpu)
 {
diff --git a/arch/microblaze/kernel/cpu/cpuinfo-static.c b/arch/microblaze/kernel/cpu/cpuinfo-static.c
index 450ca6bb828d..adb448f93d5f 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo-static.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo-static.c
@@ -18,7 +18,7 @@ static const char family_string[] = CONFIG_XILINX_MICROBLAZE0_FAMILY;
 static const char cpu_ver_string[] = CONFIG_XILINX_MICROBLAZE0_HW_VER;
 
 #define err_printk(x) \
-        early_printk("ERROR: Microblaze " x "- different for kernel and DTS\n");
+        early_printk("ERROR: Microblaze " x "-different for kernel and DTS\n");
 
 void __init set_cpuinfo_static(struct cpuinfo *ci, struct device_node *cpu)
 {
diff --git a/arch/microblaze/kernel/cpu/cpuinfo.c b/arch/microblaze/kernel/cpu/cpuinfo.c
index a10bea119b94..c411c6757deb 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo.c
@@ -26,6 +26,8 @@ const struct cpu_ver_key cpu_ver_lookup[] = {
         {"7.10.b", 0x09},
         {"7.10.c", 0x0a},
         {"7.10.d", 0x0b},
+        {"7.20.a", 0x0c},
+        {"7.20.b", 0x0d},
         /* FIXME There is no keycode defined in MBV for these versions */
         {"2.10.a", 0x10},
         {"3.00.a", 0x20},
diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index e568d6ec621b..e41c6ce2a7be 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -31,6 +31,7 @@
 #include <linux/linkage.h>
 #include <asm/thread_info.h>
 #include <asm/page.h>
+#include <asm/prom.h>           /* for OF_DT_HEADER */
 
 #ifdef CONFIG_MMU
 #include <asm/setup.h> /* COMMAND_LINE_SIZE */
@@ -54,11 +55,19 @@ ENTRY(_start)
         andi    r1, r1, ~2
         mts     rmsr, r1
 
-/* save fdt to kernel location */
-/* r7 stores pointer to fdt blob */
-        beqi    r7, no_fdt_arg
+/* r7 may point to an FDT, or there may be one linked in.
+   if it's in r7, we've got to save it away ASAP.
+   We ensure r7 points to a valid FDT, just in case the bootloader
+   is broken or non-existent */
+        beqi    r7, no_fdt_arg                  /* NULL pointer?  don't copy */
+        lw      r11, r0, r7                     /* Does r7 point to a */
+        rsubi   r11, r11, OF_DT_HEADER          /* valid FDT? */
+        beqi    r11, _prepare_copy_fdt
+        or      r7, r0, r0              /* clear R7 when not valid DTB */
+        bnei    r11, no_fdt_arg                 /* No - get out of here */
+_prepare_copy_fdt:
         or      r11, r0, r0 /* incremment */
-        ori     r4, r0, TOPHYS(_fdt_start) /* save bram context */
+        ori     r4, r0, TOPHYS(_fdt_start)
         ori     r3, r0, (0x4000 - 4)
 _copy_fdt:
         lw      r12, r7, r11 /* r12 = r7 + r11 */
diff --git a/arch/microblaze/kernel/hw_exception_handler.S b/arch/microblaze/kernel/hw_exception_handler.S
index 9d591cd74fc2..3288c9737671 100644
--- a/arch/microblaze/kernel/hw_exception_handler.S
+++ b/arch/microblaze/kernel/hw_exception_handler.S
@@ -74,6 +74,7 @@
 
 #include <asm/mmu.h>
 #include <asm/pgtable.h>
+#include <asm/signal.h>
 #include <asm/asm-offsets.h>
 
 /* Helpful Macros */
@@ -428,19 +429,9 @@ handle_unaligned_ex:
         mfs     r17, rbtr;      /* ESR[DS] set - return address in BTR */
         nop
 _no_delayslot:
-#endif
-
-#ifdef CONFIG_MMU
-        /* Check if unaligned address is last on a 4k page */
-                andi    r5, r4, 0xffc
-                xori    r5, r5, 0xffc
-                bnei    r5, _unaligned_ex2
-        _unaligned_ex1:
-                RESTORE_STATE;
-/* Another page must be accessed or physical address not in page table */
-                bri     unaligned_data_trap
-
-        _unaligned_ex2:
+        /* jump to high level unaligned handler */
+        RESTORE_STATE;
+        bri     unaligned_data_trap
 #endif
         andi    r6, r3, 0x3E0; /* Mask and extract the register operand */
         srl     r6, r6; /* r6 >> 5 */
@@ -450,45 +441,6 @@ _no_delayslot:
         srl     r6, r6;
         /* Store the register operand in a temporary location */
         sbi     r6, r0, TOPHYS(ex_reg_op);
-#ifdef CONFIG_MMU
-        /* Get physical address */
-        /* If we are faulting a kernel address, we have to use the
-         * kernel page tables.
-         */
-        ori     r5, r0, CONFIG_KERNEL_START
-        cmpu    r5, r4, r5
-        bgti    r5, _unaligned_ex3
-        ori     r5, r0, swapper_pg_dir
-        bri     _unaligned_ex4
-
-        /* Get the PGD for the current thread. */
-_unaligned_ex3: /* user thread */
-        addi    r5 ,CURRENT_TASK, TOPHYS(0); /* get current task address */
-        lwi     r5, r5, TASK_THREAD + PGDIR
-_unaligned_ex4:
-        tophys(r5,r5)
-        BSRLI(r6,r4,20)                 /* Create L1 (pgdir/pmd) address */
-        andi    r6, r6, 0xffc
-/* Assume pgdir aligned on 4K boundary, no need for "andi r5,r5,0xfffff003" */
-        or      r5, r5, r6
-        lwi     r6, r5, 0               /* Get L1 entry */
-        andi    r5, r6, 0xfffff000      /* Extract L2 (pte) base address. */
-        beqi    r5, _unaligned_ex1      /* Bail if no table */
-
-        tophys(r5,r5)
-        BSRLI(r6,r4,10)                 /* Compute PTE address */
-        andi    r6, r6, 0xffc
-        andi    r5, r5, 0xfffff003
-        or      r5, r5, r6
-        lwi     r5, r5, 0               /* Get Linux PTE */
-
-        andi    r6, r5, _PAGE_PRESENT
-        beqi    r6, _unaligned_ex1      /* Bail if no page */
-
-        andi    r5, r5, 0xfffff000      /* Extract RPN */
-        andi    r4, r4, 0x00000fff      /* Extract offset */
-        or      r4, r4, r5              /* Create physical address */
-#endif /* CONFIG_MMU */
 
         andi    r6, r3, 0x400; /* Extract ESR[S] */
         bnei    r6, ex_sw;
@@ -959,15 +911,15 @@ _unaligned_data_exception:
         andi    r6, r3, 0x800;  /* Extract ESR[W] - delay slot */
 ex_lw_vm:
         beqid   r6, ex_lhw_vm;
-        lbui    r5, r4, 0;      /* Exception address in r4 - delay slot */
+load1:  lbui    r5, r4, 0;      /* Exception address in r4 - delay slot */
 /* Load a word, byte-by-byte from destination address and save it in tmp space*/
         la      r6, r0, ex_tmp_data_loc_0;
         sbi     r5, r6, 0;
-        lbui    r5, r4, 1;
+load2:  lbui    r5, r4, 1;
         sbi     r5, r6, 1;
-        lbui    r5, r4, 2;
+load3:  lbui    r5, r4, 2;
         sbi     r5, r6, 2;
-        lbui    r5, r4, 3;
+load4:  lbui    r5, r4, 3;
         sbi     r5, r6, 3;
         brid    ex_lw_tail_vm;
 /* Get the destination register value into r3 - delay slot */
@@ -977,7 +929,7 @@ ex_lhw_vm:
          * save it in tmp space */
         la      r6, r0, ex_tmp_data_loc_0;
         sbi     r5, r6, 0;
-        lbui    r5, r4, 1;
+load5:  lbui    r5, r4, 1;
         sbi     r5, r6, 1;
         lhui    r3, r6, 0;      /* Get the destination register value into r3 */
 ex_lw_tail_vm:
@@ -996,22 +948,53 @@ ex_sw_tail_vm:
         swi     r3, r5, 0;      /* Get the word - delay slot */
         /* Store the word, byte-by-byte into destination address */
         lbui    r3, r5, 0;
-        sbi     r3, r4, 0;
+store1: sbi     r3, r4, 0;
         lbui    r3, r5, 1;
-        sbi     r3, r4, 1;
+store2: sbi     r3, r4, 1;
         lbui    r3, r5, 2;
-        sbi     r3, r4, 2;
+store3: sbi     r3, r4, 2;
         lbui    r3, r5, 3;
         brid    ret_from_exc;
-        sbi     r3, r4, 3;      /* Delay slot */
+store4: sbi     r3, r4, 3;      /* Delay slot */
 ex_shw_vm:
         /* Store the lower half-word, byte-by-byte into destination address */
         lbui    r3, r5, 2;
-        sbi     r3, r4, 0;
+store5: sbi     r3, r4, 0;
         lbui    r3, r5, 3;
         brid    ret_from_exc;
-        sbi     r3, r4, 1;      /* Delay slot */
+store6: sbi     r3, r4, 1;      /* Delay slot */
 ex_sw_end_vm:                   /* Exception handling of store word, ends. */
+
+/* We have to prevent cases that get/put_user macros get unaligned pointer
+ * to bad page area. We have to find out which origin instruction caused it
+ * and called fixup for that origin instruction not instruction in unaligned
+ * handler */
+ex_unaligned_fixup:
+        ori     r5, r7, 0 /* setup pointer to pt_regs */
+        lwi     r6, r7, PT_PC; /* faulting address is one instruction above */
+        addik   r6, r6, -4 /* for finding proper fixup */
+        swi     r6, r7, PT_PC; /* a save back it to PT_PC */
+        addik   r7, r0, SIGSEGV
+        /* call bad_page_fault for finding aligned fixup, fixup address is saved
+         * in PT_PC which is used as return address from exception */
+        la      r15, r0, ret_from_exc-8 /* setup return address */
+        brid    bad_page_fault
+        nop
+
+/* We prevent all load/store because it could failed any attempt to access */
+.section __ex_table,"a";
+        .word   load1,ex_unaligned_fixup;
+        .word   load2,ex_unaligned_fixup;
+        .word   load3,ex_unaligned_fixup;
+        .word   load4,ex_unaligned_fixup;
+        .word   load5,ex_unaligned_fixup;
+        .word   store1,ex_unaligned_fixup;
+        .word   store2,ex_unaligned_fixup;
+        .word   store3,ex_unaligned_fixup;
+        .word   store4,ex_unaligned_fixup;
+        .word   store5,ex_unaligned_fixup;
+        .word   store6,ex_unaligned_fixup;
+.previous;
 .end _unaligned_data_exception
 #endif /* CONFIG_MMU */
 
diff --git a/arch/microblaze/kernel/module.c b/arch/microblaze/kernel/module.c
index 51414171326f..5a45b1adfef1 100644
--- a/arch/microblaze/kernel/module.c
+++ b/arch/microblaze/kernel/module.c
@@ -57,7 +57,6 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
         Elf32_Rela *rela = (void *)sechdrs[relsec].sh_addr;
         Elf32_Sym *sym;
         unsigned long int *location;
-        unsigned long int locoffs;
         unsigned long int value;
 #if __GNUC__ < 4
         unsigned long int old_value;
@@ -113,10 +112,12 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                         break;
 
                 case R_MICROBLAZE_64_PCREL:
-                        locoffs = (location[0] & 0xFFFF) << 16 |
+#if __GNUC__ < 4
+                        old_value = (location[0] & 0xFFFF) << 16 |
                                 (location[1] & 0xFFFF);
-                        value -= (unsigned long int)(location) + 4 +
-                                locoffs;
+                        value -= old_value;
+#endif
+                        value -= (unsigned long int)(location) + 4;
                         location[0] = (location[0] & 0xFFFF0000) |
                                         (value >> 16);
                         location[1] = (location[1] & 0xFFFF0000) |
@@ -125,6 +126,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                                 value);
                         break;
 
+                case R_MICROBLAZE_32_PCREL_LO:
+                        pr_debug("R_MICROBLAZE_32_PCREL_LO\n");
+                        break;
+
+                case R_MICROBLAZE_64_NONE:
+                        pr_debug("R_MICROBLAZE_NONE\n");
+                        break;
+
                 case R_MICROBLAZE_NONE:
                         pr_debug("R_MICROBLAZE_NONE\n");
                         break;
@@ -133,7 +142,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                         printk(KERN_ERR "module %s: "
                                 "Unknown relocation: %u\n",
                                 module->name,
-                                ELF32_R_TYPE(rela->r_info));
+                                ELF32_R_TYPE(rela[i].r_info));
                         return -ENOEXEC;
                 }
         }
diff --git a/arch/microblaze/kernel/setup.c b/arch/microblaze/kernel/setup.c
index 8709bea09604..2a97bf513b64 100644
--- a/arch/microblaze/kernel/setup.c
+++ b/arch/microblaze/kernel/setup.c
@@ -138,8 +138,12 @@ void __init machine_early_init(const char *cmdline, unsigned int ram,
         setup_early_printk(NULL);
 #endif
 
-        early_printk("Ramdisk addr 0x%08x, FDT 0x%08x\n", ram, fdt);
-        printk(KERN_NOTICE "Found FDT at 0x%08x\n", fdt);
+        early_printk("Ramdisk addr 0x%08x, ", ram);
+        if (fdt)
+                early_printk("FDT at 0x%08x\n", fdt);
+        else
+                early_printk("Compiled-in FDT at 0x%08x\n",
+                                        (unsigned int)_fdt_start);
 
 #ifdef CONFIG_MTD_UCLINUX
         early_printk("Found romfs @ 0x%08x (0x%08x)\n",
diff --git a/arch/microblaze/kernel/sys_microblaze.c b/arch/microblaze/kernel/sys_microblaze.c
index e000bce09b2b..b96f1682bb24 100644
--- a/arch/microblaze/kernel/sys_microblaze.c
+++ b/arch/microblaze/kernel/sys_microblaze.c
@@ -33,105 +33,6 @@
 #include <linux/unistd.h>
 
 #include <asm/syscalls.h>
-/*
- * sys_ipc() is the de-multiplexer for the SysV IPC calls..
- *
- * This is really horribly ugly. This will be remove with new toolchain.
- */
-asmlinkage long
-sys_ipc(uint call, int first, int second, int third, void *ptr, long fifth)
-{
-        int version, ret;
-
-        version = call >> 16; /* hack for backward compatibility */
-        call &= 0xffff;
-
-        ret = -EINVAL;
-        switch (call) {
-        case SEMOP:
-                ret = sys_semop(first, (struct sembuf *)ptr, second);
-                break;
-        case SEMGET:
-                ret = sys_semget(first, second, third);
-                break;
-        case SEMCTL:
-        {
-                union semun fourth;
-
-                if (!ptr)
-                        break;
-                ret = (access_ok(VERIFY_READ, ptr, sizeof(long)) ? 0 : -EFAULT)
-                                || (get_user(fourth.__pad, (void **)ptr)) ;
-                if (ret)
-                        break;
-                ret = sys_semctl(first, second, third, fourth);
-                break;
-        }
-        case MSGSND:
-                ret = sys_msgsnd(first, (struct msgbuf *) ptr, second, third);
-                break;
-        case MSGRCV:
-                switch (version) {
-                case 0: {
-                        struct ipc_kludge tmp;
-
-                        if (!ptr)
-                                break;
-                        ret = (access_ok(VERIFY_READ, ptr, sizeof(tmp))
-                                ? 0 : -EFAULT) || copy_from_user(&tmp,
-                                (struct ipc_kludge *) ptr, sizeof(tmp));
-                        if (ret)
-                                break;
-                        ret = sys_msgrcv(first, tmp.msgp, second, tmp.msgtyp,
-                                        third);
-                        break;
-                        }
-                default:
-                        ret = sys_msgrcv(first, (struct msgbuf *) ptr,
-                                        second, fifth, third);
-                        break;
-                }
-                break;
-        case MSGGET:
-                ret = sys_msgget((key_t) first, second);
-                break;
-        case MSGCTL:
-                ret = sys_msgctl(first, second, (struct msqid_ds *) ptr);
-                break;
-        case SHMAT:
-                switch (version) {
-                default: {
-                        ulong raddr;
-                        ret = access_ok(VERIFY_WRITE, (ulong *) third,
-                                        sizeof(ulong)) ? 0 : -EFAULT;
-                        if (ret)
-                                break;
-                        ret = do_shmat(first, (char *) ptr, second, &raddr);
-                        if (ret)
-                                break;
-                        ret = put_user(raddr, (ulong *) third);
-                        break;
-                        }
-                case 1: /* iBCS2 emulator entry point */
-                        if (!segment_eq(get_fs(), get_ds()))
-                                break;
-                        ret = do_shmat(first, (char *) ptr, second,
-                                        (ulong *) third);
-                        break;
-                }
-                break;
-        case SHMDT:
-                ret = sys_shmdt((char *)ptr);
-                break;
-        case SHMGET:
-                ret = sys_shmget(first, second, third);
-                break;
-        case SHMCTL:
-                ret = sys_shmctl(first, second, (struct shmid_ds *) ptr);
-                break;
-        }
-        return ret;
-}
 
 asmlinkage long microblaze_vfork(struct pt_regs *regs)
 {
diff --git a/arch/microblaze/kernel/syscall_table.S b/arch/microblaze/kernel/syscall_table.S
index 31b32a6c5f4e..216db817beb6 100644
--- a/arch/microblaze/kernel/syscall_table.S
+++ b/arch/microblaze/kernel/syscall_table.S
@@ -121,7 +121,7 @@ ENTRY(sys_call_table)
         .long sys_wait4
         .long sys_swapoff               /* 115 */
         .long sys_sysinfo
-        .long sys_ipc
+        .long sys_ni_syscall            /* old sys_ipc */
         .long sys_fsync
         .long sys_ni_syscall            /* sys_sigreturn_wrapper */
         .long sys_clone         /* 120 */
diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
index 956607a63f4c..d9d249a66ff2 100644
--- a/arch/microblaze/mm/fault.c
+++ b/arch/microblaze/mm/fault.c
@@ -69,7 +69,7 @@ static int store_updates_sp(struct pt_regs *regs)
  * It is called from do_page_fault above and from some of the procedures
  * in traps.c.
  */
-static void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
 {
         const struct exception_table_entry *fixup;
 /* MS: no context */
@@ -122,15 +122,10 @@ void do_page_fault(struct pt_regs *regs, unsigned long address,
         }
 #endif /* CONFIG_KGDB */
 
-        if (in_atomic() || mm == NULL) {
-                /* FIXME */
-                if (kernel_mode(regs)) {
-                        printk(KERN_EMERG
-                                "Page fault in kernel mode - Oooou!!! pid %d\n",
-                                current->pid);
-                        _exception(SIGSEGV, regs, code, address);
-                        return;
-                }
+        if (in_atomic() || !mm) {
+                if (kernel_mode(regs))
+                        goto bad_area_nosemaphore;
+
                 /* in_atomic() in user mode is really bad,
                    as is current->mm == NULL. */
                 printk(KERN_EMERG "Page fault in user mode with "
diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
index 1275831dda29..3738f4b48cbd 100644
--- a/arch/mips/include/asm/pgalloc.h
+++ b/arch/mips/include/asm/pgalloc.h
@@ -98,23 +98,12 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_pages(pte, PTE_ORDER);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,address)                 \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
 } while (0)
 
-#ifdef CONFIG_32BIT
-
-/*
- * allocating and freeing a pmd is trivial: the 1-entry pmd is
- * inside the pgd, so has no extra memory associated with it.
- */
-#define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
-
-#endif
-
 #ifdef CONFIG_64BIT
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
@@ -132,7 +121,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         free_pages((unsigned long)pmd, PMD_ORDER);
 }
 
-#define __pmd_free_tlb(tlb, x)  pmd_free((tlb)->mm, x)
+#define __pmd_free_tlb(tlb, x, addr)    pmd_free((tlb)->mm, x)
 
 #endif
 
diff --git a/arch/mn10300/include/asm/pgalloc.h b/arch/mn10300/include/asm/pgalloc.h
index ec057e1bd4cf..a19f11327cd8 100644
--- a/arch/mn10300/include/asm/pgalloc.h
+++ b/arch/mn10300/include/asm/pgalloc.h
@@ -51,6 +51,6 @@ static inline void pte_free(struct mm_struct *mm, struct page *pte)
 }
 
 
-#define __pte_free_tlb(tlb, pte) tlb_remove_page((tlb), (pte))
+#define __pte_free_tlb(tlb, pte, addr) tlb_remove_page((tlb), (pte))
 
 #endif /* _ASM_PGALLOC_H */
diff --git a/arch/parisc/include/asm/tlb.h b/arch/parisc/include/asm/tlb.h
index 383b1db310ee..07924903989e 100644
--- a/arch/parisc/include/asm/tlb.h
+++ b/arch/parisc/include/asm/tlb.h
@@ -21,7 +21,7 @@ do {	if (!(tlb)->fullmm)	\
 
 #include <asm-generic/tlb.h>
 
-#define __pmd_free_tlb(tlb, pmd)        pmd_free((tlb)->mm, pmd)
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, pte)
+#define __pmd_free_tlb(tlb, pmd, addr)  pmd_free((tlb)->mm, pmd)
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, pte)
 
 #endif
diff --git a/arch/powerpc/include/asm/pgalloc-32.h b/arch/powerpc/include/asm/pgalloc-32.h
index 0815eb40acae..c9500d666a1d 100644
--- a/arch/powerpc/include/asm/pgalloc-32.h
+++ b/arch/powerpc/include/asm/pgalloc-32.h
@@ -16,7 +16,7 @@ extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
  */
 /* #define pmd_alloc_one(mm,address)       ({ BUG(); ((pmd_t *)2); }) */
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb,x)           do { } while (0)
+#define __pmd_free_tlb(tlb,x,a)         do { } while (0)
 /* #define pgd_populate(mm, pmd, pte)      BUG() */
 
 #ifndef CONFIG_BOOKE
diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
index afda2bdd860f..e6f069c4f713 100644
--- a/arch/powerpc/include/asm/pgalloc-64.h
+++ b/arch/powerpc/include/asm/pgalloc-64.h
@@ -118,11 +118,11 @@ static inline void pgtable_free(pgtable_free_t pgf)
                 kmem_cache_free(pgtable_cache[cachenum], p);
 }
 
-#define __pmd_free_tlb(tlb, pmd)        \
+#define __pmd_free_tlb(tlb, pmd,addr)                 \
         pgtable_free_tlb(tlb, pgtable_free_cache(pmd, \
                 PMD_CACHE_NUM, PMD_TABLE_SIZE-1))
 #ifndef CONFIG_PPC_64K_PAGES
-#define __pud_free_tlb(tlb, pud)        \
+#define __pud_free_tlb(tlb, pud, addr)                \
         pgtable_free_tlb(tlb, pgtable_free_cache(pud, \
                 PUD_CACHE_NUM, PUD_TABLE_SIZE-1))
 #endif /* CONFIG_PPC_64K_PAGES */
diff --git a/arch/powerpc/include/asm/pgalloc.h b/arch/powerpc/include/asm/pgalloc.h
index 5d8480265a77..1730e5e298d6 100644
--- a/arch/powerpc/include/asm/pgalloc.h
+++ b/arch/powerpc/include/asm/pgalloc.h
@@ -38,14 +38,14 @@ static inline pgtable_free_t pgtable_free_cache(void *p, int cachenum,
 extern void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf);
 
 #ifdef CONFIG_SMP
-#define __pte_free_tlb(tlb,ptepage)     \
+#define __pte_free_tlb(tlb,ptepage,address)             \
 do { \
         pgtable_page_dtor(ptepage); \
         pgtable_free_tlb(tlb, pgtable_free_cache(page_address(ptepage), \
-                PTE_NONCACHE_NUM, PTE_TABLE_SIZE-1)); \
+                                        PTE_NONCACHE_NUM, PTE_TABLE_SIZE-1)); \
 } while (0)
 #else
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, (pte))
+#define __pte_free_tlb(tlb, pte, address)       pte_free((tlb)->mm, (pte))
 #endif
 
 
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 9920d6a7cf29..c46ef2ffa3d9 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -305,7 +305,7 @@ static void hugetlb_free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
 
         pmd = pmd_offset(pud, start);
         pud_clear(pud);
-        pmd_free_tlb(tlb, pmd);
+        pmd_free_tlb(tlb, pmd, start);
 }
 
 static void hugetlb_free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
@@ -348,7 +348,7 @@ static void hugetlb_free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
 
         pud = pud_offset(pgd, start);
         pgd_clear(pgd);
-        pud_free_tlb(tlb, pud);
+        pud_free_tlb(tlb, pud, start);
 }
 
 /*
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index 3d8a96d39d9d..81150b053689 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -96,7 +96,8 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
  * pte_free_tlb frees a pte table and clears the CRSTE for the
  * page table from the tlb.
  */
-static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte)
+static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+                                unsigned long address)
 {
         if (!tlb->fullmm) {
                 tlb->array[tlb->nr_ptes++] = pte;
@@ -113,7 +114,8 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte)
  * as the pgd. pmd_free_tlb checks the asce_limit against 2GB
  * to avoid the double free of the pmd in this case.
  */
-static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
+static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+                                unsigned long address)
 {
 #ifdef __s390x__
         if (tlb->mm->context.asce_limit <= (1UL << 31))
@@ -134,7 +136,8 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
  * as the pgd. pud_free_tlb checks the asce_limit against 4TB
  * to avoid the double free of the pud in this case.
  */
-static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
+static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+                                unsigned long address)
 {
 #ifdef __s390x__
         if (tlb->mm->context.asce_limit <= (1UL << 42))
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index f9b144049dc9..8d15314381e0 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -210,7 +210,7 @@ static noinline __init void detect_machine_type(void)
                 machine_flags |= MACHINE_FLAG_VM;
 }
 
-static void early_pgm_check_handler(void)
+static __init void early_pgm_check_handler(void)
 {
         unsigned long addr;
         const struct exception_table_entry *fixup;
@@ -222,7 +222,7 @@ static void early_pgm_check_handler(void)
         S390_lowcore.program_old_psw.addr = fixup->fixup | PSW_ADDR_AMODE;
 }
 
-void setup_lowcore_early(void)
+static noinline __init void setup_lowcore_early(void)
 {
         psw_t psw;
 
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 2270730f5354..be2cae083406 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -687,13 +687,14 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 #ifndef CONFIG_64BIT
         if (MACHINE_HAS_IEEE)
                 lowcore->extended_save_area_addr = (u32) save_area;
-#else
-        if (vdso_alloc_per_cpu(smp_processor_id(), lowcore))
-                BUG();
 #endif
         set_prefix((u32)(unsigned long) lowcore);
         local_mcck_enable();
         local_irq_enable();
+#ifdef CONFIG_64BIT
+        if (vdso_alloc_per_cpu(smp_processor_id(), &S390_lowcore))
+                BUG();
+#endif
         for_each_possible_cpu(cpu)
                 if (cpu != smp_processor_id())
                         smp_create_idle(cpu);
diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
index 79dbfee831ec..49106c6e6f88 100644
--- a/arch/s390/kernel/vdso64/clock_gettime.S
+++ b/arch/s390/kernel/vdso64/clock_gettime.S
@@ -88,10 +88,17 @@ __kernel_clock_gettime:
         llilh   %r4,0x0100
         sar     %a4,%r4
         lghi    %r4,0
+        epsw    %r5,0
         sacf    512                             /* Magic ectg instruction */
         .insn   ssf,0xc80100000000,__VDSO_ECTG_BASE(4),__VDSO_ECTG_USER(4),4
-        sacf    0
-        sar     %a4,%r2
+        tml     %r5,0x4000
+        jo      11f
+        tml     %r5,0x8000
+        jno     10f
+        sacf    256
+        j       11f
+10:     sacf    0
+11:     sar     %a4,%r2
         algr    %r1,%r0                         /* r1 = cputime as TOD value */
         mghi    %r1,1000                        /* convert to nanoseconds */
         srlg    %r1,%r1,12                      /* r1 = cputime in nanosec */
diff --git a/arch/s390/power/swsusp.c b/arch/s390/power/swsusp.c
index e6a4fe9f5f24..bd1f5c6b0b8c 100644
--- a/arch/s390/power/swsusp.c
+++ b/arch/s390/power/swsusp.c
@@ -7,24 +7,36 @@
  *
  */
 
+#include <asm/system.h>
 
-/*
- * save CPU registers before creating a hibernation image and before
- * restoring the memory state from it
- */
 void save_processor_state(void)
 {
-        /* implentation contained in the
-         * swsusp_arch_suspend function
+        /* swsusp_arch_suspend() actually saves all cpu register contents.
+         * Machine checks must be disabled since swsusp_arch_suspend() stores
+         * register contents to their lowcore save areas. That's the same
+         * place where register contents on machine checks would be saved.
+         * To avoid register corruption disable machine checks.
+         * We must also disable machine checks in the new psw mask for
+         * program checks, since swsusp_arch_suspend() may generate program
+         * checks. Disabling machine checks for all other new psw masks is
+         * just paranoia.
          */
+        local_mcck_disable();
+        /* Disable lowcore protection */
+        __ctl_clear_bit(0,28);
+        S390_lowcore.external_new_psw.mask &= ~PSW_MASK_MCHECK;
+        S390_lowcore.svc_new_psw.mask &= ~PSW_MASK_MCHECK;
+        S390_lowcore.io_new_psw.mask &= ~PSW_MASK_MCHECK;
+        S390_lowcore.program_new_psw.mask &= ~PSW_MASK_MCHECK;
 }
 
-/*
- * restore the contents of CPU registers
- */
 void restore_processor_state(void)
 {
-        /* implentation contained in the
-         * swsusp_arch_resume function
-         */
+        S390_lowcore.external_new_psw.mask |= PSW_MASK_MCHECK;
+        S390_lowcore.svc_new_psw.mask |= PSW_MASK_MCHECK;
+        S390_lowcore.io_new_psw.mask |= PSW_MASK_MCHECK;
+        S390_lowcore.program_new_psw.mask |= PSW_MASK_MCHECK;
+        /* Enable lowcore protection */
+        __ctl_set_bit(0,28);
+        local_mcck_enable();
 }
diff --git a/arch/s390/power/swsusp_asm64.S b/arch/s390/power/swsusp_asm64.S
index 76d688da32fa..b26df5c5933e 100644
--- a/arch/s390/power/swsusp_asm64.S
+++ b/arch/s390/power/swsusp_asm64.S
@@ -32,19 +32,14 @@ swsusp_arch_suspend:
         /* Deactivate DAT */
         stnsm   __SF_EMPTY(%r15),0xfb
 
-        /* Switch off lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        ni      __SF_EMPTY+4(%r15),0xef
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Store prefix register on stack */
         stpx    __SF_EMPTY(%r15)
 
-        /* Setup base register for lowcore (absolute 0) */
-        llgf    %r1,__SF_EMPTY(%r15)
+        /* Save prefix register contents for lowcore */
+        llgf    %r4,__SF_EMPTY(%r15)
 
         /* Get pointer to save area */
-        aghi    %r1,0x1000
+        lghi    %r1,0x1000
 
         /* Store registers */
         mvc     0x318(4,%r1),__SF_EMPTY(%r15)   /* move prefix to lowcore */
@@ -79,17 +74,15 @@ swsusp_arch_suspend:
         xc      __SF_EMPTY(4,%r15),__SF_EMPTY(%r15)
         spx     __SF_EMPTY(%r15)
 
-        /* Setup lowcore */
-        brasl   %r14,setup_lowcore_early
+        lghi    %r2,0
+        lghi    %r3,2*PAGE_SIZE
+        lghi    %r5,2*PAGE_SIZE
+1:      mvcle   %r2,%r4,0
+        jo      1b
 
         /* Save image */
         brasl   %r14,swsusp_save
 
-        /* Switch on lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        oi      __SF_EMPTY+4(%r15),0x10
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Restore prefix register and return */
         lghi    %r1,0x1000
         spx     0x318(%r1)
@@ -117,11 +110,6 @@ swsusp_arch_resume:
         /* Deactivate DAT */
         stnsm   __SF_EMPTY(%r15),0xfb
 
-        /* Switch off lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        ni      __SF_EMPTY+4(%r15),0xef
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Set prefix page to zero */
         xc      __SF_EMPTY(4,%r15),__SF_EMPTY(%r15)
         spx     __SF_EMPTY(%r15)
@@ -175,7 +163,7 @@ swsusp_arch_resume:
         /* Load old stack */
         lg      %r15,0x2f8(%r13)
 
-        /* Pointer to save arae */
+        /* Pointer to save area */
         lghi    %r13,0x1000
 
 #ifdef CONFIG_SMP
@@ -187,11 +175,6 @@ swsusp_arch_resume:
         /* Restore prefix register */
         spx     0x318(%r13)
 
-        /* Switch on lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        oi      __SF_EMPTY+4(%r15),0x10
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Activate DAT */
         stosm   __SF_EMPTY(%r15),0x04
 
diff --git a/arch/sh/include/asm/pgalloc.h b/arch/sh/include/asm/pgalloc.h
index 84dd2db7104c..63ca37bd9a95 100644
--- a/arch/sh/include/asm/pgalloc.h
+++ b/arch/sh/include/asm/pgalloc.h
@@ -73,20 +73,12 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         quicklist_free_page(QUICK_PT, NULL, pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,addr)                    \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), (pte));                  \
 } while (0)
 
-/*
- * allocating and freeing a pmd is trivial: the 1-entry pmd is
- * inside the pgd, so has no extra memory associated with it.
- */
-
-#define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb,x)           do { } while (0)
-
 static inline void check_pgt_cache(void)
 {
         quicklist_trim(QUICK_PGD, NULL, 25, 16);
diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h
index 9c16f737074a..da8fe7ab8728 100644
--- a/arch/sh/include/asm/tlb.h
+++ b/arch/sh/include/asm/tlb.h
@@ -91,9 +91,9 @@ tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vma)
 }
 
 #define tlb_remove_page(tlb,page)       free_page_and_swap_cache(page)
-#define pte_free_tlb(tlb, ptep)         pte_free((tlb)->mm, ptep)
-#define pmd_free_tlb(tlb, pmdp)         pmd_free((tlb)->mm, pmdp)
-#define pud_free_tlb(tlb, pudp)         pud_free((tlb)->mm, pudp)
+#define pte_free_tlb(tlb, ptep, addr)   pte_free((tlb)->mm, ptep)
+#define pmd_free_tlb(tlb, pmdp, addr)   pmd_free((tlb)->mm, pmdp)
+#define pud_free_tlb(tlb, pudp, addr)   pud_free((tlb)->mm, pudp)
 
 #define tlb_migrate_finish(mm)          do { } while (0)
 
diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
index 681582d26969..ca2b34456c4b 100644
--- a/arch/sparc/include/asm/pgalloc_32.h
+++ b/arch/sparc/include/asm/pgalloc_32.h
@@ -44,8 +44,8 @@ BTFIXUPDEF_CALL(pmd_t *, pmd_alloc_one, struct mm_struct *, unsigned long)
 BTFIXUPDEF_CALL(void, free_pmd_fast, pmd_t *)
 #define free_pmd_fast(pmd)      BTFIXUP_CALL(free_pmd_fast)(pmd)
 
-#define pmd_free(mm, pmd)       free_pmd_fast(pmd)
-#define __pmd_free_tlb(tlb, pmd) pmd_free((tlb)->mm, pmd)
+#define pmd_free(mm, pmd)               free_pmd_fast(pmd)
+#define __pmd_free_tlb(tlb, pmd, addr)  pmd_free((tlb)->mm, pmd)
 
 BTFIXUPDEF_CALL(void, pmd_populate, pmd_t *, struct page *)
 #define pmd_populate(MM, PMD, PTE)        BTFIXUP_CALL(pmd_populate)(PMD, PTE)
@@ -62,7 +62,7 @@ BTFIXUPDEF_CALL(void, free_pte_fast, pte_t *)
 #define pte_free_kernel(mm, pte)        BTFIXUP_CALL(free_pte_fast)(pte)
 
 BTFIXUPDEF_CALL(void, pte_free, pgtable_t )
-#define pte_free(mm, pte)       BTFIXUP_CALL(pte_free)(pte)
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, pte)
+#define pte_free(mm, pte)               BTFIXUP_CALL(pte_free)(pte)
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, pte)
 
 #endif /* _SPARC_PGALLOC_H */
diff --git a/arch/sparc/include/asm/tlb_64.h b/arch/sparc/include/asm/tlb_64.h
index ee38e731bfa6..dca406b9b6fc 100644
--- a/arch/sparc/include/asm/tlb_64.h
+++ b/arch/sparc/include/asm/tlb_64.h
@@ -100,9 +100,9 @@ static inline void tlb_remove_page(struct mmu_gather *mp, struct page *page)
 }
 
 #define tlb_remove_tlb_entry(mp,ptep,addr) do { } while (0)
-#define pte_free_tlb(mp, ptepage) pte_free((mp)->mm, ptepage)
-#define pmd_free_tlb(mp, pmdp) pmd_free((mp)->mm, pmdp)
-#define pud_free_tlb(tlb,pudp) __pud_free_tlb(tlb,pudp)
+#define pte_free_tlb(mp, ptepage, addr) pte_free((mp)->mm, ptepage)
+#define pmd_free_tlb(mp, pmdp, addr) pmd_free((mp)->mm, pmdp)
+#define pud_free_tlb(tlb,pudp, addr) __pud_free_tlb(tlb,pudp,addr)
 
 #define tlb_migrate_finish(mm)  do { } while (0)
 #define tlb_start_vma(tlb, vma) do { } while (0)
diff --git a/arch/um/include/asm/pgalloc.h b/arch/um/include/asm/pgalloc.h
index 718984359f8c..32c8ce4e1515 100644
--- a/arch/um/include/asm/pgalloc.h
+++ b/arch/um/include/asm/pgalloc.h
@@ -40,7 +40,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte, address)                \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb),(pte));                   \
@@ -53,7 +53,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         free_page((unsigned long)pmd);
 }
 
-#define __pmd_free_tlb(tlb,x)   tlb_remove_page((tlb),virt_to_page(x))
+#define __pmd_free_tlb(tlb,x, address)   tlb_remove_page((tlb),virt_to_page(x))
 #endif
 
 #define check_pgt_cache()       do { } while (0)
diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h
index 5240fa1c5e08..660caedac9eb 100644
--- a/arch/um/include/asm/tlb.h
+++ b/arch/um/include/asm/tlb.h
@@ -116,11 +116,11 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
                 __tlb_remove_tlb_entry(tlb, ptep, address);     \
         } while (0)
 
-#define pte_free_tlb(tlb, ptep) __pte_free_tlb(tlb, ptep)
+#define pte_free_tlb(tlb, ptep, addr) __pte_free_tlb(tlb, ptep, addr)
 
-#define pud_free_tlb(tlb, pudp) __pud_free_tlb(tlb, pudp)
+#define pud_free_tlb(tlb, pudp, addr) __pud_free_tlb(tlb, pudp, addr)
 
-#define pmd_free_tlb(tlb, pmdp) __pmd_free_tlb(tlb, pmdp)
+#define pmd_free_tlb(tlb, pmdp, addr) __pmd_free_tlb(tlb, pmdp, addr)
 
 #define tlb_migrate_finish(mm) do {} while (0)
 
diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
index dd14c54ac718..0e8c2a0fd922 100644
--- a/arch/x86/include/asm/pgalloc.h
+++ b/arch/x86/include/asm/pgalloc.h
@@ -46,7 +46,13 @@ static inline void pte_free(struct mm_struct *mm, struct page *pte)
         __free_page(pte);
 }
 
-extern void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte);
+extern void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte);
+
+static inline void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte,
+                                  unsigned long address)
+{
+        ___pte_free_tlb(tlb, pte);
+}
 
 static inline void pmd_populate_kernel(struct mm_struct *mm,
                                        pmd_t *pmd, pte_t *pte)
@@ -78,7 +84,13 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         free_page((unsigned long)pmd);
 }
 
-extern void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd);
+extern void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd);
+
+static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+                                  unsigned long adddress)
+{
+        ___pmd_free_tlb(tlb, pmd);
+}
 
 #ifdef CONFIG_X86_PAE
 extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
@@ -108,7 +120,14 @@ static inline void pud_free(struct mm_struct *mm, pud_t *pud)
         free_page((unsigned long)pud);
 }
 
-extern void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud);
+extern void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud);
+
+static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+                                  unsigned long address)
+{
+        ___pud_free_tlb(tlb, pud);
+}
+
 #endif  /* PAGETABLE_LEVELS > 3 */
 #endif  /* PAGETABLE_LEVELS > 2 */
 
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 20e6a795e160..d2c6c930b491 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -212,9 +212,9 @@ extern int __get_user_bad(void);
                      : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
 #else
 #define __put_user_asm_u64(x, ptr, retval, errret) \
-        __put_user_asm(x, ptr, retval, "q", "", "Zr", errret)
+        __put_user_asm(x, ptr, retval, "q", "", "er", errret)
 #define __put_user_asm_ex_u64(x, addr)  \
-        __put_user_asm_ex(x, addr, "q", "", "Zr")
+        __put_user_asm_ex(x, addr, "q", "", "er")
 #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu)
 #endif
 
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 8cc687326eb8..db24b215fc50 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -88,11 +88,11 @@ int __copy_to_user(void __user *dst, const void *src, unsigned size)
                               ret, "l", "k", "ir", 4);
                 return ret;
         case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
-                              ret, "q", "", "ir", 8);
+                              ret, "q", "", "er", 8);
                 return ret;
         case 10:
                 __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-                               ret, "q", "", "ir", 10);
+                               ret, "q", "", "er", 10);
                 if (unlikely(ret))
                         return ret;
                 asm("":::"memory");
@@ -101,12 +101,12 @@ int __copy_to_user(void __user *dst, const void *src, unsigned size)
                 return ret;
         case 16:
                 __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-                               ret, "q", "", "ir", 16);
+                               ret, "q", "", "er", 16);
                 if (unlikely(ret))
                         return ret;
                 asm("":::"memory");
                 __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
-                               ret, "q", "", "ir", 8);
+                               ret, "q", "", "er", 8);
                 return ret;
         default:
                 return copy_user_generic((__force void *)dst, src, size);
@@ -157,7 +157,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
                                ret, "q", "", "=r", 8);
                 if (likely(!ret))
                         __put_user_asm(tmp, (u64 __user *)dst,
-                                       ret, "q", "", "ir", 8);
+                                       ret, "q", "", "er", 8);
                 return ret;
         }
         default:
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 28e5f5956042..e2485b03f1cf 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -356,7 +356,7 @@ static void __cpuinit early_init_amd(struct cpuinfo_x86 *c)
 #endif
 #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI)
         /* check CPU config space for extended APIC ID */
-        if (c->x86 >= 0xf) {
+        if (cpu_has_apic && c->x86 >= 0xf) {
                 unsigned int val;
                 val = read_pci_config(0, 24, 0, 0x68);
                 if ((val & ((1 << 17) | (1 << 18))) == ((1 << 17) | (1 << 18)))
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 484c1e5f658e..1cfb623ce11c 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1692,17 +1692,15 @@ static ssize_t set_trigger(struct sys_device *s, struct sysdev_attribute *attr,
                                 const char *buf, size_t siz)
 {
         char *p;
-        int len;
 
         strncpy(mce_helper, buf, sizeof(mce_helper));
         mce_helper[sizeof(mce_helper)-1] = 0;
-        len = strlen(mce_helper);
         p = strchr(mce_helper, '\n');
 
-        if (*p)
+        if (p)
                 *p = 0;
 
-        return len;
+        return strlen(mce_helper) + !!p;
 }
 
 static ssize_t set_ignore_ce(struct sys_device *s,
diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
index 696f0e475c2d..92b7703d3d58 100644
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -187,7 +187,7 @@ static void __init apic_intr_init(void)
 #ifdef CONFIG_X86_THERMAL_VECTOR
         alloc_intr_gate(THERMAL_APIC_VECTOR, thermal_interrupt);
 #endif
-#ifdef CONFIG_X86_THRESHOLD
+#ifdef CONFIG_X86_MCE_THRESHOLD
         alloc_intr_gate(THRESHOLD_APIC_VECTOR, threshold_interrupt);
 #endif
 #if defined(CONFIG_X86_NEW_MCE) && defined(CONFIG_X86_LOCAL_APIC)
diff --git a/arch/x86/kernel/mfgpt_32.c b/arch/x86/kernel/mfgpt_32.c
index 846510b78a09..2a62d843f015 100644
--- a/arch/x86/kernel/mfgpt_32.c
+++ b/arch/x86/kernel/mfgpt_32.c
@@ -347,7 +347,7 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id)
 
 static struct irqaction mfgptirq  = {
         .handler = mfgpt_tick,
-        .flags = IRQF_DISABLED | IRQF_NOBALANCING,
+        .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_TIMER,
         .name = "mfgpt-timer"
 };
 
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index d2d1ce8170f0..508e982dd072 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -249,6 +249,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "VGN-Z540N"),
                 },
         },
+        {       /* Handle problems with rebooting on CompuLab SBC-FITPC2 */
+                .callback = set_bios_reboot,
+                .ident = "CompuLab SBC-FITPC2",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "CompuLab"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index de2cab132844..63f32d220ef2 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -672,6 +672,19 @@ static struct dmi_system_id __initdata bad_bios_dmi_table[] = {
                         DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies"),
                 },
         },
+        {
+        /*
+         * AMI BIOS with low memory corruption was found on Intel DG45ID board.
+         * It hase different DMI_BIOS_VENDOR = "Intel Corp.", for now we will
+         * match only DMI_BOARD_NAME and see if there is more bad products
+         * with this vendor.
+         */
+                .callback = dmi_low_memory_corruption,
+                .ident = "AMI BIOS",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_NAME, "DG45ID"),
+                },
+        },
 #endif
         {}
 };
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 367e87882041..59f31d2dd435 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -112,11 +112,6 @@ SECTIONS
                 _sdata = .;
                 DATA_DATA
                 CONSTRUCTORS
-
-#ifdef CONFIG_X86_64
-                /* End of data section */
-                _edata = .;
-#endif
         } :data
 
 #ifdef CONFIG_X86_32
@@ -156,10 +151,8 @@ SECTIONS
         .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET) {
                 *(.data.read_mostly)
 
-#ifdef CONFIG_X86_32
                 /* End of data section */
                 _edata = .;
-#endif
         }
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
index 58f621e81919..2112ed55e7ea 100644
--- a/arch/x86/mm/highmem_32.c
+++ b/arch/x86/mm/highmem_32.c
@@ -103,6 +103,7 @@ EXPORT_SYMBOL(kmap);
 EXPORT_SYMBOL(kunmap);
 EXPORT_SYMBOL(kmap_atomic);
 EXPORT_SYMBOL(kunmap_atomic);
+EXPORT_SYMBOL(kmap_atomic_prot);
 
 void __init set_highmem_pages_init(void)
 {
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 8e43bdd45456..af8f9650058c 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -25,7 +25,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long address)
         return pte;
 }
 
-void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
+void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 {
         pgtable_page_dtor(pte);
         paravirt_release_pte(page_to_pfn(pte));
@@ -33,14 +33,14 @@ void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 }
 
 #if PAGETABLE_LEVELS > 2
-void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
+void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
 {
         paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
         tlb_remove_page(tlb, virt_to_page(pmd));
 }
 
 #if PAGETABLE_LEVELS > 3
-void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
+void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
 {
         paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
         tlb_remove_page(tlb, virt_to_page(pud));
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 2dfcbf9df2ae..dbb5381f7b3b 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -79,8 +79,10 @@ static __init void bad_srat(void)
         acpi_numa = -1;
         for (i = 0; i < MAX_LOCAL_APIC; i++)
                 apicid_to_node[i] = NUMA_NO_NODE;
-        for (i = 0; i < MAX_NUMNODES; i++)
-                nodes_add[i].start = nodes[i].end = 0;
+        for (i = 0; i < MAX_NUMNODES; i++) {
+                nodes[i].start = nodes[i].end = 0;
+                nodes_add[i].start = nodes_add[i].end = 0;
+        }
         remove_all_active_ranges();
 }
 
diff --git a/arch/xtensa/include/asm/tlb.h b/arch/xtensa/include/asm/tlb.h
index 31c220faca02..0d766f9c1083 100644
--- a/arch/xtensa/include/asm/tlb.h
+++ b/arch/xtensa/include/asm/tlb.h
@@ -42,6 +42,6 @@
 
 #include <asm-generic/tlb.h>
 
-#define __pte_free_tlb(tlb, pte)                pte_free((tlb)->mm, pte)
+#define __pte_free_tlb(tlb, pte, address)       pte_free((tlb)->mm, pte)
 
 #endif  /* _XTENSA_TLB_H */
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 336eb1ed73cc..958c1fa41900 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -515,10 +515,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x3a05), board_ahci }, /* ICH10 */
         { PCI_VDEVICE(INTEL, 0x3a22), board_ahci }, /* ICH10 */
         { PCI_VDEVICE(INTEL, 0x3a25), board_ahci }, /* ICH10 */
+        { PCI_VDEVICE(INTEL, 0x3b22), board_ahci }, /* PCH AHCI */
+        { PCI_VDEVICE(INTEL, 0x3b23), board_ahci }, /* PCH AHCI */
         { PCI_VDEVICE(INTEL, 0x3b24), board_ahci }, /* PCH RAID */
         { PCI_VDEVICE(INTEL, 0x3b25), board_ahci }, /* PCH RAID */
+        { PCI_VDEVICE(INTEL, 0x3b29), board_ahci }, /* PCH AHCI */
         { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
         { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */
+        { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index d0a14cf2bd74..56b8a3ff1286 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -596,9 +596,12 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x27DF, 0x0005, 0x0280 },     /* ICH7 on Acer 5602WLMi */
         { 0x27DF, 0x1025, 0x0102 },     /* ICH7 on Acer 5602aWLMi */
         { 0x27DF, 0x1025, 0x0110 },     /* ICH7 on Acer 3682WLMi */
+        { 0x27DF, 0x1028, 0x02b0 },     /* ICH7 on unknown Dell */
         { 0x27DF, 0x1043, 0x1267 },     /* ICH7 on Asus W5F */
         { 0x27DF, 0x103C, 0x30A1 },     /* ICH7 on HP Compaq nc2400 */
+        { 0x27DF, 0x103C, 0x361a },     /* ICH7 on unkown HP  */
         { 0x27DF, 0x1071, 0xD221 },     /* ICH7 on Hercules EC-900 */
+        { 0x27DF, 0x152D, 0x0778 },     /* ICH7 on unknown Intel */
         { 0x24CA, 0x1025, 0x0061 },     /* ICH4 on ACER Aspire 2023WLMi */
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2c6aedaef718..8ac98ff16d7d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1515,6 +1515,7 @@ static int ata_hpa_resize(struct ata_device *dev)
 
                 return rc;
         }
+        dev->n_native_sectors = native_sectors;
 
         /* nothing to do? */
         if (native_sectors <= sectors || !ata_ignore_hpa) {
@@ -4099,6 +4100,7 @@ int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
                        unsigned int readid_flags)
 {
         u64 n_sectors = dev->n_sectors;
+        u64 n_native_sectors = dev->n_native_sectors;
         int rc;
 
         if (!ata_dev_enabled(dev))
@@ -4128,16 +4130,30 @@ int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
         /* verify n_sectors hasn't changed */
         if (dev->class == ATA_DEV_ATA && n_sectors &&
             dev->n_sectors != n_sectors) {
-                ata_dev_printk(dev, KERN_INFO, "n_sectors mismatch "
+                ata_dev_printk(dev, KERN_WARNING, "n_sectors mismatch "
                                "%llu != %llu\n",
                                (unsigned long long)n_sectors,
                                (unsigned long long)dev->n_sectors);
-
-                /* restore original n_sectors */
-                dev->n_sectors = n_sectors;
-
-                rc = -ENODEV;
-                goto fail;
+                /*
+                 * Something could have caused HPA to be unlocked
+                 * involuntarily.  If n_native_sectors hasn't changed
+                 * and the new size matches it, keep the device.
+                 */
+                if (dev->n_native_sectors == n_native_sectors &&
+                    dev->n_sectors > n_sectors &&
+                    dev->n_sectors == n_native_sectors) {
+                        ata_dev_printk(dev, KERN_WARNING,
+                                       "new n_sectors matches native, probably "
+                                       "late HPA unlock, continuing\n");
+                        /* keep using the old n_sectors */
+                        dev->n_sectors = n_sectors;
+                } else {
+                        /* restore original n_[native]_sectors and fail */
+                        dev->n_native_sectors = n_native_sectors;
+                        dev->n_sectors = n_sectors;
+                        rc = -ENODEV;
+                        goto fail;
+                }
         }
 
         return 0;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 1a07c061f644..79711b64054b 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2327,7 +2327,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
         struct ata_port *ap = link->ap;
         struct ata_link *slave = ap->slave_link;
         struct ata_eh_context *ehc = &link->eh_context;
-        struct ata_eh_context *sehc = &slave->eh_context;
+        struct ata_eh_context *sehc = slave ? &slave->eh_context : NULL;
         unsigned int *classes = ehc->classes;
         unsigned int lflags = link->flags;
         int verbose = !(ehc->i.flags & ATA_EHI_QUIET);
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index 8561a9f195c1..5702affcb325 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -26,9 +26,7 @@
 #include <linux/platform_device.h>
 #include <linux/ata_platform.h>
 
-#include <mach/at91sam9260_matrix.h>
 #include <mach/at91sam9_smc.h>
-#include <mach/at91sam9260.h>
 #include <mach/board.h>
 #include <mach/gpio.h>
 
@@ -44,65 +42,62 @@ struct at91_ide_info {
         unsigned long mode;
         unsigned int cs;
 
+        struct clk *mck;
+
         void __iomem *ide_addr;
         void __iomem *alt_addr;
 };
 
-const struct ata_timing initial_timing =
+static const struct ata_timing initial_timing =
         {XFER_PIO_0, 70, 290, 240, 600, 165, 150, 600, 0};
 
-static unsigned int calc_mck_cycles(unsigned int ns, unsigned int mck_hz)
+static unsigned long calc_mck_cycles(unsigned long ns, unsigned long mck_hz)
 {
         unsigned long mul;
 
-    /*
-     * cycles = x [nsec] * f [Hz] / 10^9 [ns in sec] =
-     *     x * (f / 1_000_000_000) =
-     *     x * ((f * 65536) / 1_000_000_000) / 65536 =
-     *     x * (((f / 10_000) * 65536) / 100_000) / 65536 =
-     */
+        /*
+        * cycles = x [nsec] * f [Hz] / 10^9 [ns in sec] =
+        *     x * (f / 1_000_000_000) =
+        *     x * ((f * 65536) / 1_000_000_000) / 65536 =
+        *     x * (((f / 10_000) * 65536) / 100_000) / 65536 =
+        */
 
-    mul = (mck_hz / 10000) << 16;
-    mul /= 100000;
+        mul = (mck_hz / 10000) << 16;
+        mul /= 100000;
 
-    return (ns * mul + 65536) >> 16;    /* rounding */
+        return (ns * mul + 65536) >> 16;    /* rounding */
 }
 
 static void set_smc_mode(struct at91_ide_info *info)
 {
-    at91_sys_write(AT91_SMC_MODE(info->cs), info->mode);
-    return;
+        at91_sys_write(AT91_SMC_MODE(info->cs), info->mode);
+        return;
 }
 
 static void set_smc_timing(struct device *dev,
                 struct at91_ide_info *info, const struct ata_timing *ata)
 {
-        int read_cycle, write_cycle, active, recover;
-        int nrd_setup, nrd_pulse, nrd_recover;
-        int nwe_setup, nwe_pulse;
+        unsigned long read_cycle, write_cycle, active, recover;
+        unsigned long nrd_setup, nrd_pulse, nrd_recover;
+        unsigned long nwe_setup, nwe_pulse;
 
-        int ncs_write_setup, ncs_write_pulse;
-        int ncs_read_setup, ncs_read_pulse;
+        unsigned long ncs_write_setup, ncs_write_pulse;
+        unsigned long ncs_read_setup, ncs_read_pulse;
 
-        unsigned int mck_hz;
-        struct clk *mck;
+        unsigned long mck_hz;
 
         read_cycle  = ata->cyc8b;
         nrd_setup   = ata->setup;
         nrd_pulse   = ata->act8b;
         nrd_recover = ata->rec8b;
 
-        mck = clk_get(NULL, "mck");
-        BUG_ON(IS_ERR(mck));
-        mck_hz = clk_get_rate(mck);
+        mck_hz = clk_get_rate(info->mck);
 
         read_cycle  = calc_mck_cycles(read_cycle, mck_hz);
         nrd_setup   = calc_mck_cycles(nrd_setup, mck_hz);
         nrd_pulse   = calc_mck_cycles(nrd_pulse, mck_hz);
         nrd_recover = calc_mck_cycles(nrd_recover, mck_hz);
 
-        clk_put(mck);
-
         active  = nrd_setup + nrd_pulse;
         recover = read_cycle - active;
 
@@ -121,13 +116,13 @@ static void set_smc_timing(struct device *dev,
         ncs_write_setup = ncs_read_setup;
         ncs_write_pulse = ncs_read_pulse;
 
-        dev_dbg(dev, "ATA timings: nrd_setup = %d nrd_pulse = %d nrd_cycle = %d\n",
+        dev_dbg(dev, "ATA timings: nrd_setup = %lu nrd_pulse = %lu nrd_cycle = %lu\n",
                         nrd_setup, nrd_pulse, read_cycle);
-        dev_dbg(dev, "ATA timings: nwe_setup = %d nwe_pulse = %d nwe_cycle = %d\n",
+        dev_dbg(dev, "ATA timings: nwe_setup = %lu nwe_pulse = %lu nwe_cycle = %lu\n",
                         nwe_setup, nwe_pulse, write_cycle);
-        dev_dbg(dev, "ATA timings: ncs_read_setup = %d ncs_read_pulse = %d\n",
+        dev_dbg(dev, "ATA timings: ncs_read_setup = %lu ncs_read_pulse = %lu\n",
                         ncs_read_setup, ncs_read_pulse);
-        dev_dbg(dev, "ATA timings: ncs_write_setup = %d ncs_write_pulse = %d\n",
+        dev_dbg(dev, "ATA timings: ncs_write_setup = %lu ncs_write_pulse = %lu\n",
                         ncs_write_setup, ncs_write_pulse);
 
         at91_sys_write(AT91_SMC_SETUP(info->cs),
@@ -217,6 +212,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
         struct resource *mem_res;
         struct ata_host *host;
         struct ata_port *ap;
+
         int irq_flags = 0;
         int irq = 0;
         int ret;
@@ -261,6 +257,13 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
+        info->mck = clk_get(NULL, "mck");
+
+        if (IS_ERR(info->mck)) {
+                dev_err(dev, "failed to get access to mck clock\n");
+                return -ENODEV;
+        }
+
         info->cs    = board->chipselect;
         info->mode  = AT91_SMC_READMODE | AT91_SMC_WRITEMODE |
                 AT91_SMC_EXNWMODE_READY | AT91_SMC_BAT_SELECT |
@@ -304,6 +307,7 @@ err_alt_ioremap:
         devm_iounmap(dev, info->ide_addr);
 
 err_ide_ioremap:
+        clk_put(info->mck);
         kfree(info);
 
         return ret;
@@ -326,6 +330,7 @@ static int __devexit pata_at91_remove(struct platform_device *pdev)
 
         devm_iounmap(dev, info->ide_addr);
         devm_iounmap(dev, info->alt_addr);
+        clk_put(info->mck);
 
         kfree(info);
         return 0;
diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
index 8d9343accf3c..abdd19fe990a 100644
--- a/drivers/ata/pata_octeon_cf.c
+++ b/drivers/ata/pata_octeon_cf.c
@@ -653,7 +653,8 @@ static irqreturn_t octeon_cf_interrupt(int irq, void *dev_instance)
 
                 ap = host->ports[i];
                 ocd = ap->dev->platform_data;
-                if (!ap || (ap->flags & ATA_FLAG_DISABLED))
+
+                if (ap->flags & ATA_FLAG_DISABLED)
                         continue;
 
                 ocd = ap->dev->platform_data;
diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
index f4d009ed50ac..dc99e26f8e5b 100644
--- a/drivers/ata/pata_pcmcia.c
+++ b/drivers/ata/pata_pcmcia.c
@@ -411,6 +411,7 @@ static struct pcmcia_device_id pcmcia_devices[] = {
         PCMCIA_DEVICE_PROD_ID123("PCMCIA", "IDE CARD", "F1", 0x281f1c5d, 0x1907960c, 0xf7fde8b9),
         PCMCIA_DEVICE_PROD_ID12("ARGOSY", "CD-ROM", 0x78f308dc, 0x66536591),
         PCMCIA_DEVICE_PROD_ID12("ARGOSY", "PnPIDE", 0x78f308dc, 0x0c694728),
+        PCMCIA_DEVICE_PROD_ID12("CNF   ", "CD-ROM", 0x46d7db81, 0x66536591),
         PCMCIA_DEVICE_PROD_ID12("CNF CD-M", "CD-ROM", 0x7d93b852, 0x66536591),
         PCMCIA_DEVICE_PROD_ID12("Creative Technology Ltd.", "PCMCIA CD-ROM Interface Card", 0xff8c8a45, 0xfe8020c4),
         PCMCIA_DEVICE_PROD_ID12("Digital Equipment Corporation.", "Digital Mobile Media CD-ROM", 0x17692a66, 0xef1dcbde),
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 23714aefb825..c19417e02208 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -2514,7 +2514,7 @@ static void mv_unexpected_intr(struct ata_port *ap, int edma_was_enabled)
         char *when = "idle";
 
         ata_ehi_clear_desc(ehi);
-        if (!ap || (ap->flags & ATA_FLAG_DISABLED)) {
+        if (ap->flags & ATA_FLAG_DISABLED) {
                 when = "disabled";
         } else if (edma_was_enabled) {
                 when = "EDMA enabled";
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 030ec079b184..35bd5cc7f285 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -532,7 +532,7 @@ static irqreturn_t sil_interrupt(int irq, void *dev_instance)
                 struct ata_port *ap = host->ports[i];
                 u32 bmdma2 = readl(mmio_base + sil_port[ap->port_no].bmdma2);
 
-                if (unlikely(!ap || ap->flags & ATA_FLAG_DISABLED))
+                if (unlikely(ap->flags & ATA_FLAG_DISABLED))
                         continue;
 
                 /* turn off SATA_IRQ if not supported */
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index f285f441fab9..7376367bcb80 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -180,7 +180,6 @@ static ssize_t firmware_loading_store(struct device *dev,
                                 goto err;
                         }
                         /* Pages will be freed by vfree() */
-                        fw_priv->pages = NULL;
                         fw_priv->page_array_size = 0;
                         fw_priv->nr_pages = 0;
                         complete(&fw_priv->completion);
diff --git a/drivers/base/sys.c b/drivers/base/sys.c
index 79a9ae5238ac..0d903909af7e 100644
--- a/drivers/base/sys.c
+++ b/drivers/base/sys.c
@@ -275,9 +275,9 @@ int sysdev_register(struct sys_device *sysdev)
                                 drv->add(sysdev);
                 }
                 mutex_unlock(&sysdev_drivers_lock);
+                kobject_uevent(&sysdev->kobj, KOBJ_ADD);
         }
 
-        kobject_uevent(&sysdev->kobj, KOBJ_ADD);
         return error;
 }
 
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index ff47907ff1bf..973be2f44195 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -1583,6 +1583,7 @@ static int n_tty_open(struct tty_struct *tty)
 
 static inline int input_available_p(struct tty_struct *tty, int amt)
 {
+        tty_flush_to_ldisc(tty);
         if (tty->icanon) {
                 if (tty->canon_data)
                         return 1;
diff --git a/drivers/char/tty_buffer.c b/drivers/char/tty_buffer.c
index 810ee25d66a4..3108991c5c8b 100644
--- a/drivers/char/tty_buffer.c
+++ b/drivers/char/tty_buffer.c
@@ -462,6 +462,19 @@ static void flush_to_ldisc(struct work_struct *work)
 }
 
 /**
+ *      tty_flush_to_ldisc
+ *      @tty: tty to push
+ *
+ *      Push the terminal flip buffers to the line discipline.
+ *
+ *      Must not be called from IRQ context.
+ */
+void tty_flush_to_ldisc(struct tty_struct *tty)
+{
+        flush_to_ldisc(&tty->buf.work.work);
+}
+
+/**
  *      tty_flip_buffer_push    -       terminal
  *      @tty: tty to push
  *
diff --git a/drivers/char/vr41xx_giu.c b/drivers/char/vr41xx_giu.c
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/drivers/char/vr41xx_giu.c
+++ /dev/null
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 858fe6037223..24964c1d0af9 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -970,7 +970,7 @@ static void amd64_read_dct_base_mask(struct amd64_pvt *pvt)
         }
 
         for (cs = 0; cs < pvt->num_dcsm; cs++) {
-                reg = K8_DCSB0 + (cs * 4);
+                reg = K8_DCSM0 + (cs * 4);
                 err = pci_read_config_dword(pvt->dram_f2_ctl, reg,
                                         &pvt->dcsm0[cs]);
                 if (unlikely(err))
diff --git a/drivers/gpu/drm/radeon/Makefile b/drivers/gpu/drm/radeon/Makefile
index 5fae1e074b4b..013d38059943 100644
--- a/drivers/gpu/drm/radeon/Makefile
+++ b/drivers/gpu/drm/radeon/Makefile
@@ -13,7 +13,8 @@ radeon-$(CONFIG_DRM_RADEON_KMS) += radeon_device.o radeon_kms.o \
         radeon_encoders.o radeon_display.o radeon_cursor.o radeon_i2c.o \
         radeon_clocks.o radeon_fb.o radeon_gem.o radeon_ring.o radeon_irq_kms.o \
         radeon_cs.o radeon_bios.o radeon_benchmark.o r100.o r300.o r420.o \
-        rs400.o rs600.o rs690.o rv515.o r520.o r600.o rs780.o rv770.o
+        rs400.o rs600.o rs690.o rv515.o r520.o r600.o rs780.o rv770.o \
+        radeon_test.o
 
 radeon-$(CONFIG_COMPAT) += radeon_ioc32.o
 
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c0080cc9bf8d..74d034f77c6b 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -31,6 +31,132 @@
 #include "atom.h"
 #include "atom-bits.h"
 
+static void atombios_overscan_setup(struct drm_crtc *crtc,
+                                    struct drm_display_mode *mode,
+                                    struct drm_display_mode *adjusted_mode)
+{
+        struct drm_device *dev = crtc->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        SET_CRTC_OVERSCAN_PS_ALLOCATION args;
+        int index = GetIndexIntoMasterTable(COMMAND, SetCRTC_OverScan);
+        int a1, a2;
+
+        memset(&args, 0, sizeof(args));
+
+        args.usOverscanRight = 0;
+        args.usOverscanLeft = 0;
+        args.usOverscanBottom = 0;
+        args.usOverscanTop = 0;
+        args.ucCRTC = radeon_crtc->crtc_id;
+
+        switch (radeon_crtc->rmx_type) {
+        case RMX_CENTER:
+                args.usOverscanTop = (adjusted_mode->crtc_vdisplay - mode->crtc_vdisplay) / 2;
+                args.usOverscanBottom = (adjusted_mode->crtc_vdisplay - mode->crtc_vdisplay) / 2;
+                args.usOverscanLeft = (adjusted_mode->crtc_hdisplay - mode->crtc_hdisplay) / 2;
+                args.usOverscanRight = (adjusted_mode->crtc_hdisplay - mode->crtc_hdisplay) / 2;
+                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                break;
+        case RMX_ASPECT:
+                a1 = mode->crtc_vdisplay * adjusted_mode->crtc_hdisplay;
+                a2 = adjusted_mode->crtc_vdisplay * mode->crtc_hdisplay;
+
+                if (a1 > a2) {
+                        args.usOverscanLeft = (adjusted_mode->crtc_hdisplay - (a2 / mode->crtc_vdisplay)) / 2;
+                        args.usOverscanRight = (adjusted_mode->crtc_hdisplay - (a2 / mode->crtc_vdisplay)) / 2;
+                } else if (a2 > a1) {
+                        args.usOverscanLeft = (adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2;
+                        args.usOverscanRight = (adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2;
+                }
+                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                break;
+        case RMX_FULL:
+        default:
+                args.usOverscanRight = 0;
+                args.usOverscanLeft = 0;
+                args.usOverscanBottom = 0;
+                args.usOverscanTop = 0;
+                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                break;
+        }
+}
+
+static void atombios_scaler_setup(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        ENABLE_SCALER_PS_ALLOCATION args;
+        int index = GetIndexIntoMasterTable(COMMAND, EnableScaler);
+        /* fixme - fill in enc_priv for atom dac */
+        enum radeon_tv_std tv_std = TV_STD_NTSC;
+
+        if (!ASIC_IS_AVIVO(rdev) && radeon_crtc->crtc_id)
+                return;
+
+        memset(&args, 0, sizeof(args));
+
+        args.ucScaler = radeon_crtc->crtc_id;
+
+        if (radeon_crtc->devices & (ATOM_DEVICE_TV_SUPPORT)) {
+                switch (tv_std) {
+                case TV_STD_NTSC:
+                default:
+                        args.ucTVStandard = ATOM_TV_NTSC;
+                        break;
+                case TV_STD_PAL:
+                        args.ucTVStandard = ATOM_TV_PAL;
+                        break;
+                case TV_STD_PAL_M:
+                        args.ucTVStandard = ATOM_TV_PALM;
+                        break;
+                case TV_STD_PAL_60:
+                        args.ucTVStandard = ATOM_TV_PAL60;
+                        break;
+                case TV_STD_NTSC_J:
+                        args.ucTVStandard = ATOM_TV_NTSCJ;
+                        break;
+                case TV_STD_SCART_PAL:
+                        args.ucTVStandard = ATOM_TV_PAL; /* ??? */
+                        break;
+                case TV_STD_SECAM:
+                        args.ucTVStandard = ATOM_TV_SECAM;
+                        break;
+                case TV_STD_PAL_CN:
+                        args.ucTVStandard = ATOM_TV_PALCN;
+                        break;
+                }
+                args.ucEnable = SCALER_ENABLE_MULTITAP_MODE;
+        } else if (radeon_crtc->devices & (ATOM_DEVICE_CV_SUPPORT)) {
+                args.ucTVStandard = ATOM_TV_CV;
+                args.ucEnable = SCALER_ENABLE_MULTITAP_MODE;
+        } else {
+                switch (radeon_crtc->rmx_type) {
+                case RMX_FULL:
+                        args.ucEnable = ATOM_SCALER_EXPANSION;
+                        break;
+                case RMX_CENTER:
+                        args.ucEnable = ATOM_SCALER_CENTER;
+                        break;
+                case RMX_ASPECT:
+                        args.ucEnable = ATOM_SCALER_EXPANSION;
+                        break;
+                default:
+                        if (ASIC_IS_AVIVO(rdev))
+                                args.ucEnable = ATOM_SCALER_DISABLE;
+                        else
+                                args.ucEnable = ATOM_SCALER_CENTER;
+                        break;
+                }
+        }
+        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+        if (radeon_crtc->devices & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT)
+            && rdev->family >= CHIP_RV515 && rdev->family <= CHIP_RV570) {
+                atom_rv515_force_tv_scaler(rdev);
+        }
+}
+
 static void atombios_lock_crtc(struct drm_crtc *crtc, int lock)
 {
         struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
@@ -203,6 +329,12 @@ void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
         if (ASIC_IS_AVIVO(rdev)) {
                 uint32_t ss_cntl;
 
+                if ((rdev->family == CHIP_RS600) ||
+                    (rdev->family == CHIP_RS690) ||
+                    (rdev->family == CHIP_RS740))
+                        pll_flags |= (RADEON_PLL_USE_FRAC_FB_DIV |
+                                      RADEON_PLL_PREFER_CLOSEST_LOWER);
+
                 if (ASIC_IS_DCE32(rdev) && mode->clock > 200000)        /* range limits??? */
                         pll_flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
                 else
@@ -321,7 +453,7 @@ int atombios_crtc_set_base(struct drm_crtc *crtc, int x, int y,
         struct drm_gem_object *obj;
         struct drm_radeon_gem_object *obj_priv;
         uint64_t fb_location;
-        uint32_t fb_format, fb_pitch_pixels;
+        uint32_t fb_format, fb_pitch_pixels, tiling_flags;
 
         if (!crtc->fb)
                 return -EINVAL;
@@ -358,7 +490,14 @@ int atombios_crtc_set_base(struct drm_crtc *crtc, int x, int y,
                 return -EINVAL;
         }
 
-        /* TODO tiling */
+        radeon_object_get_tiling_flags(obj->driver_private,
+                                       &tiling_flags, NULL);
+        if (tiling_flags & RADEON_TILING_MACRO)
+                fb_format |= AVIVO_D1GRPH_MACRO_ADDRESS_MODE;
+
+        if (tiling_flags & RADEON_TILING_MICRO)
+                fb_format |= AVIVO_D1GRPH_TILED;
+
         if (radeon_crtc->crtc_id == 0)
                 WREG32(AVIVO_D1VGA_CONTROL, 0);
         else
@@ -509,6 +648,9 @@ int atombios_crtc_mode_set(struct drm_crtc *crtc,
                 radeon_crtc_set_base(crtc, x, y, old_fb);
                 radeon_legacy_atom_set_surface(crtc);
         }
+        atombios_overscan_setup(crtc, mode, adjusted_mode);
+        atombios_scaler_setup(crtc);
+        radeon_bandwidth_update(rdev);
         return 0;
 }
 
@@ -516,6 +658,8 @@ static bool atombios_crtc_mode_fixup(struct drm_crtc *crtc,
                                      struct drm_display_mode *mode,
                                      struct drm_display_mode *adjusted_mode)
 {
+        if (!radeon_crtc_scaling_mode_fixup(crtc, mode, adjusted_mode))
+                return false;
         return true;
 }
 
@@ -548,148 +692,3 @@ void radeon_atombios_init_crtc(struct drm_device *dev,
                     AVIVO_D2CRTC_H_TOTAL - AVIVO_D1CRTC_H_TOTAL;
         drm_crtc_helper_add(&radeon_crtc->base, &atombios_helper_funcs);
 }
-
-void radeon_init_disp_bw_avivo(struct drm_device *dev,
-                               struct drm_display_mode *mode1,
-                               uint32_t pixel_bytes1,
-                               struct drm_display_mode *mode2,
-                               uint32_t pixel_bytes2)
-{
-        struct radeon_device *rdev = dev->dev_private;
-        fixed20_12 min_mem_eff;
-        fixed20_12 peak_disp_bw, mem_bw, pix_clk, pix_clk2, temp_ff;
-        fixed20_12 sclk_ff, mclk_ff;
-        uint32_t dc_lb_memory_split, temp;
-
-        min_mem_eff.full = rfixed_const_8(0);
-        if (rdev->disp_priority == 2) {
-                uint32_t mc_init_misc_lat_timer = 0;
-                if (rdev->family == CHIP_RV515)
-                        mc_init_misc_lat_timer =
-                            RREG32_MC(RV515_MC_INIT_MISC_LAT_TIMER);
-                else if (rdev->family == CHIP_RS690)
-                        mc_init_misc_lat_timer =
-                            RREG32_MC(RS690_MC_INIT_MISC_LAT_TIMER);
-
-                mc_init_misc_lat_timer &=
-                    ~(R300_MC_DISP1R_INIT_LAT_MASK <<
-                      R300_MC_DISP1R_INIT_LAT_SHIFT);
-                mc_init_misc_lat_timer &=
-                    ~(R300_MC_DISP0R_INIT_LAT_MASK <<
-                      R300_MC_DISP0R_INIT_LAT_SHIFT);
-
-                if (mode2)
-                        mc_init_misc_lat_timer |=
-                            (1 << R300_MC_DISP1R_INIT_LAT_SHIFT);
-                if (mode1)
-                        mc_init_misc_lat_timer |=
-                            (1 << R300_MC_DISP0R_INIT_LAT_SHIFT);
-
-                if (rdev->family == CHIP_RV515)
-                        WREG32_MC(RV515_MC_INIT_MISC_LAT_TIMER,
-                                  mc_init_misc_lat_timer);
-                else if (rdev->family == CHIP_RS690)
-                        WREG32_MC(RS690_MC_INIT_MISC_LAT_TIMER,
-                                  mc_init_misc_lat_timer);
-        }
-
-        /*
-         * determine is there is enough bw for current mode
-         */
-        temp_ff.full = rfixed_const(100);
-        mclk_ff.full = rfixed_const(rdev->clock.default_mclk);
-        mclk_ff.full = rfixed_div(mclk_ff, temp_ff);
-        sclk_ff.full = rfixed_const(rdev->clock.default_sclk);
-        sclk_ff.full = rfixed_div(sclk_ff, temp_ff);
-
-        temp = (rdev->mc.vram_width / 8) * (rdev->mc.vram_is_ddr ? 2 : 1);
-        temp_ff.full = rfixed_const(temp);
-        mem_bw.full = rfixed_mul(mclk_ff, temp_ff);
-        mem_bw.full = rfixed_mul(mem_bw, min_mem_eff);
-
-        pix_clk.full = 0;
-        pix_clk2.full = 0;
-        peak_disp_bw.full = 0;
-        if (mode1) {
-                temp_ff.full = rfixed_const(1000);
-                pix_clk.full = rfixed_const(mode1->clock);      /* convert to fixed point */
-                pix_clk.full = rfixed_div(pix_clk, temp_ff);
-                temp_ff.full = rfixed_const(pixel_bytes1);
-                peak_disp_bw.full += rfixed_mul(pix_clk, temp_ff);
-        }
-        if (mode2) {
-                temp_ff.full = rfixed_const(1000);
-                pix_clk2.full = rfixed_const(mode2->clock);     /* convert to fixed point */
-                pix_clk2.full = rfixed_div(pix_clk2, temp_ff);
-                temp_ff.full = rfixed_const(pixel_bytes2);
-                peak_disp_bw.full += rfixed_mul(pix_clk2, temp_ff);
-        }
-
-        if (peak_disp_bw.full >= mem_bw.full) {
-                DRM_ERROR
-                    ("You may not have enough display bandwidth for current mode\n"
-                     "If you have flickering problem, try to lower resolution, refresh rate, or color depth\n");
-                printk("peak disp bw %d, mem_bw %d\n",
-                       rfixed_trunc(peak_disp_bw), rfixed_trunc(mem_bw));
-        }
-
-        /*
-         * Line Buffer Setup
-         * There is a single line buffer shared by both display controllers.
-         * DC_LB_MEMORY_SPLIT controls how that line buffer is shared between the display
-         * controllers.  The paritioning can either be done manually or via one of four
-         * preset allocations specified in bits 1:0:
-         * 0 - line buffer is divided in half and shared between each display controller
-         * 1 - D1 gets 3/4 of the line buffer, D2 gets 1/4
-         * 2 - D1 gets the whole buffer
-         * 3 - D1 gets 1/4 of the line buffer, D2 gets 3/4
-         * Setting bit 2 of DC_LB_MEMORY_SPLIT controls switches to manual allocation mode.
-         * In manual allocation mode, D1 always starts at 0, D1 end/2 is specified in bits
-         * 14:4; D2 allocation follows D1.
-         */
-
-        /* is auto or manual better ? */
-        dc_lb_memory_split =
-            RREG32(AVIVO_DC_LB_MEMORY_SPLIT) & ~AVIVO_DC_LB_MEMORY_SPLIT_MASK;
-        dc_lb_memory_split &= ~AVIVO_DC_LB_MEMORY_SPLIT_SHIFT_MODE;
-#if 1
-        /* auto */
-        if (mode1 && mode2) {
-                if (mode1->hdisplay > mode2->hdisplay) {
-                        if (mode1->hdisplay > 2560)
-                                dc_lb_memory_split |=
-                                    AVIVO_DC_LB_MEMORY_SPLIT_D1_3Q_D2_1Q;
-                        else
-                                dc_lb_memory_split |=
-                                    AVIVO_DC_LB_MEMORY_SPLIT_D1HALF_D2HALF;
-                } else if (mode2->hdisplay > mode1->hdisplay) {
-                        if (mode2->hdisplay > 2560)
-                                dc_lb_memory_split |=
-                                    AVIVO_DC_LB_MEMORY_SPLIT_D1_1Q_D2_3Q;
-                        else
-                                dc_lb_memory_split |=
-                                    AVIVO_DC_LB_MEMORY_SPLIT_D1HALF_D2HALF;
-                } else
-                        dc_lb_memory_split |=
-                            AVIVO_DC_LB_MEMORY_SPLIT_D1HALF_D2HALF;
-        } else if (mode1) {
-                dc_lb_memory_split |= AVIVO_DC_LB_MEMORY_SPLIT_D1_ONLY;
-        } else if (mode2) {
-                dc_lb_memory_split |= AVIVO_DC_LB_MEMORY_SPLIT_D1_1Q_D2_3Q;
-        }
-#else
-        /* manual */
-        dc_lb_memory_split |= AVIVO_DC_LB_MEMORY_SPLIT_SHIFT_MODE;
-        dc_lb_memory_split &=
-            ~(AVIVO_DC_LB_DISP1_END_ADR_MASK <<
-              AVIVO_DC_LB_DISP1_END_ADR_SHIFT);
-        if (mode1) {
-                dc_lb_memory_split |=
-                    ((((mode1->hdisplay / 2) + 64) & AVIVO_DC_LB_DISP1_END_ADR_MASK)
-                     << AVIVO_DC_LB_DISP1_END_ADR_SHIFT);
-        } else if (mode2) {
-                dc_lb_memory_split |= (0 << AVIVO_DC_LB_DISP1_END_ADR_SHIFT);
-        }
-#endif
-        WREG32(AVIVO_DC_LB_MEMORY_SPLIT, dc_lb_memory_split);
-}
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index c550932a108f..05a44896dffb 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -110,7 +110,7 @@ int r100_pci_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
         if (i < 0 || i > rdev->gart.num_gpu_pages) {
                 return -EINVAL;
         }
-        rdev->gart.table.ram.ptr[i] = cpu_to_le32((uint32_t)addr);
+        rdev->gart.table.ram.ptr[i] = cpu_to_le32(lower_32_bits(addr));
         return 0;
 }
 
@@ -173,8 +173,12 @@ void r100_mc_setup(struct radeon_device *rdev)
                 DRM_ERROR("Failed to register debugfs file for R100 MC !\n");
         }
         /* Write VRAM size in case we are limiting it */
-        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.vram_size);
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
+        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.real_vram_size);
+        /* Novell bug 204882 for RN50/M6/M7 with 8/16/32MB VRAM,
+         * if the aperture is 64MB but we have 32MB VRAM
+         * we report only 32MB VRAM but we have to set MC_FB_LOCATION
+         * to 64MB, otherwise the gpu accidentially dies */
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
         tmp = REG_SET(RADEON_MC_FB_TOP, tmp >> 16);
         tmp |= REG_SET(RADEON_MC_FB_START, rdev->mc.vram_location >> 16);
         WREG32(RADEON_MC_FB_LOCATION, tmp);
@@ -215,7 +219,6 @@ int r100_mc_init(struct radeon_device *rdev)
         r100_pci_gart_disable(rdev);
 
         /* Setup GPU memory space */
-        rdev->mc.vram_location = 0xFFFFFFFFUL;
         rdev->mc.gtt_location = 0xFFFFFFFFUL;
         if (rdev->flags & RADEON_IS_AGP) {
                 r = radeon_agp_init(rdev);
@@ -753,6 +756,102 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
 }
 
 /**
+ * r100_cs_packet_next_vline() - parse userspace VLINE packet
+ * @parser:             parser structure holding parsing context.
+ *
+ * Userspace sends a special sequence for VLINE waits.
+ * PACKET0 - VLINE_START_END + value
+ * PACKET0 - WAIT_UNTIL +_value
+ * RELOC (P3) - crtc_id in reloc.
+ *
+ * This function parses this and relocates the VLINE START END
+ * and WAIT UNTIL packets to the correct crtc.
+ * It also detects a switched off crtc and nulls out the
+ * wait in that case.
+ */
+int r100_cs_packet_parse_vline(struct radeon_cs_parser *p)
+{
+        struct radeon_cs_chunk *ib_chunk;
+        struct drm_mode_object *obj;
+        struct drm_crtc *crtc;
+        struct radeon_crtc *radeon_crtc;
+        struct radeon_cs_packet p3reloc, waitreloc;
+        int crtc_id;
+        int r;
+        uint32_t header, h_idx, reg;
+
+        ib_chunk = &p->chunks[p->chunk_ib_idx];
+
+        /* parse the wait until */
+        r = r100_cs_packet_parse(p, &waitreloc, p->idx);
+        if (r)
+                return r;
+
+        /* check its a wait until and only 1 count */
+        if (waitreloc.reg != RADEON_WAIT_UNTIL ||
+            waitreloc.count != 0) {
+                DRM_ERROR("vline wait had illegal wait until segment\n");
+                r = -EINVAL;
+                return r;
+        }
+
+        if (ib_chunk->kdata[waitreloc.idx + 1] != RADEON_WAIT_CRTC_VLINE) {
+                DRM_ERROR("vline wait had illegal wait until\n");
+                r = -EINVAL;
+                return r;
+        }
+
+        /* jump over the NOP */
+        r = r100_cs_packet_parse(p, &p3reloc, p->idx);
+        if (r)
+                return r;
+
+        h_idx = p->idx - 2;
+        p->idx += waitreloc.count;
+        p->idx += p3reloc.count;
+
+        header = ib_chunk->kdata[h_idx];
+        crtc_id = ib_chunk->kdata[h_idx + 5];
+        reg = ib_chunk->kdata[h_idx] >> 2;
+        mutex_lock(&p->rdev->ddev->mode_config.mutex);
+        obj = drm_mode_object_find(p->rdev->ddev, crtc_id, DRM_MODE_OBJECT_CRTC);
+        if (!obj) {
+                DRM_ERROR("cannot find crtc %d\n", crtc_id);
+                r = -EINVAL;
+                goto out;
+        }
+        crtc = obj_to_crtc(obj);
+        radeon_crtc = to_radeon_crtc(crtc);
+        crtc_id = radeon_crtc->crtc_id;
+
+        if (!crtc->enabled) {
+                /* if the CRTC isn't enabled - we need to nop out the wait until */
+                ib_chunk->kdata[h_idx + 2] = PACKET2(0);
+                ib_chunk->kdata[h_idx + 3] = PACKET2(0);
+        } else if (crtc_id == 1) {
+                switch (reg) {
+                case AVIVO_D1MODE_VLINE_START_END:
+                        header &= R300_CP_PACKET0_REG_MASK;
+                        header |= AVIVO_D2MODE_VLINE_START_END >> 2;
+                        break;
+                case RADEON_CRTC_GUI_TRIG_VLINE:
+                        header &= R300_CP_PACKET0_REG_MASK;
+                        header |= RADEON_CRTC2_GUI_TRIG_VLINE >> 2;
+                        break;
+                default:
+                        DRM_ERROR("unknown crtc reloc\n");
+                        r = -EINVAL;
+                        goto out;
+                }
+                ib_chunk->kdata[h_idx] = header;
+                ib_chunk->kdata[h_idx + 3] |= RADEON_ENG_DISPLAY_SELECT_CRTC1;
+        }
+out:
+        mutex_unlock(&p->rdev->ddev->mode_config.mutex);
+        return r;
+}
+
+/**
  * r100_cs_packet_next_reloc() - parse next packet which should be reloc packet3
  * @parser:             parser structure holding parsing context.
  * @data:               pointer to relocation data
@@ -814,6 +913,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
         unsigned idx;
         bool onereg;
         int r;
+        u32 tile_flags = 0;
 
         ib = p->ib->ptr;
         ib_chunk = &p->chunks[p->chunk_ib_idx];
@@ -825,6 +925,15 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
         }
         for (i = 0; i <= pkt->count; i++, idx++, reg += 4) {
                 switch (reg) {
+                case RADEON_CRTC_GUI_TRIG_VLINE:
+                        r = r100_cs_packet_parse_vline(p);
+                        if (r) {
+                                DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                                idx, reg);
+                                r100_cs_dump_packet(p, pkt);
+                                return r;
+                        }
+                        break;
                 /* FIXME: only allow PACKET3 blit? easier to check for out of
                  * range access */
                 case RADEON_DST_PITCH_OFFSET:
@@ -838,7 +947,20 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         }
                         tmp = ib_chunk->kdata[idx] & 0x003fffff;
                         tmp += (((u32)reloc->lobj.gpu_offset) >> 10);
-                        ib[idx] = (ib_chunk->kdata[idx] & 0xffc00000) | tmp;
+
+                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                                tile_flags |= RADEON_DST_TILE_MACRO;
+                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO) {
+                                if (reg == RADEON_SRC_PITCH_OFFSET) {
+                                        DRM_ERROR("Cannot src blit from microtiled surface\n");
+                                        r100_cs_dump_packet(p, pkt);
+                                        return -EINVAL;
+                                }
+                                tile_flags |= RADEON_DST_TILE_MICRO;
+                        }
+
+                        tmp |= tile_flags;
+                        ib[idx] = (ib_chunk->kdata[idx] & 0x3fc00000) | tmp;
                         break;
                 case RADEON_RB3D_DEPTHOFFSET:
                 case RADEON_RB3D_COLOROFFSET:
@@ -869,6 +991,11 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                 case R300_TX_OFFSET_0+52:
                 case R300_TX_OFFSET_0+56:
                 case R300_TX_OFFSET_0+60:
+                        /* rn50 has no 3D engine so fail on any 3d setup */
+                        if (ASIC_IS_RN50(p->rdev)) {
+                                DRM_ERROR("attempt to use RN50 3D engine failed\n");
+                                return -EINVAL;
+                        }
                         r = r100_cs_packet_next_reloc(p, &reloc);
                         if (r) {
                                 DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
@@ -878,6 +1005,25 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         }
                         ib[idx] = ib_chunk->kdata[idx] + ((u32)reloc->lobj.gpu_offset);
                         break;
+                case R300_RB3D_COLORPITCH0:
+                case RADEON_RB3D_COLORPITCH:
+                        r = r100_cs_packet_next_reloc(p, &reloc);
+                        if (r) {
+                                DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                          idx, reg);
+                                r100_cs_dump_packet(p, pkt);
+                                return r;
+                        }
+
+                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                                tile_flags |= RADEON_COLOR_TILE_ENABLE;
+                        if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                                tile_flags |= RADEON_COLOR_MICROTILE_ENABLE;
+
+                        tmp = ib_chunk->kdata[idx] & ~(0x7 << 16);
+                        tmp |= tile_flags;
+                        ib[idx] = tmp;
+                        break;
                 default:
                         /* FIXME: we don't want to allow anyothers packet */
                         break;
@@ -1256,29 +1402,100 @@ static void r100_vram_get_type(struct radeon_device *rdev)
         }
 }
 
-void r100_vram_info(struct radeon_device *rdev)
+static u32 r100_get_accessible_vram(struct radeon_device *rdev)
 {
-        r100_vram_get_type(rdev);
+        u32 aper_size;
+        u8 byte;
+
+        aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
+
+        /* Set HDP_APER_CNTL only on cards that are known not to be broken,
+         * that is has the 2nd generation multifunction PCI interface
+         */
+        if (rdev->family == CHIP_RV280 ||
+            rdev->family >= CHIP_RV350) {
+                WREG32_P(RADEON_HOST_PATH_CNTL, RADEON_HDP_APER_CNTL,
+                       ~RADEON_HDP_APER_CNTL);
+                DRM_INFO("Generation 2 PCI interface, using max accessible memory\n");
+                return aper_size * 2;
+        }
+
+        /* Older cards have all sorts of funny issues to deal with. First
+         * check if it's a multifunction card by reading the PCI config
+         * header type... Limit those to one aperture size
+         */
+        pci_read_config_byte(rdev->pdev, 0xe, &byte);
+        if (byte & 0x80) {
+                DRM_INFO("Generation 1 PCI interface in multifunction mode\n");
+                DRM_INFO("Limiting VRAM to one aperture\n");
+                return aper_size;
+        }
+
+        /* Single function older card. We read HDP_APER_CNTL to see how the BIOS
+         * have set it up. We don't write this as it's broken on some ASICs but
+         * we expect the BIOS to have done the right thing (might be too optimistic...)
+         */
+        if (RREG32(RADEON_HOST_PATH_CNTL) & RADEON_HDP_APER_CNTL)
+                return aper_size * 2;
+        return aper_size;
+}
+
+void r100_vram_init_sizes(struct radeon_device *rdev)
+{
+        u64 config_aper_size;
+        u32 accessible;
+
+        config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
 
         if (rdev->flags & RADEON_IS_IGP) {
                 uint32_t tom;
                 /* read NB_TOM to get the amount of ram stolen for the GPU */
                 tom = RREG32(RADEON_NB_TOM);
-                rdev->mc.vram_size = (((tom >> 16) - (tom & 0xffff) + 1) << 16);
-                WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.vram_size);
+                rdev->mc.real_vram_size = (((tom >> 16) - (tom & 0xffff) + 1) << 16);
+                /* for IGPs we need to keep VRAM where it was put by the BIOS */
+                rdev->mc.vram_location = (tom & 0xffff) << 16;
+                WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.real_vram_size);
+                rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
         } else {
-                rdev->mc.vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
+                rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
                 /* Some production boards of m6 will report 0
                  * if it's 8 MB
                  */
-                if (rdev->mc.vram_size == 0) {
-                        rdev->mc.vram_size = 8192 * 1024;
-                        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.vram_size);
+                if (rdev->mc.real_vram_size == 0) {
+                        rdev->mc.real_vram_size = 8192 * 1024;
+                        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.real_vram_size);
                 }
+                /* let driver place VRAM */
+                rdev->mc.vram_location = 0xFFFFFFFFUL;
+                 /* Fix for RN50, M6, M7 with 8/16/32(??) MBs of VRAM - 
+                  * Novell bug 204882 + along with lots of ubuntu ones */
+                if (config_aper_size > rdev->mc.real_vram_size)
+                        rdev->mc.mc_vram_size = config_aper_size;
+                else
+                        rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
         }
 
+        /* work out accessible VRAM */
+        accessible = r100_get_accessible_vram(rdev);
+
         rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
         rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+
+        if (accessible > rdev->mc.aper_size)
+                accessible = rdev->mc.aper_size;
+
+        if (rdev->mc.mc_vram_size > rdev->mc.aper_size)
+                rdev->mc.mc_vram_size = rdev->mc.aper_size;
+
+        if (rdev->mc.real_vram_size > rdev->mc.aper_size)
+                rdev->mc.real_vram_size = rdev->mc.aper_size;
+}
+
+void r100_vram_info(struct radeon_device *rdev)
+{
+        r100_vram_get_type(rdev);
+
+        r100_vram_init_sizes(rdev);
 }
 
 
@@ -1533,3 +1750,530 @@ int r100_debugfs_mc_info_init(struct radeon_device *rdev)
         return 0;
 #endif
 }
+
+int r100_set_surface_reg(struct radeon_device *rdev, int reg,
+                         uint32_t tiling_flags, uint32_t pitch,
+                         uint32_t offset, uint32_t obj_size)
+{
+        int surf_index = reg * 16;
+        int flags = 0;
+
+        /* r100/r200 divide by 16 */
+        if (rdev->family < CHIP_R300)
+                flags = pitch / 16;
+        else
+                flags = pitch / 8;
+
+        if (rdev->family <= CHIP_RS200) {
+                if ((tiling_flags & (RADEON_TILING_MACRO|RADEON_TILING_MICRO))
+                                 == (RADEON_TILING_MACRO|RADEON_TILING_MICRO))
+                        flags |= RADEON_SURF_TILE_COLOR_BOTH;
+                if (tiling_flags & RADEON_TILING_MACRO)
+                        flags |= RADEON_SURF_TILE_COLOR_MACRO;
+        } else if (rdev->family <= CHIP_RV280) {
+                if (tiling_flags & (RADEON_TILING_MACRO))
+                        flags |= R200_SURF_TILE_COLOR_MACRO;
+                if (tiling_flags & RADEON_TILING_MICRO)
+                        flags |= R200_SURF_TILE_COLOR_MICRO;
+        } else {
+                if (tiling_flags & RADEON_TILING_MACRO)
+                        flags |= R300_SURF_TILE_MACRO;
+                if (tiling_flags & RADEON_TILING_MICRO)
+                        flags |= R300_SURF_TILE_MICRO;
+        }
+
+        DRM_DEBUG("writing surface %d %d %x %x\n", reg, flags, offset, offset+obj_size-1);
+        WREG32(RADEON_SURFACE0_INFO + surf_index, flags);
+        WREG32(RADEON_SURFACE0_LOWER_BOUND + surf_index, offset);
+        WREG32(RADEON_SURFACE0_UPPER_BOUND + surf_index, offset + obj_size - 1);
+        return 0;
+}
+
+void r100_clear_surface_reg(struct radeon_device *rdev, int reg)
+{
+        int surf_index = reg * 16;
+        WREG32(RADEON_SURFACE0_INFO + surf_index, 0);
+}
+
+void r100_bandwidth_update(struct radeon_device *rdev)
+{
+        fixed20_12 trcd_ff, trp_ff, tras_ff, trbs_ff, tcas_ff;
+        fixed20_12 sclk_ff, mclk_ff, sclk_eff_ff, sclk_delay_ff;
+        fixed20_12 peak_disp_bw, mem_bw, pix_clk, pix_clk2, temp_ff, crit_point_ff;
+        uint32_t temp, data, mem_trcd, mem_trp, mem_tras;
+        fixed20_12 memtcas_ff[8] = {
+                fixed_init(1),
+                fixed_init(2),
+                fixed_init(3),
+                fixed_init(0),
+                fixed_init_half(1),
+                fixed_init_half(2),
+                fixed_init(0),
+        };
+        fixed20_12 memtcas_rs480_ff[8] = {
+                fixed_init(0),
+                fixed_init(1),
+                fixed_init(2),
+                fixed_init(3),
+                fixed_init(0),
+                fixed_init_half(1),
+                fixed_init_half(2),
+                fixed_init_half(3),
+        };
+        fixed20_12 memtcas2_ff[8] = {
+                fixed_init(0),
+                fixed_init(1),
+                fixed_init(2),
+                fixed_init(3),
+                fixed_init(4),
+                fixed_init(5),
+                fixed_init(6),
+                fixed_init(7),
+        };
+        fixed20_12 memtrbs[8] = {
+                fixed_init(1),
+                fixed_init_half(1),
+                fixed_init(2),
+                fixed_init_half(2),
+                fixed_init(3),
+                fixed_init_half(3),
+                fixed_init(4),
+                fixed_init_half(4)
+        };
+        fixed20_12 memtrbs_r4xx[8] = {
+                fixed_init(4),
+                fixed_init(5),
+                fixed_init(6),
+                fixed_init(7),
+                fixed_init(8),
+                fixed_init(9),
+                fixed_init(10),
+                fixed_init(11)
+        };
+        fixed20_12 min_mem_eff;
+        fixed20_12 mc_latency_sclk, mc_latency_mclk, k1;
+        fixed20_12 cur_latency_mclk, cur_latency_sclk;
+        fixed20_12 disp_latency, disp_latency_overhead, disp_drain_rate,
+                disp_drain_rate2, read_return_rate;
+        fixed20_12 time_disp1_drop_priority;
+        int c;
+        int cur_size = 16;       /* in octawords */
+        int critical_point = 0, critical_point2;
+/*      uint32_t read_return_rate, time_disp1_drop_priority; */
+        int stop_req, max_stop_req;
+        struct drm_display_mode *mode1 = NULL;
+        struct drm_display_mode *mode2 = NULL;
+        uint32_t pixel_bytes1 = 0;
+        uint32_t pixel_bytes2 = 0;
+
+        if (rdev->mode_info.crtcs[0]->base.enabled) {
+                mode1 = &rdev->mode_info.crtcs[0]->base.mode;
+                pixel_bytes1 = rdev->mode_info.crtcs[0]->base.fb->bits_per_pixel / 8;
+        }
+        if (rdev->mode_info.crtcs[1]->base.enabled) {
+                mode2 = &rdev->mode_info.crtcs[1]->base.mode;
+                pixel_bytes2 = rdev->mode_info.crtcs[1]->base.fb->bits_per_pixel / 8;
+        }
+
+        min_mem_eff.full = rfixed_const_8(0);
+        /* get modes */
+        if ((rdev->disp_priority == 2) && ASIC_IS_R300(rdev)) {
+                uint32_t mc_init_misc_lat_timer = RREG32(R300_MC_INIT_MISC_LAT_TIMER);
+                mc_init_misc_lat_timer &= ~(R300_MC_DISP1R_INIT_LAT_MASK << R300_MC_DISP1R_INIT_LAT_SHIFT);
+                mc_init_misc_lat_timer &= ~(R300_MC_DISP0R_INIT_LAT_MASK << R300_MC_DISP0R_INIT_LAT_SHIFT);
+                /* check crtc enables */
+                if (mode2)
+                        mc_init_misc_lat_timer |= (1 << R300_MC_DISP1R_INIT_LAT_SHIFT);
+                if (mode1)
+                        mc_init_misc_lat_timer |= (1 << R300_MC_DISP0R_INIT_LAT_SHIFT);
+                WREG32(R300_MC_INIT_MISC_LAT_TIMER, mc_init_misc_lat_timer);
+        }
+
+        /*
+         * determine is there is enough bw for current mode
+         */
+        mclk_ff.full = rfixed_const(rdev->clock.default_mclk);
+        temp_ff.full = rfixed_const(100);
+        mclk_ff.full = rfixed_div(mclk_ff, temp_ff);
+        sclk_ff.full = rfixed_const(rdev->clock.default_sclk);
+        sclk_ff.full = rfixed_div(sclk_ff, temp_ff);
+
+        temp = (rdev->mc.vram_width / 8) * (rdev->mc.vram_is_ddr ? 2 : 1);
+        temp_ff.full = rfixed_const(temp);
+        mem_bw.full = rfixed_mul(mclk_ff, temp_ff);
+
+        pix_clk.full = 0;
+        pix_clk2.full = 0;
+        peak_disp_bw.full = 0;
+        if (mode1) {
+                temp_ff.full = rfixed_const(1000);
+                pix_clk.full = rfixed_const(mode1->clock); /* convert to fixed point */
+                pix_clk.full = rfixed_div(pix_clk, temp_ff);
+                temp_ff.full = rfixed_const(pixel_bytes1);
+                peak_disp_bw.full += rfixed_mul(pix_clk, temp_ff);
+        }
+        if (mode2) {
+                temp_ff.full = rfixed_const(1000);
+                pix_clk2.full = rfixed_const(mode2->clock); /* convert to fixed point */
+                pix_clk2.full = rfixed_div(pix_clk2, temp_ff);
+                temp_ff.full = rfixed_const(pixel_bytes2);
+                peak_disp_bw.full += rfixed_mul(pix_clk2, temp_ff);
+        }
+
+        mem_bw.full = rfixed_mul(mem_bw, min_mem_eff);
+        if (peak_disp_bw.full >= mem_bw.full) {
+                DRM_ERROR("You may not have enough display bandwidth for current mode\n"
+                          "If you have flickering problem, try to lower resolution, refresh rate, or color depth\n");
+        }
+
+        /*  Get values from the EXT_MEM_CNTL register...converting its contents. */
+        temp = RREG32(RADEON_MEM_TIMING_CNTL);
+        if ((rdev->family == CHIP_RV100) || (rdev->flags & RADEON_IS_IGP)) { /* RV100, M6, IGPs */
+                mem_trcd = ((temp >> 2) & 0x3) + 1;
+                mem_trp  = ((temp & 0x3)) + 1;
+                mem_tras = ((temp & 0x70) >> 4) + 1;
+        } else if (rdev->family == CHIP_R300 ||
+                   rdev->family == CHIP_R350) { /* r300, r350 */
+                mem_trcd = (temp & 0x7) + 1;
+                mem_trp = ((temp >> 8) & 0x7) + 1;
+                mem_tras = ((temp >> 11) & 0xf) + 4;
+        } else if (rdev->family == CHIP_RV350 ||
+                   rdev->family <= CHIP_RV380) {
+                /* rv3x0 */
+                mem_trcd = (temp & 0x7) + 3;
+                mem_trp = ((temp >> 8) & 0x7) + 3;
+                mem_tras = ((temp >> 11) & 0xf) + 6;
+        } else if (rdev->family == CHIP_R420 ||
+                   rdev->family == CHIP_R423 ||
+                   rdev->family == CHIP_RV410) {
+                /* r4xx */
+                mem_trcd = (temp & 0xf) + 3;
+                if (mem_trcd > 15)
+                        mem_trcd = 15;
+                mem_trp = ((temp >> 8) & 0xf) + 3;
+                if (mem_trp > 15)
+                        mem_trp = 15;
+                mem_tras = ((temp >> 12) & 0x1f) + 6;
+                if (mem_tras > 31)
+                        mem_tras = 31;
+        } else { /* RV200, R200 */
+                mem_trcd = (temp & 0x7) + 1;
+                mem_trp = ((temp >> 8) & 0x7) + 1;
+                mem_tras = ((temp >> 12) & 0xf) + 4;
+        }
+        /* convert to FF */
+        trcd_ff.full = rfixed_const(mem_trcd);
+        trp_ff.full = rfixed_const(mem_trp);
+        tras_ff.full = rfixed_const(mem_tras);
+
+        /* Get values from the MEM_SDRAM_MODE_REG register...converting its */
+        temp = RREG32(RADEON_MEM_SDRAM_MODE_REG);
+        data = (temp & (7 << 20)) >> 20;
+        if ((rdev->family == CHIP_RV100) || rdev->flags & RADEON_IS_IGP) {
+                if (rdev->family == CHIP_RS480) /* don't think rs400 */
+                        tcas_ff = memtcas_rs480_ff[data];
+                else
+                        tcas_ff = memtcas_ff[data];
+        } else
+                tcas_ff = memtcas2_ff[data];
+
+        if (rdev->family == CHIP_RS400 ||
+            rdev->family == CHIP_RS480) {
+                /* extra cas latency stored in bits 23-25 0-4 clocks */
+                data = (temp >> 23) & 0x7;
+                if (data < 5)
+                        tcas_ff.full += rfixed_const(data);
+        }
+
+        if (ASIC_IS_R300(rdev) && !(rdev->flags & RADEON_IS_IGP)) {
+                /* on the R300, Tcas is included in Trbs.
+                 */
+                temp = RREG32(RADEON_MEM_CNTL);
+                data = (R300_MEM_NUM_CHANNELS_MASK & temp);
+                if (data == 1) {
+                        if (R300_MEM_USE_CD_CH_ONLY & temp) {
+                                temp = RREG32(R300_MC_IND_INDEX);
+                                temp &= ~R300_MC_IND_ADDR_MASK;
+                                temp |= R300_MC_READ_CNTL_CD_mcind;
+                                WREG32(R300_MC_IND_INDEX, temp);
+                                temp = RREG32(R300_MC_IND_DATA);
+                                data = (R300_MEM_RBS_POSITION_C_MASK & temp);
+                        } else {
+                                temp = RREG32(R300_MC_READ_CNTL_AB);
+                                data = (R300_MEM_RBS_POSITION_A_MASK & temp);
+                        }
+                } else {
+                        temp = RREG32(R300_MC_READ_CNTL_AB);
+                        data = (R300_MEM_RBS_POSITION_A_MASK & temp);
+                }
+                if (rdev->family == CHIP_RV410 ||
+                    rdev->family == CHIP_R420 ||
+                    rdev->family == CHIP_R423)
+                        trbs_ff = memtrbs_r4xx[data];
+                else
+                        trbs_ff = memtrbs[data];
+                tcas_ff.full += trbs_ff.full;
+        }
+
+        sclk_eff_ff.full = sclk_ff.full;
+
+        if (rdev->flags & RADEON_IS_AGP) {
+                fixed20_12 agpmode_ff;
+                agpmode_ff.full = rfixed_const(radeon_agpmode);
+                temp_ff.full = rfixed_const_666(16);
+                sclk_eff_ff.full -= rfixed_mul(agpmode_ff, temp_ff);
+        }
+        /* TODO PCIE lanes may affect this - agpmode == 16?? */
+
+        if (ASIC_IS_R300(rdev)) {
+                sclk_delay_ff.full = rfixed_const(250);
+        } else {
+                if ((rdev->family == CHIP_RV100) ||
+                    rdev->flags & RADEON_IS_IGP) {
+                        if (rdev->mc.vram_is_ddr)
+                                sclk_delay_ff.full = rfixed_const(41);
+                        else
+                                sclk_delay_ff.full = rfixed_const(33);
+                } else {
+                        if (rdev->mc.vram_width == 128)
+                                sclk_delay_ff.full = rfixed_const(57);
+                        else
+                                sclk_delay_ff.full = rfixed_const(41);
+                }
+        }
+
+        mc_latency_sclk.full = rfixed_div(sclk_delay_ff, sclk_eff_ff);
+
+        if (rdev->mc.vram_is_ddr) {
+                if (rdev->mc.vram_width == 32) {
+                        k1.full = rfixed_const(40);
+                        c  = 3;
+                } else {
+                        k1.full = rfixed_const(20);
+                        c  = 1;
+                }
+        } else {
+                k1.full = rfixed_const(40);
+                c  = 3;
+        }
+
+        temp_ff.full = rfixed_const(2);
+        mc_latency_mclk.full = rfixed_mul(trcd_ff, temp_ff);
+        temp_ff.full = rfixed_const(c);
+        mc_latency_mclk.full += rfixed_mul(tcas_ff, temp_ff);
+        temp_ff.full = rfixed_const(4);
+        mc_latency_mclk.full += rfixed_mul(tras_ff, temp_ff);
+        mc_latency_mclk.full += rfixed_mul(trp_ff, temp_ff);
+        mc_latency_mclk.full += k1.full;
+
+        mc_latency_mclk.full = rfixed_div(mc_latency_mclk, mclk_ff);
+        mc_latency_mclk.full += rfixed_div(temp_ff, sclk_eff_ff);
+
+        /*
+          HW cursor time assuming worst case of full size colour cursor.
+        */
+        temp_ff.full = rfixed_const((2 * (cur_size - (rdev->mc.vram_is_ddr + 1))));
+        temp_ff.full += trcd_ff.full;
+        if (temp_ff.full < tras_ff.full)
+                temp_ff.full = tras_ff.full;
+        cur_latency_mclk.full = rfixed_div(temp_ff, mclk_ff);
+
+        temp_ff.full = rfixed_const(cur_size);
+        cur_latency_sclk.full = rfixed_div(temp_ff, sclk_eff_ff);
+        /*
+          Find the total latency for the display data.
+        */
+        disp_latency_overhead.full = rfixed_const(80);
+        disp_latency_overhead.full = rfixed_div(disp_latency_overhead, sclk_ff);
+        mc_latency_mclk.full += disp_latency_overhead.full + cur_latency_mclk.full;
+        mc_latency_sclk.full += disp_latency_overhead.full + cur_latency_sclk.full;
+
+        if (mc_latency_mclk.full > mc_latency_sclk.full)
+                disp_latency.full = mc_latency_mclk.full;
+        else
+                disp_latency.full = mc_latency_sclk.full;
+
+        /* setup Max GRPH_STOP_REQ default value */
+        if (ASIC_IS_RV100(rdev))
+                max_stop_req = 0x5c;
+        else
+                max_stop_req = 0x7c;
+
+        if (mode1) {
+                /*  CRTC1
+                    Set GRPH_BUFFER_CNTL register using h/w defined optimal values.
+                    GRPH_STOP_REQ <= MIN[ 0x7C, (CRTC_H_DISP + 1) * (bit depth) / 0x10 ]
+                */
+                stop_req = mode1->hdisplay * pixel_bytes1 / 16;
+
+                if (stop_req > max_stop_req)
+                        stop_req = max_stop_req;
+
+                /*
+                  Find the drain rate of the display buffer.
+                */
+                temp_ff.full = rfixed_const((16/pixel_bytes1));
+                disp_drain_rate.full = rfixed_div(pix_clk, temp_ff);
+
+                /*
+                  Find the critical point of the display buffer.
+                */
+                crit_point_ff.full = rfixed_mul(disp_drain_rate, disp_latency);
+                crit_point_ff.full += rfixed_const_half(0);
+
+                critical_point = rfixed_trunc(crit_point_ff);
+
+                if (rdev->disp_priority == 2) {
+                        critical_point = 0;
+                }
+
+                /*
+                  The critical point should never be above max_stop_req-4.  Setting
+                  GRPH_CRITICAL_CNTL = 0 will thus force high priority all the time.
+                */
+                if (max_stop_req - critical_point < 4)
+                        critical_point = 0;
+
+                if (critical_point == 0 && mode2 && rdev->family == CHIP_R300) {
+                        /* some R300 cards have problem with this set to 0, when CRTC2 is enabled.*/
+                        critical_point = 0x10;
+                }
+
+                temp = RREG32(RADEON_GRPH_BUFFER_CNTL);
+                temp &= ~(RADEON_GRPH_STOP_REQ_MASK);
+                temp |= (stop_req << RADEON_GRPH_STOP_REQ_SHIFT);
+                temp &= ~(RADEON_GRPH_START_REQ_MASK);
+                if ((rdev->family == CHIP_R350) &&
+                    (stop_req > 0x15)) {
+                        stop_req -= 0x10;
+                }
+                temp |= (stop_req << RADEON_GRPH_START_REQ_SHIFT);
+                temp |= RADEON_GRPH_BUFFER_SIZE;
+                temp &= ~(RADEON_GRPH_CRITICAL_CNTL   |
+                          RADEON_GRPH_CRITICAL_AT_SOF |
+                          RADEON_GRPH_STOP_CNTL);
+                /*
+                  Write the result into the register.
+                */
+                WREG32(RADEON_GRPH_BUFFER_CNTL, ((temp & ~RADEON_GRPH_CRITICAL_POINT_MASK) |
+                                                       (critical_point << RADEON_GRPH_CRITICAL_POINT_SHIFT)));
+
+#if 0
+                if ((rdev->family == CHIP_RS400) ||
+                    (rdev->family == CHIP_RS480)) {
+                        /* attempt to program RS400 disp regs correctly ??? */
+                        temp = RREG32(RS400_DISP1_REG_CNTL);
+                        temp &= ~(RS400_DISP1_START_REQ_LEVEL_MASK |
+                                  RS400_DISP1_STOP_REQ_LEVEL_MASK);
+                        WREG32(RS400_DISP1_REQ_CNTL1, (temp |
+                                                       (critical_point << RS400_DISP1_START_REQ_LEVEL_SHIFT) |
+                                                       (critical_point << RS400_DISP1_STOP_REQ_LEVEL_SHIFT)));
+                        temp = RREG32(RS400_DMIF_MEM_CNTL1);
+                        temp &= ~(RS400_DISP1_CRITICAL_POINT_START_MASK |
+                                  RS400_DISP1_CRITICAL_POINT_STOP_MASK);
+                        WREG32(RS400_DMIF_MEM_CNTL1, (temp |
+                                                      (critical_point << RS400_DISP1_CRITICAL_POINT_START_SHIFT) |
+                                                      (critical_point << RS400_DISP1_CRITICAL_POINT_STOP_SHIFT)));
+                }
+#endif
+
+                DRM_DEBUG("GRPH_BUFFER_CNTL from to %x\n",
+                          /*      (unsigned int)info->SavedReg->grph_buffer_cntl, */
+                          (unsigned int)RREG32(RADEON_GRPH_BUFFER_CNTL));
+        }
+
+        if (mode2) {
+                u32 grph2_cntl;
+                stop_req = mode2->hdisplay * pixel_bytes2 / 16;
+
+                if (stop_req > max_stop_req)
+                        stop_req = max_stop_req;
+
+                /*
+                  Find the drain rate of the display buffer.
+                */
+                temp_ff.full = rfixed_const((16/pixel_bytes2));
+                disp_drain_rate2.full = rfixed_div(pix_clk2, temp_ff);
+
+                grph2_cntl = RREG32(RADEON_GRPH2_BUFFER_CNTL);
+                grph2_cntl &= ~(RADEON_GRPH_STOP_REQ_MASK);
+                grph2_cntl |= (stop_req << RADEON_GRPH_STOP_REQ_SHIFT);
+                grph2_cntl &= ~(RADEON_GRPH_START_REQ_MASK);
+                if ((rdev->family == CHIP_R350) &&
+                    (stop_req > 0x15)) {
+                        stop_req -= 0x10;
+                }
+                grph2_cntl |= (stop_req << RADEON_GRPH_START_REQ_SHIFT);
+                grph2_cntl |= RADEON_GRPH_BUFFER_SIZE;
+                grph2_cntl &= ~(RADEON_GRPH_CRITICAL_CNTL   |
+                          RADEON_GRPH_CRITICAL_AT_SOF |
+                          RADEON_GRPH_STOP_CNTL);
+
+                if ((rdev->family == CHIP_RS100) ||
+                    (rdev->family == CHIP_RS200))
+                        critical_point2 = 0;
+                else {
+                        temp = (rdev->mc.vram_width * rdev->mc.vram_is_ddr + 1)/128;
+                        temp_ff.full = rfixed_const(temp);
+                        temp_ff.full = rfixed_mul(mclk_ff, temp_ff);
+                        if (sclk_ff.full < temp_ff.full)
+                                temp_ff.full = sclk_ff.full;
+
+                        read_return_rate.full = temp_ff.full;
+
+                        if (mode1) {
+                                temp_ff.full = read_return_rate.full - disp_drain_rate.full;
+                                time_disp1_drop_priority.full = rfixed_div(crit_point_ff, temp_ff);
+                        } else {
+                                time_disp1_drop_priority.full = 0;
+                        }
+                        crit_point_ff.full = disp_latency.full + time_disp1_drop_priority.full + disp_latency.full;
+                        crit_point_ff.full = rfixed_mul(crit_point_ff, disp_drain_rate2);
+                        crit_point_ff.full += rfixed_const_half(0);
+
+                        critical_point2 = rfixed_trunc(crit_point_ff);
+
+                        if (rdev->disp_priority == 2) {
+                                critical_point2 = 0;
+                        }
+
+                        if (max_stop_req - critical_point2 < 4)
+                                critical_point2 = 0;
+
+                }
+
+                if (critical_point2 == 0 && rdev->family == CHIP_R300) {
+                        /* some R300 cards have problem with this set to 0 */
+                        critical_point2 = 0x10;
+                }
+
+                WREG32(RADEON_GRPH2_BUFFER_CNTL, ((grph2_cntl & ~RADEON_GRPH_CRITICAL_POINT_MASK) |
+                                                  (critical_point2 << RADEON_GRPH_CRITICAL_POINT_SHIFT)));
+
+                if ((rdev->family == CHIP_RS400) ||
+                    (rdev->family == CHIP_RS480)) {
+#if 0
+                        /* attempt to program RS400 disp2 regs correctly ??? */
+                        temp = RREG32(RS400_DISP2_REQ_CNTL1);
+                        temp &= ~(RS400_DISP2_START_REQ_LEVEL_MASK |
+                                  RS400_DISP2_STOP_REQ_LEVEL_MASK);
+                        WREG32(RS400_DISP2_REQ_CNTL1, (temp |
+                                                       (critical_point2 << RS400_DISP1_START_REQ_LEVEL_SHIFT) |
+                                                       (critical_point2 << RS400_DISP1_STOP_REQ_LEVEL_SHIFT)));
+                        temp = RREG32(RS400_DISP2_REQ_CNTL2);
+                        temp &= ~(RS400_DISP2_CRITICAL_POINT_START_MASK |
+                                  RS400_DISP2_CRITICAL_POINT_STOP_MASK);
+                        WREG32(RS400_DISP2_REQ_CNTL2, (temp |
+                                                       (critical_point2 << RS400_DISP2_CRITICAL_POINT_START_SHIFT) |
+                                                       (critical_point2 << RS400_DISP2_CRITICAL_POINT_STOP_SHIFT)));
+#endif
+                        WREG32(RS400_DISP2_REQ_CNTL1, 0x105DC1CC);
+                        WREG32(RS400_DISP2_REQ_CNTL2, 0x2749D000);
+                        WREG32(RS400_DMIF_MEM_CNTL1,  0x29CA71DC);
+                        WREG32(RS400_DISP1_REQ_CNTL1, 0x28FBC3AC);
+                }
+
+                DRM_DEBUG("GRPH2_BUFFER_CNTL from to %x\n",
+                          (unsigned int)RREG32(RADEON_GRPH2_BUFFER_CNTL));
+        }
+}
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index e2ed5bc08170..9c8d41534a5d 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -30,6 +30,8 @@
 #include "drm.h"
 #include "radeon_reg.h"
 #include "radeon.h"
+#include "radeon_drm.h"
+#include "radeon_share.h"
 
 /* r300,r350,rv350,rv370,rv380 depends on : */
 void r100_hdp_reset(struct radeon_device *rdev);
@@ -44,6 +46,7 @@ int r100_gui_wait_for_idle(struct radeon_device *rdev);
 int r100_cs_packet_parse(struct radeon_cs_parser *p,
                          struct radeon_cs_packet *pkt,
                          unsigned idx);
+int r100_cs_packet_parse_vline(struct radeon_cs_parser *p);
 int r100_cs_packet_next_reloc(struct radeon_cs_parser *p,
                               struct radeon_cs_reloc **cs_reloc);
 int r100_cs_parse_packet0(struct radeon_cs_parser *p,
@@ -150,8 +153,13 @@ int rv370_pcie_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
         if (i < 0 || i > rdev->gart.num_gpu_pages) {
                 return -EINVAL;
         }
-        addr = (((u32)addr) >> 8) | ((upper_32_bits(addr) & 0xff) << 4) | 0xC;
-        writel(cpu_to_le32(addr), ((void __iomem *)ptr) + (i * 4));
+        addr = (lower_32_bits(addr) >> 8) |
+               ((upper_32_bits(addr) & 0xff) << 24) |
+               0xc;
+        /* on x86 we want this to be CPU endian, on powerpc
+         * on powerpc without HW swappers, it'll get swapped on way
+         * into VRAM - so no need for cpu_to_le32 on VRAM tables */
+        writel(addr, ((void __iomem *)ptr) + (i * 4));
         return 0;
 }
 
@@ -579,10 +587,8 @@ void r300_vram_info(struct radeon_device *rdev)
         } else {
                 rdev->mc.vram_width = 64;
         }
-        rdev->mc.vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
 
-        rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
-        rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+        r100_vram_init_sizes(rdev);
 }
 
 
@@ -970,7 +976,7 @@ static inline void r300_cs_track_clear(struct r300_cs_track *track)
 
 static const unsigned r300_reg_safe_bm[159] = {
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
-        0xFFFFFFBF, 0xFFFFFFFF, 0xFFFFFFBF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
@@ -1019,7 +1025,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
         struct radeon_cs_reloc *reloc;
         struct r300_cs_track *track;
         volatile uint32_t *ib;
-        uint32_t tmp;
+        uint32_t tmp, tile_flags = 0;
         unsigned i;
         int r;
 
@@ -1027,6 +1033,16 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
         ib_chunk = &p->chunks[p->chunk_ib_idx];
         track = (struct r300_cs_track*)p->track;
         switch(reg) {
+        case AVIVO_D1MODE_VLINE_START_END:
+        case RADEON_CRTC_GUI_TRIG_VLINE:
+                r = r100_cs_packet_parse_vline(p);
+                if (r) {
+                        DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                        idx, reg);
+                        r100_cs_dump_packet(p, pkt);
+                        return r;
+                }
+                break;
         case RADEON_DST_PITCH_OFFSET:
         case RADEON_SRC_PITCH_OFFSET:
                 r = r100_cs_packet_next_reloc(p, &reloc);
@@ -1038,7 +1054,19 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 }
                 tmp = ib_chunk->kdata[idx] & 0x003fffff;
                 tmp += (((u32)reloc->lobj.gpu_offset) >> 10);
-                ib[idx] = (ib_chunk->kdata[idx] & 0xffc00000) | tmp;
+
+                if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        tile_flags |= RADEON_DST_TILE_MACRO;
+                if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO) {
+                        if (reg == RADEON_SRC_PITCH_OFFSET) {
+                                DRM_ERROR("Cannot src blit from microtiled surface\n");
+                                r100_cs_dump_packet(p, pkt);
+                                return -EINVAL;
+                        }
+                        tile_flags |= RADEON_DST_TILE_MICRO;
+                }
+                tmp |= tile_flags;
+                ib[idx] = (ib_chunk->kdata[idx] & 0x3fc00000) | tmp;
                 break;
         case R300_RB3D_COLOROFFSET0:
         case R300_RB3D_COLOROFFSET1:
@@ -1127,6 +1155,23 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 /* RB3D_COLORPITCH1 */
                 /* RB3D_COLORPITCH2 */
                 /* RB3D_COLORPITCH3 */
+                r = r100_cs_packet_next_reloc(p, &reloc);
+                if (r) {
+                        DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                  idx, reg);
+                        r100_cs_dump_packet(p, pkt);
+                        return r;
+                }
+
+                if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        tile_flags |= R300_COLOR_TILE_ENABLE;
+                if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        tile_flags |= R300_COLOR_MICROTILE_ENABLE;
+
+                tmp = ib_chunk->kdata[idx] & ~(0x7 << 16);
+                tmp |= tile_flags;
+                ib[idx] = tmp;
+
                 i = (reg - 0x4E38) >> 2;
                 track->cb[i].pitch = ib_chunk->kdata[idx] & 0x3FFE;
                 switch (((ib_chunk->kdata[idx] >> 21) & 0xF)) {
@@ -1182,6 +1227,23 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 break;
         case 0x4F24:
                 /* ZB_DEPTHPITCH */
+                r = r100_cs_packet_next_reloc(p, &reloc);
+                if (r) {
+                        DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                  idx, reg);
+                        r100_cs_dump_packet(p, pkt);
+                        return r;
+                }
+
+                if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+                        tile_flags |= R300_DEPTHMACROTILE_ENABLE;
+                if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+                        tile_flags |= R300_DEPTHMICROTILE_TILED;;
+
+                tmp = ib_chunk->kdata[idx] & ~(0x7 << 16);
+                tmp |= tile_flags;
+                ib[idx] = tmp;
+
                 track->zb.pitch = ib_chunk->kdata[idx] & 0x3FFC;
                 break;
         case 0x4104:
diff --git a/drivers/gpu/drm/radeon/r300_reg.h b/drivers/gpu/drm/radeon/r300_reg.h
index 70f48609515e..4b7afef35a65 100644
--- a/drivers/gpu/drm/radeon/r300_reg.h
+++ b/drivers/gpu/drm/radeon/r300_reg.h
@@ -27,7 +27,9 @@
 #ifndef _R300_REG_H_
 #define _R300_REG_H_
 
-
+#define R300_SURF_TILE_MACRO (1<<16)
+#define R300_SURF_TILE_MICRO (2<<16)
+#define R300_SURF_TILE_BOTH (3<<16)
 
 
 #define R300_MC_INIT_MISC_LAT_TIMER     0x180
diff --git a/drivers/gpu/drm/radeon/r500_reg.h b/drivers/gpu/drm/radeon/r500_reg.h
index 9070a1c2ce23..036691b38cb7 100644
--- a/drivers/gpu/drm/radeon/r500_reg.h
+++ b/drivers/gpu/drm/radeon/r500_reg.h
@@ -445,6 +445,7 @@
 #define AVIVO_D1MODE_DATA_FORMAT                0x6528
 #       define AVIVO_D1MODE_INTERLEAVE_EN       (1 << 0)
 #define AVIVO_D1MODE_DESKTOP_HEIGHT             0x652C
+#define AVIVO_D1MODE_VLINE_START_END            0x6538
 #define AVIVO_D1MODE_VIEWPORT_START             0x6580
 #define AVIVO_D1MODE_VIEWPORT_SIZE              0x6584
 #define AVIVO_D1MODE_EXT_OVERSCAN_LEFT_RIGHT    0x6588
@@ -496,6 +497,7 @@
 #define AVIVO_D2CUR_SIZE                        0x6c10
 #define AVIVO_D2CUR_POSITION                    0x6c14
 
+#define AVIVO_D2MODE_VLINE_START_END            0x6d38
 #define AVIVO_D2MODE_VIEWPORT_START             0x6d80
 #define AVIVO_D2MODE_VIEWPORT_SIZE              0x6d84
 #define AVIVO_D2MODE_EXT_OVERSCAN_LEFT_RIGHT    0x6d88
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 570a244bd88b..09fb0b6ec7dd 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -28,6 +28,7 @@
 #include "drmP.h"
 #include "radeon_reg.h"
 #include "radeon.h"
+#include "radeon_share.h"
 
 /* r520,rv530,rv560,rv570,r580 depends on : */
 void r100_hdp_reset(struct radeon_device *rdev);
@@ -94,8 +95,8 @@ int r520_mc_init(struct radeon_device *rdev)
                        "programming pipes. Bad things might happen.\n");
         }
         /* Write VRAM size in case we are limiting it */
-        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.vram_size);
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
+        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.real_vram_size);
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
         tmp = REG_SET(R520_MC_FB_TOP, tmp >> 16);
         tmp |= REG_SET(R520_MC_FB_START, rdev->mc.vram_location >> 16);
         WREG32_MC(R520_MC_FB_LOCATION, tmp);
@@ -226,9 +227,20 @@ static void r520_vram_get_type(struct radeon_device *rdev)
 
 void r520_vram_info(struct radeon_device *rdev)
 {
+        fixed20_12 a;
+
         r520_vram_get_type(rdev);
-        rdev->mc.vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
 
-        rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
-        rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+        r100_vram_init_sizes(rdev);
+        /* FIXME: we should enforce default clock in case GPU is not in
+         * default setup
+         */
+        a.full = rfixed_const(100);
+        rdev->pm.sclk.full = rfixed_const(rdev->clock.default_sclk);
+        rdev->pm.sclk.full = rfixed_div(rdev->pm.sclk, a);
+}
+
+void r520_bandwidth_update(struct radeon_device *rdev)
+{
+        rv515_bandwidth_avivo_update(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index c45559fc97fd..538cd907df69 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -67,7 +67,7 @@ int r600_mc_init(struct radeon_device *rdev)
                        "programming pipes. Bad things might happen.\n");
         }
 
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
         tmp = REG_SET(R600_MC_FB_TOP, tmp >> 24);
         tmp |= REG_SET(R600_MC_FB_BASE, rdev->mc.vram_location >> 24);
         WREG32(R600_MC_VM_FB_LOCATION, tmp);
@@ -140,7 +140,8 @@ void r600_vram_get_type(struct radeon_device *rdev)
 void r600_vram_info(struct radeon_device *rdev)
 {
         r600_vram_get_type(rdev);
-        rdev->mc.vram_size = RREG32(R600_CONFIG_MEMSIZE);
+        rdev->mc.real_vram_size = RREG32(R600_CONFIG_MEMSIZE);
+        rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
 
         /* Could aper size report 0 ? */
         rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index d61f2fc61df5..b1d945b8ed6c 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -64,6 +64,7 @@ extern int radeon_agpmode;
 extern int radeon_vram_limit;
 extern int radeon_gart_size;
 extern int radeon_benchmarking;
+extern int radeon_testing;
 extern int radeon_connector_table;
 
 /*
@@ -113,6 +114,7 @@ enum radeon_family {
         CHIP_RV770,
         CHIP_RV730,
         CHIP_RV710,
+        CHIP_RS880,
         CHIP_LAST,
 };
 
@@ -201,6 +203,14 @@ int radeon_fence_wait_last(struct radeon_device *rdev);
 struct radeon_fence *radeon_fence_ref(struct radeon_fence *fence);
 void radeon_fence_unref(struct radeon_fence **fence);
 
+/*
+ * Tiling registers
+ */
+struct radeon_surface_reg {
+        struct radeon_object *robj;
+};
+
+#define RADEON_GEM_MAX_SURFACES 8
 
 /*
  * Radeon buffer.
@@ -213,6 +223,7 @@ struct radeon_object_list {
         uint64_t                gpu_offset;
         unsigned                rdomain;
         unsigned                wdomain;
+        uint32_t                tiling_flags;
 };
 
 int radeon_object_init(struct radeon_device *rdev);
@@ -242,8 +253,15 @@ void radeon_object_list_clean(struct list_head *head);
 int radeon_object_fbdev_mmap(struct radeon_object *robj,
                              struct vm_area_struct *vma);
 unsigned long radeon_object_size(struct radeon_object *robj);
-
-
+void radeon_object_clear_surface_reg(struct radeon_object *robj);
+int radeon_object_check_tiling(struct radeon_object *robj, bool has_moved,
+                               bool force_drop);
+void radeon_object_set_tiling_flags(struct radeon_object *robj,
+                                    uint32_t tiling_flags, uint32_t pitch);
+void radeon_object_get_tiling_flags(struct radeon_object *robj, uint32_t *tiling_flags, uint32_t *pitch);
+void radeon_bo_move_notify(struct ttm_buffer_object *bo,
+                           struct ttm_mem_reg *mem);
+void radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
 /*
  * GEM objects.
  */
@@ -315,8 +333,11 @@ struct radeon_mc {
         unsigned                gtt_location;
         unsigned                gtt_size;
         unsigned                vram_location;
-        unsigned                vram_size;
+        /* for some chips with <= 32MB we need to lie
+         * about vram size near mc fb location */
+        unsigned                mc_vram_size;
         unsigned                vram_width;
+        unsigned                real_vram_size;
         int                     vram_mtrr;
         bool                    vram_is_ddr;
 };
@@ -474,6 +495,39 @@ struct radeon_wb {
         uint64_t                gpu_addr;
 };
 
+/**
+ * struct radeon_pm - power management datas
+ * @max_bandwidth:      maximum bandwidth the gpu has (MByte/s)
+ * @igp_sideport_mclk:  sideport memory clock Mhz (rs690,rs740,rs780,rs880)
+ * @igp_system_mclk:    system clock Mhz (rs690,rs740,rs780,rs880)
+ * @igp_ht_link_clk:    ht link clock Mhz (rs690,rs740,rs780,rs880)
+ * @igp_ht_link_width:  ht link width in bits (rs690,rs740,rs780,rs880)
+ * @k8_bandwidth:       k8 bandwidth the gpu has (MByte/s) (IGP)
+ * @sideport_bandwidth: sideport bandwidth the gpu has (MByte/s) (IGP)
+ * @ht_bandwidth:       ht bandwidth the gpu has (MByte/s) (IGP)
+ * @core_bandwidth:     core GPU bandwidth the gpu has (MByte/s) (IGP)
+ * @sclk:               GPU clock Mhz (core bandwith depends of this clock)
+ * @needed_bandwidth:   current bandwidth needs
+ *
+ * It keeps track of various data needed to take powermanagement decision.
+ * Bandwith need is used to determine minimun clock of the GPU and memory.
+ * Equation between gpu/memory clock and available bandwidth is hw dependent
+ * (type of memory, bus size, efficiency, ...)
+ */
+struct radeon_pm {
+        fixed20_12              max_bandwidth;
+        fixed20_12              igp_sideport_mclk;
+        fixed20_12              igp_system_mclk;
+        fixed20_12              igp_ht_link_clk;
+        fixed20_12              igp_ht_link_width;
+        fixed20_12              k8_bandwidth;
+        fixed20_12              sideport_bandwidth;
+        fixed20_12              ht_bandwidth;
+        fixed20_12              core_bandwidth;
+        fixed20_12              sclk;
+        fixed20_12              needed_bandwidth;
+};
+
 
 /*
  * Benchmarking
@@ -482,6 +536,12 @@ void radeon_benchmark(struct radeon_device *rdev);
 
 
 /*
+ * Testing
+ */
+void radeon_test_moves(struct radeon_device *rdev);
+
+
+/*
  * Debugfs
  */
 int radeon_debugfs_add_files(struct radeon_device *rdev,
@@ -535,6 +595,11 @@ struct radeon_asic {
         void (*set_memory_clock)(struct radeon_device *rdev, uint32_t mem_clock);
         void (*set_pcie_lanes)(struct radeon_device *rdev, int lanes);
         void (*set_clock_gating)(struct radeon_device *rdev, int enable);
+        int (*set_surface_reg)(struct radeon_device *rdev, int reg,
+                               uint32_t tiling_flags, uint32_t pitch,
+                               uint32_t offset, uint32_t obj_size);
+        int (*clear_surface_reg)(struct radeon_device *rdev, int reg);
+        void (*bandwidth_update)(struct radeon_device *rdev);
 };
 
 union radeon_asic_config {
@@ -566,6 +631,10 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
                               struct drm_file *filp);
 int radeon_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp);
+int radeon_gem_set_tiling_ioctl(struct drm_device *dev, void *data,
+                                struct drm_file *filp);
+int radeon_gem_get_tiling_ioctl(struct drm_device *dev, void *data,
+                                struct drm_file *filp);
 
 
 /*
@@ -594,8 +663,8 @@ struct radeon_device {
         struct radeon_object            *fbdev_robj;
         struct radeon_framebuffer       *fbdev_rfb;
         /* Register mmio */
-        unsigned long                   rmmio_base;
-        unsigned long                   rmmio_size;
+        resource_size_t                 rmmio_base;
+        resource_size_t                 rmmio_size;
         void                            *rmmio;
         radeon_rreg_t                   mm_rreg;
         radeon_wreg_t                   mm_wreg;
@@ -619,11 +688,14 @@ struct radeon_device {
         struct radeon_irq               irq;
         struct radeon_asic              *asic;
         struct radeon_gem               gem;
+        struct radeon_pm                pm;
         struct mutex                    cs_mutex;
         struct radeon_wb                wb;
         bool                            gpu_lockup;
         bool                            shutdown;
         bool                            suspend;
+        bool                            need_dma32;
+        struct radeon_surface_reg surface_regs[RADEON_GEM_MAX_SURFACES];
 };
 
 int radeon_device_init(struct radeon_device *rdev,
@@ -670,6 +742,8 @@ void r100_pll_errata_after_index(struct radeon_device *rdev);
 /*
  * ASICs helpers.
  */
+#define ASIC_IS_RN50(rdev) ((rdev->pdev->device == 0x515e) || \
+                            (rdev->pdev->device == 0x5969))
 #define ASIC_IS_RV100(rdev) ((rdev->family == CHIP_RV100) || \
                 (rdev->family == CHIP_RV200) || \
                 (rdev->family == CHIP_RS100) || \
@@ -796,5 +870,8 @@ static inline void radeon_ring_write(struct radeon_device *rdev, uint32_t v)
 #define radeon_set_memory_clock(rdev, e) (rdev)->asic->set_engine_clock((rdev), (e))
 #define radeon_set_pcie_lanes(rdev, l) (rdev)->asic->set_pcie_lanes((rdev), (l))
 #define radeon_set_clock_gating(rdev, e) (rdev)->asic->set_clock_gating((rdev), (e))
+#define radeon_set_surface_reg(rdev, r, f, p, o, s) ((rdev)->asic->set_surface_reg((rdev), (r), (f), (p), (o), (s)))
+#define radeon_clear_surface_reg(rdev, r) ((rdev)->asic->clear_surface_reg((rdev), (r)))
+#define radeon_bandwidth_update(rdev) (rdev)->asic->bandwidth_update((rdev))
 
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index e2e567395df8..9a75876e0c3b 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -71,6 +71,11 @@ int r100_copy_blit(struct radeon_device *rdev,
                    uint64_t dst_offset,
                    unsigned num_pages,
                    struct radeon_fence *fence);
+int r100_set_surface_reg(struct radeon_device *rdev, int reg,
+                         uint32_t tiling_flags, uint32_t pitch,
+                         uint32_t offset, uint32_t obj_size);
+int r100_clear_surface_reg(struct radeon_device *rdev, int reg);
+void r100_bandwidth_update(struct radeon_device *rdev);
 
 static struct radeon_asic r100_asic = {
         .init = &r100_init,
@@ -100,6 +105,9 @@ static struct radeon_asic r100_asic = {
         .set_memory_clock = NULL,
         .set_pcie_lanes = NULL,
         .set_clock_gating = &radeon_legacy_set_clock_gating,
+        .set_surface_reg = r100_set_surface_reg,
+        .clear_surface_reg = r100_clear_surface_reg,
+        .bandwidth_update = &r100_bandwidth_update,
 };
 
 
@@ -128,6 +136,7 @@ int r300_copy_dma(struct radeon_device *rdev,
                   uint64_t dst_offset,
                   unsigned num_pages,
                   struct radeon_fence *fence);
+
 static struct radeon_asic r300_asic = {
         .init = &r300_init,
         .errata = &r300_errata,
@@ -156,6 +165,9 @@ static struct radeon_asic r300_asic = {
         .set_memory_clock = NULL,
         .set_pcie_lanes = &rv370_set_pcie_lanes,
         .set_clock_gating = &radeon_legacy_set_clock_gating,
+        .set_surface_reg = r100_set_surface_reg,
+        .clear_surface_reg = r100_clear_surface_reg,
+        .bandwidth_update = &r100_bandwidth_update,
 };
 
 /*
@@ -193,6 +205,9 @@ static struct radeon_asic r420_asic = {
         .set_memory_clock = &radeon_atom_set_memory_clock,
         .set_pcie_lanes = &rv370_set_pcie_lanes,
         .set_clock_gating = &radeon_atom_set_clock_gating,
+        .set_surface_reg = r100_set_surface_reg,
+        .clear_surface_reg = r100_clear_surface_reg,
+        .bandwidth_update = &r100_bandwidth_update,
 };
 
 
@@ -237,6 +252,9 @@ static struct radeon_asic rs400_asic = {
         .set_memory_clock = NULL,
         .set_pcie_lanes = NULL,
         .set_clock_gating = &radeon_legacy_set_clock_gating,
+        .set_surface_reg = r100_set_surface_reg,
+        .clear_surface_reg = r100_clear_surface_reg,
+        .bandwidth_update = &r100_bandwidth_update,
 };
 
 
@@ -254,6 +272,7 @@ void rs600_gart_tlb_flush(struct radeon_device *rdev);
 int rs600_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr);
 uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
+void rs600_bandwidth_update(struct radeon_device *rdev);
 static struct radeon_asic rs600_asic = {
         .init = &r300_init,
         .errata = &rs600_errata,
@@ -282,6 +301,7 @@ static struct radeon_asic rs600_asic = {
         .set_memory_clock = &radeon_atom_set_memory_clock,
         .set_pcie_lanes = NULL,
         .set_clock_gating = &radeon_atom_set_clock_gating,
+        .bandwidth_update = &rs600_bandwidth_update,
 };
 
 
@@ -294,6 +314,7 @@ int rs690_mc_init(struct radeon_device *rdev);
 void rs690_mc_fini(struct radeon_device *rdev);
 uint32_t rs690_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
+void rs690_bandwidth_update(struct radeon_device *rdev);
 static struct radeon_asic rs690_asic = {
         .init = &r300_init,
         .errata = &rs690_errata,
@@ -322,6 +343,9 @@ static struct radeon_asic rs690_asic = {
         .set_memory_clock = &radeon_atom_set_memory_clock,
         .set_pcie_lanes = NULL,
         .set_clock_gating = &radeon_atom_set_clock_gating,
+        .set_surface_reg = r100_set_surface_reg,
+        .clear_surface_reg = r100_clear_surface_reg,
+        .bandwidth_update = &rs690_bandwidth_update,
 };
 
 
@@ -339,6 +363,7 @@ void rv515_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rv515_ring_start(struct radeon_device *rdev);
 uint32_t rv515_pcie_rreg(struct radeon_device *rdev, uint32_t reg);
 void rv515_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
+void rv515_bandwidth_update(struct radeon_device *rdev);
 static struct radeon_asic rv515_asic = {
         .init = &rv515_init,
         .errata = &rv515_errata,
@@ -367,6 +392,9 @@ static struct radeon_asic rv515_asic = {
         .set_memory_clock = &radeon_atom_set_memory_clock,
         .set_pcie_lanes = &rv370_set_pcie_lanes,
         .set_clock_gating = &radeon_atom_set_clock_gating,
+        .set_surface_reg = r100_set_surface_reg,
+        .clear_surface_reg = r100_clear_surface_reg,
+        .bandwidth_update = &rv515_bandwidth_update,
 };
 
 
@@ -377,6 +405,7 @@ void r520_errata(struct radeon_device *rdev);
 void r520_vram_info(struct radeon_device *rdev);
 int r520_mc_init(struct radeon_device *rdev);
 void r520_mc_fini(struct radeon_device *rdev);
+void r520_bandwidth_update(struct radeon_device *rdev);
 static struct radeon_asic r520_asic = {
         .init = &rv515_init,
         .errata = &r520_errata,
@@ -405,6 +434,9 @@ static struct radeon_asic r520_asic = {
         .set_memory_clock = &radeon_atom_set_memory_clock,
         .set_pcie_lanes = &rv370_set_pcie_lanes,
         .set_clock_gating = &radeon_atom_set_clock_gating,
+        .set_surface_reg = r100_set_surface_reg,
+        .clear_surface_reg = r100_clear_surface_reg,
+        .bandwidth_update = &r520_bandwidth_update,
 };
 
 /*
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 1f5a1a490984..fcfe5c02d744 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -103,7 +103,8 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_gpio(struct drm_device
 static bool radeon_atom_apply_quirks(struct drm_device *dev,
                                      uint32_t supported_device,
                                      int *connector_type,
-                                     struct radeon_i2c_bus_rec *i2c_bus)
+                                     struct radeon_i2c_bus_rec *i2c_bus,
+                                     uint8_t *line_mux)
 {
 
         /* Asus M2A-VM HDMI board lists the DVI port as HDMI */
@@ -127,8 +128,10 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
         if ((dev->pdev->device == 0x5653) &&
             (dev->pdev->subsystem_vendor == 0x1462) &&
             (dev->pdev->subsystem_device == 0x0291)) {
-                if (*connector_type == DRM_MODE_CONNECTOR_LVDS)
+                if (*connector_type == DRM_MODE_CONNECTOR_LVDS) {
                         i2c_bus->valid = false;
+                        *line_mux = 53;
+                }
         }
 
         /* Funky macbooks */
@@ -526,7 +529,7 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 
                 if (!radeon_atom_apply_quirks
                     (dev, (1 << i), &bios_connectors[i].connector_type,
-                     &bios_connectors[i].ddc_bus))
+                     &bios_connectors[i].ddc_bus, &bios_connectors[i].line_mux))
                         continue;
 
                 bios_connectors[i].valid = true;
diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
index c44403a2ca76..2e938f7496fb 100644
--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
@@ -63,7 +63,7 @@ void radeon_benchmark_move(struct radeon_device *rdev, unsigned bsize,
                 if (r) {
                         goto out_cleanup;
                 }
-                r = radeon_copy_dma(rdev, saddr, daddr, size >> 14, fence);
+                r = radeon_copy_dma(rdev, saddr, daddr, size / 4096, fence);
                 if (r) {
                         goto out_cleanup;
                 }
@@ -88,7 +88,7 @@ void radeon_benchmark_move(struct radeon_device *rdev, unsigned bsize,
                 if (r) {
                         goto out_cleanup;
                 }
-                r = radeon_copy_blit(rdev, saddr, daddr, size >> 14, fence);
+                r = radeon_copy_blit(rdev, saddr, daddr, size / 4096, fence);
                 if (r) {
                         goto out_cleanup;
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index b843f9bdfb14..a169067efc4e 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -127,17 +127,23 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                                        sizeof(struct drm_radeon_cs_chunk))) {
                         return -EFAULT;
                 }
+                p->chunks[i].length_dw = user_chunk.length_dw;
+                p->chunks[i].kdata = NULL;
                 p->chunks[i].chunk_id = user_chunk.chunk_id;
+
                 if (p->chunks[i].chunk_id == RADEON_CHUNK_ID_RELOCS) {
                         p->chunk_relocs_idx = i;
                 }
                 if (p->chunks[i].chunk_id == RADEON_CHUNK_ID_IB) {
                         p->chunk_ib_idx = i;
+                        /* zero length IB isn't useful */
+                        if (p->chunks[i].length_dw == 0)
+                                return -EINVAL;
                 }
+
                 p->chunks[i].length_dw = user_chunk.length_dw;
                 cdata = (uint32_t *)(unsigned long)user_chunk.chunk_data;
 
-                p->chunks[i].kdata = NULL;
                 size = p->chunks[i].length_dw * sizeof(uint32_t);
                 p->chunks[i].kdata = kzalloc(size, GFP_KERNEL);
                 if (p->chunks[i].kdata == NULL) {
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index 5232441f119b..b13c79e38bc0 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -111,9 +111,11 @@ static void radeon_set_cursor(struct drm_crtc *crtc, struct drm_gem_object *obj,
 
         if (ASIC_IS_AVIVO(rdev))
                 WREG32(AVIVO_D1CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset, gpu_addr);
-        else
+        else {
+                radeon_crtc->legacy_cursor_offset = gpu_addr - radeon_crtc->legacy_display_base_addr;
                 /* offset is from DISP(2)_BASE_ADDRESS */
-                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, gpu_addr);
+                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, radeon_crtc->legacy_cursor_offset);
+        }
 }
 
 int radeon_crtc_cursor_set(struct drm_crtc *crtc,
@@ -245,6 +247,9 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                        (RADEON_CUR_LOCK
                         | ((xorigin ? 0 : x) << 16)
                         | (yorigin ? 0 : y)));
+                /* offset is from DISP(2)_BASE_ADDRESS */
+                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, (radeon_crtc->legacy_cursor_offset +
+                                                                      (yorigin * 256)));
         }
         radeon_lock_cursor(crtc, false);
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index f97563db4e59..a162ade74b7f 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -48,6 +48,8 @@ static void radeon_surface_init(struct radeon_device *rdev)
                                i * (RADEON_SURFACE1_INFO - RADEON_SURFACE0_INFO),
                                0);
                 }
+                /* enable surfaces */
+                WREG32(RADEON_SURFACE_CNTL, 0);
         }
 }
 
@@ -119,7 +121,7 @@ int radeon_mc_setup(struct radeon_device *rdev)
         if (rdev->mc.vram_location != 0xFFFFFFFFUL) {
                 /* vram location was already setup try to put gtt after
                  * if it fits */
-                tmp = rdev->mc.vram_location + rdev->mc.vram_size;
+                tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size;
                 tmp = (tmp + rdev->mc.gtt_size - 1) & ~(rdev->mc.gtt_size - 1);
                 if ((0xFFFFFFFFUL - tmp) >= rdev->mc.gtt_size) {
                         rdev->mc.gtt_location = tmp;
@@ -134,13 +136,13 @@ int radeon_mc_setup(struct radeon_device *rdev)
         } else if (rdev->mc.gtt_location != 0xFFFFFFFFUL) {
                 /* gtt location was already setup try to put vram before
                  * if it fits */
-                if (rdev->mc.vram_size < rdev->mc.gtt_location) {
+                if (rdev->mc.mc_vram_size < rdev->mc.gtt_location) {
                         rdev->mc.vram_location = 0;
                 } else {
                         tmp = rdev->mc.gtt_location + rdev->mc.gtt_size;
-                        tmp += (rdev->mc.vram_size - 1);
-                        tmp &= ~(rdev->mc.vram_size - 1);
-                        if ((0xFFFFFFFFUL - tmp) >= rdev->mc.vram_size) {
+                        tmp += (rdev->mc.mc_vram_size - 1);
+                        tmp &= ~(rdev->mc.mc_vram_size - 1);
+                        if ((0xFFFFFFFFUL - tmp) >= rdev->mc.mc_vram_size) {
                                 rdev->mc.vram_location = tmp;
                         } else {
                                 printk(KERN_ERR "[drm] vram too big to fit "
@@ -150,12 +152,14 @@ int radeon_mc_setup(struct radeon_device *rdev)
                 }
         } else {
                 rdev->mc.vram_location = 0;
-                rdev->mc.gtt_location = rdev->mc.vram_size;
+                rdev->mc.gtt_location = rdev->mc.mc_vram_size;
         }
-        DRM_INFO("radeon: VRAM %uM\n", rdev->mc.vram_size >> 20);
+        DRM_INFO("radeon: VRAM %uM\n", rdev->mc.real_vram_size >> 20);
         DRM_INFO("radeon: VRAM from 0x%08X to 0x%08X\n",
                  rdev->mc.vram_location,
-                 rdev->mc.vram_location + rdev->mc.vram_size - 1);
+                 rdev->mc.vram_location + rdev->mc.mc_vram_size - 1);
+        if (rdev->mc.real_vram_size != rdev->mc.mc_vram_size)
+                DRM_INFO("radeon: VRAM less than aperture workaround enabled\n");
         DRM_INFO("radeon: GTT %uM\n", rdev->mc.gtt_size >> 20);
         DRM_INFO("radeon: GTT from 0x%08X to 0x%08X\n",
                  rdev->mc.gtt_location,
@@ -450,6 +454,7 @@ int radeon_device_init(struct radeon_device *rdev,
                        uint32_t flags)
 {
         int r, ret;
+        int dma_bits;
 
         DRM_INFO("radeon: Initializing kernel modesetting.\n");
         rdev->shutdown = false;
@@ -492,8 +497,20 @@ int radeon_device_init(struct radeon_device *rdev,
                 return r;
         }
 
-        /* Report DMA addressing limitation */
-        r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(32));
+        /* set DMA mask + need_dma32 flags.
+         * PCIE - can handle 40-bits.
+         * IGP - can handle 40-bits (in theory)
+         * AGP - generally dma32 is safest
+         * PCI - only dma32
+         */
+        rdev->need_dma32 = false;
+        if (rdev->flags & RADEON_IS_AGP)
+                rdev->need_dma32 = true;
+        if (rdev->flags & RADEON_IS_PCI)
+                rdev->need_dma32 = true;
+
+        dma_bits = rdev->need_dma32 ? 32 : 40;
+        r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
         if (r) {
                 printk(KERN_WARNING "radeon: No suitable DMA available.\n");
         }
@@ -546,27 +563,22 @@ int radeon_device_init(struct radeon_device *rdev,
                         radeon_combios_asic_init(rdev->ddev);
                 }
         }
+        /* Initialize clocks */
+        r = radeon_clocks_init(rdev);
+        if (r) {
+                return r;
+        }
         /* Get vram informations */
         radeon_vram_info(rdev);
-        /* Device is severly broken if aper size > vram size.
-         * for RN50/M6/M7 - Novell bug 204882 ?
-         */
-        if (rdev->mc.vram_size < rdev->mc.aper_size) {
-                rdev->mc.aper_size = rdev->mc.vram_size;
-        }
+
         /* Add an MTRR for the VRAM */
         rdev->mc.vram_mtrr = mtrr_add(rdev->mc.aper_base, rdev->mc.aper_size,
                                       MTRR_TYPE_WRCOMB, 1);
         DRM_INFO("Detected VRAM RAM=%uM, BAR=%uM\n",
-                 rdev->mc.vram_size >> 20,
+                 rdev->mc.real_vram_size >> 20,
                  (unsigned)rdev->mc.aper_size >> 20);
         DRM_INFO("RAM width %dbits %cDR\n",
                  rdev->mc.vram_width, rdev->mc.vram_is_ddr ? 'D' : 'S');
-        /* Initialize clocks */
-        r = radeon_clocks_init(rdev);
-        if (r) {
-                return r;
-        }
         /* Initialize memory controller (also test AGP) */
         r = radeon_mc_init(rdev);
         if (r) {
@@ -626,6 +638,9 @@ int radeon_device_init(struct radeon_device *rdev,
         if (!ret) {
                 DRM_INFO("radeon: kernel modesetting successfully initialized.\n");
         }
+        if (radeon_testing) {
+                radeon_test_moves(rdev);
+        }
         if (radeon_benchmarking) {
                 radeon_benchmark(rdev);
         }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 3efcf1a526be..a8fa1bb84cf7 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -187,6 +187,7 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
 
         drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
         radeon_crtc->crtc_id = index;
+        rdev->mode_info.crtcs[index] = radeon_crtc;
 
         radeon_crtc->mode_set.crtc = &radeon_crtc->base;
         radeon_crtc->mode_set.connectors = (struct drm_connector **)(radeon_crtc + 1);
@@ -491,7 +492,11 @@ void radeon_compute_pll(struct radeon_pll *pll,
                                         tmp += (uint64_t)pll->reference_freq * 1000 * frac_feedback_div;
                                         current_freq = radeon_div(tmp, ref_div * post_div);
 
-                                        error = abs(current_freq - freq);
+                                        if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
+                                                error = freq - current_freq;
+                                                error = error < 0 ? 0xffffffff : error;
+                                        } else
+                                                error = abs(current_freq - freq);
                                         vco_diff = abs(vco - best_vco);
 
                                         if ((best_vco == 0 && error < best_error) ||
@@ -657,36 +662,51 @@ void radeon_modeset_fini(struct radeon_device *rdev)
         }
 }
 
-void radeon_init_disp_bandwidth(struct drm_device *dev)
+bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
+                                struct drm_display_mode *mode,
+                                struct drm_display_mode *adjusted_mode)
 {
-        struct radeon_device *rdev = dev->dev_private;
-        struct drm_display_mode *modes[2];
-        int pixel_bytes[2];
-        struct drm_crtc *crtc;
-
-        pixel_bytes[0] = pixel_bytes[1] = 0;
-        modes[0] = modes[1] = NULL;
-
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        struct drm_device *dev = crtc->dev;
+        struct drm_encoder *encoder;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        struct radeon_encoder *radeon_encoder;
+        bool first = true;
 
-                if (crtc->enabled && crtc->fb) {
-                        modes[radeon_crtc->crtc_id] = &crtc->mode;
-                        pixel_bytes[radeon_crtc->crtc_id] = crtc->fb->bits_per_pixel / 8;
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+                radeon_encoder = to_radeon_encoder(encoder);
+                if (encoder->crtc != crtc)
+                        continue;
+                if (first) {
+                        radeon_crtc->rmx_type = radeon_encoder->rmx_type;
+                        radeon_crtc->devices = radeon_encoder->devices;
+                        memcpy(&radeon_crtc->native_mode,
+                                &radeon_encoder->native_mode,
+                                sizeof(struct radeon_native_mode));
+                        first = false;
+                } else {
+                        if (radeon_crtc->rmx_type != radeon_encoder->rmx_type) {
+                                /* WARNING: Right now this can't happen but
+                                 * in the future we need to check that scaling
+                                 * are consistent accross different encoder
+                                 * (ie all encoder can work with the same
+                                 *  scaling).
+                                 */
+                                DRM_ERROR("Scaling not consistent accross encoder.\n");
+                                return false;
+                        }
                 }
         }
-
-        if (ASIC_IS_AVIVO(rdev)) {
-                radeon_init_disp_bw_avivo(dev,
-                                          modes[0],
-                                          pixel_bytes[0],
-                                          modes[1],
-                                          pixel_bytes[1]);
+        if (radeon_crtc->rmx_type != RMX_OFF) {
+                fixed20_12 a, b;
+                a.full = rfixed_const(crtc->mode.vdisplay);
+                b.full = rfixed_const(radeon_crtc->native_mode.panel_xres);
+                radeon_crtc->vsc.full = rfixed_div(a, b);
+                a.full = rfixed_const(crtc->mode.hdisplay);
+                b.full = rfixed_const(radeon_crtc->native_mode.panel_yres);
+                radeon_crtc->hsc.full = rfixed_div(a, b);
         } else {
-                radeon_init_disp_bw_legacy(dev,
-                                           modes[0],
-                                           pixel_bytes[0],
-                                           modes[1],
-                                           pixel_bytes[1]);
+                radeon_crtc->vsc.full = rfixed_const(1);
+                radeon_crtc->hsc.full = rfixed_const(1);
         }
+        return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 84ba69f48784..3cfcee17dc56 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -89,6 +89,7 @@ int radeon_agpmode = 0;
 int radeon_vram_limit = 0;
 int radeon_gart_size = 512; /* default gart size */
 int radeon_benchmarking = 0;
+int radeon_testing = 0;
 int radeon_connector_table = 0;
 #endif
 
@@ -117,6 +118,9 @@ module_param_named(gartsize, radeon_gart_size, int, 0600);
 MODULE_PARM_DESC(benchmark, "Run benchmark");
 module_param_named(benchmark, radeon_benchmarking, int, 0444);
 
+MODULE_PARM_DESC(test, "Run tests");
+module_param_named(test, radeon_testing, int, 0444);
+
 MODULE_PARM_DESC(connector_table, "Force connector table");
 module_param_named(connector_table, radeon_connector_table, int, 0444);
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index c8ef0d14ffab..0a92706eac19 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -154,7 +154,6 @@ void radeon_rmx_mode_fixup(struct drm_encoder *encoder,
 
         if (mode->hdisplay < native_mode->panel_xres ||
             mode->vdisplay < native_mode->panel_yres) {
-                radeon_encoder->flags |= RADEON_USE_RMX;
                 if (ASIC_IS_AVIVO(rdev)) {
                         adjusted_mode->hdisplay = native_mode->panel_xres;
                         adjusted_mode->vdisplay = native_mode->panel_yres;
@@ -197,15 +196,13 @@ void radeon_rmx_mode_fixup(struct drm_encoder *encoder,
         }
 }
 
+
 static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
                                    struct drm_display_mode *mode,
                                    struct drm_display_mode *adjusted_mode)
 {
-
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 
-        radeon_encoder->flags &= ~RADEON_USE_RMX;
-
         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
         if (radeon_encoder->rmx_type != RMX_OFF)
@@ -808,234 +805,6 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
 
 }
 
-static void atom_rv515_force_tv_scaler(struct radeon_device *rdev)
-{
-
-        WREG32(0x659C, 0x0);
-        WREG32(0x6594, 0x705);
-        WREG32(0x65A4, 0x10001);
-        WREG32(0x65D8, 0x0);
-        WREG32(0x65B0, 0x0);
-        WREG32(0x65C0, 0x0);
-        WREG32(0x65D4, 0x0);
-        WREG32(0x6578, 0x0);
-        WREG32(0x657C, 0x841880A8);
-        WREG32(0x6578, 0x1);
-        WREG32(0x657C, 0x84208680);
-        WREG32(0x6578, 0x2);
-        WREG32(0x657C, 0xBFF880B0);
-        WREG32(0x6578, 0x100);
-        WREG32(0x657C, 0x83D88088);
-        WREG32(0x6578, 0x101);
-        WREG32(0x657C, 0x84608680);
-        WREG32(0x6578, 0x102);
-        WREG32(0x657C, 0xBFF080D0);
-        WREG32(0x6578, 0x200);
-        WREG32(0x657C, 0x83988068);
-        WREG32(0x6578, 0x201);
-        WREG32(0x657C, 0x84A08680);
-        WREG32(0x6578, 0x202);
-        WREG32(0x657C, 0xBFF080F8);
-        WREG32(0x6578, 0x300);
-        WREG32(0x657C, 0x83588058);
-        WREG32(0x6578, 0x301);
-        WREG32(0x657C, 0x84E08660);
-        WREG32(0x6578, 0x302);
-        WREG32(0x657C, 0xBFF88120);
-        WREG32(0x6578, 0x400);
-        WREG32(0x657C, 0x83188040);
-        WREG32(0x6578, 0x401);
-        WREG32(0x657C, 0x85008660);
-        WREG32(0x6578, 0x402);
-        WREG32(0x657C, 0xBFF88150);
-        WREG32(0x6578, 0x500);
-        WREG32(0x657C, 0x82D88030);
-        WREG32(0x6578, 0x501);
-        WREG32(0x657C, 0x85408640);
-        WREG32(0x6578, 0x502);
-        WREG32(0x657C, 0xBFF88180);
-        WREG32(0x6578, 0x600);
-        WREG32(0x657C, 0x82A08018);
-        WREG32(0x6578, 0x601);
-        WREG32(0x657C, 0x85808620);
-        WREG32(0x6578, 0x602);
-        WREG32(0x657C, 0xBFF081B8);
-        WREG32(0x6578, 0x700);
-        WREG32(0x657C, 0x82608010);
-        WREG32(0x6578, 0x701);
-        WREG32(0x657C, 0x85A08600);
-        WREG32(0x6578, 0x702);
-        WREG32(0x657C, 0x800081F0);
-        WREG32(0x6578, 0x800);
-        WREG32(0x657C, 0x8228BFF8);
-        WREG32(0x6578, 0x801);
-        WREG32(0x657C, 0x85E085E0);
-        WREG32(0x6578, 0x802);
-        WREG32(0x657C, 0xBFF88228);
-        WREG32(0x6578, 0x10000);
-        WREG32(0x657C, 0x82A8BF00);
-        WREG32(0x6578, 0x10001);
-        WREG32(0x657C, 0x82A08CC0);
-        WREG32(0x6578, 0x10002);
-        WREG32(0x657C, 0x8008BEF8);
-        WREG32(0x6578, 0x10100);
-        WREG32(0x657C, 0x81F0BF28);
-        WREG32(0x6578, 0x10101);
-        WREG32(0x657C, 0x83608CA0);
-        WREG32(0x6578, 0x10102);
-        WREG32(0x657C, 0x8018BED0);
-        WREG32(0x6578, 0x10200);
-        WREG32(0x657C, 0x8148BF38);
-        WREG32(0x6578, 0x10201);
-        WREG32(0x657C, 0x84408C80);
-        WREG32(0x6578, 0x10202);
-        WREG32(0x657C, 0x8008BEB8);
-        WREG32(0x6578, 0x10300);
-        WREG32(0x657C, 0x80B0BF78);
-        WREG32(0x6578, 0x10301);
-        WREG32(0x657C, 0x85008C20);
-        WREG32(0x6578, 0x10302);
-        WREG32(0x657C, 0x8020BEA0);
-        WREG32(0x6578, 0x10400);
-        WREG32(0x657C, 0x8028BF90);
-        WREG32(0x6578, 0x10401);
-        WREG32(0x657C, 0x85E08BC0);
-        WREG32(0x6578, 0x10402);
-        WREG32(0x657C, 0x8018BE90);
-        WREG32(0x6578, 0x10500);
-        WREG32(0x657C, 0xBFB8BFB0);
-        WREG32(0x6578, 0x10501);
-        WREG32(0x657C, 0x86C08B40);
-        WREG32(0x6578, 0x10502);
-        WREG32(0x657C, 0x8010BE90);
-        WREG32(0x6578, 0x10600);
-        WREG32(0x657C, 0xBF58BFC8);
-        WREG32(0x6578, 0x10601);
-        WREG32(0x657C, 0x87A08AA0);
-        WREG32(0x6578, 0x10602);
-        WREG32(0x657C, 0x8010BE98);
-        WREG32(0x6578, 0x10700);
-        WREG32(0x657C, 0xBF10BFF0);
-        WREG32(0x6578, 0x10701);
-        WREG32(0x657C, 0x886089E0);
-        WREG32(0x6578, 0x10702);
-        WREG32(0x657C, 0x8018BEB0);
-        WREG32(0x6578, 0x10800);
-        WREG32(0x657C, 0xBED8BFE8);
-        WREG32(0x6578, 0x10801);
-        WREG32(0x657C, 0x89408940);
-        WREG32(0x6578, 0x10802);
-        WREG32(0x657C, 0xBFE8BED8);
-        WREG32(0x6578, 0x20000);
-        WREG32(0x657C, 0x80008000);
-        WREG32(0x6578, 0x20001);
-        WREG32(0x657C, 0x90008000);
-        WREG32(0x6578, 0x20002);
-        WREG32(0x657C, 0x80008000);
-        WREG32(0x6578, 0x20003);
-        WREG32(0x657C, 0x80008000);
-        WREG32(0x6578, 0x20100);
-        WREG32(0x657C, 0x80108000);
-        WREG32(0x6578, 0x20101);
-        WREG32(0x657C, 0x8FE0BF70);
-        WREG32(0x6578, 0x20102);
-        WREG32(0x657C, 0xBFE880C0);
-        WREG32(0x6578, 0x20103);
-        WREG32(0x657C, 0x80008000);
-        WREG32(0x6578, 0x20200);
-        WREG32(0x657C, 0x8018BFF8);
-        WREG32(0x6578, 0x20201);
-        WREG32(0x657C, 0x8F80BF08);
-        WREG32(0x6578, 0x20202);
-        WREG32(0x657C, 0xBFD081A0);
-        WREG32(0x6578, 0x20203);
-        WREG32(0x657C, 0xBFF88000);
-        WREG32(0x6578, 0x20300);
-        WREG32(0x657C, 0x80188000);
-        WREG32(0x6578, 0x20301);
-        WREG32(0x657C, 0x8EE0BEC0);
-        WREG32(0x6578, 0x20302);
-        WREG32(0x657C, 0xBFB082A0);
-        WREG32(0x6578, 0x20303);
-        WREG32(0x657C, 0x80008000);
-        WREG32(0x6578, 0x20400);
-        WREG32(0x657C, 0x80188000);
-        WREG32(0x6578, 0x20401);
-        WREG32(0x657C, 0x8E00BEA0);
-        WREG32(0x6578, 0x20402);
-        WREG32(0x657C, 0xBF8883C0);
-        WREG32(0x6578, 0x20403);
-        WREG32(0x657C, 0x80008000);
-        WREG32(0x6578, 0x20500);
-        WREG32(0x657C, 0x80188000);
-        WREG32(0x6578, 0x20501);
-        WREG32(0x657C, 0x8D00BE90);
-        WREG32(0x6578, 0x20502);
-        WREG32(0x657C, 0xBF588500);
-        WREG32(0x6578, 0x20503);
-        WREG32(0x657C, 0x80008008);
-        WREG32(0x6578, 0x20600);
-        WREG32(0x657C, 0x80188000);
-        WREG32(0x6578, 0x20601);
-        WREG32(0x657C, 0x8BC0BE98);
-        WREG32(0x6578, 0x20602);
-        WREG32(0x657C, 0xBF308660);
-        WREG32(0x6578, 0x20603);
-        WREG32(0x657C, 0x80008008);
-        WREG32(0x6578, 0x20700);
-        WREG32(0x657C, 0x80108000);
-        WREG32(0x6578, 0x20701);
-        WREG32(0x657C, 0x8A80BEB0);
-        WREG32(0x6578, 0x20702);
-        WREG32(0x657C, 0xBF0087C0);
-        WREG32(0x6578, 0x20703);
-        WREG32(0x657C, 0x80008008);
-        WREG32(0x6578, 0x20800);
-        WREG32(0x657C, 0x80108000);
-        WREG32(0x6578, 0x20801);
-        WREG32(0x657C, 0x8920BED0);
-        WREG32(0x6578, 0x20802);
-        WREG32(0x657C, 0xBED08920);
-        WREG32(0x6578, 0x20803);
-        WREG32(0x657C, 0x80008010);
-        WREG32(0x6578, 0x30000);
-        WREG32(0x657C, 0x90008000);
-        WREG32(0x6578, 0x30001);
-        WREG32(0x657C, 0x80008000);
-        WREG32(0x6578, 0x30100);
-        WREG32(0x657C, 0x8FE0BF90);
-        WREG32(0x6578, 0x30101);
-        WREG32(0x657C, 0xBFF880A0);
-        WREG32(0x6578, 0x30200);
-        WREG32(0x657C, 0x8F60BF40);
-        WREG32(0x6578, 0x30201);
-        WREG32(0x657C, 0xBFE88180);
-        WREG32(0x6578, 0x30300);
-        WREG32(0x657C, 0x8EC0BF00);
-        WREG32(0x6578, 0x30301);
-        WREG32(0x657C, 0xBFC88280);
-        WREG32(0x6578, 0x30400);
-        WREG32(0x657C, 0x8DE0BEE0);
-        WREG32(0x6578, 0x30401);
-        WREG32(0x657C, 0xBFA083A0);
-        WREG32(0x6578, 0x30500);
-        WREG32(0x657C, 0x8CE0BED0);
-        WREG32(0x6578, 0x30501);
-        WREG32(0x657C, 0xBF7884E0);
-        WREG32(0x6578, 0x30600);
-        WREG32(0x657C, 0x8BA0BED8);
-        WREG32(0x6578, 0x30601);
-        WREG32(0x657C, 0xBF508640);
-        WREG32(0x6578, 0x30700);
-        WREG32(0x657C, 0x8A60BEE8);
-        WREG32(0x6578, 0x30701);
-        WREG32(0x657C, 0xBF2087A0);
-        WREG32(0x6578, 0x30800);
-        WREG32(0x657C, 0x8900BF00);
-        WREG32(0x6578, 0x30801);
-        WREG32(0x657C, 0xBF008900);
-}
-
 static void
 atombios_yuv_setup(struct drm_encoder *encoder, bool enable)
 {
@@ -1074,129 +843,6 @@ atombios_yuv_setup(struct drm_encoder *encoder, bool enable)
 }
 
 static void
-atombios_overscan_setup(struct drm_encoder *encoder,
-                        struct drm_display_mode *mode,
-                        struct drm_display_mode *adjusted_mode)
-{
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
-        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-        struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
-        SET_CRTC_OVERSCAN_PS_ALLOCATION args;
-        int index = GetIndexIntoMasterTable(COMMAND, SetCRTC_OverScan);
-
-        memset(&args, 0, sizeof(args));
-
-        args.usOverscanRight = 0;
-        args.usOverscanLeft = 0;
-        args.usOverscanBottom = 0;
-        args.usOverscanTop = 0;
-        args.ucCRTC = radeon_crtc->crtc_id;
-
-        if (radeon_encoder->flags & RADEON_USE_RMX) {
-                if (radeon_encoder->rmx_type == RMX_FULL) {
-                        args.usOverscanRight = 0;
-                        args.usOverscanLeft = 0;
-                        args.usOverscanBottom = 0;
-                        args.usOverscanTop = 0;
-                } else if (radeon_encoder->rmx_type == RMX_CENTER) {
-                        args.usOverscanTop = (adjusted_mode->crtc_vdisplay - mode->crtc_vdisplay) / 2;
-                        args.usOverscanBottom = (adjusted_mode->crtc_vdisplay - mode->crtc_vdisplay) / 2;
-                        args.usOverscanLeft = (adjusted_mode->crtc_hdisplay - mode->crtc_hdisplay) / 2;
-                        args.usOverscanRight = (adjusted_mode->crtc_hdisplay - mode->crtc_hdisplay) / 2;
-                } else if (radeon_encoder->rmx_type == RMX_ASPECT) {
-                        int a1 = mode->crtc_vdisplay * adjusted_mode->crtc_hdisplay;
-                        int a2 = adjusted_mode->crtc_vdisplay * mode->crtc_hdisplay;
-
-                        if (a1 > a2) {
-                                args.usOverscanLeft = (adjusted_mode->crtc_hdisplay - (a2 / mode->crtc_vdisplay)) / 2;
-                                args.usOverscanRight = (adjusted_mode->crtc_hdisplay - (a2 / mode->crtc_vdisplay)) / 2;
-                        } else if (a2 > a1) {
-                                args.usOverscanLeft = (adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2;
-                                args.usOverscanRight = (adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2;
-                        }
-                }
-        }
-
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
-
-}
-
-static void
-atombios_scaler_setup(struct drm_encoder *encoder)
-{
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
-        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-        struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
-        ENABLE_SCALER_PS_ALLOCATION args;
-        int index = GetIndexIntoMasterTable(COMMAND, EnableScaler);
-        /* fixme - fill in enc_priv for atom dac */
-        enum radeon_tv_std tv_std = TV_STD_NTSC;
-
-        if (!ASIC_IS_AVIVO(rdev) && radeon_crtc->crtc_id)
-                return;
-
-        memset(&args, 0, sizeof(args));
-
-        args.ucScaler = radeon_crtc->crtc_id;
-
-        if (radeon_encoder->devices & (ATOM_DEVICE_TV_SUPPORT)) {
-                switch (tv_std) {
-                case TV_STD_NTSC:
-                default:
-                        args.ucTVStandard = ATOM_TV_NTSC;
-                        break;
-                case TV_STD_PAL:
-                        args.ucTVStandard = ATOM_TV_PAL;
-                        break;
-                case TV_STD_PAL_M:
-                        args.ucTVStandard = ATOM_TV_PALM;
-                        break;
-                case TV_STD_PAL_60:
-                        args.ucTVStandard = ATOM_TV_PAL60;
-                        break;
-                case TV_STD_NTSC_J:
-                        args.ucTVStandard = ATOM_TV_NTSCJ;
-                        break;
-                case TV_STD_SCART_PAL:
-                        args.ucTVStandard = ATOM_TV_PAL; /* ??? */
-                        break;
-                case TV_STD_SECAM:
-                        args.ucTVStandard = ATOM_TV_SECAM;
-                        break;
-                case TV_STD_PAL_CN:
-                        args.ucTVStandard = ATOM_TV_PALCN;
-                        break;
-                }
-                args.ucEnable = SCALER_ENABLE_MULTITAP_MODE;
-        } else if (radeon_encoder->devices & (ATOM_DEVICE_CV_SUPPORT)) {
-                args.ucTVStandard = ATOM_TV_CV;
-                args.ucEnable = SCALER_ENABLE_MULTITAP_MODE;
-        } else if (radeon_encoder->flags & RADEON_USE_RMX) {
-                if (radeon_encoder->rmx_type == RMX_FULL)
-                        args.ucEnable = ATOM_SCALER_EXPANSION;
-                else if (radeon_encoder->rmx_type == RMX_CENTER)
-                        args.ucEnable = ATOM_SCALER_CENTER;
-                else if (radeon_encoder->rmx_type == RMX_ASPECT)
-                        args.ucEnable = ATOM_SCALER_EXPANSION;
-        } else {
-                if (ASIC_IS_AVIVO(rdev))
-                        args.ucEnable = ATOM_SCALER_DISABLE;
-                else
-                        args.ucEnable = ATOM_SCALER_CENTER;
-        }
-
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
-
-        if (radeon_encoder->devices & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT)
-            && rdev->family >= CHIP_RV515 && rdev->family <= CHIP_RV570) {
-                atom_rv515_force_tv_scaler(rdev);
-        }
-
-}
-
-static void
 radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
 {
         struct drm_device *dev = encoder->dev;
@@ -1448,8 +1094,6 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         radeon_encoder->pixel_clock = adjusted_mode->clock;
 
         radeon_atombios_encoder_crtc_scratch_regs(encoder, radeon_crtc->crtc_id);
-        atombios_overscan_setup(encoder, mode, adjusted_mode);
-        atombios_scaler_setup(encoder);
         atombios_set_encoder_crtc_source(encoder);
 
         if (ASIC_IS_AVIVO(rdev)) {
@@ -1667,6 +1311,7 @@ radeon_add_atom_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t su
 
         radeon_encoder->encoder_id = encoder_id;
         radeon_encoder->devices = supported_device;
+        radeon_encoder->rmx_type = RMX_OFF;
 
         switch (radeon_encoder->encoder_id) {
         case ENCODER_OBJECT_ID_INTERNAL_LVDS:
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 9e8f191eb64a..3206c0ad7b6c 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -101,9 +101,10 @@ static int radeonfb_setcolreg(unsigned regno,
                                 break;
                         case 24:
                         case 32:
-                                fb->pseudo_palette[regno] = ((red & 0xff00) << 8) |
-                                        (green & 0xff00) |
-                                        ((blue  & 0xff00) >> 8);
+                                fb->pseudo_palette[regno] =
+                                        (((red >> 8) & 0xff) << info->var.red.offset) |
+                                        (((green >> 8) & 0xff) << info->var.green.offset) |
+                                        (((blue >> 8) & 0xff) << info->var.blue.offset);
                                 break;
                         }
                 }
@@ -154,6 +155,7 @@ static int radeonfb_check_var(struct fb_var_screeninfo *var,
                 var->transp.length = 0;
                 var->transp.offset = 0;
                 break;
+#ifdef __LITTLE_ENDIAN
         case 15:
                 var->red.offset = 10;
                 var->green.offset = 5;
@@ -194,6 +196,28 @@ static int radeonfb_check_var(struct fb_var_screeninfo *var,
                 var->transp.length = 8;
                 var->transp.offset = 24;
                 break;
+#else
+        case 24:
+                var->red.offset = 8;
+                var->green.offset = 16;
+                var->blue.offset = 24;
+                var->red.length = 8;
+                var->green.length = 8;
+                var->blue.length = 8;
+                var->transp.length = 0;
+                var->transp.offset = 0;
+                break;
+        case 32:
+                var->red.offset = 8;
+                var->green.offset = 16;
+                var->blue.offset = 24;
+                var->red.length = 8;
+                var->green.length = 8;
+                var->blue.length = 8;
+                var->transp.length = 8;
+                var->transp.offset = 0;
+                break;
+#endif
         default:
                 return -EINVAL;
         }
@@ -447,10 +471,10 @@ static struct notifier_block paniced = {
         .notifier_call = radeonfb_panic,
 };
 
-static int radeon_align_pitch(struct radeon_device *rdev, int width, int bpp)
+static int radeon_align_pitch(struct radeon_device *rdev, int width, int bpp, bool tiled)
 {
         int aligned = width;
-        int align_large = (ASIC_IS_AVIVO(rdev));
+        int align_large = (ASIC_IS_AVIVO(rdev)) || tiled;
         int pitch_mask = 0;
 
         switch (bpp / 8) {
@@ -488,12 +512,13 @@ int radeonfb_create(struct radeon_device *rdev,
         u64 fb_gpuaddr;
         void *fbptr = NULL;
         unsigned long tmp;
+        bool fb_tiled = false; /* useful for testing */
 
         mode_cmd.width = surface_width;
         mode_cmd.height = surface_height;
         mode_cmd.bpp = 32;
         /* need to align pitch with crtc limits */
-        mode_cmd.pitch = radeon_align_pitch(rdev, mode_cmd.width, mode_cmd.bpp) * ((mode_cmd.bpp + 1) / 8);
+        mode_cmd.pitch = radeon_align_pitch(rdev, mode_cmd.width, mode_cmd.bpp, fb_tiled) * ((mode_cmd.bpp + 1) / 8);
         mode_cmd.depth = 24;
 
         size = mode_cmd.pitch * mode_cmd.height;
@@ -511,6 +536,8 @@ int radeonfb_create(struct radeon_device *rdev,
         }
         robj = gobj->driver_private;
 
+        if (fb_tiled)
+                radeon_object_set_tiling_flags(robj, RADEON_TILING_MACRO|RADEON_TILING_SURFACE, mode_cmd.pitch);
         mutex_lock(&rdev->ddev->struct_mutex);
         fb = radeon_framebuffer_create(rdev->ddev, &mode_cmd, gobj);
         if (fb == NULL) {
@@ -539,6 +566,9 @@ int radeonfb_create(struct radeon_device *rdev,
         }
         rfbdev = info->par;
 
+        if (fb_tiled)
+                radeon_object_check_tiling(robj, 0, 0);
+
         ret = radeon_object_kmap(robj, &fbptr);
         if (ret) {
                 goto out_unref;
@@ -572,6 +602,11 @@ int radeonfb_create(struct radeon_device *rdev,
         info->var.width = -1;
         info->var.xres = fb_width;
         info->var.yres = fb_height;
+
+        /* setup aperture base/size for vesafb takeover */
+        info->aperture_base = rdev->ddev->mode_config.fb_base;
+        info->aperture_size = rdev->mc.real_vram_size;
+
         info->fix.mmio_start = 0;
         info->fix.mmio_len = 0;
         info->pixmap.size = 64*1024;
@@ -600,6 +635,7 @@ int radeonfb_create(struct radeon_device *rdev,
                 info->var.transp.offset = 0;
                 info->var.transp.length = 0;
                 break;
+#ifdef __LITTLE_ENDIAN
         case 15:
                 info->var.red.offset = 10;
                 info->var.green.offset = 5;
@@ -639,7 +675,29 @@ int radeonfb_create(struct radeon_device *rdev,
                 info->var.transp.offset = 24;
                 info->var.transp.length = 8;
                 break;
+#else
+        case 24:
+                info->var.red.offset = 8;
+                info->var.green.offset = 16;
+                info->var.blue.offset = 24;
+                info->var.red.length = 8;
+                info->var.green.length = 8;
+                info->var.blue.length = 8;
+                info->var.transp.offset = 0;
+                info->var.transp.length = 0;
+                break;
+        case 32:
+                info->var.red.offset = 8;
+                info->var.green.offset = 16;
+                info->var.blue.offset = 24;
+                info->var.red.length = 8;
+                info->var.green.length = 8;
+                info->var.blue.length = 8;
+                info->var.transp.offset = 0;
+                info->var.transp.length = 8;
+                break;
         default:
+#endif
                 break;
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 96afbf5ae2ad..b4e48dd2e859 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -195,7 +195,7 @@ retry:
                 r = wait_event_interruptible_timeout(rdev->fence_drv.queue,
                                 radeon_fence_signaled(fence), timeout);
                 if (unlikely(r == -ERESTARTSYS)) {
-                        return -ERESTART;
+                        return -EBUSY;
                 }
         } else {
                 r = wait_event_timeout(rdev->fence_drv.queue,
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index d343a15316ec..2977539880fb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -177,7 +177,7 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
                         return -ENOMEM;
                 }
                 rdev->gart.pages[p] = pagelist[i];
-                page_base = (uint32_t)rdev->gart.pages_addr[p];
+                page_base = rdev->gart.pages_addr[p];
                 for (j = 0; j < (PAGE_SIZE / 4096); j++, t++) {
                         radeon_gart_set_page(rdev, t, page_base);
                         page_base += 4096;
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index eb516034235d..cded5180c752 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -157,9 +157,9 @@ int radeon_gem_info_ioctl(struct drm_device *dev, void *data,
         struct radeon_device *rdev = dev->dev_private;
         struct drm_radeon_gem_info *args = data;
 
-        args->vram_size = rdev->mc.vram_size;
+        args->vram_size = rdev->mc.real_vram_size;
         /* FIXME: report somethings that makes sense */
-        args->vram_visible = rdev->mc.vram_size - (4 * 1024 * 1024);
+        args->vram_visible = rdev->mc.real_vram_size - (4 * 1024 * 1024);
         args->gart_size = rdev->mc.gtt_size;
         return 0;
 }
@@ -285,3 +285,44 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
         mutex_unlock(&dev->struct_mutex);
         return r;
 }
+
+int radeon_gem_set_tiling_ioctl(struct drm_device *dev, void *data,
+                                struct drm_file *filp)
+{
+        struct drm_radeon_gem_set_tiling *args = data;
+        struct drm_gem_object *gobj;
+        struct radeon_object *robj;
+        int r = 0;
+
+        DRM_DEBUG("%d \n", args->handle);
+        gobj = drm_gem_object_lookup(dev, filp, args->handle);
+        if (gobj == NULL)
+                return -EINVAL;
+        robj = gobj->driver_private;
+        radeon_object_set_tiling_flags(robj, args->tiling_flags, args->pitch);
+        mutex_lock(&dev->struct_mutex);
+        drm_gem_object_unreference(gobj);
+        mutex_unlock(&dev->struct_mutex);
+        return r;
+}
+
+int radeon_gem_get_tiling_ioctl(struct drm_device *dev, void *data,
+                                struct drm_file *filp)
+{
+        struct drm_radeon_gem_get_tiling *args = data;
+        struct drm_gem_object *gobj;
+        struct radeon_object *robj;
+        int r = 0;
+
+        DRM_DEBUG("\n");
+        gobj = drm_gem_object_lookup(dev, filp, args->handle);
+        if (gobj == NULL)
+                return -EINVAL;
+        robj = gobj->driver_private;
+        radeon_object_get_tiling_flags(robj, &args->tiling_flags,
+                                       &args->pitch);
+        mutex_lock(&dev->struct_mutex);
+        drm_gem_object_unreference(gobj);
+        mutex_unlock(&dev->struct_mutex);
+        return r;
+}
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 4612a7c146d1..937a2f1cdb46 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -291,5 +291,7 @@ struct drm_ioctl_desc radeon_ioctls_kms[] = {
         DRM_IOCTL_DEF(DRM_RADEON_GEM_WAIT_IDLE, radeon_gem_wait_idle_ioctl, DRM_AUTH),
         DRM_IOCTL_DEF(DRM_RADEON_CS, radeon_cs_ioctl, DRM_AUTH),
         DRM_IOCTL_DEF(DRM_RADEON_INFO, radeon_info_ioctl, DRM_AUTH),
+        DRM_IOCTL_DEF(DRM_RADEON_GEM_SET_TILING, radeon_gem_set_tiling_ioctl, DRM_AUTH),
+        DRM_IOCTL_DEF(DRM_RADEON_GEM_GET_TILING, radeon_gem_get_tiling_ioctl, DRM_AUTH),
 };
 int radeon_max_kms_ioctl = DRM_ARRAY_SIZE(radeon_ioctls_kms);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index 8086ecf7f03d..7d06dc98a42a 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -29,6 +29,171 @@
 #include "radeon_fixed.h"
 #include "radeon.h"
 
+static void radeon_legacy_rmx_mode_set(struct drm_crtc *crtc,
+                                       struct drm_display_mode *mode,
+                                       struct drm_display_mode *adjusted_mode)
+{
+        struct drm_device *dev = crtc->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        int xres = mode->hdisplay;
+        int yres = mode->vdisplay;
+        bool hscale = true, vscale = true;
+        int hsync_wid;
+        int vsync_wid;
+        int hsync_start;
+        int blank_width;
+        u32 scale, inc, crtc_more_cntl;
+        u32 fp_horz_stretch, fp_vert_stretch, fp_horz_vert_active;
+        u32 fp_h_sync_strt_wid, fp_crtc_h_total_disp;
+        u32 fp_v_sync_strt_wid, fp_crtc_v_total_disp;
+        struct radeon_native_mode *native_mode = &radeon_crtc->native_mode;
+
+        fp_vert_stretch = RREG32(RADEON_FP_VERT_STRETCH) &
+                (RADEON_VERT_STRETCH_RESERVED |
+                 RADEON_VERT_AUTO_RATIO_INC);
+        fp_horz_stretch = RREG32(RADEON_FP_HORZ_STRETCH) &
+                (RADEON_HORZ_FP_LOOP_STRETCH |
+                 RADEON_HORZ_AUTO_RATIO_INC);
+
+        crtc_more_cntl = 0;
+        if ((rdev->family == CHIP_RS100) ||
+            (rdev->family == CHIP_RS200)) {
+                /* This is to workaround the asic bug for RMX, some versions
+                   of BIOS dosen't have this register initialized correctly. */
+                crtc_more_cntl |= RADEON_CRTC_H_CUTOFF_ACTIVE_EN;
+        }
+
+
+        fp_crtc_h_total_disp = ((((mode->crtc_htotal / 8) - 1) & 0x3ff)
+                                | ((((mode->crtc_hdisplay / 8) - 1) & 0x1ff) << 16));
+
+        hsync_wid = (mode->crtc_hsync_end - mode->crtc_hsync_start) / 8;
+        if (!hsync_wid)
+                hsync_wid = 1;
+        hsync_start = mode->crtc_hsync_start - 8;
+
+        fp_h_sync_strt_wid = ((hsync_start & 0x1fff)
+                              | ((hsync_wid & 0x3f) << 16)
+                              | ((mode->flags & DRM_MODE_FLAG_NHSYNC)
+                                 ? RADEON_CRTC_H_SYNC_POL
+                                 : 0));
+
+        fp_crtc_v_total_disp = (((mode->crtc_vtotal - 1) & 0xffff)
+                                | ((mode->crtc_vdisplay - 1) << 16));
+
+        vsync_wid = mode->crtc_vsync_end - mode->crtc_vsync_start;
+        if (!vsync_wid)
+                vsync_wid = 1;
+
+        fp_v_sync_strt_wid = (((mode->crtc_vsync_start - 1) & 0xfff)
+                              | ((vsync_wid & 0x1f) << 16)
+                              | ((mode->flags & DRM_MODE_FLAG_NVSYNC)
+                                 ? RADEON_CRTC_V_SYNC_POL
+                                 : 0));
+
+        fp_horz_vert_active = 0;
+
+        if (native_mode->panel_xres == 0 ||
+            native_mode->panel_yres == 0) {
+                hscale = false;
+                vscale = false;
+        } else {
+                if (xres > native_mode->panel_xres)
+                        xres = native_mode->panel_xres;
+                if (yres > native_mode->panel_yres)
+                        yres = native_mode->panel_yres;
+
+                if (xres == native_mode->panel_xres)
+                        hscale = false;
+                if (yres == native_mode->panel_yres)
+                        vscale = false;
+        }
+
+        switch (radeon_crtc->rmx_type) {
+        case RMX_FULL:
+        case RMX_ASPECT:
+                if (!hscale)
+                        fp_horz_stretch |= ((xres/8-1) << 16);
+                else {
+                        inc = (fp_horz_stretch & RADEON_HORZ_AUTO_RATIO_INC) ? 1 : 0;
+                        scale = ((xres + inc) * RADEON_HORZ_STRETCH_RATIO_MAX)
+                                / native_mode->panel_xres + 1;
+                        fp_horz_stretch |= (((scale) & RADEON_HORZ_STRETCH_RATIO_MASK) |
+                                        RADEON_HORZ_STRETCH_BLEND |
+                                        RADEON_HORZ_STRETCH_ENABLE |
+                                        ((native_mode->panel_xres/8-1) << 16));
+                }
+
+                if (!vscale)
+                        fp_vert_stretch |= ((yres-1) << 12);
+                else {
+                        inc = (fp_vert_stretch & RADEON_VERT_AUTO_RATIO_INC) ? 1 : 0;
+                        scale = ((yres + inc) * RADEON_VERT_STRETCH_RATIO_MAX)
+                                / native_mode->panel_yres + 1;
+                        fp_vert_stretch |= (((scale) & RADEON_VERT_STRETCH_RATIO_MASK) |
+                                        RADEON_VERT_STRETCH_ENABLE |
+                                        RADEON_VERT_STRETCH_BLEND |
+                                        ((native_mode->panel_yres-1) << 12));
+                }
+                break;
+        case RMX_CENTER:
+                fp_horz_stretch |= ((xres/8-1) << 16);
+                fp_vert_stretch |= ((yres-1) << 12);
+
+                crtc_more_cntl |= (RADEON_CRTC_AUTO_HORZ_CENTER_EN |
+                                RADEON_CRTC_AUTO_VERT_CENTER_EN);
+
+                blank_width = (mode->crtc_hblank_end - mode->crtc_hblank_start) / 8;
+                if (blank_width > 110)
+                        blank_width = 110;
+
+                fp_crtc_h_total_disp = (((blank_width) & 0x3ff)
+                                | ((((mode->crtc_hdisplay / 8) - 1) & 0x1ff) << 16));
+
+                hsync_wid = (mode->crtc_hsync_end - mode->crtc_hsync_start) / 8;
+                if (!hsync_wid)
+                        hsync_wid = 1;
+
+                fp_h_sync_strt_wid = ((((mode->crtc_hsync_start - mode->crtc_hblank_start) / 8) & 0x1fff)
+                                | ((hsync_wid & 0x3f) << 16)
+                                | ((mode->flags & DRM_MODE_FLAG_NHSYNC)
+                                        ? RADEON_CRTC_H_SYNC_POL
+                                        : 0));
+
+                fp_crtc_v_total_disp = (((mode->crtc_vblank_end - mode->crtc_vblank_start) & 0xffff)
+                                | ((mode->crtc_vdisplay - 1) << 16));
+
+                vsync_wid = mode->crtc_vsync_end - mode->crtc_vsync_start;
+                if (!vsync_wid)
+                        vsync_wid = 1;
+
+                fp_v_sync_strt_wid = ((((mode->crtc_vsync_start - mode->crtc_vblank_start) & 0xfff)
+                                        | ((vsync_wid & 0x1f) << 16)
+                                        | ((mode->flags & DRM_MODE_FLAG_NVSYNC)
+                                                ? RADEON_CRTC_V_SYNC_POL
+                                                : 0)));
+
+                fp_horz_vert_active = (((native_mode->panel_yres) & 0xfff) |
+                                (((native_mode->panel_xres / 8) & 0x1ff) << 16));
+                break;
+        case RMX_OFF:
+        default:
+                fp_horz_stretch |= ((xres/8-1) << 16);
+                fp_vert_stretch |= ((yres-1) << 12);
+                break;
+        }
+
+        WREG32(RADEON_FP_HORZ_STRETCH,      fp_horz_stretch);
+        WREG32(RADEON_FP_VERT_STRETCH,      fp_vert_stretch);
+        WREG32(RADEON_CRTC_MORE_CNTL,       crtc_more_cntl);
+        WREG32(RADEON_FP_HORZ_VERT_ACTIVE,  fp_horz_vert_active);
+        WREG32(RADEON_FP_H_SYNC_STRT_WID,   fp_h_sync_strt_wid);
+        WREG32(RADEON_FP_V_SYNC_STRT_WID,   fp_v_sync_strt_wid);
+        WREG32(RADEON_FP_CRTC_H_TOTAL_DISP, fp_crtc_h_total_disp);
+        WREG32(RADEON_FP_CRTC_V_TOTAL_DISP, fp_crtc_v_total_disp);
+}
+
 void radeon_restore_common_regs(struct drm_device *dev)
 {
         /* don't need this yet */
@@ -235,6 +400,7 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
         uint64_t base;
         uint32_t crtc_offset, crtc_offset_cntl, crtc_tile_x0_y0 = 0;
         uint32_t crtc_pitch, pitch_pixels;
+        uint32_t tiling_flags;
 
         DRM_DEBUG("\n");
 
@@ -244,7 +410,12 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
         if (radeon_gem_object_pin(obj, RADEON_GEM_DOMAIN_VRAM, &base)) {
                 return -EINVAL;
         }
-        crtc_offset = (u32)base;
+        /* if scanout was in GTT this really wouldn't work */
+        /* crtc offset is from display base addr not FB location */
+        radeon_crtc->legacy_display_base_addr = rdev->mc.vram_location;
+
+        base -= radeon_crtc->legacy_display_base_addr;
+
         crtc_offset_cntl = 0;
 
         pitch_pixels = crtc->fb->pitch / (crtc->fb->bits_per_pixel / 8);
@@ -253,8 +424,12 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
                        (crtc->fb->bits_per_pixel * 8));
         crtc_pitch |= crtc_pitch << 16;
 
-        /* TODO tiling */
-        if (0) {
+        radeon_object_get_tiling_flags(obj->driver_private,
+                                       &tiling_flags, NULL);
+        if (tiling_flags & RADEON_TILING_MICRO)
+                DRM_ERROR("trying to scanout microtiled buffer\n");
+
+        if (tiling_flags & RADEON_TILING_MACRO) {
                 if (ASIC_IS_R300(rdev))
                         crtc_offset_cntl |= (R300_CRTC_X_Y_MODE_EN |
                                              R300_CRTC_MICRO_TILE_BUFFER_DIS |
@@ -270,15 +445,13 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
                         crtc_offset_cntl &= ~RADEON_CRTC_TILE_EN;
         }
 
-
-        /* TODO more tiling */
-        if (0) {
+        if (tiling_flags & RADEON_TILING_MACRO) {
                 if (ASIC_IS_R300(rdev)) {
                         crtc_tile_x0_y0 = x | (y << 16);
                         base &= ~0x7ff;
                 } else {
                         int byteshift = crtc->fb->bits_per_pixel >> 4;
-                        int tile_addr = (((y >> 3) * crtc->fb->width + x) >> (8 - byteshift)) << 11;
+                        int tile_addr = (((y >> 3) * pitch_pixels +  x) >> (8 - byteshift)) << 11;
                         base += tile_addr + ((x << byteshift) % 256) + ((y % 8) << 8);
                         crtc_offset_cntl |= (y % 16);
                 }
@@ -303,11 +476,9 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 
         base &= ~7;
 
-        /* update sarea TODO */
-
         crtc_offset = (u32)base;
 
-        WREG32(RADEON_DISPLAY_BASE_ADDR + radeon_crtc->crtc_offset, rdev->mc.vram_location);
+        WREG32(RADEON_DISPLAY_BASE_ADDR + radeon_crtc->crtc_offset, radeon_crtc->legacy_display_base_addr);
 
         if (ASIC_IS_R300(rdev)) {
                 if (radeon_crtc->crtc_id)
@@ -751,6 +922,8 @@ static bool radeon_crtc_mode_fixup(struct drm_crtc *crtc,
                                    struct drm_display_mode *mode,
                                    struct drm_display_mode *adjusted_mode)
 {
+        if (!radeon_crtc_scaling_mode_fixup(crtc, mode, adjusted_mode))
+                return false;
         return true;
 }
 
@@ -759,16 +932,25 @@ static int radeon_crtc_mode_set(struct drm_crtc *crtc,
                                  struct drm_display_mode *adjusted_mode,
                                  int x, int y, struct drm_framebuffer *old_fb)
 {
-
-        DRM_DEBUG("\n");
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        struct drm_device *dev = crtc->dev;
+        struct radeon_device *rdev = dev->dev_private;
 
         /* TODO TV */
-
         radeon_crtc_set_base(crtc, x, y, old_fb);
         radeon_set_crtc_timing(crtc, adjusted_mode);
         radeon_set_pll(crtc, adjusted_mode);
-        radeon_init_disp_bandwidth(crtc->dev);
-
+        radeon_bandwidth_update(rdev);
+        if (radeon_crtc->crtc_id == 0) {
+                radeon_legacy_rmx_mode_set(crtc, mode, adjusted_mode);
+        } else {
+                if (radeon_crtc->rmx_type != RMX_OFF) {
+                        /* FIXME: only first crtc has rmx what should we
+                         * do ?
+                         */
+                        DRM_ERROR("Mode need scaling but only first crtc can do that.\n");
+                }
+        }
         return 0;
 }
 
@@ -799,478 +981,3 @@ void radeon_legacy_init_crtc(struct drm_device *dev,
                 radeon_crtc->crtc_offset = RADEON_CRTC2_H_TOTAL_DISP - RADEON_CRTC_H_TOTAL_DISP;
         drm_crtc_helper_add(&radeon_crtc->base, &legacy_helper_funcs);
 }
-
-void radeon_init_disp_bw_legacy(struct drm_device *dev,
-                                struct drm_display_mode *mode1,
-                                uint32_t pixel_bytes1,
-                                struct drm_display_mode *mode2,
-                                uint32_t pixel_bytes2)
-{
-        struct radeon_device *rdev = dev->dev_private;
-        fixed20_12 trcd_ff, trp_ff, tras_ff, trbs_ff, tcas_ff;
-        fixed20_12 sclk_ff, mclk_ff, sclk_eff_ff, sclk_delay_ff;
-        fixed20_12 peak_disp_bw, mem_bw, pix_clk, pix_clk2, temp_ff, crit_point_ff;
-        uint32_t temp, data, mem_trcd, mem_trp, mem_tras;
-        fixed20_12 memtcas_ff[8] = {
-                fixed_init(1),
-                fixed_init(2),
-                fixed_init(3),
-                fixed_init(0),
-                fixed_init_half(1),
-                fixed_init_half(2),
-                fixed_init(0),
-        };
-        fixed20_12 memtcas_rs480_ff[8] = {
-                fixed_init(0),
-                fixed_init(1),
-                fixed_init(2),
-                fixed_init(3),
-                fixed_init(0),
-                fixed_init_half(1),
-                fixed_init_half(2),
-                fixed_init_half(3),
-        };
-        fixed20_12 memtcas2_ff[8] = {
-                fixed_init(0),
-                fixed_init(1),
-                fixed_init(2),
-                fixed_init(3),
-                fixed_init(4),
-                fixed_init(5),
-                fixed_init(6),
-                fixed_init(7),
-        };
-        fixed20_12 memtrbs[8] = {
-                fixed_init(1),
-                fixed_init_half(1),
-                fixed_init(2),
-                fixed_init_half(2),
-                fixed_init(3),
-                fixed_init_half(3),
-                fixed_init(4),
-                fixed_init_half(4)
-        };
-        fixed20_12 memtrbs_r4xx[8] = {
-                fixed_init(4),
-                fixed_init(5),
-                fixed_init(6),
-                fixed_init(7),
-                fixed_init(8),
-                fixed_init(9),
-                fixed_init(10),
-                fixed_init(11)
-        };
-        fixed20_12 min_mem_eff;
-        fixed20_12 mc_latency_sclk, mc_latency_mclk, k1;
-        fixed20_12 cur_latency_mclk, cur_latency_sclk;
-        fixed20_12 disp_latency, disp_latency_overhead, disp_drain_rate,
-                disp_drain_rate2, read_return_rate;
-        fixed20_12 time_disp1_drop_priority;
-        int c;
-        int cur_size = 16;       /* in octawords */
-        int critical_point = 0, critical_point2;
-/*      uint32_t read_return_rate, time_disp1_drop_priority; */
-        int stop_req, max_stop_req;
-
-        min_mem_eff.full = rfixed_const_8(0);
-        /* get modes */
-        if ((rdev->disp_priority == 2) && ASIC_IS_R300(rdev)) {
-                uint32_t mc_init_misc_lat_timer = RREG32(R300_MC_INIT_MISC_LAT_TIMER);
-                mc_init_misc_lat_timer &= ~(R300_MC_DISP1R_INIT_LAT_MASK << R300_MC_DISP1R_INIT_LAT_SHIFT);
-                mc_init_misc_lat_timer &= ~(R300_MC_DISP0R_INIT_LAT_MASK << R300_MC_DISP0R_INIT_LAT_SHIFT);
-                /* check crtc enables */
-                if (mode2)
-                        mc_init_misc_lat_timer |= (1 << R300_MC_DISP1R_INIT_LAT_SHIFT);
-                if (mode1)
-                        mc_init_misc_lat_timer |= (1 << R300_MC_DISP0R_INIT_LAT_SHIFT);
-                WREG32(R300_MC_INIT_MISC_LAT_TIMER, mc_init_misc_lat_timer);
-        }
-
-        /*
-         * determine is there is enough bw for current mode
-         */
-        mclk_ff.full = rfixed_const(rdev->clock.default_mclk);
-        temp_ff.full = rfixed_const(100);
-        mclk_ff.full = rfixed_div(mclk_ff, temp_ff);
-        sclk_ff.full = rfixed_const(rdev->clock.default_sclk);
-        sclk_ff.full = rfixed_div(sclk_ff, temp_ff);
-
-        temp = (rdev->mc.vram_width / 8) * (rdev->mc.vram_is_ddr ? 2 : 1);
-        temp_ff.full = rfixed_const(temp);
-        mem_bw.full = rfixed_mul(mclk_ff, temp_ff);
-
-        pix_clk.full = 0;
-        pix_clk2.full = 0;
-        peak_disp_bw.full = 0;
-        if (mode1) {
-                temp_ff.full = rfixed_const(1000);
-                pix_clk.full = rfixed_const(mode1->clock); /* convert to fixed point */
-                pix_clk.full = rfixed_div(pix_clk, temp_ff);
-                temp_ff.full = rfixed_const(pixel_bytes1);
-                peak_disp_bw.full += rfixed_mul(pix_clk, temp_ff);
-        }
-        if (mode2) {
-                temp_ff.full = rfixed_const(1000);
-                pix_clk2.full = rfixed_const(mode2->clock); /* convert to fixed point */
-                pix_clk2.full = rfixed_div(pix_clk2, temp_ff);
-                temp_ff.full = rfixed_const(pixel_bytes2);
-                peak_disp_bw.full += rfixed_mul(pix_clk2, temp_ff);
-        }
-
-        mem_bw.full = rfixed_mul(mem_bw, min_mem_eff);
-        if (peak_disp_bw.full >= mem_bw.full) {
-                DRM_ERROR("You may not have enough display bandwidth for current mode\n"
-                          "If you have flickering problem, try to lower resolution, refresh rate, or color depth\n");
-        }
-
-        /*  Get values from the EXT_MEM_CNTL register...converting its contents. */
-        temp = RREG32(RADEON_MEM_TIMING_CNTL);
-        if ((rdev->family == CHIP_RV100) || (rdev->flags & RADEON_IS_IGP)) { /* RV100, M6, IGPs */
-                mem_trcd = ((temp >> 2) & 0x3) + 1;
-                mem_trp  = ((temp & 0x3)) + 1;
-                mem_tras = ((temp & 0x70) >> 4) + 1;
-        } else if (rdev->family == CHIP_R300 ||
-                   rdev->family == CHIP_R350) { /* r300, r350 */
-                mem_trcd = (temp & 0x7) + 1;
-                mem_trp = ((temp >> 8) & 0x7) + 1;
-                mem_tras = ((temp >> 11) & 0xf) + 4;
-        } else if (rdev->family == CHIP_RV350 ||
-                   rdev->family <= CHIP_RV380) {
-                /* rv3x0 */
-                mem_trcd = (temp & 0x7) + 3;
-                mem_trp = ((temp >> 8) & 0x7) + 3;
-                mem_tras = ((temp >> 11) & 0xf) + 6;
-        } else if (rdev->family == CHIP_R420 ||
-                   rdev->family == CHIP_R423 ||
-                   rdev->family == CHIP_RV410) {
-                /* r4xx */
-                mem_trcd = (temp & 0xf) + 3;
-                if (mem_trcd > 15)
-                        mem_trcd = 15;
-                mem_trp = ((temp >> 8) & 0xf) + 3;
-                if (mem_trp > 15)
-                        mem_trp = 15;
-                mem_tras = ((temp >> 12) & 0x1f) + 6;
-                if (mem_tras > 31)
-                        mem_tras = 31;
-        } else { /* RV200, R200 */
-                mem_trcd = (temp & 0x7) + 1;
-                mem_trp = ((temp >> 8) & 0x7) + 1;
-                mem_tras = ((temp >> 12) & 0xf) + 4;
-        }
-        /* convert to FF */
-        trcd_ff.full = rfixed_const(mem_trcd);
-        trp_ff.full = rfixed_const(mem_trp);
-        tras_ff.full = rfixed_const(mem_tras);
-
-        /* Get values from the MEM_SDRAM_MODE_REG register...converting its */
-        temp = RREG32(RADEON_MEM_SDRAM_MODE_REG);
-        data = (temp & (7 << 20)) >> 20;
-        if ((rdev->family == CHIP_RV100) || rdev->flags & RADEON_IS_IGP) {
-                if (rdev->family == CHIP_RS480) /* don't think rs400 */
-                        tcas_ff = memtcas_rs480_ff[data];
-                else
-                        tcas_ff = memtcas_ff[data];
-        } else
-                tcas_ff = memtcas2_ff[data];
-
-        if (rdev->family == CHIP_RS400 ||
-            rdev->family == CHIP_RS480) {
-                /* extra cas latency stored in bits 23-25 0-4 clocks */
-                data = (temp >> 23) & 0x7;
-                if (data < 5)
-                        tcas_ff.full += rfixed_const(data);
-        }
-
-        if (ASIC_IS_R300(rdev) && !(rdev->flags & RADEON_IS_IGP)) {
-                /* on the R300, Tcas is included in Trbs.
-                 */
-                temp = RREG32(RADEON_MEM_CNTL);
-                data = (R300_MEM_NUM_CHANNELS_MASK & temp);
-                if (data == 1) {
-                        if (R300_MEM_USE_CD_CH_ONLY & temp) {
-                                temp = RREG32(R300_MC_IND_INDEX);
-                                temp &= ~R300_MC_IND_ADDR_MASK;
-                                temp |= R300_MC_READ_CNTL_CD_mcind;
-                                WREG32(R300_MC_IND_INDEX, temp);
-                                temp = RREG32(R300_MC_IND_DATA);
-                                data = (R300_MEM_RBS_POSITION_C_MASK & temp);
-                        } else {
-                                temp = RREG32(R300_MC_READ_CNTL_AB);
-                                data = (R300_MEM_RBS_POSITION_A_MASK & temp);
-                        }
-                } else {
-                        temp = RREG32(R300_MC_READ_CNTL_AB);
-                        data = (R300_MEM_RBS_POSITION_A_MASK & temp);
-                }
-                if (rdev->family == CHIP_RV410 ||
-                    rdev->family == CHIP_R420 ||
-                    rdev->family == CHIP_R423)
-                        trbs_ff = memtrbs_r4xx[data];
-                else
-                        trbs_ff = memtrbs[data];
-                tcas_ff.full += trbs_ff.full;
-        }
-
-        sclk_eff_ff.full = sclk_ff.full;
-
-        if (rdev->flags & RADEON_IS_AGP) {
-                fixed20_12 agpmode_ff;
-                agpmode_ff.full = rfixed_const(radeon_agpmode);
-                temp_ff.full = rfixed_const_666(16);
-                sclk_eff_ff.full -= rfixed_mul(agpmode_ff, temp_ff);
-        }
-        /* TODO PCIE lanes may affect this - agpmode == 16?? */
-
-        if (ASIC_IS_R300(rdev)) {
-                sclk_delay_ff.full = rfixed_const(250);
-        } else {
-                if ((rdev->family == CHIP_RV100) ||
-                    rdev->flags & RADEON_IS_IGP) {
-                        if (rdev->mc.vram_is_ddr)
-                                sclk_delay_ff.full = rfixed_const(41);
-                        else
-                                sclk_delay_ff.full = rfixed_const(33);
-                } else {
-                        if (rdev->mc.vram_width == 128)
-                                sclk_delay_ff.full = rfixed_const(57);
-                        else
-                                sclk_delay_ff.full = rfixed_const(41);
-                }
-        }
-
-        mc_latency_sclk.full = rfixed_div(sclk_delay_ff, sclk_eff_ff);
-
-        if (rdev->mc.vram_is_ddr) {
-                if (rdev->mc.vram_width == 32) {
-                        k1.full = rfixed_const(40);
-                        c  = 3;
-                } else {
-                        k1.full = rfixed_const(20);
-                        c  = 1;
-                }
-        } else {
-                k1.full = rfixed_const(40);
-                c  = 3;
-        }
-
-        temp_ff.full = rfixed_const(2);
-        mc_latency_mclk.full = rfixed_mul(trcd_ff, temp_ff);
-        temp_ff.full = rfixed_const(c);
-        mc_latency_mclk.full += rfixed_mul(tcas_ff, temp_ff);
-        temp_ff.full = rfixed_const(4);
-        mc_latency_mclk.full += rfixed_mul(tras_ff, temp_ff);
-        mc_latency_mclk.full += rfixed_mul(trp_ff, temp_ff);
-        mc_latency_mclk.full += k1.full;
-
-        mc_latency_mclk.full = rfixed_div(mc_latency_mclk, mclk_ff);
-        mc_latency_mclk.full += rfixed_div(temp_ff, sclk_eff_ff);
-
-        /*
-          HW cursor time assuming worst case of full size colour cursor.
-        */
-        temp_ff.full = rfixed_const((2 * (cur_size - (rdev->mc.vram_is_ddr + 1))));
-        temp_ff.full += trcd_ff.full;
-        if (temp_ff.full < tras_ff.full)
-                temp_ff.full = tras_ff.full;
-        cur_latency_mclk.full = rfixed_div(temp_ff, mclk_ff);
-
-        temp_ff.full = rfixed_const(cur_size);
-        cur_latency_sclk.full = rfixed_div(temp_ff, sclk_eff_ff);
-        /*
-          Find the total latency for the display data.
-        */
-        disp_latency_overhead.full = rfixed_const(80);
-        disp_latency_overhead.full = rfixed_div(disp_latency_overhead, sclk_ff);
-        mc_latency_mclk.full += disp_latency_overhead.full + cur_latency_mclk.full;
-        mc_latency_sclk.full += disp_latency_overhead.full + cur_latency_sclk.full;
-
-        if (mc_latency_mclk.full > mc_latency_sclk.full)
-                disp_latency.full = mc_latency_mclk.full;
-        else
-                disp_latency.full = mc_latency_sclk.full;
-
-        /* setup Max GRPH_STOP_REQ default value */
-        if (ASIC_IS_RV100(rdev))
-                max_stop_req = 0x5c;
-        else
-                max_stop_req = 0x7c;
-
-        if (mode1) {
-                /*  CRTC1
-                    Set GRPH_BUFFER_CNTL register using h/w defined optimal values.
-                    GRPH_STOP_REQ <= MIN[ 0x7C, (CRTC_H_DISP + 1) * (bit depth) / 0x10 ]
-                */
-                stop_req = mode1->hdisplay * pixel_bytes1 / 16;
-
-                if (stop_req > max_stop_req)
-                        stop_req = max_stop_req;
-
-                /*
-                  Find the drain rate of the display buffer.
-                */
-                temp_ff.full = rfixed_const((16/pixel_bytes1));
-                disp_drain_rate.full = rfixed_div(pix_clk, temp_ff);
-
-                /*
-                  Find the critical point of the display buffer.
-                */
-                crit_point_ff.full = rfixed_mul(disp_drain_rate, disp_latency);
-                crit_point_ff.full += rfixed_const_half(0);
-
-                critical_point = rfixed_trunc(crit_point_ff);
-
-                if (rdev->disp_priority == 2) {
-                        critical_point = 0;
-                }
-
-                /*
-                  The critical point should never be above max_stop_req-4.  Setting
-                  GRPH_CRITICAL_CNTL = 0 will thus force high priority all the time.
-                */
-                if (max_stop_req - critical_point < 4)
-                        critical_point = 0;
-
-                if (critical_point == 0 && mode2 && rdev->family == CHIP_R300) {
-                        /* some R300 cards have problem with this set to 0, when CRTC2 is enabled.*/
-                        critical_point = 0x10;
-                }
-
-                temp = RREG32(RADEON_GRPH_BUFFER_CNTL);
-                temp &= ~(RADEON_GRPH_STOP_REQ_MASK);
-                temp |= (stop_req << RADEON_GRPH_STOP_REQ_SHIFT);
-                temp &= ~(RADEON_GRPH_START_REQ_MASK);
-                if ((rdev->family == CHIP_R350) &&
-                    (stop_req > 0x15)) {
-                        stop_req -= 0x10;
-                }
-                temp |= (stop_req << RADEON_GRPH_START_REQ_SHIFT);
-                temp |= RADEON_GRPH_BUFFER_SIZE;
-                temp &= ~(RADEON_GRPH_CRITICAL_CNTL   |
-                          RADEON_GRPH_CRITICAL_AT_SOF |
-                          RADEON_GRPH_STOP_CNTL);
-                /*
-                  Write the result into the register.
-                */
-                WREG32(RADEON_GRPH_BUFFER_CNTL, ((temp & ~RADEON_GRPH_CRITICAL_POINT_MASK) |
-                                                       (critical_point << RADEON_GRPH_CRITICAL_POINT_SHIFT)));
-
-#if 0
-                if ((rdev->family == CHIP_RS400) ||
-                    (rdev->family == CHIP_RS480)) {
-                        /* attempt to program RS400 disp regs correctly ??? */
-                        temp = RREG32(RS400_DISP1_REG_CNTL);
-                        temp &= ~(RS400_DISP1_START_REQ_LEVEL_MASK |
-                                  RS400_DISP1_STOP_REQ_LEVEL_MASK);
-                        WREG32(RS400_DISP1_REQ_CNTL1, (temp |
-                                                       (critical_point << RS400_DISP1_START_REQ_LEVEL_SHIFT) |
-                                                       (critical_point << RS400_DISP1_STOP_REQ_LEVEL_SHIFT)));
-                        temp = RREG32(RS400_DMIF_MEM_CNTL1);
-                        temp &= ~(RS400_DISP1_CRITICAL_POINT_START_MASK |
-                                  RS400_DISP1_CRITICAL_POINT_STOP_MASK);
-                        WREG32(RS400_DMIF_MEM_CNTL1, (temp |
-                                                      (critical_point << RS400_DISP1_CRITICAL_POINT_START_SHIFT) |
-                                                      (critical_point << RS400_DISP1_CRITICAL_POINT_STOP_SHIFT)));
-                }
-#endif
-
-                DRM_DEBUG("GRPH_BUFFER_CNTL from to %x\n",
-                          /*      (unsigned int)info->SavedReg->grph_buffer_cntl, */
-                          (unsigned int)RREG32(RADEON_GRPH_BUFFER_CNTL));
-        }
-
-        if (mode2) {
-                u32 grph2_cntl;
-                stop_req = mode2->hdisplay * pixel_bytes2 / 16;
-
-                if (stop_req > max_stop_req)
-                        stop_req = max_stop_req;
-
-                /*
-                  Find the drain rate of the display buffer.
-                */
-                temp_ff.full = rfixed_const((16/pixel_bytes2));
-                disp_drain_rate2.full = rfixed_div(pix_clk2, temp_ff);
-
-                grph2_cntl = RREG32(RADEON_GRPH2_BUFFER_CNTL);
-                grph2_cntl &= ~(RADEON_GRPH_STOP_REQ_MASK);
-                grph2_cntl |= (stop_req << RADEON_GRPH_STOP_REQ_SHIFT);
-                grph2_cntl &= ~(RADEON_GRPH_START_REQ_MASK);
-                if ((rdev->family == CHIP_R350) &&
-                    (stop_req > 0x15)) {
-                        stop_req -= 0x10;
-                }
-                grph2_cntl |= (stop_req << RADEON_GRPH_START_REQ_SHIFT);
-                grph2_cntl |= RADEON_GRPH_BUFFER_SIZE;
-                grph2_cntl &= ~(RADEON_GRPH_CRITICAL_CNTL   |
-                          RADEON_GRPH_CRITICAL_AT_SOF |
-                          RADEON_GRPH_STOP_CNTL);
-
-                if ((rdev->family == CHIP_RS100) ||
-                    (rdev->family == CHIP_RS200))
-                        critical_point2 = 0;
-                else {
-                        temp = (rdev->mc.vram_width * rdev->mc.vram_is_ddr + 1)/128;
-                        temp_ff.full = rfixed_const(temp);
-                        temp_ff.full = rfixed_mul(mclk_ff, temp_ff);
-                        if (sclk_ff.full < temp_ff.full)
-                                temp_ff.full = sclk_ff.full;
-
-                        read_return_rate.full = temp_ff.full;
-
-                        if (mode1) {
-                                temp_ff.full = read_return_rate.full - disp_drain_rate.full;
-                                time_disp1_drop_priority.full = rfixed_div(crit_point_ff, temp_ff);
-                        } else {
-                                time_disp1_drop_priority.full = 0;
-                        }
-                        crit_point_ff.full = disp_latency.full + time_disp1_drop_priority.full + disp_latency.full;
-                        crit_point_ff.full = rfixed_mul(crit_point_ff, disp_drain_rate2);
-                        crit_point_ff.full += rfixed_const_half(0);
-
-                        critical_point2 = rfixed_trunc(crit_point_ff);
-
-                        if (rdev->disp_priority == 2) {
-                                critical_point2 = 0;
-                        }
-
-                        if (max_stop_req - critical_point2 < 4)
-                                critical_point2 = 0;
-
-                }
-
-                if (critical_point2 == 0 && rdev->family == CHIP_R300) {
-                        /* some R300 cards have problem with this set to 0 */
-                        critical_point2 = 0x10;
-                }
-
-                WREG32(RADEON_GRPH2_BUFFER_CNTL, ((grph2_cntl & ~RADEON_GRPH_CRITICAL_POINT_MASK) |
-                                                  (critical_point2 << RADEON_GRPH_CRITICAL_POINT_SHIFT)));
-
-                if ((rdev->family == CHIP_RS400) ||
-                    (rdev->family == CHIP_RS480)) {
-#if 0
-                        /* attempt to program RS400 disp2 regs correctly ??? */
-                        temp = RREG32(RS400_DISP2_REQ_CNTL1);
-                        temp &= ~(RS400_DISP2_START_REQ_LEVEL_MASK |
-                                  RS400_DISP2_STOP_REQ_LEVEL_MASK);
-                        WREG32(RS400_DISP2_REQ_CNTL1, (temp |
-                                                       (critical_point2 << RS400_DISP1_START_REQ_LEVEL_SHIFT) |
-                                                       (critical_point2 << RS400_DISP1_STOP_REQ_LEVEL_SHIFT)));
-                        temp = RREG32(RS400_DISP2_REQ_CNTL2);
-                        temp &= ~(RS400_DISP2_CRITICAL_POINT_START_MASK |
-                                  RS400_DISP2_CRITICAL_POINT_STOP_MASK);
-                        WREG32(RS400_DISP2_REQ_CNTL2, (temp |
-                                                       (critical_point2 << RS400_DISP2_CRITICAL_POINT_START_SHIFT) |
-                                                       (critical_point2 << RS400_DISP2_CRITICAL_POINT_STOP_SHIFT)));
-#endif
-                        WREG32(RS400_DISP2_REQ_CNTL1, 0x105DC1CC);
-                        WREG32(RS400_DISP2_REQ_CNTL2, 0x2749D000);
-                        WREG32(RS400_DMIF_MEM_CNTL1,  0x29CA71DC);
-                        WREG32(RS400_DISP1_REQ_CNTL1, 0x28FBC3AC);
-                }
-
-                DRM_DEBUG("GRPH2_BUFFER_CNTL from to %x\n",
-                          (unsigned int)RREG32(RADEON_GRPH2_BUFFER_CNTL));
-        }
-}
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 2c2f42de1d4c..34d0f58eb944 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -30,170 +30,6 @@
 #include "atom.h"
 
 
-static void radeon_legacy_rmx_mode_set(struct drm_encoder *encoder,
-                                       struct drm_display_mode *mode,
-                                       struct drm_display_mode *adjusted_mode)
-{
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
-        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-        int    xres = mode->hdisplay;
-        int    yres = mode->vdisplay;
-        bool   hscale = true, vscale = true;
-        int    hsync_wid;
-        int    vsync_wid;
-        int    hsync_start;
-        uint32_t scale, inc;
-        uint32_t fp_horz_stretch, fp_vert_stretch, crtc_more_cntl, fp_horz_vert_active;
-        uint32_t fp_h_sync_strt_wid, fp_v_sync_strt_wid, fp_crtc_h_total_disp, fp_crtc_v_total_disp;
-        struct radeon_native_mode *native_mode = &radeon_encoder->native_mode;
-
-        DRM_DEBUG("\n");
-
-        fp_vert_stretch = RREG32(RADEON_FP_VERT_STRETCH) &
-                (RADEON_VERT_STRETCH_RESERVED |
-                 RADEON_VERT_AUTO_RATIO_INC);
-        fp_horz_stretch = RREG32(RADEON_FP_HORZ_STRETCH) &
-                (RADEON_HORZ_FP_LOOP_STRETCH |
-                 RADEON_HORZ_AUTO_RATIO_INC);
-
-        crtc_more_cntl = 0;
-        if ((rdev->family == CHIP_RS100) ||
-            (rdev->family == CHIP_RS200)) {
-                /* This is to workaround the asic bug for RMX, some versions
-                   of BIOS dosen't have this register initialized correctly. */
-                crtc_more_cntl |= RADEON_CRTC_H_CUTOFF_ACTIVE_EN;
-        }
-
-
-        fp_crtc_h_total_disp = ((((mode->crtc_htotal / 8) - 1) & 0x3ff)
-                                | ((((mode->crtc_hdisplay / 8) - 1) & 0x1ff) << 16));
-
-        hsync_wid = (mode->crtc_hsync_end - mode->crtc_hsync_start) / 8;
-        if (!hsync_wid)
-                hsync_wid = 1;
-        hsync_start = mode->crtc_hsync_start - 8;
-
-        fp_h_sync_strt_wid = ((hsync_start & 0x1fff)
-                              | ((hsync_wid & 0x3f) << 16)
-                              | ((mode->flags & DRM_MODE_FLAG_NHSYNC)
-                                 ? RADEON_CRTC_H_SYNC_POL
-                                 : 0));
-
-        fp_crtc_v_total_disp = (((mode->crtc_vtotal - 1) & 0xffff)
-                                | ((mode->crtc_vdisplay - 1) << 16));
-
-        vsync_wid = mode->crtc_vsync_end - mode->crtc_vsync_start;
-        if (!vsync_wid)
-                vsync_wid = 1;
-
-        fp_v_sync_strt_wid = (((mode->crtc_vsync_start - 1) & 0xfff)
-                              | ((vsync_wid & 0x1f) << 16)
-                              | ((mode->flags & DRM_MODE_FLAG_NVSYNC)
-                                 ? RADEON_CRTC_V_SYNC_POL
-                                 : 0));
-
-        fp_horz_vert_active = 0;
-
-        if (native_mode->panel_xres == 0 ||
-            native_mode->panel_yres == 0) {
-                hscale = false;
-                vscale = false;
-        } else {
-                if (xres > native_mode->panel_xres)
-                        xres = native_mode->panel_xres;
-                if (yres > native_mode->panel_yres)
-                        yres = native_mode->panel_yres;
-
-                if (xres == native_mode->panel_xres)
-                        hscale = false;
-                if (yres == native_mode->panel_yres)
-                        vscale = false;
-        }
-
-        if (radeon_encoder->flags & RADEON_USE_RMX) {
-                if (radeon_encoder->rmx_type != RMX_CENTER) {
-                        if (!hscale)
-                                fp_horz_stretch |= ((xres/8-1) << 16);
-                        else {
-                                inc = (fp_horz_stretch & RADEON_HORZ_AUTO_RATIO_INC) ? 1 : 0;
-                                scale = ((xres + inc) * RADEON_HORZ_STRETCH_RATIO_MAX)
-                                        / native_mode->panel_xres + 1;
-                                fp_horz_stretch |= (((scale) & RADEON_HORZ_STRETCH_RATIO_MASK) |
-                                                    RADEON_HORZ_STRETCH_BLEND |
-                                                    RADEON_HORZ_STRETCH_ENABLE |
-                                                    ((native_mode->panel_xres/8-1) << 16));
-                        }
-
-                        if (!vscale)
-                                fp_vert_stretch |= ((yres-1) << 12);
-                        else {
-                                inc = (fp_vert_stretch & RADEON_VERT_AUTO_RATIO_INC) ? 1 : 0;
-                                scale = ((yres + inc) * RADEON_VERT_STRETCH_RATIO_MAX)
-                                        / native_mode->panel_yres + 1;
-                                fp_vert_stretch |= (((scale) & RADEON_VERT_STRETCH_RATIO_MASK) |
-                                                    RADEON_VERT_STRETCH_ENABLE |
-                                                    RADEON_VERT_STRETCH_BLEND |
-                                                    ((native_mode->panel_yres-1) << 12));
-                        }
-                } else if (radeon_encoder->rmx_type == RMX_CENTER) {
-                        int    blank_width;
-
-                        fp_horz_stretch |= ((xres/8-1) << 16);
-                        fp_vert_stretch |= ((yres-1) << 12);
-
-                        crtc_more_cntl |= (RADEON_CRTC_AUTO_HORZ_CENTER_EN |
-                                           RADEON_CRTC_AUTO_VERT_CENTER_EN);
-
-                        blank_width = (mode->crtc_hblank_end - mode->crtc_hblank_start) / 8;
-                        if (blank_width > 110)
-                                blank_width = 110;
-
-                        fp_crtc_h_total_disp = (((blank_width) & 0x3ff)
-                                                | ((((mode->crtc_hdisplay / 8) - 1) & 0x1ff) << 16));
-
-                        hsync_wid = (mode->crtc_hsync_end - mode->crtc_hsync_start) / 8;
-                        if (!hsync_wid)
-                                hsync_wid = 1;
-
-                        fp_h_sync_strt_wid = ((((mode->crtc_hsync_start - mode->crtc_hblank_start) / 8) & 0x1fff)
-                                              | ((hsync_wid & 0x3f) << 16)
-                                              | ((mode->flags & DRM_MODE_FLAG_NHSYNC)
-                                                 ? RADEON_CRTC_H_SYNC_POL
-                                                 : 0));
-
-                        fp_crtc_v_total_disp = (((mode->crtc_vblank_end - mode->crtc_vblank_start) & 0xffff)
-                                                | ((mode->crtc_vdisplay - 1) << 16));
-
-                        vsync_wid = mode->crtc_vsync_end - mode->crtc_vsync_start;
-                        if (!vsync_wid)
-                                vsync_wid = 1;
-
-                        fp_v_sync_strt_wid = ((((mode->crtc_vsync_start - mode->crtc_vblank_start) & 0xfff)
-                                               | ((vsync_wid & 0x1f) << 16)
-                                               | ((mode->flags & DRM_MODE_FLAG_NVSYNC)
-                                                  ? RADEON_CRTC_V_SYNC_POL
-                                                  : 0)));
-
-                        fp_horz_vert_active = (((native_mode->panel_yres) & 0xfff) |
-                                               (((native_mode->panel_xres / 8) & 0x1ff) << 16));
-                }
-        } else {
-                fp_horz_stretch |= ((xres/8-1) << 16);
-                fp_vert_stretch |= ((yres-1) << 12);
-        }
-
-        WREG32(RADEON_FP_HORZ_STRETCH,      fp_horz_stretch);
-        WREG32(RADEON_FP_VERT_STRETCH,      fp_vert_stretch);
-        WREG32(RADEON_CRTC_MORE_CNTL,       crtc_more_cntl);
-        WREG32(RADEON_FP_HORZ_VERT_ACTIVE,  fp_horz_vert_active);
-        WREG32(RADEON_FP_H_SYNC_STRT_WID,   fp_h_sync_strt_wid);
-        WREG32(RADEON_FP_V_SYNC_STRT_WID,   fp_v_sync_strt_wid);
-        WREG32(RADEON_FP_CRTC_H_TOTAL_DISP, fp_crtc_h_total_disp);
-        WREG32(RADEON_FP_CRTC_V_TOTAL_DISP, fp_crtc_v_total_disp);
-
-}
-
 static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
 {
         struct drm_device *dev = encoder->dev;
@@ -287,9 +123,6 @@ static void radeon_legacy_lvds_mode_set(struct drm_encoder *encoder,
 
         DRM_DEBUG("\n");
 
-        if (radeon_crtc->crtc_id == 0)
-                radeon_legacy_rmx_mode_set(encoder, mode, adjusted_mode);
-
         lvds_pll_cntl = RREG32(RADEON_LVDS_PLL_CNTL);
         lvds_pll_cntl &= ~RADEON_LVDS_PLL_EN;
 
@@ -318,7 +151,7 @@ static void radeon_legacy_lvds_mode_set(struct drm_encoder *encoder,
 
         if (radeon_crtc->crtc_id == 0) {
                 if (ASIC_IS_R300(rdev)) {
-                        if (radeon_encoder->flags & RADEON_USE_RMX)
+                        if (radeon_encoder->rmx_type != RMX_OFF)
                                 lvds_pll_cntl |= R300_LVDS_SRC_SEL_RMX;
                 } else
                         lvds_gen_cntl &= ~RADEON_LVDS_SEL_CRTC2;
@@ -350,8 +183,6 @@ static bool radeon_legacy_lvds_mode_fixup(struct drm_encoder *encoder,
 
         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
-        radeon_encoder->flags &= ~RADEON_USE_RMX;
-
         if (radeon_encoder->rmx_type != RMX_OFF)
                 radeon_rmx_mode_fixup(encoder, mode, adjusted_mode);
 
@@ -455,9 +286,6 @@ static void radeon_legacy_primary_dac_mode_set(struct drm_encoder *encoder,
 
         DRM_DEBUG("\n");
 
-        if (radeon_crtc->crtc_id == 0)
-                radeon_legacy_rmx_mode_set(encoder, mode, adjusted_mode);
-
         if (radeon_crtc->crtc_id == 0) {
                 if (rdev->family == CHIP_R200 || ASIC_IS_R300(rdev)) {
                         disp_output_cntl = RREG32(RADEON_DISP_OUTPUT_CNTL) &
@@ -653,9 +481,6 @@ static void radeon_legacy_tmds_int_mode_set(struct drm_encoder *encoder,
 
         DRM_DEBUG("\n");
 
-        if (radeon_crtc->crtc_id == 0)
-                radeon_legacy_rmx_mode_set(encoder, mode, adjusted_mode);
-
         tmp = tmds_pll_cntl = RREG32(RADEON_TMDS_PLL_CNTL);
         tmp &= 0xfffff;
         if (rdev->family == CHIP_RV280) {
@@ -711,7 +536,7 @@ static void radeon_legacy_tmds_int_mode_set(struct drm_encoder *encoder,
     if (radeon_crtc->crtc_id == 0) {
             if (ASIC_IS_R300(rdev) || rdev->family == CHIP_R200) {
                     fp_gen_cntl &= ~R200_FP_SOURCE_SEL_MASK;
-                    if (radeon_encoder->flags & RADEON_USE_RMX)
+                    if (radeon_encoder->rmx_type != RMX_OFF)
                             fp_gen_cntl |= R200_FP_SOURCE_SEL_RMX;
                     else
                             fp_gen_cntl |= R200_FP_SOURCE_SEL_CRTC1;
@@ -820,9 +645,6 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder,
 
         DRM_DEBUG("\n");
 
-        if (radeon_crtc->crtc_id == 0)
-                radeon_legacy_rmx_mode_set(encoder, mode, adjusted_mode);
-
         if (rdev->is_atom_bios) {
                 radeon_encoder->pixel_clock = adjusted_mode->clock;
                 atombios_external_tmds_setup(encoder, ATOM_ENABLE);
@@ -856,7 +678,7 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder,
         if (radeon_crtc->crtc_id == 0) {
                 if ((rdev->family == CHIP_R200) || ASIC_IS_R300(rdev)) {
                         fp2_gen_cntl &= ~R200_FP2_SOURCE_SEL_MASK;
-                        if (radeon_encoder->flags & RADEON_USE_RMX)
+                        if (radeon_encoder->rmx_type != RMX_OFF)
                                 fp2_gen_cntl |= R200_FP2_SOURCE_SEL_RMX;
                         else
                                 fp2_gen_cntl |= R200_FP2_SOURCE_SEL_CRTC1;
@@ -1014,9 +836,6 @@ static void radeon_legacy_tv_dac_mode_set(struct drm_encoder *encoder,
 
         DRM_DEBUG("\n");
 
-        if (radeon_crtc->crtc_id == 0)
-                radeon_legacy_rmx_mode_set(encoder, mode, adjusted_mode);
-
         if (rdev->family != CHIP_R200) {
                 tv_dac_cntl = RREG32(RADEON_TV_DAC_CNTL);
                 if (rdev->family == CHIP_R420 ||
@@ -1243,6 +1062,7 @@ radeon_add_legacy_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t
 
         radeon_encoder->encoder_id = encoder_id;
         radeon_encoder->devices = supported_device;
+        radeon_encoder->rmx_type = RMX_OFF;
 
         switch (radeon_encoder->encoder_id) {
         case ENCODER_OBJECT_ID_INTERNAL_LVDS:
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 9173b687462b..3b09a1f2d8f9 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -36,6 +36,9 @@
 #include <linux/i2c.h>
 #include <linux/i2c-id.h>
 #include <linux/i2c-algo-bit.h>
+#include "radeon_fixed.h"
+
+struct radeon_device;
 
 #define to_radeon_crtc(x) container_of(x, struct radeon_crtc, base)
 #define to_radeon_connector(x) container_of(x, struct radeon_connector, base)
@@ -124,6 +127,7 @@ struct radeon_tmds_pll {
 #define RADEON_PLL_PREFER_LOW_POST_DIV  (1 << 8)
 #define RADEON_PLL_PREFER_HIGH_POST_DIV (1 << 9)
 #define RADEON_PLL_USE_FRAC_FB_DIV      (1 << 10)
+#define RADEON_PLL_PREFER_CLOSEST_LOWER (1 << 11)
 
 struct radeon_pll {
         uint16_t reference_freq;
@@ -170,6 +174,18 @@ struct radeon_mode_info {
         struct atom_context *atom_context;
         enum radeon_connector_table connector_table;
         bool mode_config_initialized;
+        struct radeon_crtc *crtcs[2];
+};
+
+struct radeon_native_mode {
+        /* preferred mode */
+        uint32_t panel_xres, panel_yres;
+        uint32_t hoverplus, hsync_width;
+        uint32_t hblank;
+        uint32_t voverplus, vsync_width;
+        uint32_t vblank;
+        uint32_t dotclock;
+        uint32_t flags;
 };
 
 struct radeon_crtc {
@@ -185,19 +201,13 @@ struct radeon_crtc {
         uint64_t cursor_addr;
         int cursor_width;
         int cursor_height;
-};
-
-#define RADEON_USE_RMX 1
-
-struct radeon_native_mode {
-        /* preferred mode */
-        uint32_t panel_xres, panel_yres;
-        uint32_t hoverplus, hsync_width;
-        uint32_t hblank;
-        uint32_t voverplus, vsync_width;
-        uint32_t vblank;
-        uint32_t dotclock;
-        uint32_t flags;
+        uint32_t legacy_display_base_addr;
+        uint32_t legacy_cursor_offset;
+        enum radeon_rmx_type rmx_type;
+        uint32_t devices;
+        fixed20_12 vsc;
+        fixed20_12 hsc;
+        struct radeon_native_mode native_mode;
 };
 
 struct radeon_encoder_primary_dac {
@@ -383,16 +393,9 @@ void radeon_enc_destroy(struct drm_encoder *encoder);
 void radeon_copy_fb(struct drm_device *dev, struct drm_gem_object *dst_obj);
 void radeon_combios_asic_init(struct drm_device *dev);
 extern int radeon_static_clocks_init(struct drm_device *dev);
-void radeon_init_disp_bw_legacy(struct drm_device *dev,
-                                struct drm_display_mode *mode1,
-                                uint32_t pixel_bytes1,
-                                struct drm_display_mode *mode2,
-                                uint32_t pixel_bytes2);
-void radeon_init_disp_bw_avivo(struct drm_device *dev,
-                               struct drm_display_mode *mode1,
-                               uint32_t pixel_bytes1,
-                               struct drm_display_mode *mode2,
-                               uint32_t pixel_bytes2);
-void radeon_init_disp_bandwidth(struct drm_device *dev);
+bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
+                                        struct drm_display_mode *mode,
+                                        struct drm_display_mode *adjusted_mode);
+void atom_rv515_force_tv_scaler(struct radeon_device *rdev);
 
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index bac0d06c52ac..dd9ac2fed6d6 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -44,6 +44,9 @@ struct radeon_object {
         uint64_t                        gpu_addr;
         void                            *kptr;
         bool                            is_iomem;
+        uint32_t                        tiling_flags;
+        uint32_t                        pitch;
+        int                             surface_reg;
 };
 
 int radeon_ttm_init(struct radeon_device *rdev);
@@ -70,6 +73,7 @@ static void radeon_ttm_object_object_destroy(struct ttm_buffer_object *tobj)
 
         robj = container_of(tobj, struct radeon_object, tobj);
         list_del_init(&robj->list);
+        radeon_object_clear_surface_reg(robj);
         kfree(robj);
 }
 
@@ -99,16 +103,16 @@ static inline uint32_t radeon_object_flags_from_domain(uint32_t domain)
 {
         uint32_t flags = 0;
         if (domain & RADEON_GEM_DOMAIN_VRAM) {
-                flags |= TTM_PL_FLAG_VRAM;
+                flags |= TTM_PL_FLAG_VRAM | TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED;
         }
         if (domain & RADEON_GEM_DOMAIN_GTT) {
-                flags |= TTM_PL_FLAG_TT;
+                flags |= TTM_PL_FLAG_TT | TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED;
         }
         if (domain & RADEON_GEM_DOMAIN_CPU) {
-                flags |= TTM_PL_FLAG_SYSTEM;
+                flags |= TTM_PL_FLAG_SYSTEM | TTM_PL_MASK_CACHING;
         }
         if (!flags) {
-                flags |= TTM_PL_FLAG_SYSTEM;
+                flags |= TTM_PL_FLAG_SYSTEM | TTM_PL_MASK_CACHING;
         }
         return flags;
 }
@@ -141,6 +145,7 @@ int radeon_object_create(struct radeon_device *rdev,
         }
         robj->rdev = rdev;
         robj->gobj = gobj;
+        robj->surface_reg = -1;
         INIT_LIST_HEAD(&robj->list);
 
         flags = radeon_object_flags_from_domain(domain);
@@ -304,7 +309,7 @@ int radeon_object_wait(struct radeon_object *robj)
         }
         spin_lock(&robj->tobj.lock);
         if (robj->tobj.sync_obj) {
-                r = ttm_bo_wait(&robj->tobj, true, false, false);
+                r = ttm_bo_wait(&robj->tobj, true, true, false);
         }
         spin_unlock(&robj->tobj.lock);
         radeon_object_unreserve(robj);
@@ -403,7 +408,6 @@ int radeon_object_list_validate(struct list_head *head, void *fence)
         struct radeon_object *robj;
         struct radeon_fence *old_fence = NULL;
         struct list_head *i;
-        uint32_t flags;
         int r;
 
         r = radeon_object_list_reserve(head);
@@ -414,27 +418,25 @@ int radeon_object_list_validate(struct list_head *head, void *fence)
         list_for_each(i, head) {
                 lobj = list_entry(i, struct radeon_object_list, list);
                 robj = lobj->robj;
-                if (lobj->wdomain) {
-                        flags = radeon_object_flags_from_domain(lobj->wdomain);
-                        flags |= TTM_PL_FLAG_TT;
-                } else {
-                        flags = radeon_object_flags_from_domain(lobj->rdomain);
-                        flags |= TTM_PL_FLAG_TT;
-                        flags |= TTM_PL_FLAG_VRAM;
-                }
                 if (!robj->pin_count) {
-                        robj->tobj.proposed_placement = flags | TTM_PL_MASK_CACHING;
+                        if (lobj->wdomain) {
+                                robj->tobj.proposed_placement =
+                                        radeon_object_flags_from_domain(lobj->wdomain);
+                        } else {
+                                robj->tobj.proposed_placement =
+                                        radeon_object_flags_from_domain(lobj->rdomain);
+                        }
                         r = ttm_buffer_object_validate(&robj->tobj,
                                                        robj->tobj.proposed_placement,
                                                        true, false);
                         if (unlikely(r)) {
-                                radeon_object_list_unreserve(head);
                                 DRM_ERROR("radeon: failed to validate.\n");
                                 return r;
                         }
                         radeon_object_gpu_addr(robj);
                 }
                 lobj->gpu_offset = robj->gpu_addr;
+                lobj->tiling_flags = robj->tiling_flags;
                 if (fence) {
                         old_fence = (struct radeon_fence *)robj->tobj.sync_obj;
                         robj->tobj.sync_obj = radeon_fence_ref(fence);
@@ -479,3 +481,127 @@ unsigned long radeon_object_size(struct radeon_object *robj)
 {
         return robj->tobj.num_pages << PAGE_SHIFT;
 }
+
+int radeon_object_get_surface_reg(struct radeon_object *robj)
+{
+        struct radeon_device *rdev = robj->rdev;
+        struct radeon_surface_reg *reg;
+        struct radeon_object *old_object;
+        int steal;
+        int i;
+
+        if (!robj->tiling_flags)
+                return 0;
+
+        if (robj->surface_reg >= 0) {
+                reg = &rdev->surface_regs[robj->surface_reg];
+                i = robj->surface_reg;
+                goto out;
+        }
+
+        steal = -1;
+        for (i = 0; i < RADEON_GEM_MAX_SURFACES; i++) {
+
+                reg = &rdev->surface_regs[i];
+                if (!reg->robj)
+                        break;
+
+                old_object = reg->robj;
+                if (old_object->pin_count == 0)
+                        steal = i;
+        }
+
+        /* if we are all out */
+        if (i == RADEON_GEM_MAX_SURFACES) {
+                if (steal == -1)
+                        return -ENOMEM;
+                /* find someone with a surface reg and nuke their BO */
+                reg = &rdev->surface_regs[steal];
+                old_object = reg->robj;
+                /* blow away the mapping */
+                DRM_DEBUG("stealing surface reg %d from %p\n", steal, old_object);
+                ttm_bo_unmap_virtual(&old_object->tobj);
+                old_object->surface_reg = -1;
+                i = steal;
+        }
+
+        robj->surface_reg = i;
+        reg->robj = robj;
+
+out:
+        radeon_set_surface_reg(rdev, i, robj->tiling_flags, robj->pitch,
+                               robj->tobj.mem.mm_node->start << PAGE_SHIFT,
+                               robj->tobj.num_pages << PAGE_SHIFT);
+        return 0;
+}
+
+void radeon_object_clear_surface_reg(struct radeon_object *robj)
+{
+        struct radeon_device *rdev = robj->rdev;
+        struct radeon_surface_reg *reg;
+
+        if (robj->surface_reg == -1)
+                return;
+
+        reg = &rdev->surface_regs[robj->surface_reg];
+        radeon_clear_surface_reg(rdev, robj->surface_reg);
+
+        reg->robj = NULL;
+        robj->surface_reg = -1;
+}
+
+void radeon_object_set_tiling_flags(struct radeon_object *robj,
+                                    uint32_t tiling_flags, uint32_t pitch)
+{
+        robj->tiling_flags = tiling_flags;
+        robj->pitch = pitch;
+}
+
+void radeon_object_get_tiling_flags(struct radeon_object *robj,
+                                    uint32_t *tiling_flags,
+                                    uint32_t *pitch)
+{
+        if (tiling_flags)
+                *tiling_flags = robj->tiling_flags;
+        if (pitch)
+                *pitch = robj->pitch;
+}
+
+int radeon_object_check_tiling(struct radeon_object *robj, bool has_moved,
+                               bool force_drop)
+{
+        if (!(robj->tiling_flags & RADEON_TILING_SURFACE))
+                return 0;
+
+        if (force_drop) {
+                radeon_object_clear_surface_reg(robj);
+                return 0;
+        }
+
+        if (robj->tobj.mem.mem_type != TTM_PL_VRAM) {
+                if (!has_moved)
+                        return 0;
+
+                if (robj->surface_reg >= 0)
+                        radeon_object_clear_surface_reg(robj);
+                return 0;
+        }
+
+        if ((robj->surface_reg >= 0) && !has_moved)
+                return 0;
+
+        return radeon_object_get_surface_reg(robj);
+}
+
+void radeon_bo_move_notify(struct ttm_buffer_object *bo,
+                          struct ttm_mem_reg *mem)
+{
+        struct radeon_object *robj = container_of(bo, struct radeon_object, tobj);
+        radeon_object_check_tiling(robj, 0, 1);
+}
+
+void radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo)
+{
+        struct radeon_object *robj = container_of(bo, struct radeon_object, tobj);
+        radeon_object_check_tiling(robj, 0, 0);
+}
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index a853261d1881..60d159308b88 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -126,32 +126,19 @@ static void radeon_ib_align(struct radeon_device *rdev, struct radeon_ib *ib)
         }
 }
 
-static void radeon_ib_cpu_flush(struct radeon_device *rdev,
-                                struct radeon_ib *ib)
-{
-        unsigned long tmp;
-        unsigned i;
-
-        /* To force CPU cache flush ugly but seems reliable */
-        for (i = 0; i < ib->length_dw; i += (rdev->cp.align_mask + 1)) {
-                tmp = readl(&ib->ptr[i]);
-        }
-}
-
 int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib)
 {
         int r = 0;
 
         mutex_lock(&rdev->ib_pool.mutex);
         radeon_ib_align(rdev, ib);
-        radeon_ib_cpu_flush(rdev, ib);
         if (!ib->length_dw || !rdev->cp.ready) {
                 /* TODO: Nothings in the ib we should report. */
                 mutex_unlock(&rdev->ib_pool.mutex);
                 DRM_ERROR("radeon: couldn't schedule IB(%lu).\n", ib->idx);
                 return -EINVAL;
         }
-        /* 64 dwords should be enought for fence too */
+        /* 64 dwords should be enough for fence too */
         r = radeon_ring_lock(rdev, 64);
         if (r) {
                 DRM_ERROR("radeon: scheduling IB failled (%d).\n", r);
diff --git a/drivers/gpu/drm/radeon/radeon_share.h b/drivers/gpu/drm/radeon/radeon_share.h
new file mode 100644
index 000000000000..63a773578f17
--- /dev/null
+++ b/drivers/gpu/drm/radeon/radeon_share.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2008 Advanced Micro Devices, Inc.
+ * Copyright 2008 Red Hat Inc.
+ * Copyright 2009 Jerome Glisse.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Dave Airlie
+ *          Alex Deucher
+ *          Jerome Glisse
+ */
+#ifndef __RADEON_SHARE_H__
+#define __RADEON_SHARE_H__
+
+void r100_vram_init_sizes(struct radeon_device *rdev);
+
+void rs690_line_buffer_adjust(struct radeon_device *rdev,
+                              struct drm_display_mode *mode1,
+                              struct drm_display_mode *mode2);
+
+void rv515_bandwidth_avivo_update(struct radeon_device *rdev);
+
+#endif
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
new file mode 100644
index 000000000000..03c33cf4e14c
--- /dev/null
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -0,0 +1,209 @@
+/*
+ * Copyright 2009 VMware, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Michel Dänzer
+ */
+#include <drm/drmP.h>
+#include <drm/radeon_drm.h>
+#include "radeon_reg.h"
+#include "radeon.h"
+
+
+/* Test BO GTT->VRAM and VRAM->GTT GPU copies across the whole GTT aperture */
+void radeon_test_moves(struct radeon_device *rdev)
+{
+        struct radeon_object *vram_obj = NULL;
+        struct radeon_object **gtt_obj = NULL;
+        struct radeon_fence *fence = NULL;
+        uint64_t gtt_addr, vram_addr;
+        unsigned i, n, size;
+        int r;
+
+        size = 1024 * 1024;
+
+        /* Number of tests =
+         * (Total GTT - IB pool - writeback page - ring buffer) / test size
+         */
+        n = (rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - 4096 -
+             rdev->cp.ring_size) / size;
+
+        gtt_obj = kzalloc(n * sizeof(*gtt_obj), GFP_KERNEL);
+        if (!gtt_obj) {
+                DRM_ERROR("Failed to allocate %d pointers\n", n);
+                r = 1;
+                goto out_cleanup;
+        }
+
+        r = radeon_object_create(rdev, NULL, size, true, RADEON_GEM_DOMAIN_VRAM,
+                                 false, &vram_obj);
+        if (r) {
+                DRM_ERROR("Failed to create VRAM object\n");
+                goto out_cleanup;
+        }
+
+        r = radeon_object_pin(vram_obj, RADEON_GEM_DOMAIN_VRAM, &vram_addr);
+        if (r) {
+                DRM_ERROR("Failed to pin VRAM object\n");
+                goto out_cleanup;
+        }
+
+        for (i = 0; i < n; i++) {
+                void *gtt_map, *vram_map;
+                void **gtt_start, **gtt_end;
+                void **vram_start, **vram_end;
+
+                r = radeon_object_create(rdev, NULL, size, true,
+                                         RADEON_GEM_DOMAIN_GTT, false, gtt_obj + i);
+                if (r) {
+                        DRM_ERROR("Failed to create GTT object %d\n", i);
+                        goto out_cleanup;
+                }
+
+                r = radeon_object_pin(gtt_obj[i], RADEON_GEM_DOMAIN_GTT, &gtt_addr);
+                if (r) {
+                        DRM_ERROR("Failed to pin GTT object %d\n", i);
+                        goto out_cleanup;
+                }
+
+                r = radeon_object_kmap(gtt_obj[i], &gtt_map);
+                if (r) {
+                        DRM_ERROR("Failed to map GTT object %d\n", i);
+                        goto out_cleanup;
+                }
+
+                for (gtt_start = gtt_map, gtt_end = gtt_map + size;
+                     gtt_start < gtt_end;
+                     gtt_start++)
+                        *gtt_start = gtt_start;
+
+                radeon_object_kunmap(gtt_obj[i]);
+
+                r = radeon_fence_create(rdev, &fence);
+                if (r) {
+                        DRM_ERROR("Failed to create GTT->VRAM fence %d\n", i);
+                        goto out_cleanup;
+                }
+
+                r = radeon_copy(rdev, gtt_addr, vram_addr, size / 4096, fence);
+                if (r) {
+                        DRM_ERROR("Failed GTT->VRAM copy %d\n", i);
+                        goto out_cleanup;
+                }
+
+                r = radeon_fence_wait(fence, false);
+                if (r) {
+                        DRM_ERROR("Failed to wait for GTT->VRAM fence %d\n", i);
+                        goto out_cleanup;
+                }
+
+                radeon_fence_unref(&fence);
+
+                r = radeon_object_kmap(vram_obj, &vram_map);
+                if (r) {
+                        DRM_ERROR("Failed to map VRAM object after copy %d\n", i);
+                        goto out_cleanup;
+                }
+
+                for (gtt_start = gtt_map, gtt_end = gtt_map + size,
+                     vram_start = vram_map, vram_end = vram_map + size;
+                     vram_start < vram_end;
+                     gtt_start++, vram_start++) {
+                        if (*vram_start != gtt_start) {
+                                DRM_ERROR("Incorrect GTT->VRAM copy %d: Got 0x%p, "
+                                          "expected 0x%p (GTT map 0x%p-0x%p)\n",
+                                          i, *vram_start, gtt_start, gtt_map,
+                                          gtt_end);
+                                radeon_object_kunmap(vram_obj);
+                                goto out_cleanup;
+                        }
+                        *vram_start = vram_start;
+                }
+
+                radeon_object_kunmap(vram_obj);
+
+                r = radeon_fence_create(rdev, &fence);
+                if (r) {
+                        DRM_ERROR("Failed to create VRAM->GTT fence %d\n", i);
+                        goto out_cleanup;
+                }
+
+                r = radeon_copy(rdev, vram_addr, gtt_addr, size / 4096, fence);
+                if (r) {
+                        DRM_ERROR("Failed VRAM->GTT copy %d\n", i);
+                        goto out_cleanup;
+                }
+
+                r = radeon_fence_wait(fence, false);
+                if (r) {
+                        DRM_ERROR("Failed to wait for VRAM->GTT fence %d\n", i);
+                        goto out_cleanup;
+                }
+
+                radeon_fence_unref(&fence);
+
+                r = radeon_object_kmap(gtt_obj[i], &gtt_map);
+                if (r) {
+                        DRM_ERROR("Failed to map GTT object after copy %d\n", i);
+                        goto out_cleanup;
+                }
+
+                for (gtt_start = gtt_map, gtt_end = gtt_map + size,
+                     vram_start = vram_map, vram_end = vram_map + size;
+                     gtt_start < gtt_end;
+                     gtt_start++, vram_start++) {
+                        if (*gtt_start != vram_start) {
+                                DRM_ERROR("Incorrect VRAM->GTT copy %d: Got 0x%p, "
+                                          "expected 0x%p (VRAM map 0x%p-0x%p)\n",
+                                          i, *gtt_start, vram_start, vram_map,
+                                          vram_end);
+                                radeon_object_kunmap(gtt_obj[i]);
+                                goto out_cleanup;
+                        }
+                }
+
+                radeon_object_kunmap(gtt_obj[i]);
+
+                DRM_INFO("Tested GTT->VRAM and VRAM->GTT copy for GTT offset 0x%llx\n",
+                         gtt_addr - rdev->mc.gtt_location);
+        }
+
+out_cleanup:
+        if (vram_obj) {
+                radeon_object_unpin(vram_obj);
+                radeon_object_unref(&vram_obj);
+        }
+        if (gtt_obj) {
+                for (i = 0; i < n; i++) {
+                        if (gtt_obj[i]) {
+                                radeon_object_unpin(gtt_obj[i]);
+                                radeon_object_unref(&gtt_obj[i]);
+                        }
+                }
+                kfree(gtt_obj);
+        }
+        if (fence) {
+                radeon_fence_unref(&fence);
+        }
+        if (r) {
+                printk(KERN_WARNING "Error while testing BO move.\n");
+        }
+}
+
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 1227a97f5169..15c3531377ed 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -355,23 +355,26 @@ static int radeon_bo_move(struct ttm_buffer_object *bo,
         if (!rdev->cp.ready) {
                 /* use memcpy */
                 DRM_ERROR("CP is not ready use memcpy.\n");
-                return ttm_bo_move_memcpy(bo, evict, no_wait, new_mem);
+                goto memcpy;
         }
 
         if (old_mem->mem_type == TTM_PL_VRAM &&
             new_mem->mem_type == TTM_PL_SYSTEM) {
-                return radeon_move_vram_ram(bo, evict, interruptible,
+                r = radeon_move_vram_ram(bo, evict, interruptible,
                                             no_wait, new_mem);
         } else if (old_mem->mem_type == TTM_PL_SYSTEM &&
                    new_mem->mem_type == TTM_PL_VRAM) {
-                return radeon_move_ram_vram(bo, evict, interruptible,
+                r = radeon_move_ram_vram(bo, evict, interruptible,
                                             no_wait, new_mem);
         } else {
                 r = radeon_move_blit(bo, evict, no_wait, new_mem, old_mem);
-                if (unlikely(r)) {
-                        return r;
-                }
         }
+
+        if (r) {
+memcpy:
+                r = ttm_bo_move_memcpy(bo, evict, no_wait, new_mem);
+        }
+
         return r;
 }
 
@@ -429,6 +432,8 @@ static struct ttm_bo_driver radeon_bo_driver = {
         .sync_obj_flush = &radeon_sync_obj_flush,
         .sync_obj_unref = &radeon_sync_obj_unref,
         .sync_obj_ref = &radeon_sync_obj_ref,
+        .move_notify = &radeon_bo_move_notify,
+        .fault_reserve_notify = &radeon_bo_fault_reserve_notify,
 };
 
 int radeon_ttm_init(struct radeon_device *rdev)
@@ -442,13 +447,14 @@ int radeon_ttm_init(struct radeon_device *rdev)
         /* No others user of address space so set it to 0 */
         r = ttm_bo_device_init(&rdev->mman.bdev,
                                rdev->mman.mem_global_ref.object,
-                               &radeon_bo_driver, DRM_FILE_PAGE_OFFSET);
+                               &radeon_bo_driver, DRM_FILE_PAGE_OFFSET,
+                               rdev->need_dma32);
         if (r) {
                 DRM_ERROR("failed initializing buffer object driver(%d).\n", r);
                 return r;
         }
         r = ttm_bo_init_mm(&rdev->mman.bdev, TTM_PL_VRAM, 0,
-                           ((rdev->mc.aper_size) >> PAGE_SHIFT));
+                           ((rdev->mc.real_vram_size) >> PAGE_SHIFT));
         if (r) {
                 DRM_ERROR("Failed initializing VRAM heap.\n");
                 return r;
@@ -465,7 +471,7 @@ int radeon_ttm_init(struct radeon_device *rdev)
                 return r;
         }
         DRM_INFO("radeon: %uM of VRAM memory ready\n",
-                 rdev->mc.vram_size / (1024 * 1024));
+                 rdev->mc.real_vram_size / (1024 * 1024));
         r = ttm_bo_init_mm(&rdev->mman.bdev, TTM_PL_TT, 0,
                            ((rdev->mc.gtt_size) >> PAGE_SHIFT));
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index cc074b5a8f74..b29affd9c5d8 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -29,6 +29,7 @@
 #include <drm/drmP.h>
 #include "radeon_reg.h"
 #include "radeon.h"
+#include "radeon_share.h"
 
 /* rs400,rs480 depends on : */
 void r100_hdp_reset(struct radeon_device *rdev);
@@ -164,7 +165,9 @@ int rs400_gart_enable(struct radeon_device *rdev)
                 WREG32(RADEON_BUS_CNTL, tmp);
         }
         /* Table should be in 32bits address space so ignore bits above. */
-        tmp = rdev->gart.table_addr & 0xfffff000;
+        tmp = (u32)rdev->gart.table_addr & 0xfffff000;
+        tmp |= (upper_32_bits(rdev->gart.table_addr) & 0xff) << 4;
+
         WREG32_MC(RS480_GART_BASE, tmp);
         /* TODO: more tweaking here */
         WREG32_MC(RS480_GART_FEATURE_ID,
@@ -201,10 +204,17 @@ void rs400_gart_disable(struct radeon_device *rdev)
 
 int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
 {
+        uint32_t entry;
+
         if (i < 0 || i > rdev->gart.num_gpu_pages) {
                 return -EINVAL;
         }
-        rdev->gart.table.ram.ptr[i] = cpu_to_le32(((uint32_t)addr) | 0xC);
+
+        entry = (lower_32_bits(addr) & PAGE_MASK) |
+                ((upper_32_bits(addr) & 0xff) << 4) |
+                0xc;
+        entry = cpu_to_le32(entry);
+        rdev->gart.table.ram.ptr[i] = entry;
         return 0;
 }
 
@@ -223,10 +233,9 @@ int rs400_mc_init(struct radeon_device *rdev)
 
         rs400_gpu_init(rdev);
         rs400_gart_disable(rdev);
-        rdev->mc.gtt_location = rdev->mc.vram_size;
+        rdev->mc.gtt_location = rdev->mc.mc_vram_size;
         rdev->mc.gtt_location += (rdev->mc.gtt_size - 1);
         rdev->mc.gtt_location &= ~(rdev->mc.gtt_size - 1);
-        rdev->mc.vram_location = 0xFFFFFFFFUL;
         r = radeon_mc_setup(rdev);
         if (r) {
                 return r;
@@ -238,7 +247,7 @@ int rs400_mc_init(struct radeon_device *rdev)
                        "programming pipes. Bad things might happen.\n");
         }
 
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
         tmp = REG_SET(RADEON_MC_FB_TOP, tmp >> 16);
         tmp |= REG_SET(RADEON_MC_FB_START, rdev->mc.vram_location >> 16);
         WREG32(RADEON_MC_FB_LOCATION, tmp);
@@ -284,21 +293,12 @@ void rs400_gpu_init(struct radeon_device *rdev)
  */
 void rs400_vram_info(struct radeon_device *rdev)
 {
-        uint32_t tom;
-
         rs400_gart_adjust_size(rdev);
         /* DDR for all card after R300 & IGP */
         rdev->mc.vram_is_ddr = true;
         rdev->mc.vram_width = 128;
 
-        /* read NB_TOM to get the amount of ram stolen for the GPU */
-        tom = RREG32(RADEON_NB_TOM);
-        rdev->mc.vram_size = (((tom >> 16) - (tom & 0xffff) + 1) << 16);
-        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.vram_size);
-
-        /* Could aper size report 0 ? */
-        rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
-        rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+        r100_vram_init_sizes(rdev);
 }
 
 
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index ab0c967553e6..bbea6dee4a94 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -223,7 +223,7 @@ int rs600_mc_init(struct radeon_device *rdev)
                 printk(KERN_WARNING "Failed to wait MC idle while "
                        "programming pipes. Bad things might happen.\n");
         }
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
         tmp = REG_SET(RS600_MC_FB_TOP, tmp >> 16);
         tmp |= REG_SET(RS600_MC_FB_START, rdev->mc.vram_location >> 16);
         WREG32_MC(RS600_MC_FB_LOCATION, tmp);
@@ -301,6 +301,11 @@ void rs600_vram_info(struct radeon_device *rdev)
         rdev->mc.vram_width = 128;
 }
 
+void rs600_bandwidth_update(struct radeon_device *rdev)
+{
+        /* FIXME: implement, should this be like rs690 ? */
+}
+
 
 /*
  * Indirect registers accessor
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 79ba85042b5f..839595b00728 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -28,6 +28,9 @@
 #include "drmP.h"
 #include "radeon_reg.h"
 #include "radeon.h"
+#include "rs690r.h"
+#include "atom.h"
+#include "atom-bits.h"
 
 /* rs690,rs740 depends on : */
 void r100_hdp_reset(struct radeon_device *rdev);
@@ -64,7 +67,7 @@ int rs690_mc_init(struct radeon_device *rdev)
         rs400_gart_disable(rdev);
 
         /* Setup GPU memory space */
-        rdev->mc.gtt_location = rdev->mc.vram_size;
+        rdev->mc.gtt_location = rdev->mc.mc_vram_size;
         rdev->mc.gtt_location += (rdev->mc.gtt_size - 1);
         rdev->mc.gtt_location &= ~(rdev->mc.gtt_size - 1);
         rdev->mc.vram_location = 0xFFFFFFFFUL;
@@ -79,7 +82,7 @@ int rs690_mc_init(struct radeon_device *rdev)
                 printk(KERN_WARNING "Failed to wait MC idle while "
                        "programming pipes. Bad things might happen.\n");
         }
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
         tmp = REG_SET(RS690_MC_FB_TOP, tmp >> 16);
         tmp |= REG_SET(RS690_MC_FB_START, rdev->mc.vram_location >> 16);
         WREG32_MC(RS690_MCCFG_FB_LOCATION, tmp);
@@ -138,9 +141,82 @@ void rs690_gpu_init(struct radeon_device *rdev)
 /*
  * VRAM info.
  */
+void rs690_pm_info(struct radeon_device *rdev)
+{
+        int index = GetIndexIntoMasterTable(DATA, IntegratedSystemInfo);
+        struct _ATOM_INTEGRATED_SYSTEM_INFO *info;
+        struct _ATOM_INTEGRATED_SYSTEM_INFO_V2 *info_v2;
+        void *ptr;
+        uint16_t data_offset;
+        uint8_t frev, crev;
+        fixed20_12 tmp;
+
+        atom_parse_data_header(rdev->mode_info.atom_context, index, NULL,
+                               &frev, &crev, &data_offset);
+        ptr = rdev->mode_info.atom_context->bios + data_offset;
+        info = (struct _ATOM_INTEGRATED_SYSTEM_INFO *)ptr;
+        info_v2 = (struct _ATOM_INTEGRATED_SYSTEM_INFO_V2 *)ptr;
+        /* Get various system informations from bios */
+        switch (crev) {
+        case 1:
+                tmp.full = rfixed_const(100);
+                rdev->pm.igp_sideport_mclk.full = rfixed_const(info->ulBootUpMemoryClock);
+                rdev->pm.igp_sideport_mclk.full = rfixed_div(rdev->pm.igp_sideport_mclk, tmp);
+                rdev->pm.igp_system_mclk.full = rfixed_const(le16_to_cpu(info->usK8MemoryClock));
+                rdev->pm.igp_ht_link_clk.full = rfixed_const(le16_to_cpu(info->usFSBClock));
+                rdev->pm.igp_ht_link_width.full = rfixed_const(info->ucHTLinkWidth);
+                break;
+        case 2:
+                tmp.full = rfixed_const(100);
+                rdev->pm.igp_sideport_mclk.full = rfixed_const(info_v2->ulBootUpSidePortClock);
+                rdev->pm.igp_sideport_mclk.full = rfixed_div(rdev->pm.igp_sideport_mclk, tmp);
+                rdev->pm.igp_system_mclk.full = rfixed_const(info_v2->ulBootUpUMAClock);
+                rdev->pm.igp_system_mclk.full = rfixed_div(rdev->pm.igp_system_mclk, tmp);
+                rdev->pm.igp_ht_link_clk.full = rfixed_const(info_v2->ulHTLinkFreq);
+                rdev->pm.igp_ht_link_clk.full = rfixed_div(rdev->pm.igp_ht_link_clk, tmp);
+                rdev->pm.igp_ht_link_width.full = rfixed_const(le16_to_cpu(info_v2->usMinHTLinkWidth));
+                break;
+        default:
+                tmp.full = rfixed_const(100);
+                /* We assume the slower possible clock ie worst case */
+                /* DDR 333Mhz */
+                rdev->pm.igp_sideport_mclk.full = rfixed_const(333);
+                /* FIXME: system clock ? */
+                rdev->pm.igp_system_mclk.full = rfixed_const(100);
+                rdev->pm.igp_system_mclk.full = rfixed_div(rdev->pm.igp_system_mclk, tmp);
+                rdev->pm.igp_ht_link_clk.full = rfixed_const(200);
+                rdev->pm.igp_ht_link_width.full = rfixed_const(8);
+                DRM_ERROR("No integrated system info for your GPU, using safe default\n");
+                break;
+        }
+        /* Compute various bandwidth */
+        /* k8_bandwidth = (memory_clk / 2) * 2 * 8 * 0.5 = memory_clk * 4  */
+        tmp.full = rfixed_const(4);
+        rdev->pm.k8_bandwidth.full = rfixed_mul(rdev->pm.igp_system_mclk, tmp);
+        /* ht_bandwidth = ht_clk * 2 * ht_width / 8 * 0.8
+         *              = ht_clk * ht_width / 5
+         */
+        tmp.full = rfixed_const(5);
+        rdev->pm.ht_bandwidth.full = rfixed_mul(rdev->pm.igp_ht_link_clk,
+                                                rdev->pm.igp_ht_link_width);
+        rdev->pm.ht_bandwidth.full = rfixed_div(rdev->pm.ht_bandwidth, tmp);
+        if (tmp.full < rdev->pm.max_bandwidth.full) {
+                /* HT link is a limiting factor */
+                rdev->pm.max_bandwidth.full = tmp.full;
+        }
+        /* sideport_bandwidth = (sideport_clk / 2) * 2 * 2 * 0.7
+         *                    = (sideport_clk * 14) / 10
+         */
+        tmp.full = rfixed_const(14);
+        rdev->pm.sideport_bandwidth.full = rfixed_mul(rdev->pm.igp_sideport_mclk, tmp);
+        tmp.full = rfixed_const(10);
+        rdev->pm.sideport_bandwidth.full = rfixed_div(rdev->pm.sideport_bandwidth, tmp);
+}
+
 void rs690_vram_info(struct radeon_device *rdev)
 {
         uint32_t tmp;
+        fixed20_12 a;
 
         rs400_gart_adjust_size(rdev);
         /* DDR for all card after R300 & IGP */
@@ -152,12 +228,409 @@ void rs690_vram_info(struct radeon_device *rdev)
         } else {
                 rdev->mc.vram_width = 64;
         }
-        rdev->mc.vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
+        rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
+        rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
 
         rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
         rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+        rs690_pm_info(rdev);
+        /* FIXME: we should enforce default clock in case GPU is not in
+         * default setup
+         */
+        a.full = rfixed_const(100);
+        rdev->pm.sclk.full = rfixed_const(rdev->clock.default_sclk);
+        rdev->pm.sclk.full = rfixed_div(rdev->pm.sclk, a);
+        a.full = rfixed_const(16);
+        /* core_bandwidth = sclk(Mhz) * 16 */
+        rdev->pm.core_bandwidth.full = rfixed_div(rdev->pm.sclk, a);
+}
+
+void rs690_line_buffer_adjust(struct radeon_device *rdev,
+                              struct drm_display_mode *mode1,
+                              struct drm_display_mode *mode2)
+{
+        u32 tmp;
+
+        /*
+         * Line Buffer Setup
+         * There is a single line buffer shared by both display controllers.
+         * DC_LB_MEMORY_SPLIT controls how that line buffer is shared between
+         * the display controllers.  The paritioning can either be done
+         * manually or via one of four preset allocations specified in bits 1:0:
+         *  0 - line buffer is divided in half and shared between crtc
+         *  1 - D1 gets 3/4 of the line buffer, D2 gets 1/4
+         *  2 - D1 gets the whole buffer
+         *  3 - D1 gets 1/4 of the line buffer, D2 gets 3/4
+         * Setting bit 2 of DC_LB_MEMORY_SPLIT controls switches to manual
+         * allocation mode. In manual allocation mode, D1 always starts at 0,
+         * D1 end/2 is specified in bits 14:4; D2 allocation follows D1.
+         */
+        tmp = RREG32(DC_LB_MEMORY_SPLIT) & ~DC_LB_MEMORY_SPLIT_MASK;
+        tmp &= ~DC_LB_MEMORY_SPLIT_SHIFT_MODE;
+        /* auto */
+        if (mode1 && mode2) {
+                if (mode1->hdisplay > mode2->hdisplay) {
+                        if (mode1->hdisplay > 2560)
+                                tmp |= DC_LB_MEMORY_SPLIT_D1_3Q_D2_1Q;
+                        else
+                                tmp |= DC_LB_MEMORY_SPLIT_D1HALF_D2HALF;
+                } else if (mode2->hdisplay > mode1->hdisplay) {
+                        if (mode2->hdisplay > 2560)
+                                tmp |= DC_LB_MEMORY_SPLIT_D1_1Q_D2_3Q;
+                        else
+                                tmp |= DC_LB_MEMORY_SPLIT_D1HALF_D2HALF;
+                } else
+                        tmp |= AVIVO_DC_LB_MEMORY_SPLIT_D1HALF_D2HALF;
+        } else if (mode1) {
+                tmp |= DC_LB_MEMORY_SPLIT_D1_ONLY;
+        } else if (mode2) {
+                tmp |= DC_LB_MEMORY_SPLIT_D1_1Q_D2_3Q;
+        }
+        WREG32(DC_LB_MEMORY_SPLIT, tmp);
 }
 
+struct rs690_watermark {
+        u32        lb_request_fifo_depth;
+        fixed20_12 num_line_pair;
+        fixed20_12 estimated_width;
+        fixed20_12 worst_case_latency;
+        fixed20_12 consumption_rate;
+        fixed20_12 active_time;
+        fixed20_12 dbpp;
+        fixed20_12 priority_mark_max;
+        fixed20_12 priority_mark;
+        fixed20_12 sclk;
+};
+
+void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
+                                  struct radeon_crtc *crtc,
+                                  struct rs690_watermark *wm)
+{
+        struct drm_display_mode *mode = &crtc->base.mode;
+        fixed20_12 a, b, c;
+        fixed20_12 pclk, request_fifo_depth, tolerable_latency, estimated_width;
+        fixed20_12 consumption_time, line_time, chunk_time, read_delay_latency;
+        /* FIXME: detect IGP with sideport memory, i don't think there is any
+         * such product available
+         */
+        bool sideport = false;
+
+        if (!crtc->base.enabled) {
+                /* FIXME: wouldn't it better to set priority mark to maximum */
+                wm->lb_request_fifo_depth = 4;
+                return;
+        }
+
+        if (crtc->vsc.full > rfixed_const(2))
+                wm->num_line_pair.full = rfixed_const(2);
+        else
+                wm->num_line_pair.full = rfixed_const(1);
+
+        b.full = rfixed_const(mode->crtc_hdisplay);
+        c.full = rfixed_const(256);
+        a.full = rfixed_mul(wm->num_line_pair, b);
+        request_fifo_depth.full = rfixed_div(a, c);
+        if (a.full < rfixed_const(4)) {
+                wm->lb_request_fifo_depth = 4;
+        } else {
+                wm->lb_request_fifo_depth = rfixed_trunc(request_fifo_depth);
+        }
+
+        /* Determine consumption rate
+         *  pclk = pixel clock period(ns) = 1000 / (mode.clock / 1000)
+         *  vtaps = number of vertical taps,
+         *  vsc = vertical scaling ratio, defined as source/destination
+         *  hsc = horizontal scaling ration, defined as source/destination
+         */
+        a.full = rfixed_const(mode->clock);
+        b.full = rfixed_const(1000);
+        a.full = rfixed_div(a, b);
+        pclk.full = rfixed_div(b, a);
+        if (crtc->rmx_type != RMX_OFF) {
+                b.full = rfixed_const(2);
+                if (crtc->vsc.full > b.full)
+                        b.full = crtc->vsc.full;
+                b.full = rfixed_mul(b, crtc->hsc);
+                c.full = rfixed_const(2);
+                b.full = rfixed_div(b, c);
+                consumption_time.full = rfixed_div(pclk, b);
+        } else {
+                consumption_time.full = pclk.full;
+        }
+        a.full = rfixed_const(1);
+        wm->consumption_rate.full = rfixed_div(a, consumption_time);
+
+
+        /* Determine line time
+         *  LineTime = total time for one line of displayhtotal
+         *  LineTime = total number of horizontal pixels
+         *  pclk = pixel clock period(ns)
+         */
+        a.full = rfixed_const(crtc->base.mode.crtc_htotal);
+        line_time.full = rfixed_mul(a, pclk);
+
+        /* Determine active time
+         *  ActiveTime = time of active region of display within one line,
+         *  hactive = total number of horizontal active pixels
+         *  htotal = total number of horizontal pixels
+         */
+        a.full = rfixed_const(crtc->base.mode.crtc_htotal);
+        b.full = rfixed_const(crtc->base.mode.crtc_hdisplay);
+        wm->active_time.full = rfixed_mul(line_time, b);
+        wm->active_time.full = rfixed_div(wm->active_time, a);
+
+        /* Maximun bandwidth is the minimun bandwidth of all component */
+        rdev->pm.max_bandwidth = rdev->pm.core_bandwidth;
+        if (sideport) {
+                if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
+                        rdev->pm.sideport_bandwidth.full)
+                        rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
+                read_delay_latency.full = rfixed_const(370 * 800 * 1000);
+                read_delay_latency.full = rfixed_div(read_delay_latency,
+                        rdev->pm.igp_sideport_mclk);
+        } else {
+                if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
+                        rdev->pm.k8_bandwidth.full)
+                        rdev->pm.max_bandwidth = rdev->pm.k8_bandwidth;
+                if (rdev->pm.max_bandwidth.full > rdev->pm.ht_bandwidth.full &&
+                        rdev->pm.ht_bandwidth.full)
+                        rdev->pm.max_bandwidth = rdev->pm.ht_bandwidth;
+                read_delay_latency.full = rfixed_const(5000);
+        }
+
+        /* sclk = system clocks(ns) = 1000 / max_bandwidth / 16 */
+        a.full = rfixed_const(16);
+        rdev->pm.sclk.full = rfixed_mul(rdev->pm.max_bandwidth, a);
+        a.full = rfixed_const(1000);
+        rdev->pm.sclk.full = rfixed_div(a, rdev->pm.sclk);
+        /* Determine chunk time
+         * ChunkTime = the time it takes the DCP to send one chunk of data
+         * to the LB which consists of pipeline delay and inter chunk gap
+         * sclk = system clock(ns)
+         */
+        a.full = rfixed_const(256 * 13);
+        chunk_time.full = rfixed_mul(rdev->pm.sclk, a);
+        a.full = rfixed_const(10);
+        chunk_time.full = rfixed_div(chunk_time, a);
+
+        /* Determine the worst case latency
+         * NumLinePair = Number of line pairs to request(1=2 lines, 2=4 lines)
+         * WorstCaseLatency = worst case time from urgent to when the MC starts
+         *                    to return data
+         * READ_DELAY_IDLE_MAX = constant of 1us
+         * ChunkTime = time it takes the DCP to send one chunk of data to the LB
+         *             which consists of pipeline delay and inter chunk gap
+         */
+        if (rfixed_trunc(wm->num_line_pair) > 1) {
+                a.full = rfixed_const(3);
+                wm->worst_case_latency.full = rfixed_mul(a, chunk_time);
+                wm->worst_case_latency.full += read_delay_latency.full;
+        } else {
+                a.full = rfixed_const(2);
+                wm->worst_case_latency.full = rfixed_mul(a, chunk_time);
+                wm->worst_case_latency.full += read_delay_latency.full;
+        }
+
+        /* Determine the tolerable latency
+         * TolerableLatency = Any given request has only 1 line time
+         *                    for the data to be returned
+         * LBRequestFifoDepth = Number of chunk requests the LB can
+         *                      put into the request FIFO for a display
+         *  LineTime = total time for one line of display
+         *  ChunkTime = the time it takes the DCP to send one chunk
+         *              of data to the LB which consists of
+         *  pipeline delay and inter chunk gap
+         */
+        if ((2+wm->lb_request_fifo_depth) >= rfixed_trunc(request_fifo_depth)) {
+                tolerable_latency.full = line_time.full;
+        } else {
+                tolerable_latency.full = rfixed_const(wm->lb_request_fifo_depth - 2);
+                tolerable_latency.full = request_fifo_depth.full - tolerable_latency.full;
+                tolerable_latency.full = rfixed_mul(tolerable_latency, chunk_time);
+                tolerable_latency.full = line_time.full - tolerable_latency.full;
+        }
+        /* We assume worst case 32bits (4 bytes) */
+        wm->dbpp.full = rfixed_const(4 * 8);
+
+        /* Determine the maximum priority mark
+         *  width = viewport width in pixels
+         */
+        a.full = rfixed_const(16);
+        wm->priority_mark_max.full = rfixed_const(crtc->base.mode.crtc_hdisplay);
+        wm->priority_mark_max.full = rfixed_div(wm->priority_mark_max, a);
+
+        /* Determine estimated width */
+        estimated_width.full = tolerable_latency.full - wm->worst_case_latency.full;
+        estimated_width.full = rfixed_div(estimated_width, consumption_time);
+        if (rfixed_trunc(estimated_width) > crtc->base.mode.crtc_hdisplay) {
+                wm->priority_mark.full = rfixed_const(10);
+        } else {
+                a.full = rfixed_const(16);
+                wm->priority_mark.full = rfixed_div(estimated_width, a);
+                wm->priority_mark.full = wm->priority_mark_max.full - wm->priority_mark.full;
+        }
+}
+
+void rs690_bandwidth_update(struct radeon_device *rdev)
+{
+        struct drm_display_mode *mode0 = NULL;
+        struct drm_display_mode *mode1 = NULL;
+        struct rs690_watermark wm0;
+        struct rs690_watermark wm1;
+        u32 tmp;
+        fixed20_12 priority_mark02, priority_mark12, fill_rate;
+        fixed20_12 a, b;
+
+        if (rdev->mode_info.crtcs[0]->base.enabled)
+                mode0 = &rdev->mode_info.crtcs[0]->base.mode;
+        if (rdev->mode_info.crtcs[1]->base.enabled)
+                mode1 = &rdev->mode_info.crtcs[1]->base.mode;
+        /*
+         * Set display0/1 priority up in the memory controller for
+         * modes if the user specifies HIGH for displaypriority
+         * option.
+         */
+        if (rdev->disp_priority == 2) {
+                tmp = RREG32_MC(MC_INIT_MISC_LAT_TIMER);
+                tmp &= ~MC_DISP1R_INIT_LAT_MASK;
+                tmp &= ~MC_DISP0R_INIT_LAT_MASK;
+                if (mode1)
+                        tmp |= (1 << MC_DISP1R_INIT_LAT_SHIFT);
+                if (mode0)
+                        tmp |= (1 << MC_DISP0R_INIT_LAT_SHIFT);
+                WREG32_MC(MC_INIT_MISC_LAT_TIMER, tmp);
+        }
+        rs690_line_buffer_adjust(rdev, mode0, mode1);
+
+        if ((rdev->family == CHIP_RS690) || (rdev->family == CHIP_RS740))
+                WREG32(DCP_CONTROL, 0);
+        if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
+                WREG32(DCP_CONTROL, 2);
+
+        rs690_crtc_bandwidth_compute(rdev, rdev->mode_info.crtcs[0], &wm0);
+        rs690_crtc_bandwidth_compute(rdev, rdev->mode_info.crtcs[1], &wm1);
+
+        tmp = (wm0.lb_request_fifo_depth - 1);
+        tmp |= (wm1.lb_request_fifo_depth - 1) << 16;
+        WREG32(LB_MAX_REQ_OUTSTANDING, tmp);
+
+        if (mode0 && mode1) {
+                if (rfixed_trunc(wm0.dbpp) > 64)
+                        a.full = rfixed_mul(wm0.dbpp, wm0.num_line_pair);
+                else
+                        a.full = wm0.num_line_pair.full;
+                if (rfixed_trunc(wm1.dbpp) > 64)
+                        b.full = rfixed_mul(wm1.dbpp, wm1.num_line_pair);
+                else
+                        b.full = wm1.num_line_pair.full;
+                a.full += b.full;
+                fill_rate.full = rfixed_div(wm0.sclk, a);
+                if (wm0.consumption_rate.full > fill_rate.full) {
+                        b.full = wm0.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm0.active_time);
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        a.full = a.full + b.full;
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark02.full = rfixed_div(a, b);
+                } else {
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark02.full = rfixed_div(a, b);
+                }
+                if (wm1.consumption_rate.full > fill_rate.full) {
+                        b.full = wm1.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm1.active_time);
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        a.full = a.full + b.full;
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark12.full = rfixed_div(a, b);
+                } else {
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark12.full = rfixed_div(a, b);
+                }
+                if (wm0.priority_mark.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark.full;
+                if (rfixed_trunc(priority_mark02) < 0)
+                        priority_mark02.full = 0;
+                if (wm0.priority_mark_max.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark_max.full;
+                if (wm1.priority_mark.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark.full;
+                if (rfixed_trunc(priority_mark12) < 0)
+                        priority_mark12.full = 0;
+                if (wm1.priority_mark_max.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark_max.full;
+                WREG32(D1MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D1MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D2MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark12));
+                WREG32(D2MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark12));
+        } else if (mode0) {
+                if (rfixed_trunc(wm0.dbpp) > 64)
+                        a.full = rfixed_mul(wm0.dbpp, wm0.num_line_pair);
+                else
+                        a.full = wm0.num_line_pair.full;
+                fill_rate.full = rfixed_div(wm0.sclk, a);
+                if (wm0.consumption_rate.full > fill_rate.full) {
+                        b.full = wm0.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm0.active_time);
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        a.full = a.full + b.full;
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark02.full = rfixed_div(a, b);
+                } else {
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark02.full = rfixed_div(a, b);
+                }
+                if (wm0.priority_mark.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark.full;
+                if (rfixed_trunc(priority_mark02) < 0)
+                        priority_mark02.full = 0;
+                if (wm0.priority_mark_max.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark_max.full;
+                WREG32(D1MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D1MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D2MODE_PRIORITY_A_CNT, MODE_PRIORITY_OFF);
+                WREG32(D2MODE_PRIORITY_B_CNT, MODE_PRIORITY_OFF);
+        } else {
+                if (rfixed_trunc(wm1.dbpp) > 64)
+                        a.full = rfixed_mul(wm1.dbpp, wm1.num_line_pair);
+                else
+                        a.full = wm1.num_line_pair.full;
+                fill_rate.full = rfixed_div(wm1.sclk, a);
+                if (wm1.consumption_rate.full > fill_rate.full) {
+                        b.full = wm1.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm1.active_time);
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        a.full = a.full + b.full;
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark12.full = rfixed_div(a, b);
+                } else {
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark12.full = rfixed_div(a, b);
+                }
+                if (wm1.priority_mark.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark.full;
+                if (rfixed_trunc(priority_mark12) < 0)
+                        priority_mark12.full = 0;
+                if (wm1.priority_mark_max.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark_max.full;
+                WREG32(D1MODE_PRIORITY_A_CNT, MODE_PRIORITY_OFF);
+                WREG32(D1MODE_PRIORITY_B_CNT, MODE_PRIORITY_OFF);
+                WREG32(D2MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark12));
+                WREG32(D2MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark12));
+        }
+}
 
 /*
  * Indirect registers accessor
diff --git a/drivers/gpu/drm/radeon/rs690r.h b/drivers/gpu/drm/radeon/rs690r.h
new file mode 100644
index 000000000000..c0d9faa2175b
--- /dev/null
+++ b/drivers/gpu/drm/radeon/rs690r.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2008 Advanced Micro Devices, Inc.
+ * Copyright 2008 Red Hat Inc.
+ * Copyright 2009 Jerome Glisse.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Dave Airlie
+ *          Alex Deucher
+ *          Jerome Glisse
+ */
+#ifndef RS690R_H
+#define RS690R_H
+
+/* RS690/RS740 registers */
+#define MC_INDEX                        0x0078
+#       define MC_INDEX_MASK                    0x1FF
+#       define MC_INDEX_WR_EN                   (1 << 9)
+#       define MC_INDEX_WR_ACK                  0x7F
+#define MC_DATA                         0x007C
+#define HDP_FB_LOCATION                 0x0134
+#define DC_LB_MEMORY_SPLIT              0x6520
+#define         DC_LB_MEMORY_SPLIT_MASK                 0x00000003
+#define         DC_LB_MEMORY_SPLIT_SHIFT                0
+#define         DC_LB_MEMORY_SPLIT_D1HALF_D2HALF        0
+#define         DC_LB_MEMORY_SPLIT_D1_3Q_D2_1Q          1
+#define         DC_LB_MEMORY_SPLIT_D1_ONLY              2
+#define         DC_LB_MEMORY_SPLIT_D1_1Q_D2_3Q          3
+#define         DC_LB_MEMORY_SPLIT_SHIFT_MODE           (1 << 2)
+#define         DC_LB_DISP1_END_ADR_SHIFT               4
+#define         DC_LB_DISP1_END_ADR_MASK                0x00007FF0
+#define D1MODE_PRIORITY_A_CNT           0x6548
+#define         MODE_PRIORITY_MARK_MASK                 0x00007FFF
+#define         MODE_PRIORITY_OFF                       (1 << 16)
+#define         MODE_PRIORITY_ALWAYS_ON                 (1 << 20)
+#define         MODE_PRIORITY_FORCE_MASK                (1 << 24)
+#define D1MODE_PRIORITY_B_CNT           0x654C
+#define LB_MAX_REQ_OUTSTANDING          0x6D58
+#define         LB_D1_MAX_REQ_OUTSTANDING_MASK          0x0000000F
+#define         LB_D1_MAX_REQ_OUTSTANDING_SHIFT         0
+#define         LB_D2_MAX_REQ_OUTSTANDING_MASK          0x000F0000
+#define         LB_D2_MAX_REQ_OUTSTANDING_SHIFT         16
+#define DCP_CONTROL                     0x6C9C
+#define D2MODE_PRIORITY_A_CNT           0x6D48
+#define D2MODE_PRIORITY_B_CNT           0x6D4C
+
+/* MC indirect registers */
+#define MC_STATUS_IDLE                          (1 << 0)
+#define MC_MISC_CNTL                    0x18
+#define         DISABLE_GTW                     (1 << 1)
+#define         GART_INDEX_REG_EN               (1 << 12)
+#define         BLOCK_GFX_D3_EN                 (1 << 14)
+#define GART_FEATURE_ID                 0x2B
+#define         HANG_EN                         (1 << 11)
+#define         TLB_ENABLE                      (1 << 18)
+#define         P2P_ENABLE                      (1 << 19)
+#define         GTW_LAC_EN                      (1 << 25)
+#define         LEVEL2_GART                     (0 << 30)
+#define         LEVEL1_GART                     (1 << 30)
+#define         PDC_EN                          (1 << 31)
+#define GART_BASE                       0x2C
+#define GART_CACHE_CNTRL                0x2E
+#       define GART_CACHE_INVALIDATE            (1 << 0)
+#define MC_STATUS                       0x90
+#define MCCFG_FB_LOCATION               0x100
+#define         MC_FB_START_MASK                0x0000FFFF
+#define         MC_FB_START_SHIFT               0
+#define         MC_FB_TOP_MASK                  0xFFFF0000
+#define         MC_FB_TOP_SHIFT                 16
+#define MCCFG_AGP_LOCATION              0x101
+#define         MC_AGP_START_MASK               0x0000FFFF
+#define         MC_AGP_START_SHIFT              0
+#define         MC_AGP_TOP_MASK                 0xFFFF0000
+#define         MC_AGP_TOP_SHIFT                16
+#define MCCFG_AGP_BASE                  0x102
+#define MCCFG_AGP_BASE_2                0x103
+#define MC_INIT_MISC_LAT_TIMER          0x104
+#define         MC_DISP0R_INIT_LAT_SHIFT        8
+#define         MC_DISP0R_INIT_LAT_MASK         0x00000F00
+#define         MC_DISP1R_INIT_LAT_SHIFT        12
+#define         MC_DISP1R_INIT_LAT_MASK         0x0000F000
+
+#endif
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index ffea37b1b3e2..551e608702e4 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -27,8 +27,9 @@
  */
 #include <linux/seq_file.h>
 #include "drmP.h"
-#include "radeon_reg.h"
+#include "rv515r.h"
 #include "radeon.h"
+#include "radeon_share.h"
 
 /* rv515 depends on : */
 void r100_hdp_reset(struct radeon_device *rdev);
@@ -99,26 +100,26 @@ int rv515_mc_init(struct radeon_device *rdev)
                        "programming pipes. Bad things might happen.\n");
         }
         /* Write VRAM size in case we are limiting it */
-        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.vram_size);
-        tmp = REG_SET(RV515_MC_FB_START, rdev->mc.vram_location >> 16);
+        WREG32(RADEON_CONFIG_MEMSIZE, rdev->mc.real_vram_size);
+        tmp = REG_SET(MC_FB_START, rdev->mc.vram_location >> 16);
         WREG32(0x134, tmp);
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
-        tmp = REG_SET(RV515_MC_FB_TOP, tmp >> 16);
-        tmp |= REG_SET(RV515_MC_FB_START, rdev->mc.vram_location >> 16);
-        WREG32_MC(RV515_MC_FB_LOCATION, tmp);
-        WREG32(RS690_HDP_FB_LOCATION, rdev->mc.vram_location >> 16);
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
+        tmp = REG_SET(MC_FB_TOP, tmp >> 16);
+        tmp |= REG_SET(MC_FB_START, rdev->mc.vram_location >> 16);
+        WREG32_MC(MC_FB_LOCATION, tmp);
+        WREG32(HDP_FB_LOCATION, rdev->mc.vram_location >> 16);
         WREG32(0x310, rdev->mc.vram_location);
         if (rdev->flags & RADEON_IS_AGP) {
                 tmp = rdev->mc.gtt_location + rdev->mc.gtt_size - 1;
-                tmp = REG_SET(RV515_MC_AGP_TOP, tmp >> 16);
-                tmp |= REG_SET(RV515_MC_AGP_START, rdev->mc.gtt_location >> 16);
-                WREG32_MC(RV515_MC_AGP_LOCATION, tmp);
-                WREG32_MC(RV515_MC_AGP_BASE, rdev->mc.agp_base);
-                WREG32_MC(RV515_MC_AGP_BASE_2, 0);
+                tmp = REG_SET(MC_AGP_TOP, tmp >> 16);
+                tmp |= REG_SET(MC_AGP_START, rdev->mc.gtt_location >> 16);
+                WREG32_MC(MC_AGP_LOCATION, tmp);
+                WREG32_MC(MC_AGP_BASE, rdev->mc.agp_base);
+                WREG32_MC(MC_AGP_BASE_2, 0);
         } else {
-                WREG32_MC(RV515_MC_AGP_LOCATION, 0x0FFFFFFF);
-                WREG32_MC(RV515_MC_AGP_BASE, 0);
-                WREG32_MC(RV515_MC_AGP_BASE_2, 0);
+                WREG32_MC(MC_AGP_LOCATION, 0x0FFFFFFF);
+                WREG32_MC(MC_AGP_BASE, 0);
+                WREG32_MC(MC_AGP_BASE_2, 0);
         }
         return 0;
 }
@@ -136,95 +137,67 @@ void rv515_mc_fini(struct radeon_device *rdev)
  */
 void rv515_ring_start(struct radeon_device *rdev)
 {
-        unsigned gb_tile_config;
         int r;
 
-        /* Sub pixel 1/12 so we can have 4K rendering according to doc */
-        gb_tile_config = R300_ENABLE_TILING | R300_TILE_SIZE_16;
-        switch (rdev->num_gb_pipes) {
-        case 2:
-                gb_tile_config |= R300_PIPE_COUNT_R300;
-                break;
-        case 3:
-                gb_tile_config |= R300_PIPE_COUNT_R420_3P;
-                break;
-        case 4:
-                gb_tile_config |= R300_PIPE_COUNT_R420;
-                break;
-        case 1:
-        default:
-                gb_tile_config |= R300_PIPE_COUNT_RV350;
-                break;
-        }
-
         r = radeon_ring_lock(rdev, 64);
         if (r) {
                 return;
         }
-        radeon_ring_write(rdev, PACKET0(RADEON_ISYNC_CNTL, 0));
-        radeon_ring_write(rdev,
-                          RADEON_ISYNC_ANY2D_IDLE3D |
-                          RADEON_ISYNC_ANY3D_IDLE2D |
-                          RADEON_ISYNC_WAIT_IDLEGUI |
-                          RADEON_ISYNC_CPSCRATCH_IDLEGUI);
-        radeon_ring_write(rdev, PACKET0(R300_GB_TILE_CONFIG, 0));
-        radeon_ring_write(rdev, gb_tile_config);
-        radeon_ring_write(rdev, PACKET0(RADEON_WAIT_UNTIL, 0));
+        radeon_ring_write(rdev, PACKET0(ISYNC_CNTL, 0));
         radeon_ring_write(rdev,
-                          RADEON_WAIT_2D_IDLECLEAN |
-                          RADEON_WAIT_3D_IDLECLEAN);
+                          ISYNC_ANY2D_IDLE3D |
+                          ISYNC_ANY3D_IDLE2D |
+                          ISYNC_WAIT_IDLEGUI |
+                          ISYNC_CPSCRATCH_IDLEGUI);
+        radeon_ring_write(rdev, PACKET0(WAIT_UNTIL, 0));
+        radeon_ring_write(rdev, WAIT_2D_IDLECLEAN | WAIT_3D_IDLECLEAN);
         radeon_ring_write(rdev, PACKET0(0x170C, 0));
         radeon_ring_write(rdev, 1 << 31);
-        radeon_ring_write(rdev, PACKET0(R300_GB_SELECT, 0));
+        radeon_ring_write(rdev, PACKET0(GB_SELECT, 0));
         radeon_ring_write(rdev, 0);
-        radeon_ring_write(rdev, PACKET0(R300_GB_ENABLE, 0));
+        radeon_ring_write(rdev, PACKET0(GB_ENABLE, 0));
         radeon_ring_write(rdev, 0);
         radeon_ring_write(rdev, PACKET0(0x42C8, 0));
         radeon_ring_write(rdev, (1 << rdev->num_gb_pipes) - 1);
-        radeon_ring_write(rdev, PACKET0(R500_VAP_INDEX_OFFSET, 0));
+        radeon_ring_write(rdev, PACKET0(VAP_INDEX_OFFSET, 0));
         radeon_ring_write(rdev, 0);
-        radeon_ring_write(rdev, PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
-        radeon_ring_write(rdev, R300_RB3D_DC_FLUSH | R300_RB3D_DC_FREE);
-        radeon_ring_write(rdev, PACKET0(R300_RB3D_ZCACHE_CTLSTAT, 0));
-        radeon_ring_write(rdev, R300_ZC_FLUSH | R300_ZC_FREE);
-        radeon_ring_write(rdev, PACKET0(RADEON_WAIT_UNTIL, 0));
-        radeon_ring_write(rdev,
-                          RADEON_WAIT_2D_IDLECLEAN |
-                          RADEON_WAIT_3D_IDLECLEAN);
-        radeon_ring_write(rdev, PACKET0(R300_GB_AA_CONFIG, 0));
+        radeon_ring_write(rdev, PACKET0(RB3D_DSTCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RB3D_DC_FLUSH | RB3D_DC_FREE);
+        radeon_ring_write(rdev, PACKET0(ZB_ZCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, ZC_FLUSH | ZC_FREE);
+        radeon_ring_write(rdev, PACKET0(WAIT_UNTIL, 0));
+        radeon_ring_write(rdev, WAIT_2D_IDLECLEAN | WAIT_3D_IDLECLEAN);
+        radeon_ring_write(rdev, PACKET0(GB_AA_CONFIG, 0));
         radeon_ring_write(rdev, 0);
-        radeon_ring_write(rdev, PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
-        radeon_ring_write(rdev, R300_RB3D_DC_FLUSH | R300_RB3D_DC_FREE);
-        radeon_ring_write(rdev, PACKET0(R300_RB3D_ZCACHE_CTLSTAT, 0));
-        radeon_ring_write(rdev, R300_ZC_FLUSH | R300_ZC_FREE);
-        radeon_ring_write(rdev, PACKET0(R300_GB_MSPOS0, 0));
-        radeon_ring_write(rdev,
-                          ((6 << R300_MS_X0_SHIFT) |
-                           (6 << R300_MS_Y0_SHIFT) |
-                           (6 << R300_MS_X1_SHIFT) |
-                           (6 << R300_MS_Y1_SHIFT) |
-                           (6 << R300_MS_X2_SHIFT) |
-                           (6 << R300_MS_Y2_SHIFT) |
-                           (6 << R300_MSBD0_Y_SHIFT) |
-                           (6 << R300_MSBD0_X_SHIFT)));
-        radeon_ring_write(rdev, PACKET0(R300_GB_MSPOS1, 0));
+        radeon_ring_write(rdev, PACKET0(RB3D_DSTCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RB3D_DC_FLUSH | RB3D_DC_FREE);
+        radeon_ring_write(rdev, PACKET0(ZB_ZCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, ZC_FLUSH | ZC_FREE);
+        radeon_ring_write(rdev, PACKET0(GB_MSPOS0, 0));
         radeon_ring_write(rdev,
-                          ((6 << R300_MS_X3_SHIFT) |
-                           (6 << R300_MS_Y3_SHIFT) |
-                           (6 << R300_MS_X4_SHIFT) |
-                           (6 << R300_MS_Y4_SHIFT) |
-                           (6 << R300_MS_X5_SHIFT) |
-                           (6 << R300_MS_Y5_SHIFT) |
-                           (6 << R300_MSBD1_SHIFT)));
-        radeon_ring_write(rdev, PACKET0(R300_GA_ENHANCE, 0));
-        radeon_ring_write(rdev, R300_GA_DEADLOCK_CNTL | R300_GA_FASTSYNC_CNTL);
-        radeon_ring_write(rdev, PACKET0(R300_GA_POLY_MODE, 0));
+                          ((6 << MS_X0_SHIFT) |
+                           (6 << MS_Y0_SHIFT) |
+                           (6 << MS_X1_SHIFT) |
+                           (6 << MS_Y1_SHIFT) |
+                           (6 << MS_X2_SHIFT) |
+                           (6 << MS_Y2_SHIFT) |
+                           (6 << MSBD0_Y_SHIFT) |
+                           (6 << MSBD0_X_SHIFT)));
+        radeon_ring_write(rdev, PACKET0(GB_MSPOS1, 0));
         radeon_ring_write(rdev,
-                          R300_FRONT_PTYPE_TRIANGE | R300_BACK_PTYPE_TRIANGE);
-        radeon_ring_write(rdev, PACKET0(R300_GA_ROUND_MODE, 0));
-        radeon_ring_write(rdev,
-                          R300_GEOMETRY_ROUND_NEAREST |
-                          R300_COLOR_ROUND_NEAREST);
+                          ((6 << MS_X3_SHIFT) |
+                           (6 << MS_Y3_SHIFT) |
+                           (6 << MS_X4_SHIFT) |
+                           (6 << MS_Y4_SHIFT) |
+                           (6 << MS_X5_SHIFT) |
+                           (6 << MS_Y5_SHIFT) |
+                           (6 << MSBD1_SHIFT)));
+        radeon_ring_write(rdev, PACKET0(GA_ENHANCE, 0));
+        radeon_ring_write(rdev, GA_DEADLOCK_CNTL | GA_FASTSYNC_CNTL);
+        radeon_ring_write(rdev, PACKET0(GA_POLY_MODE, 0));
+        radeon_ring_write(rdev, FRONT_PTYPE_TRIANGE | BACK_PTYPE_TRIANGE);
+        radeon_ring_write(rdev, PACKET0(GA_ROUND_MODE, 0));
+        radeon_ring_write(rdev, GEOMETRY_ROUND_NEAREST | COLOR_ROUND_NEAREST);
         radeon_ring_write(rdev, PACKET0(0x20C8, 0));
         radeon_ring_write(rdev, 0);
         radeon_ring_unlock_commit(rdev);
@@ -242,8 +215,8 @@ int rv515_mc_wait_for_idle(struct radeon_device *rdev)
 
         for (i = 0; i < rdev->usec_timeout; i++) {
                 /* read MC_STATUS */
-                tmp = RREG32_MC(RV515_MC_STATUS);
-                if (tmp & RV515_MC_STATUS_IDLE) {
+                tmp = RREG32_MC(MC_STATUS);
+                if (tmp & MC_STATUS_IDLE) {
                         return 0;
                 }
                 DRM_UDELAY(1);
@@ -291,33 +264,33 @@ int rv515_ga_reset(struct radeon_device *rdev)
         reinit_cp = rdev->cp.ready;
         rdev->cp.ready = false;
         for (i = 0; i < rdev->usec_timeout; i++) {
-                WREG32(RADEON_CP_CSQ_MODE, 0);
-                WREG32(RADEON_CP_CSQ_CNTL, 0);
-                WREG32(RADEON_RBBM_SOFT_RESET, 0x32005);
-                (void)RREG32(RADEON_RBBM_SOFT_RESET);
+                WREG32(CP_CSQ_MODE, 0);
+                WREG32(CP_CSQ_CNTL, 0);
+                WREG32(RBBM_SOFT_RESET, 0x32005);
+                (void)RREG32(RBBM_SOFT_RESET);
                 udelay(200);
-                WREG32(RADEON_RBBM_SOFT_RESET, 0);
+                WREG32(RBBM_SOFT_RESET, 0);
                 /* Wait to prevent race in RBBM_STATUS */
                 mdelay(1);
-                tmp = RREG32(RADEON_RBBM_STATUS);
+                tmp = RREG32(RBBM_STATUS);
                 if (tmp & ((1 << 20) | (1 << 26))) {
                         DRM_ERROR("VAP & CP still busy (RBBM_STATUS=0x%08X)\n", tmp);
                         /* GA still busy soft reset it */
                         WREG32(0x429C, 0x200);
-                        WREG32(R300_VAP_PVS_STATE_FLUSH_REG, 0);
+                        WREG32(VAP_PVS_STATE_FLUSH_REG, 0);
                         WREG32(0x43E0, 0);
                         WREG32(0x43E4, 0);
                         WREG32(0x24AC, 0);
                 }
                 /* Wait to prevent race in RBBM_STATUS */
                 mdelay(1);
-                tmp = RREG32(RADEON_RBBM_STATUS);
+                tmp = RREG32(RBBM_STATUS);
                 if (!(tmp & ((1 << 20) | (1 << 26)))) {
                         break;
                 }
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = RREG32(RADEON_RBBM_STATUS);
+                tmp = RREG32(RBBM_STATUS);
                 if (!(tmp & ((1 << 20) | (1 << 26)))) {
                         DRM_INFO("GA reset succeed (RBBM_STATUS=0x%08X)\n",
                                  tmp);
@@ -331,7 +304,7 @@ int rv515_ga_reset(struct radeon_device *rdev)
                 }
                 DRM_UDELAY(1);
         }
-        tmp = RREG32(RADEON_RBBM_STATUS);
+        tmp = RREG32(RBBM_STATUS);
         DRM_ERROR("Failed to reset GA ! (RBBM_STATUS=0x%08X)\n", tmp);
         return -1;
 }
@@ -341,7 +314,7 @@ int rv515_gpu_reset(struct radeon_device *rdev)
         uint32_t status;
 
         /* reset order likely matter */
-        status = RREG32(RADEON_RBBM_STATUS);
+        status = RREG32(RBBM_STATUS);
         /* reset HDP */
         r100_hdp_reset(rdev);
         /* reset rb2d */
@@ -353,12 +326,12 @@ int rv515_gpu_reset(struct radeon_device *rdev)
                 rv515_ga_reset(rdev);
         }
         /* reset CP */
-        status = RREG32(RADEON_RBBM_STATUS);
+        status = RREG32(RBBM_STATUS);
         if (status & (1 << 16)) {
                 r100_cp_reset(rdev);
         }
         /* Check if GPU is idle */
-        status = RREG32(RADEON_RBBM_STATUS);
+        status = RREG32(RBBM_STATUS);
         if (status & (1 << 31)) {
                 DRM_ERROR("Failed to reset GPU (RBBM_STATUS=0x%08X)\n", status);
                 return -1;
@@ -377,8 +350,7 @@ static void rv515_vram_get_type(struct radeon_device *rdev)
 
         rdev->mc.vram_width = 128;
         rdev->mc.vram_is_ddr = true;
-        tmp = RREG32_MC(RV515_MC_CNTL);
-        tmp &= RV515_MEM_NUM_CHANNELS_MASK;
+        tmp = RREG32_MC(RV515_MC_CNTL) & MEM_NUM_CHANNELS_MASK;
         switch (tmp) {
         case 0:
                 rdev->mc.vram_width = 64;
@@ -394,11 +366,16 @@ static void rv515_vram_get_type(struct radeon_device *rdev)
 
 void rv515_vram_info(struct radeon_device *rdev)
 {
+        fixed20_12 a;
+
         rv515_vram_get_type(rdev);
-        rdev->mc.vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
 
-        rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
-        rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+        /* FIXME: we should enforce default clock in case GPU is not in
+         * default setup
+         */
+        a.full = rfixed_const(100);
+        rdev->pm.sclk.full = rfixed_const(rdev->clock.default_sclk);
+        rdev->pm.sclk.full = rfixed_div(rdev->pm.sclk, a);
 }
 
 
@@ -409,35 +386,35 @@ uint32_t rv515_mc_rreg(struct radeon_device *rdev, uint32_t reg)
 {
         uint32_t r;
 
-        WREG32(R520_MC_IND_INDEX, 0x7f0000 | (reg & 0xffff));
-        r = RREG32(R520_MC_IND_DATA);
-        WREG32(R520_MC_IND_INDEX, 0);
+        WREG32(MC_IND_INDEX, 0x7f0000 | (reg & 0xffff));
+        r = RREG32(MC_IND_DATA);
+        WREG32(MC_IND_INDEX, 0);
         return r;
 }
 
 void rv515_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
-        WREG32(R520_MC_IND_INDEX, 0xff0000 | ((reg) & 0xffff));
-        WREG32(R520_MC_IND_DATA, (v));
-        WREG32(R520_MC_IND_INDEX, 0);
+        WREG32(MC_IND_INDEX, 0xff0000 | ((reg) & 0xffff));
+        WREG32(MC_IND_DATA, (v));
+        WREG32(MC_IND_INDEX, 0);
 }
 
 uint32_t rv515_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
 {
         uint32_t r;
 
-        WREG32(RADEON_PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        r = RREG32(RADEON_PCIE_DATA);
+        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
+        (void)RREG32(PCIE_INDEX);
+        r = RREG32(PCIE_DATA);
         return r;
 }
 
 void rv515_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 {
-        WREG32(RADEON_PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        WREG32(RADEON_PCIE_DATA, (v));
-        (void)RREG32(RADEON_PCIE_DATA);
+        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
+        (void)RREG32(PCIE_INDEX);
+        WREG32(PCIE_DATA, (v));
+        (void)RREG32(PCIE_DATA);
 }
 
 
@@ -452,13 +429,13 @@ static int rv515_debugfs_pipes_info(struct seq_file *m, void *data)
         struct radeon_device *rdev = dev->dev_private;
         uint32_t tmp;
 
-        tmp = RREG32(R400_GB_PIPE_SELECT);
+        tmp = RREG32(GB_PIPE_SELECT);
         seq_printf(m, "GB_PIPE_SELECT 0x%08x\n", tmp);
-        tmp = RREG32(R500_SU_REG_DEST);
+        tmp = RREG32(SU_REG_DEST);
         seq_printf(m, "SU_REG_DEST 0x%08x\n", tmp);
-        tmp = RREG32(R300_GB_TILE_CONFIG);
+        tmp = RREG32(GB_TILE_CONFIG);
         seq_printf(m, "GB_TILE_CONFIG 0x%08x\n", tmp);
-        tmp = RREG32(R300_DST_PIPE_CONFIG);
+        tmp = RREG32(DST_PIPE_CONFIG);
         seq_printf(m, "DST_PIPE_CONFIG 0x%08x\n", tmp);
         return 0;
 }
@@ -509,9 +486,9 @@ int rv515_debugfs_ga_info_init(struct radeon_device *rdev)
 /*
  * Asic initialization
  */
-static const unsigned r500_reg_safe_bm[159] = {
+static const unsigned r500_reg_safe_bm[219] = {
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
-        0xFFFFFFBF, 0xFFFFFFFF, 0xFFFFFFBF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
@@ -549,14 +526,575 @@ static const unsigned r500_reg_safe_bm[159] = {
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
         0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF80FFFF,
         0x00000000, 0x00000000, 0x00000000, 0x00000000,
-        0x0003FC01, 0x3FFFFCF8, 0xFE800B19,
+        0x0003FC01, 0x3FFFFCF8, 0xFE800B19, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
 };
 
-
-
 int rv515_init(struct radeon_device *rdev)
 {
         rdev->config.r300.reg_safe_bm = r500_reg_safe_bm;
         rdev->config.r300.reg_safe_bm_size = ARRAY_SIZE(r500_reg_safe_bm);
         return 0;
 }
+
+void atom_rv515_force_tv_scaler(struct radeon_device *rdev)
+{
+
+        WREG32(0x659C, 0x0);
+        WREG32(0x6594, 0x705);
+        WREG32(0x65A4, 0x10001);
+        WREG32(0x65D8, 0x0);
+        WREG32(0x65B0, 0x0);
+        WREG32(0x65C0, 0x0);
+        WREG32(0x65D4, 0x0);
+        WREG32(0x6578, 0x0);
+        WREG32(0x657C, 0x841880A8);
+        WREG32(0x6578, 0x1);
+        WREG32(0x657C, 0x84208680);
+        WREG32(0x6578, 0x2);
+        WREG32(0x657C, 0xBFF880B0);
+        WREG32(0x6578, 0x100);
+        WREG32(0x657C, 0x83D88088);
+        WREG32(0x6578, 0x101);
+        WREG32(0x657C, 0x84608680);
+        WREG32(0x6578, 0x102);
+        WREG32(0x657C, 0xBFF080D0);
+        WREG32(0x6578, 0x200);
+        WREG32(0x657C, 0x83988068);
+        WREG32(0x6578, 0x201);
+        WREG32(0x657C, 0x84A08680);
+        WREG32(0x6578, 0x202);
+        WREG32(0x657C, 0xBFF080F8);
+        WREG32(0x6578, 0x300);
+        WREG32(0x657C, 0x83588058);
+        WREG32(0x6578, 0x301);
+        WREG32(0x657C, 0x84E08660);
+        WREG32(0x6578, 0x302);
+        WREG32(0x657C, 0xBFF88120);
+        WREG32(0x6578, 0x400);
+        WREG32(0x657C, 0x83188040);
+        WREG32(0x6578, 0x401);
+        WREG32(0x657C, 0x85008660);
+        WREG32(0x6578, 0x402);
+        WREG32(0x657C, 0xBFF88150);
+        WREG32(0x6578, 0x500);
+        WREG32(0x657C, 0x82D88030);
+        WREG32(0x6578, 0x501);
+        WREG32(0x657C, 0x85408640);
+        WREG32(0x6578, 0x502);
+        WREG32(0x657C, 0xBFF88180);
+        WREG32(0x6578, 0x600);
+        WREG32(0x657C, 0x82A08018);
+        WREG32(0x6578, 0x601);
+        WREG32(0x657C, 0x85808620);
+        WREG32(0x6578, 0x602);
+        WREG32(0x657C, 0xBFF081B8);
+        WREG32(0x6578, 0x700);
+        WREG32(0x657C, 0x82608010);
+        WREG32(0x6578, 0x701);
+        WREG32(0x657C, 0x85A08600);
+        WREG32(0x6578, 0x702);
+        WREG32(0x657C, 0x800081F0);
+        WREG32(0x6578, 0x800);
+        WREG32(0x657C, 0x8228BFF8);
+        WREG32(0x6578, 0x801);
+        WREG32(0x657C, 0x85E085E0);
+        WREG32(0x6578, 0x802);
+        WREG32(0x657C, 0xBFF88228);
+        WREG32(0x6578, 0x10000);
+        WREG32(0x657C, 0x82A8BF00);
+        WREG32(0x6578, 0x10001);
+        WREG32(0x657C, 0x82A08CC0);
+        WREG32(0x6578, 0x10002);
+        WREG32(0x657C, 0x8008BEF8);
+        WREG32(0x6578, 0x10100);
+        WREG32(0x657C, 0x81F0BF28);
+        WREG32(0x6578, 0x10101);
+        WREG32(0x657C, 0x83608CA0);
+        WREG32(0x6578, 0x10102);
+        WREG32(0x657C, 0x8018BED0);
+        WREG32(0x6578, 0x10200);
+        WREG32(0x657C, 0x8148BF38);
+        WREG32(0x6578, 0x10201);
+        WREG32(0x657C, 0x84408C80);
+        WREG32(0x6578, 0x10202);
+        WREG32(0x657C, 0x8008BEB8);
+        WREG32(0x6578, 0x10300);
+        WREG32(0x657C, 0x80B0BF78);
+        WREG32(0x6578, 0x10301);
+        WREG32(0x657C, 0x85008C20);
+        WREG32(0x6578, 0x10302);
+        WREG32(0x657C, 0x8020BEA0);
+        WREG32(0x6578, 0x10400);
+        WREG32(0x657C, 0x8028BF90);
+        WREG32(0x6578, 0x10401);
+        WREG32(0x657C, 0x85E08BC0);
+        WREG32(0x6578, 0x10402);
+        WREG32(0x657C, 0x8018BE90);
+        WREG32(0x6578, 0x10500);
+        WREG32(0x657C, 0xBFB8BFB0);
+        WREG32(0x6578, 0x10501);
+        WREG32(0x657C, 0x86C08B40);
+        WREG32(0x6578, 0x10502);
+        WREG32(0x657C, 0x8010BE90);
+        WREG32(0x6578, 0x10600);
+        WREG32(0x657C, 0xBF58BFC8);
+        WREG32(0x6578, 0x10601);
+        WREG32(0x657C, 0x87A08AA0);
+        WREG32(0x6578, 0x10602);
+        WREG32(0x657C, 0x8010BE98);
+        WREG32(0x6578, 0x10700);
+        WREG32(0x657C, 0xBF10BFF0);
+        WREG32(0x6578, 0x10701);
+        WREG32(0x657C, 0x886089E0);
+        WREG32(0x6578, 0x10702);
+        WREG32(0x657C, 0x8018BEB0);
+        WREG32(0x6578, 0x10800);
+        WREG32(0x657C, 0xBED8BFE8);
+        WREG32(0x6578, 0x10801);
+        WREG32(0x657C, 0x89408940);
+        WREG32(0x6578, 0x10802);
+        WREG32(0x657C, 0xBFE8BED8);
+        WREG32(0x6578, 0x20000);
+        WREG32(0x657C, 0x80008000);
+        WREG32(0x6578, 0x20001);
+        WREG32(0x657C, 0x90008000);
+        WREG32(0x6578, 0x20002);
+        WREG32(0x657C, 0x80008000);
+        WREG32(0x6578, 0x20003);
+        WREG32(0x657C, 0x80008000);
+        WREG32(0x6578, 0x20100);
+        WREG32(0x657C, 0x80108000);
+        WREG32(0x6578, 0x20101);
+        WREG32(0x657C, 0x8FE0BF70);
+        WREG32(0x6578, 0x20102);
+        WREG32(0x657C, 0xBFE880C0);
+        WREG32(0x6578, 0x20103);
+        WREG32(0x657C, 0x80008000);
+        WREG32(0x6578, 0x20200);
+        WREG32(0x657C, 0x8018BFF8);
+        WREG32(0x6578, 0x20201);
+        WREG32(0x657C, 0x8F80BF08);
+        WREG32(0x6578, 0x20202);
+        WREG32(0x657C, 0xBFD081A0);
+        WREG32(0x6578, 0x20203);
+        WREG32(0x657C, 0xBFF88000);
+        WREG32(0x6578, 0x20300);
+        WREG32(0x657C, 0x80188000);
+        WREG32(0x6578, 0x20301);
+        WREG32(0x657C, 0x8EE0BEC0);
+        WREG32(0x6578, 0x20302);
+        WREG32(0x657C, 0xBFB082A0);
+        WREG32(0x6578, 0x20303);
+        WREG32(0x657C, 0x80008000);
+        WREG32(0x6578, 0x20400);
+        WREG32(0x657C, 0x80188000);
+        WREG32(0x6578, 0x20401);
+        WREG32(0x657C, 0x8E00BEA0);
+        WREG32(0x6578, 0x20402);
+        WREG32(0x657C, 0xBF8883C0);
+        WREG32(0x6578, 0x20403);
+        WREG32(0x657C, 0x80008000);
+        WREG32(0x6578, 0x20500);
+        WREG32(0x657C, 0x80188000);
+        WREG32(0x6578, 0x20501);
+        WREG32(0x657C, 0x8D00BE90);
+        WREG32(0x6578, 0x20502);
+        WREG32(0x657C, 0xBF588500);
+        WREG32(0x6578, 0x20503);
+        WREG32(0x657C, 0x80008008);
+        WREG32(0x6578, 0x20600);
+        WREG32(0x657C, 0x80188000);
+        WREG32(0x6578, 0x20601);
+        WREG32(0x657C, 0x8BC0BE98);
+        WREG32(0x6578, 0x20602);
+        WREG32(0x657C, 0xBF308660);
+        WREG32(0x6578, 0x20603);
+        WREG32(0x657C, 0x80008008);
+        WREG32(0x6578, 0x20700);
+        WREG32(0x657C, 0x80108000);
+        WREG32(0x6578, 0x20701);
+        WREG32(0x657C, 0x8A80BEB0);
+        WREG32(0x6578, 0x20702);
+        WREG32(0x657C, 0xBF0087C0);
+        WREG32(0x6578, 0x20703);
+        WREG32(0x657C, 0x80008008);
+        WREG32(0x6578, 0x20800);
+        WREG32(0x657C, 0x80108000);
+        WREG32(0x6578, 0x20801);
+        WREG32(0x657C, 0x8920BED0);
+        WREG32(0x6578, 0x20802);
+        WREG32(0x657C, 0xBED08920);
+        WREG32(0x6578, 0x20803);
+        WREG32(0x657C, 0x80008010);
+        WREG32(0x6578, 0x30000);
+        WREG32(0x657C, 0x90008000);
+        WREG32(0x6578, 0x30001);
+        WREG32(0x657C, 0x80008000);
+        WREG32(0x6578, 0x30100);
+        WREG32(0x657C, 0x8FE0BF90);
+        WREG32(0x6578, 0x30101);
+        WREG32(0x657C, 0xBFF880A0);
+        WREG32(0x6578, 0x30200);
+        WREG32(0x657C, 0x8F60BF40);
+        WREG32(0x6578, 0x30201);
+        WREG32(0x657C, 0xBFE88180);
+        WREG32(0x6578, 0x30300);
+        WREG32(0x657C, 0x8EC0BF00);
+        WREG32(0x6578, 0x30301);
+        WREG32(0x657C, 0xBFC88280);
+        WREG32(0x6578, 0x30400);
+        WREG32(0x657C, 0x8DE0BEE0);
+        WREG32(0x6578, 0x30401);
+        WREG32(0x657C, 0xBFA083A0);
+        WREG32(0x6578, 0x30500);
+        WREG32(0x657C, 0x8CE0BED0);
+        WREG32(0x6578, 0x30501);
+        WREG32(0x657C, 0xBF7884E0);
+        WREG32(0x6578, 0x30600);
+        WREG32(0x657C, 0x8BA0BED8);
+        WREG32(0x6578, 0x30601);
+        WREG32(0x657C, 0xBF508640);
+        WREG32(0x6578, 0x30700);
+        WREG32(0x657C, 0x8A60BEE8);
+        WREG32(0x6578, 0x30701);
+        WREG32(0x657C, 0xBF2087A0);
+        WREG32(0x6578, 0x30800);
+        WREG32(0x657C, 0x8900BF00);
+        WREG32(0x6578, 0x30801);
+        WREG32(0x657C, 0xBF008900);
+}
+
+struct rv515_watermark {
+        u32        lb_request_fifo_depth;
+        fixed20_12 num_line_pair;
+        fixed20_12 estimated_width;
+        fixed20_12 worst_case_latency;
+        fixed20_12 consumption_rate;
+        fixed20_12 active_time;
+        fixed20_12 dbpp;
+        fixed20_12 priority_mark_max;
+        fixed20_12 priority_mark;
+        fixed20_12 sclk;
+};
+
+void rv515_crtc_bandwidth_compute(struct radeon_device *rdev,
+                                  struct radeon_crtc *crtc,
+                                  struct rv515_watermark *wm)
+{
+        struct drm_display_mode *mode = &crtc->base.mode;
+        fixed20_12 a, b, c;
+        fixed20_12 pclk, request_fifo_depth, tolerable_latency, estimated_width;
+        fixed20_12 consumption_time, line_time, chunk_time, read_delay_latency;
+
+        if (!crtc->base.enabled) {
+                /* FIXME: wouldn't it better to set priority mark to maximum */
+                wm->lb_request_fifo_depth = 4;
+                return;
+        }
+
+        if (crtc->vsc.full > rfixed_const(2))
+                wm->num_line_pair.full = rfixed_const(2);
+        else
+                wm->num_line_pair.full = rfixed_const(1);
+
+        b.full = rfixed_const(mode->crtc_hdisplay);
+        c.full = rfixed_const(256);
+        a.full = rfixed_mul(wm->num_line_pair, b);
+        request_fifo_depth.full = rfixed_div(a, c);
+        if (a.full < rfixed_const(4)) {
+                wm->lb_request_fifo_depth = 4;
+        } else {
+                wm->lb_request_fifo_depth = rfixed_trunc(request_fifo_depth);
+        }
+
+        /* Determine consumption rate
+         *  pclk = pixel clock period(ns) = 1000 / (mode.clock / 1000)
+         *  vtaps = number of vertical taps,
+         *  vsc = vertical scaling ratio, defined as source/destination
+         *  hsc = horizontal scaling ration, defined as source/destination
+         */
+        a.full = rfixed_const(mode->clock);
+        b.full = rfixed_const(1000);
+        a.full = rfixed_div(a, b);
+        pclk.full = rfixed_div(b, a);
+        if (crtc->rmx_type != RMX_OFF) {
+                b.full = rfixed_const(2);
+                if (crtc->vsc.full > b.full)
+                        b.full = crtc->vsc.full;
+                b.full = rfixed_mul(b, crtc->hsc);
+                c.full = rfixed_const(2);
+                b.full = rfixed_div(b, c);
+                consumption_time.full = rfixed_div(pclk, b);
+        } else {
+                consumption_time.full = pclk.full;
+        }
+        a.full = rfixed_const(1);
+        wm->consumption_rate.full = rfixed_div(a, consumption_time);
+
+
+        /* Determine line time
+         *  LineTime = total time for one line of displayhtotal
+         *  LineTime = total number of horizontal pixels
+         *  pclk = pixel clock period(ns)
+         */
+        a.full = rfixed_const(crtc->base.mode.crtc_htotal);
+        line_time.full = rfixed_mul(a, pclk);
+
+        /* Determine active time
+         *  ActiveTime = time of active region of display within one line,
+         *  hactive = total number of horizontal active pixels
+         *  htotal = total number of horizontal pixels
+         */
+        a.full = rfixed_const(crtc->base.mode.crtc_htotal);
+        b.full = rfixed_const(crtc->base.mode.crtc_hdisplay);
+        wm->active_time.full = rfixed_mul(line_time, b);
+        wm->active_time.full = rfixed_div(wm->active_time, a);
+
+        /* Determine chunk time
+         * ChunkTime = the time it takes the DCP to send one chunk of data
+         * to the LB which consists of pipeline delay and inter chunk gap
+         * sclk = system clock(Mhz)
+         */
+        a.full = rfixed_const(600 * 1000);
+        chunk_time.full = rfixed_div(a, rdev->pm.sclk);
+        read_delay_latency.full = rfixed_const(1000);
+
+        /* Determine the worst case latency
+         * NumLinePair = Number of line pairs to request(1=2 lines, 2=4 lines)
+         * WorstCaseLatency = worst case time from urgent to when the MC starts
+         *                    to return data
+         * READ_DELAY_IDLE_MAX = constant of 1us
+         * ChunkTime = time it takes the DCP to send one chunk of data to the LB
+         *             which consists of pipeline delay and inter chunk gap
+         */
+        if (rfixed_trunc(wm->num_line_pair) > 1) {
+                a.full = rfixed_const(3);
+                wm->worst_case_latency.full = rfixed_mul(a, chunk_time);
+                wm->worst_case_latency.full += read_delay_latency.full;
+        } else {
+                wm->worst_case_latency.full = chunk_time.full + read_delay_latency.full;
+        }
+
+        /* Determine the tolerable latency
+         * TolerableLatency = Any given request has only 1 line time
+         *                    for the data to be returned
+         * LBRequestFifoDepth = Number of chunk requests the LB can
+         *                      put into the request FIFO for a display
+         *  LineTime = total time for one line of display
+         *  ChunkTime = the time it takes the DCP to send one chunk
+         *              of data to the LB which consists of
+         *  pipeline delay and inter chunk gap
+         */
+        if ((2+wm->lb_request_fifo_depth) >= rfixed_trunc(request_fifo_depth)) {
+                tolerable_latency.full = line_time.full;
+        } else {
+                tolerable_latency.full = rfixed_const(wm->lb_request_fifo_depth - 2);
+                tolerable_latency.full = request_fifo_depth.full - tolerable_latency.full;
+                tolerable_latency.full = rfixed_mul(tolerable_latency, chunk_time);
+                tolerable_latency.full = line_time.full - tolerable_latency.full;
+        }
+        /* We assume worst case 32bits (4 bytes) */
+        wm->dbpp.full = rfixed_const(2 * 16);
+
+        /* Determine the maximum priority mark
+         *  width = viewport width in pixels
+         */
+        a.full = rfixed_const(16);
+        wm->priority_mark_max.full = rfixed_const(crtc->base.mode.crtc_hdisplay);
+        wm->priority_mark_max.full = rfixed_div(wm->priority_mark_max, a);
+
+        /* Determine estimated width */
+        estimated_width.full = tolerable_latency.full - wm->worst_case_latency.full;
+        estimated_width.full = rfixed_div(estimated_width, consumption_time);
+        if (rfixed_trunc(estimated_width) > crtc->base.mode.crtc_hdisplay) {
+                wm->priority_mark.full = rfixed_const(10);
+        } else {
+                a.full = rfixed_const(16);
+                wm->priority_mark.full = rfixed_div(estimated_width, a);
+                wm->priority_mark.full = wm->priority_mark_max.full - wm->priority_mark.full;
+        }
+}
+
+void rv515_bandwidth_avivo_update(struct radeon_device *rdev)
+{
+        struct drm_display_mode *mode0 = NULL;
+        struct drm_display_mode *mode1 = NULL;
+        struct rv515_watermark wm0;
+        struct rv515_watermark wm1;
+        u32 tmp;
+        fixed20_12 priority_mark02, priority_mark12, fill_rate;
+        fixed20_12 a, b;
+
+        if (rdev->mode_info.crtcs[0]->base.enabled)
+                mode0 = &rdev->mode_info.crtcs[0]->base.mode;
+        if (rdev->mode_info.crtcs[1]->base.enabled)
+                mode1 = &rdev->mode_info.crtcs[1]->base.mode;
+        rs690_line_buffer_adjust(rdev, mode0, mode1);
+
+        rv515_crtc_bandwidth_compute(rdev, rdev->mode_info.crtcs[0], &wm0);
+        rv515_crtc_bandwidth_compute(rdev, rdev->mode_info.crtcs[1], &wm1);
+
+        tmp = wm0.lb_request_fifo_depth;
+        tmp |= wm1.lb_request_fifo_depth << 16;
+        WREG32(LB_MAX_REQ_OUTSTANDING, tmp);
+
+        if (mode0 && mode1) {
+                if (rfixed_trunc(wm0.dbpp) > 64)
+                        a.full = rfixed_div(wm0.dbpp, wm0.num_line_pair);
+                else
+                        a.full = wm0.num_line_pair.full;
+                if (rfixed_trunc(wm1.dbpp) > 64)
+                        b.full = rfixed_div(wm1.dbpp, wm1.num_line_pair);
+                else
+                        b.full = wm1.num_line_pair.full;
+                a.full += b.full;
+                fill_rate.full = rfixed_div(wm0.sclk, a);
+                if (wm0.consumption_rate.full > fill_rate.full) {
+                        b.full = wm0.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm0.active_time);
+                        a.full = rfixed_const(16);
+                        b.full = rfixed_div(b, a);
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        priority_mark02.full = a.full + b.full;
+                } else {
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark02.full = rfixed_div(a, b);
+                }
+                if (wm1.consumption_rate.full > fill_rate.full) {
+                        b.full = wm1.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm1.active_time);
+                        a.full = rfixed_const(16);
+                        b.full = rfixed_div(b, a);
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        priority_mark12.full = a.full + b.full;
+                } else {
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark12.full = rfixed_div(a, b);
+                }
+                if (wm0.priority_mark.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark.full;
+                if (rfixed_trunc(priority_mark02) < 0)
+                        priority_mark02.full = 0;
+                if (wm0.priority_mark_max.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark_max.full;
+                if (wm1.priority_mark.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark.full;
+                if (rfixed_trunc(priority_mark12) < 0)
+                        priority_mark12.full = 0;
+                if (wm1.priority_mark_max.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark_max.full;
+                WREG32(D1MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D1MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D2MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark12));
+                WREG32(D2MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark12));
+        } else if (mode0) {
+                if (rfixed_trunc(wm0.dbpp) > 64)
+                        a.full = rfixed_div(wm0.dbpp, wm0.num_line_pair);
+                else
+                        a.full = wm0.num_line_pair.full;
+                fill_rate.full = rfixed_div(wm0.sclk, a);
+                if (wm0.consumption_rate.full > fill_rate.full) {
+                        b.full = wm0.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm0.active_time);
+                        a.full = rfixed_const(16);
+                        b.full = rfixed_div(b, a);
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        priority_mark02.full = a.full + b.full;
+                } else {
+                        a.full = rfixed_mul(wm0.worst_case_latency,
+                                                wm0.consumption_rate);
+                        b.full = rfixed_const(16);
+                        priority_mark02.full = rfixed_div(a, b);
+                }
+                if (wm0.priority_mark.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark.full;
+                if (rfixed_trunc(priority_mark02) < 0)
+                        priority_mark02.full = 0;
+                if (wm0.priority_mark_max.full > priority_mark02.full)
+                        priority_mark02.full = wm0.priority_mark_max.full;
+                WREG32(D1MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D1MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark02));
+                WREG32(D2MODE_PRIORITY_A_CNT, MODE_PRIORITY_OFF);
+                WREG32(D2MODE_PRIORITY_B_CNT, MODE_PRIORITY_OFF);
+        } else {
+                if (rfixed_trunc(wm1.dbpp) > 64)
+                        a.full = rfixed_div(wm1.dbpp, wm1.num_line_pair);
+                else
+                        a.full = wm1.num_line_pair.full;
+                fill_rate.full = rfixed_div(wm1.sclk, a);
+                if (wm1.consumption_rate.full > fill_rate.full) {
+                        b.full = wm1.consumption_rate.full - fill_rate.full;
+                        b.full = rfixed_mul(b, wm1.active_time);
+                        a.full = rfixed_const(16);
+                        b.full = rfixed_div(b, a);
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        priority_mark12.full = a.full + b.full;
+                } else {
+                        a.full = rfixed_mul(wm1.worst_case_latency,
+                                                wm1.consumption_rate);
+                        b.full = rfixed_const(16 * 1000);
+                        priority_mark12.full = rfixed_div(a, b);
+                }
+                if (wm1.priority_mark.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark.full;
+                if (rfixed_trunc(priority_mark12) < 0)
+                        priority_mark12.full = 0;
+                if (wm1.priority_mark_max.full > priority_mark12.full)
+                        priority_mark12.full = wm1.priority_mark_max.full;
+                WREG32(D1MODE_PRIORITY_A_CNT, MODE_PRIORITY_OFF);
+                WREG32(D1MODE_PRIORITY_B_CNT, MODE_PRIORITY_OFF);
+                WREG32(D2MODE_PRIORITY_A_CNT, rfixed_trunc(priority_mark12));
+                WREG32(D2MODE_PRIORITY_B_CNT, rfixed_trunc(priority_mark12));
+        }
+}
+
+void rv515_bandwidth_update(struct radeon_device *rdev)
+{
+        uint32_t tmp;
+        struct drm_display_mode *mode0 = NULL;
+        struct drm_display_mode *mode1 = NULL;
+
+        if (rdev->mode_info.crtcs[0]->base.enabled)
+                mode0 = &rdev->mode_info.crtcs[0]->base.mode;
+        if (rdev->mode_info.crtcs[1]->base.enabled)
+                mode1 = &rdev->mode_info.crtcs[1]->base.mode;
+        /*
+         * Set display0/1 priority up in the memory controller for
+         * modes if the user specifies HIGH for displaypriority
+         * option.
+         */
+        if (rdev->disp_priority == 2) {
+                tmp = RREG32_MC(MC_MISC_LAT_TIMER);
+                tmp &= ~MC_DISP1R_INIT_LAT_MASK;
+                tmp &= ~MC_DISP0R_INIT_LAT_MASK;
+                if (mode1)
+                        tmp |= (1 << MC_DISP1R_INIT_LAT_SHIFT);
+                if (mode0)
+                        tmp |= (1 << MC_DISP0R_INIT_LAT_SHIFT);
+                WREG32_MC(MC_MISC_LAT_TIMER, tmp);
+        }
+        rv515_bandwidth_avivo_update(rdev);
+}
diff --git a/drivers/gpu/drm/radeon/rv515r.h b/drivers/gpu/drm/radeon/rv515r.h
new file mode 100644
index 000000000000..f3cf84039906
--- /dev/null
+++ b/drivers/gpu/drm/radeon/rv515r.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright 2008 Advanced Micro Devices, Inc.
+ * Copyright 2008 Red Hat Inc.
+ * Copyright 2009 Jerome Glisse.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Dave Airlie
+ *          Alex Deucher
+ *          Jerome Glisse
+ */
+#ifndef RV515R_H
+#define RV515R_H
+
+/* RV515 registers */
+#define PCIE_INDEX                      0x0030
+#define PCIE_DATA                       0x0034
+#define MC_IND_INDEX                    0x0070
+#define         MC_IND_WR_EN                            (1 << 24)
+#define MC_IND_DATA                     0x0074
+#define RBBM_SOFT_RESET                 0x00F0
+#define CONFIG_MEMSIZE                  0x00F8
+#define HDP_FB_LOCATION                 0x0134
+#define CP_CSQ_CNTL                     0x0740
+#define CP_CSQ_MODE                     0x0744
+#define CP_CSQ_ADDR                     0x07F0
+#define CP_CSQ_DATA                     0x07F4
+#define CP_CSQ_STAT                     0x07F8
+#define CP_CSQ2_STAT                    0x07FC
+#define RBBM_STATUS                     0x0E40
+#define DST_PIPE_CONFIG                 0x170C
+#define WAIT_UNTIL                      0x1720
+#define         WAIT_2D_IDLE                            (1 << 14)
+#define         WAIT_3D_IDLE                            (1 << 15)
+#define         WAIT_2D_IDLECLEAN                       (1 << 16)
+#define         WAIT_3D_IDLECLEAN                       (1 << 17)
+#define ISYNC_CNTL                      0x1724
+#define         ISYNC_ANY2D_IDLE3D                      (1 << 0)
+#define         ISYNC_ANY3D_IDLE2D                      (1 << 1)
+#define         ISYNC_TRIG2D_IDLE3D                     (1 << 2)
+#define         ISYNC_TRIG3D_IDLE2D                     (1 << 3)
+#define         ISYNC_WAIT_IDLEGUI                      (1 << 4)
+#define         ISYNC_CPSCRATCH_IDLEGUI                 (1 << 5)
+#define VAP_INDEX_OFFSET                0x208C
+#define VAP_PVS_STATE_FLUSH_REG         0x2284
+#define GB_ENABLE                       0x4008
+#define GB_MSPOS0                       0x4010
+#define         MS_X0_SHIFT                             0
+#define         MS_Y0_SHIFT                             4
+#define         MS_X1_SHIFT                             8
+#define         MS_Y1_SHIFT                             12
+#define         MS_X2_SHIFT                             16
+#define         MS_Y2_SHIFT                             20
+#define         MSBD0_Y_SHIFT                           24
+#define         MSBD0_X_SHIFT                           28
+#define GB_MSPOS1                       0x4014
+#define         MS_X3_SHIFT                             0
+#define         MS_Y3_SHIFT                             4
+#define         MS_X4_SHIFT                             8
+#define         MS_Y4_SHIFT                             12
+#define         MS_X5_SHIFT                             16
+#define         MS_Y5_SHIFT                             20
+#define         MSBD1_SHIFT                             24
+#define GB_TILE_CONFIG                  0x4018
+#define         ENABLE_TILING                           (1 << 0)
+#define         PIPE_COUNT_MASK                         0x0000000E
+#define         PIPE_COUNT_SHIFT                        1
+#define         TILE_SIZE_8                             (0 << 4)
+#define         TILE_SIZE_16                            (1 << 4)
+#define         TILE_SIZE_32                            (2 << 4)
+#define         SUBPIXEL_1_12                           (0 << 16)
+#define         SUBPIXEL_1_16                           (1 << 16)
+#define GB_SELECT                       0x401C
+#define GB_AA_CONFIG                    0x4020
+#define GB_PIPE_SELECT                  0x402C
+#define GA_ENHANCE                      0x4274
+#define         GA_DEADLOCK_CNTL                        (1 << 0)
+#define         GA_FASTSYNC_CNTL                        (1 << 1)
+#define GA_POLY_MODE                    0x4288
+#define         FRONT_PTYPE_POINT                       (0 << 4)
+#define         FRONT_PTYPE_LINE                        (1 << 4)
+#define         FRONT_PTYPE_TRIANGE                     (2 << 4)
+#define         BACK_PTYPE_POINT                        (0 << 7)
+#define         BACK_PTYPE_LINE                         (1 << 7)
+#define         BACK_PTYPE_TRIANGE                      (2 << 7)
+#define GA_ROUND_MODE                   0x428C
+#define         GEOMETRY_ROUND_TRUNC                    (0 << 0)
+#define         GEOMETRY_ROUND_NEAREST                  (1 << 0)
+#define         COLOR_ROUND_TRUNC                       (0 << 2)
+#define         COLOR_ROUND_NEAREST                     (1 << 2)
+#define SU_REG_DEST                     0x42C8
+#define RB3D_DSTCACHE_CTLSTAT           0x4E4C
+#define         RB3D_DC_FLUSH                           (2 << 0)
+#define         RB3D_DC_FREE                            (2 << 2)
+#define         RB3D_DC_FINISH                          (1 << 4)
+#define ZB_ZCACHE_CTLSTAT               0x4F18
+#define         ZC_FLUSH                                (1 << 0)
+#define         ZC_FREE                                 (1 << 1)
+#define DC_LB_MEMORY_SPLIT              0x6520
+#define         DC_LB_MEMORY_SPLIT_MASK                 0x00000003
+#define         DC_LB_MEMORY_SPLIT_SHIFT                0
+#define         DC_LB_MEMORY_SPLIT_D1HALF_D2HALF        0
+#define         DC_LB_MEMORY_SPLIT_D1_3Q_D2_1Q          1
+#define         DC_LB_MEMORY_SPLIT_D1_ONLY              2
+#define         DC_LB_MEMORY_SPLIT_D1_1Q_D2_3Q          3
+#define         DC_LB_MEMORY_SPLIT_SHIFT_MODE           (1 << 2)
+#define         DC_LB_DISP1_END_ADR_SHIFT               4
+#define         DC_LB_DISP1_END_ADR_MASK                0x00007FF0
+#define D1MODE_PRIORITY_A_CNT           0x6548
+#define         MODE_PRIORITY_MARK_MASK                 0x00007FFF
+#define         MODE_PRIORITY_OFF                       (1 << 16)
+#define         MODE_PRIORITY_ALWAYS_ON                 (1 << 20)
+#define         MODE_PRIORITY_FORCE_MASK                (1 << 24)
+#define D1MODE_PRIORITY_B_CNT           0x654C
+#define LB_MAX_REQ_OUTSTANDING          0x6D58
+#define         LB_D1_MAX_REQ_OUTSTANDING_MASK          0x0000000F
+#define         LB_D1_MAX_REQ_OUTSTANDING_SHIFT         0
+#define         LB_D2_MAX_REQ_OUTSTANDING_MASK          0x000F0000
+#define         LB_D2_MAX_REQ_OUTSTANDING_SHIFT         16
+#define D2MODE_PRIORITY_A_CNT           0x6D48
+#define D2MODE_PRIORITY_B_CNT           0x6D4C
+
+/* ix[MC] registers */
+#define MC_FB_LOCATION                  0x01
+#define         MC_FB_START_MASK                        0x0000FFFF
+#define         MC_FB_START_SHIFT                       0
+#define         MC_FB_TOP_MASK                          0xFFFF0000
+#define         MC_FB_TOP_SHIFT                         16
+#define MC_AGP_LOCATION                 0x02
+#define         MC_AGP_START_MASK                       0x0000FFFF
+#define         MC_AGP_START_SHIFT                      0
+#define         MC_AGP_TOP_MASK                         0xFFFF0000
+#define         MC_AGP_TOP_SHIFT                        16
+#define MC_AGP_BASE                     0x03
+#define MC_AGP_BASE_2                   0x04
+#define MC_CNTL                         0x5
+#define         MEM_NUM_CHANNELS_MASK                   0x00000003
+#define MC_STATUS                       0x08
+#define         MC_STATUS_IDLE                          (1 << 4)
+#define MC_MISC_LAT_TIMER               0x09
+#define         MC_CPR_INIT_LAT_MASK                    0x0000000F
+#define         MC_VF_INIT_LAT_MASK                     0x000000F0
+#define         MC_DISP0R_INIT_LAT_MASK                 0x00000F00
+#define         MC_DISP0R_INIT_LAT_SHIFT                8
+#define         MC_DISP1R_INIT_LAT_MASK                 0x0000F000
+#define         MC_DISP1R_INIT_LAT_SHIFT                12
+#define         MC_FIXED_INIT_LAT_MASK                  0x000F0000
+#define         MC_E2R_INIT_LAT_MASK                    0x00F00000
+#define         SAME_PAGE_PRIO_MASK                     0x0F000000
+#define         MC_GLOBW_INIT_LAT_MASK                  0xF0000000
+
+
+#endif
+
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index da50cc51ede3..21d8ffd57308 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -67,7 +67,7 @@ int rv770_mc_init(struct radeon_device *rdev)
                        "programming pipes. Bad things might happen.\n");
         }
 
-        tmp = rdev->mc.vram_location + rdev->mc.vram_size - 1;
+        tmp = rdev->mc.vram_location + rdev->mc.mc_vram_size - 1;
         tmp = REG_SET(R700_MC_FB_TOP, tmp >> 24);
         tmp |= REG_SET(R700_MC_FB_BASE, rdev->mc.vram_location >> 24);
         WREG32(R700_MC_VM_FB_LOCATION, tmp);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index c1c407f7cca3..6538d4236989 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -43,7 +43,6 @@
 #define TTM_BO_HASH_ORDER 13
 
 static int ttm_bo_setup_vm(struct ttm_buffer_object *bo);
-static void ttm_bo_unmap_virtual(struct ttm_buffer_object *bo);
 static int ttm_bo_swapout(struct ttm_mem_shrink *shrink);
 
 static inline uint32_t ttm_bo_type_flags(unsigned type)
@@ -224,6 +223,9 @@ static int ttm_bo_add_ttm(struct ttm_buffer_object *bo, bool zero_alloc)
         TTM_ASSERT_LOCKED(&bo->mutex);
         bo->ttm = NULL;
 
+        if (bdev->need_dma32)
+                page_flags |= TTM_PAGE_FLAG_DMA32;
+
         switch (bo->type) {
         case ttm_bo_type_device:
                 if (zero_alloc)
@@ -304,6 +306,9 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 
         }
 
+        if (bdev->driver->move_notify)
+                bdev->driver->move_notify(bo, mem);
+
         if (!(old_man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
             !(new_man->flags & TTM_MEMTYPE_FLAG_FIXED))
                 ret = ttm_bo_move_ttm(bo, evict, no_wait, mem);
@@ -655,31 +660,52 @@ retry_pre_get:
         return 0;
 }
 
+static uint32_t ttm_bo_select_caching(struct ttm_mem_type_manager *man,
+                                      uint32_t cur_placement,
+                                      uint32_t proposed_placement)
+{
+        uint32_t caching = proposed_placement & TTM_PL_MASK_CACHING;
+        uint32_t result = proposed_placement & ~TTM_PL_MASK_CACHING;
+
+        /**
+         * Keep current caching if possible.
+         */
+
+        if ((cur_placement & caching) != 0)
+                result |= (cur_placement & caching);
+        else if ((man->default_caching & caching) != 0)
+                result |= man->default_caching;
+        else if ((TTM_PL_FLAG_CACHED & caching) != 0)
+                result |= TTM_PL_FLAG_CACHED;
+        else if ((TTM_PL_FLAG_WC & caching) != 0)
+                result |= TTM_PL_FLAG_WC;
+        else if ((TTM_PL_FLAG_UNCACHED & caching) != 0)
+                result |= TTM_PL_FLAG_UNCACHED;
+
+        return result;
+}
+
+
 static bool ttm_bo_mt_compatible(struct ttm_mem_type_manager *man,
                                  bool disallow_fixed,
                                  uint32_t mem_type,
-                                 uint32_t mask, uint32_t *res_mask)
+                                 uint32_t proposed_placement,
+                                 uint32_t *masked_placement)
 {
         uint32_t cur_flags = ttm_bo_type_flags(mem_type);
 
         if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) && disallow_fixed)
                 return false;
 
-        if ((cur_flags & mask & TTM_PL_MASK_MEM) == 0)
+        if ((cur_flags & proposed_placement & TTM_PL_MASK_MEM) == 0)
                 return false;
 
-        if ((mask & man->available_caching) == 0)
+        if ((proposed_placement & man->available_caching) == 0)
                 return false;
-        if (mask & man->default_caching)
-                cur_flags |= man->default_caching;
-        else if (mask & TTM_PL_FLAG_CACHED)
-                cur_flags |= TTM_PL_FLAG_CACHED;
-        else if (mask & TTM_PL_FLAG_WC)
-                cur_flags |= TTM_PL_FLAG_WC;
-        else
-                cur_flags |= TTM_PL_FLAG_UNCACHED;
 
-        *res_mask = cur_flags;
+        cur_flags |= (proposed_placement & man->available_caching);
+
+        *masked_placement = cur_flags;
         return true;
 }
 
@@ -723,6 +749,9 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                 if (!type_ok)
                         continue;
 
+                cur_flags = ttm_bo_select_caching(man, bo->mem.placement,
+                                                  cur_flags);
+
                 if (mem_type == TTM_PL_SYSTEM)
                         break;
 
@@ -779,6 +808,9 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                                           proposed_placement, &cur_flags))
                         continue;
 
+                cur_flags = ttm_bo_select_caching(man, bo->mem.placement,
+                                                  cur_flags);
+
                 ret = ttm_bo_mem_force_space(bdev, mem, mem_type,
                                              interruptible, no_wait);
 
@@ -1305,7 +1337,8 @@ EXPORT_SYMBOL(ttm_bo_device_release);
 
 int ttm_bo_device_init(struct ttm_bo_device *bdev,
                        struct ttm_mem_global *mem_glob,
-                       struct ttm_bo_driver *driver, uint64_t file_page_offset)
+                       struct ttm_bo_driver *driver, uint64_t file_page_offset,
+                       bool need_dma32)
 {
         int ret = -EINVAL;
 
@@ -1342,6 +1375,7 @@ int ttm_bo_device_init(struct ttm_bo_device *bdev,
         INIT_LIST_HEAD(&bdev->ddestroy);
         INIT_LIST_HEAD(&bdev->swap_lru);
         bdev->dev_mapping = NULL;
+        bdev->need_dma32 = need_dma32;
         ttm_mem_init_shrink(&bdev->shrink, ttm_bo_swapout);
         ret = ttm_mem_register_shrink(mem_glob, &bdev->shrink);
         if (unlikely(ret != 0)) {
@@ -1419,6 +1453,7 @@ void ttm_bo_unmap_virtual(struct ttm_buffer_object *bo)
 
         unmap_mapping_range(bdev->dev_mapping, offset, holelen, 1);
 }
+EXPORT_SYMBOL(ttm_bo_unmap_virtual);
 
 static void ttm_bo_vm_insert_rb(struct ttm_buffer_object *bo)
 {
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index bdec583901eb..ce2e6f38ea01 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -136,7 +136,8 @@ static int ttm_copy_io_page(void *dst, void *src, unsigned long page)
 }
 
 static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
-                                unsigned long page)
+                                unsigned long page,
+                                pgprot_t prot)
 {
         struct page *d = ttm_tt_get_page(ttm, page);
         void *dst;
@@ -145,17 +146,35 @@ static int ttm_copy_io_ttm_page(struct ttm_tt *ttm, void *src,
                 return -ENOMEM;
 
         src = (void *)((unsigned long)src + (page << PAGE_SHIFT));
-        dst = kmap(d);
+
+#ifdef CONFIG_X86
+        dst = kmap_atomic_prot(d, KM_USER0, prot);
+#else
+        if (prot != PAGE_KERNEL)
+                dst = vmap(&d, 1, 0, prot);
+        else
+                dst = kmap(d);
+#endif
         if (!dst)
                 return -ENOMEM;
 
         memcpy_fromio(dst, src, PAGE_SIZE);
-        kunmap(d);
+
+#ifdef CONFIG_X86
+        kunmap_atomic(dst, KM_USER0);
+#else
+        if (prot != PAGE_KERNEL)
+                vunmap(dst);
+        else
+                kunmap(d);
+#endif
+
         return 0;
 }
 
 static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
-                                unsigned long page)
+                                unsigned long page,
+                                pgprot_t prot)
 {
         struct page *s = ttm_tt_get_page(ttm, page);
         void *src;
@@ -164,12 +183,28 @@ static int ttm_copy_ttm_io_page(struct ttm_tt *ttm, void *dst,
                 return -ENOMEM;
 
         dst = (void *)((unsigned long)dst + (page << PAGE_SHIFT));
-        src = kmap(s);
+#ifdef CONFIG_X86
+        src = kmap_atomic_prot(s, KM_USER0, prot);
+#else
+        if (prot != PAGE_KERNEL)
+                src = vmap(&s, 1, 0, prot);
+        else
+                src = kmap(s);
+#endif
         if (!src)
                 return -ENOMEM;
 
         memcpy_toio(dst, src, PAGE_SIZE);
-        kunmap(s);
+
+#ifdef CONFIG_X86
+        kunmap_atomic(src, KM_USER0);
+#else
+        if (prot != PAGE_KERNEL)
+                vunmap(src);
+        else
+                kunmap(s);
+#endif
+
         return 0;
 }
 
@@ -214,11 +249,17 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
 
         for (i = 0; i < new_mem->num_pages; ++i) {
                 page = i * dir + add;
-                if (old_iomap == NULL)
-                        ret = ttm_copy_ttm_io_page(ttm, new_iomap, page);
-                else if (new_iomap == NULL)
-                        ret = ttm_copy_io_ttm_page(ttm, old_iomap, page);
-                else
+                if (old_iomap == NULL) {
+                        pgprot_t prot = ttm_io_prot(old_mem->placement,
+                                                    PAGE_KERNEL);
+                        ret = ttm_copy_ttm_io_page(ttm, new_iomap, page,
+                                                   prot);
+                } else if (new_iomap == NULL) {
+                        pgprot_t prot = ttm_io_prot(new_mem->placement,
+                                                    PAGE_KERNEL);
+                        ret = ttm_copy_io_ttm_page(ttm, old_iomap, page,
+                                                   prot);
+                } else
                         ret = ttm_copy_io_page(new_iomap, old_iomap, page);
                 if (ret)
                         goto out1;
@@ -509,8 +550,8 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
         if (evict) {
                 ret = ttm_bo_wait(bo, false, false, false);
                 spin_unlock(&bo->lock);
-                driver->sync_obj_unref(&bo->sync_obj);
-
+                if (tmp_obj)
+                        driver->sync_obj_unref(&tmp_obj);
                 if (ret)
                         return ret;
 
@@ -532,6 +573,8 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
 
                 set_bit(TTM_BO_PRIV_FLAG_MOVING, &bo->priv_flags);
                 spin_unlock(&bo->lock);
+                if (tmp_obj)
+                        driver->sync_obj_unref(&tmp_obj);
 
                 ret = ttm_buffer_object_transfer(bo, &ghost_obj);
                 if (ret)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index fe949a12fe40..33de7637c0c6 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -101,6 +101,9 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                 return VM_FAULT_NOPAGE;
         }
 
+        if (bdev->driver->fault_reserve_notify)
+                bdev->driver->fault_reserve_notify(bo);
+
         /*
          * Wait for buffer data in transit, due to a pipelined
          * move.
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index 75dc8bd24592..b8b6c4a5f983 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -86,10 +86,16 @@ void ttm_tt_cache_flush(struct page *pages[], unsigned long num_pages)
         unsigned long i;
 
         for (i = 0; i < num_pages; ++i) {
-                if (pages[i]) {
-                        unsigned long start = (unsigned long)page_address(pages[i]);
-                        flush_dcache_range(start, start + PAGE_SIZE);
-                }
+                struct page *page = pages[i];
+                void *page_virtual;
+
+                if (unlikely(page == NULL))
+                        continue;
+
+                page_virtual = kmap_atomic(page, KM_USER0);
+                flush_dcache_range((unsigned long) page_virtual,
+                                   (unsigned long) page_virtual + PAGE_SIZE);
+                kunmap_atomic(page_virtual, KM_USER0);
         }
 #else
         if (on_each_cpu(ttm_tt_ipi_handler, NULL, 1) != 0)
@@ -131,10 +137,17 @@ static void ttm_tt_free_page_directory(struct ttm_tt *ttm)
 
 static struct page *ttm_tt_alloc_page(unsigned page_flags)
 {
+        gfp_t gfp_flags = GFP_USER;
+
         if (page_flags & TTM_PAGE_FLAG_ZERO_ALLOC)
-                return alloc_page(GFP_HIGHUSER | __GFP_ZERO);
+                gfp_flags |= __GFP_ZERO;
+
+        if (page_flags & TTM_PAGE_FLAG_DMA32)
+                gfp_flags |= __GFP_DMA32;
+        else
+                gfp_flags |= __GFP_HIGHMEM;
 
-        return alloc_page(GFP_HIGHUSER);
+        return alloc_page(gfp_flags);
 }
 
 static void ttm_tt_free_user_pages(struct ttm_tt *ttm)
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index bff0103610c1..fe4fa29c9219 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -593,7 +593,11 @@ static int atk_add_sensor(struct atk_data *data, union acpi_object *obj)
         sensor->data = data;
         sensor->id = flags->integer.value;
         sensor->limit1 = limit1->integer.value;
-        sensor->limit2 = limit2->integer.value;
+        if (data->old_interface)
+                sensor->limit2 = limit2->integer.value;
+        else
+                /* The upper limit is expressed as delta from lower limit */
+                sensor->limit2 = sensor->limit1 + limit2->integer.value;
 
         snprintf(sensor->input_attr_name, ATTR_NAME_SIZE,
                         "%s%d_input", base_name, start + *num);
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index a92dbb97ee99..ba75bfcf14ce 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -86,6 +86,7 @@ superio_exit(void)
 #define SUPERIO_REG_ACT         0x30
 #define SUPERIO_REG_BASE        0x60
 #define SUPERIO_REG_DEVID       0x20
+#define SUPERIO_REG_DEVREV      0x21
 
 /* Logical device registers */
 
@@ -429,6 +430,9 @@ static int __init smsc47m1_find(unsigned short *addr,
          * The LPC47M292 (device id 0x6B) is somewhat compatible, but it
          * supports a 3rd fan, and the pin configuration registers are
          * unfortunately different.
+         * The LPC47M233 has the same device id (0x6B) but is not compatible.
+         * We check the high bit of the device revision register to
+         * differentiate them.
          */
         switch (val) {
         case 0x51:
@@ -448,6 +452,13 @@ static int __init smsc47m1_find(unsigned short *addr,
                 sio_data->type = smsc47m1;
                 break;
         case 0x6B:
+                if (superio_inb(SUPERIO_REG_DEVREV) & 0x80) {
+                        pr_debug(DRVNAME ": "
+                                 "Found SMSC LPC47M233, unsupported\n");
+                        superio_exit();
+                        return -ENODEV;
+                }
+
                 pr_info(DRVNAME ": Found SMSC LPC47M292\n");
                 sio_data->type = smsc47m2;
                 break;
diff --git a/drivers/i2c/chips/tsl2550.c b/drivers/i2c/chips/tsl2550.c
index 1a9cc135219f..b96f3025e588 100644
--- a/drivers/i2c/chips/tsl2550.c
+++ b/drivers/i2c/chips/tsl2550.c
@@ -27,7 +27,7 @@
 #include <linux/delay.h>
 
 #define TSL2550_DRV_NAME        "tsl2550"
-#define DRIVER_VERSION          "1.1.1"
+#define DRIVER_VERSION          "1.1.2"
 
 /*
  * Defines
@@ -189,13 +189,16 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
         u8 r = 128;
 
         /* Avoid division by 0 and count 1 cannot be greater than count 0 */
-        if (c0 && (c1 <= c0))
-                r = c1 * 128 / c0;
+        if (c1 <= c0)
+                if (c0) {
+                        r = c1 * 128 / c0;
+
+                        /* Calculate LUX */
+                        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+                } else
+                        lux = 0;
         else
-                return -1;
-
-        /* Calculate LUX */
-        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+                return -EAGAIN;
 
         /* LUX range check */
         return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index 990e6a7e6674..c3b661a666cb 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -731,10 +731,10 @@ l1oip_socket_thread(void *data)
         while (!signal_pending(current)) {
                 struct kvec iov = {
                         .iov_base = recvbuf,
-                        .iov_len = sizeof(recvbuf),
+                        .iov_len = recvbuf_size,
                 };
                 recvlen = kernel_recvmsg(socket, &msg, &iov, 1,
-                                         sizeof(recvbuf), 0);
+                                         recvbuf_size, 0);
                 if (recvlen > 0) {
                         l1oip_socket_parse(hc, &sin_rx, recvbuf, recvlen);
                 } else {
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 529e2ba505c3..ed1038164019 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1318,7 +1318,7 @@ static int crypt_iterate_devices(struct dm_target *ti,
 {
         struct crypt_config *cc = ti->private;
 
-        return fn(ti, cc->dev, cc->start, data);
+        return fn(ti, cc->dev, cc->start, ti->len, data);
 }
 
 static struct target_type crypt_target = {
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 4e5b843cd4d7..ebe7381f47c8 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -324,12 +324,12 @@ static int delay_iterate_devices(struct dm_target *ti,
         struct delay_c *dc = ti->private;
         int ret = 0;
 
-        ret = fn(ti, dc->dev_read, dc->start_read, data);
+        ret = fn(ti, dc->dev_read, dc->start_read, ti->len, data);
         if (ret)
                 goto out;
 
         if (dc->dev_write)
-                ret = fn(ti, dc->dev_write, dc->start_write, data);
+                ret = fn(ti, dc->dev_write, dc->start_write, ti->len, data);
 
 out:
         return ret;
diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
index 9184b6deb868..82f7d6e6b1ea 100644
--- a/drivers/md/dm-linear.c
+++ b/drivers/md/dm-linear.c
@@ -139,7 +139,7 @@ static int linear_iterate_devices(struct dm_target *ti,
 {
         struct linear_c *lc = ti->private;
 
-        return fn(ti, lc->dev, lc->start, data);
+        return fn(ti, lc->dev, lc->start, ti->len, data);
 }
 
 static struct target_type linear_target = {
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index c70604a20897..6f0d90d4a541 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1453,7 +1453,7 @@ static int multipath_iterate_devices(struct dm_target *ti,
 
         list_for_each_entry(pg, &m->priority_groups, list) {
                 list_for_each_entry(p, &pg->pgpaths, list) {
-                        ret = fn(ti, p->path.dev, ti->begin, data);
+                        ret = fn(ti, p->path.dev, ti->begin, ti->len, data);
                         if (ret)
                                 goto out;
                 }
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index ce8868c768cc..9726577cde49 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -638,6 +638,7 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
                 spin_lock_irq(&ms->lock);
                 bio_list_merge(&ms->writes, &requeue);
                 spin_unlock_irq(&ms->lock);
+                delayed_wake(ms);
         }
 
         /*
@@ -1292,7 +1293,7 @@ static int mirror_iterate_devices(struct dm_target *ti,
 
         for (i = 0; !ret && i < ms->nr_mirrors; i++)
                 ret = fn(ti, ms->mirror[i].dev,
-                         ms->mirror[i].offset, data);
+                         ms->mirror[i].offset, ti->len, data);
 
         return ret;
 }
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index b240e85ae39a..4e0e5937e42a 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -320,10 +320,11 @@ static int stripe_iterate_devices(struct dm_target *ti,
         int ret = 0;
         unsigned i = 0;
 
-        do
+        do {
                 ret = fn(ti, sc->stripe[i].dev,
-                         sc->stripe[i].physical_start, data);
-        while (!ret && ++i < sc->stripes);
+                         sc->stripe[i].physical_start,
+                         sc->stripe_width, data);
+        } while (!ret && ++i < sc->stripes);
 
         return ret;
 }
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 2cba557d9e61..d952b3441913 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -346,7 +346,7 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md)
  * If possible, this checks an area of a destination device is valid.
  */
 static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
-                                sector_t start, void *data)
+                                sector_t start, sector_t len, void *data)
 {
         struct queue_limits *limits = data;
         struct block_device *bdev = dev->bdev;
@@ -359,7 +359,7 @@ static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
         if (!dev_size)
                 return 1;
 
-        if ((start >= dev_size) || (start + ti->len > dev_size)) {
+        if ((start >= dev_size) || (start + len > dev_size)) {
                 DMWARN("%s: %s too small for target",
                        dm_device_name(ti->table->md), bdevname(bdev, b));
                 return 0;
@@ -377,11 +377,11 @@ static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
                 return 0;
         }
 
-        if (ti->len & (logical_block_size_sectors - 1)) {
+        if (len & (logical_block_size_sectors - 1)) {
                 DMWARN("%s: len=%llu not aligned to h/w "
                        "logical block size %hu of %s",
                        dm_device_name(ti->table->md),
-                       (unsigned long long)ti->len,
+                       (unsigned long long)len,
                        limits->logical_block_size, bdevname(bdev, b));
                 return 0;
         }
@@ -482,7 +482,7 @@ static int __table_get_device(struct dm_table *t, struct dm_target *ti,
 #define min_not_zero(l, r) (l == 0) ? r : ((r == 0) ? l : min(l, r))
 
 int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
-                         sector_t start, void *data)
+                         sector_t start, sector_t len, void *data)
 {
         struct queue_limits *limits = data;
         struct block_device *bdev = dev->bdev;
@@ -830,11 +830,6 @@ unsigned dm_table_get_type(struct dm_table *t)
         return t->type;
 }
 
-bool dm_table_bio_based(struct dm_table *t)
-{
-        return dm_table_get_type(t) == DM_TYPE_BIO_BASED;
-}
-
 bool dm_table_request_based(struct dm_table *t)
 {
         return dm_table_get_type(t) == DM_TYPE_REQUEST_BASED;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 9acd54a5cffb..8a311ea0d441 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2203,16 +2203,6 @@ int dm_swap_table(struct mapped_device *md, struct dm_table *table)
                 goto out;
         }
 
-        /*
-         * It is enought that blk_queue_ordered() is called only once when
-         * the first bio-based table is bound.
-         *
-         * This setting should be moved to alloc_dev() when request-based dm
-         * supports barrier.
-         */
-        if (!md->map && dm_table_bio_based(table))
-                blk_queue_ordered(md->queue, QUEUE_ORDERED_DRAIN, NULL);
-
         __unbind(md);
         r = __bind(md, table, &limits);
 
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 23278ae80f08..a7663eba17e2 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -61,7 +61,6 @@ int dm_table_any_congested(struct dm_table *t, int bdi_bits);
 int dm_table_any_busy_target(struct dm_table *t);
 int dm_table_set_type(struct dm_table *t);
 unsigned dm_table_get_type(struct dm_table *t);
-bool dm_table_bio_based(struct dm_table *t);
 bool dm_table_request_based(struct dm_table *t);
 int dm_table_alloc_md_mempools(struct dm_table *t);
 void dm_table_free_md_mempools(struct dm_table *t);
diff --git a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
index efb4a6c2b57a..9a6307a347b2 100644
--- a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+++ b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -20,8 +20,14 @@
 #include "tuner-simple.h"
 #include "stv0297.h"
 
+
+/* Can we use the specified front-end?  Remember that if we are compiled
+ * into the kernel we can't call code that's in modules.  */
+#define FE_SUPPORTED(fe) (defined(CONFIG_DVB_##fe) || \
+        (defined(CONFIG_DVB_##fe##_MODULE) && defined(MODULE)))
+
 /* lnb control */
-#if defined(CONFIG_DVB_MT312_MODULE) || defined(CONFIG_DVB_STV0299_MODULE)
+#if FE_SUPPORTED(MT312) || FE_SUPPORTED(STV0299)
 static int flexcop_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
 {
         struct flexcop_device *fc = fe->dvb->priv;
@@ -49,8 +55,7 @@ static int flexcop_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage
 }
 #endif
 
-#if defined(CONFIG_DVB_S5H1420_MODULE) || defined(CONFIG_DVB_STV0299_MODULE) \
-        || defined(CONFIG_DVB_MT312_MODULE)
+#if FE_SUPPORTED(S5H1420) || FE_SUPPORTED(STV0299) || FE_SUPPORTED(MT312)
 static int flexcop_sleep(struct dvb_frontend* fe)
 {
         struct flexcop_device *fc = fe->dvb->priv;
@@ -61,7 +66,7 @@ static int flexcop_sleep(struct dvb_frontend* fe)
 #endif
 
 /* SkyStar2 DVB-S rev 2.3 */
-#if defined(CONFIG_DVB_MT312_MODULE)
+#if FE_SUPPORTED(MT312)
 static int flexcop_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
 {
 /* u16 wz_half_period_for_45_mhz[] = { 0x01ff, 0x0154, 0x00ff, 0x00cc }; */
@@ -193,10 +198,12 @@ static int skystar2_rev23_attach(struct flexcop_device *fc,
         }
         return 0;
 }
+#else
+#define skystar2_rev23_attach NULL
 #endif
 
 /* SkyStar2 DVB-S rev 2.6 */
-#if defined(CONFIG_DVB_STV0299_MODULE)
+#if FE_SUPPORTED(STV0299)
 static int samsung_tbmu24112_set_symbol_rate(struct dvb_frontend *fe,
         u32 srate, u32 ratio)
 {
@@ -321,10 +328,12 @@ static int skystar2_rev26_attach(struct flexcop_device *fc,
         }
         return 0;
 }
+#else
+#define skystar2_rev26_attach NULL
 #endif
 
 /* SkyStar2 DVB-S rev 2.7 */
-#if defined(CONFIG_DVB_S5H1420_MODULE)
+#if FE_SUPPORTED(S5H1420) && FE_SUPPORTED(ISL6421) && FE_SUPPORTED(TUNER_ITD1000)
 static struct s5h1420_config skystar2_rev2_7_s5h1420_config = {
         .demod_address = 0x53,
         .invert = 1,
@@ -385,10 +394,12 @@ fail:
         fc->fc_i2c_adap[0].no_base_addr = 0;
         return 0;
 }
+#else
+#define skystar2_rev27_attach NULL
 #endif
 
 /* SkyStar2 rev 2.8 */
-#if defined(CONFIG_DVB_CX24123_MODULE)
+#if FE_SUPPORTED(CX24123) && FE_SUPPORTED(ISL6421) && FE_SUPPORTED(TUNER_CX24113)
 static struct cx24123_config skystar2_rev2_8_cx24123_config = {
         .demod_address = 0x55,
         .dont_use_pll = 1,
@@ -433,10 +444,12 @@ static int skystar2_rev28_attach(struct flexcop_device *fc,
          * IR-receiver (PIC16F818) - but the card has no input for that ??? */
         return 1;
 }
+#else
+#define skystar2_rev28_attach NULL
 #endif
 
 /* AirStar DVB-T */
-#if defined(CONFIG_DVB_MT352_MODULE)
+#if FE_SUPPORTED(MT352)
 static int samsung_tdtc9251dh0_demod_init(struct dvb_frontend *fe)
 {
         static u8 mt352_clock_config[] = { 0x89, 0x18, 0x2d };
@@ -495,10 +508,12 @@ static int airstar_dvbt_attach(struct flexcop_device *fc,
         }
         return 0;
 }
+#else
+#define airstar_dvbt_attach NULL
 #endif
 
 /* AirStar ATSC 1st generation */
-#if defined(CONFIG_DVB_BCM3510_MODULE)
+#if FE_SUPPORTED(BCM3510)
 static int flexcop_fe_request_firmware(struct dvb_frontend *fe,
         const struct firmware **fw, char* name)
 {
@@ -517,10 +532,12 @@ static int airstar_atsc1_attach(struct flexcop_device *fc,
         fc->fe = dvb_attach(bcm3510_attach, &air2pc_atsc_first_gen_config, i2c);
         return fc->fe != NULL;
 }
+#else
+#define airstar_atsc1_attach NULL
 #endif
 
 /* AirStar ATSC 2nd generation */
-#if defined(CONFIG_DVB_NXT200X_MODULE)
+#if FE_SUPPORTED(NXT200X) && FE_SUPPORTED(PLL)
 static struct nxt200x_config samsung_tbmv_config = {
         .demod_address = 0x0a,
 };
@@ -535,10 +552,12 @@ static int airstar_atsc2_attach(struct flexcop_device *fc,
         return !!dvb_attach(dvb_pll_attach, fc->fe, 0x61, NULL,
                             DVB_PLL_SAMSUNG_TBMV);
 }
+#else
+#define airstar_atsc2_attach NULL
 #endif
 
 /* AirStar ATSC 3rd generation */
-#if defined(CONFIG_DVB_LGDT330X_MODULE)
+#if FE_SUPPORTED(LGDT330X)
 static struct lgdt330x_config air2pc_atsc_hd5000_config = {
         .demod_address       = 0x59,
         .demod_chip          = LGDT3303,
@@ -556,10 +575,12 @@ static int airstar_atsc3_attach(struct flexcop_device *fc,
         return !!dvb_attach(simple_tuner_attach, fc->fe, i2c, 0x61,
                             TUNER_LG_TDVS_H06XF);
 }
+#else
+#define airstar_atsc3_attach NULL
 #endif
 
 /* CableStar2 DVB-C */
-#if defined(CONFIG_DVB_STV0297_MODULE)
+#if FE_SUPPORTED(STV0297)
 static int alps_tdee4_stv0297_tuner_set_params(struct dvb_frontend* fe,
                 struct dvb_frontend_parameters *fep)
 {
@@ -698,39 +719,23 @@ static int cablestar2_attach(struct flexcop_device *fc,
         fc->fe->ops.tuner_ops.set_params = alps_tdee4_stv0297_tuner_set_params;
         return 1;
 }
+#else
+#define cablestar2_attach NULL
 #endif
 
 static struct {
         flexcop_device_type_t type;
         int (*attach)(struct flexcop_device *, struct i2c_adapter *);
 } flexcop_frontends[] = {
-#if defined(CONFIG_DVB_S5H1420_MODULE)
         { FC_SKY_REV27, skystar2_rev27_attach },
-#endif
-#if defined(CONFIG_DVB_CX24123_MODULE)
         { FC_SKY_REV28, skystar2_rev28_attach },
-#endif
-#if defined(CONFIG_DVB_STV0299_MODULE)
         { FC_SKY_REV26, skystar2_rev26_attach },
-#endif
-#if defined(CONFIG_DVB_MT352_MODULE)
         { FC_AIR_DVBT, airstar_dvbt_attach },
-#endif
-#if defined(CONFIG_DVB_NXT200X_MODULE)
         { FC_AIR_ATSC2, airstar_atsc2_attach },
-#endif
-#if defined(CONFIG_DVB_LGDT330X_MODULE)
         { FC_AIR_ATSC3, airstar_atsc3_attach },
-#endif
-#if defined(CONFIG_DVB_BCM3510_MODULE)
         { FC_AIR_ATSC1, airstar_atsc1_attach },
-#endif
-#if defined(CONFIG_DVB_STV0297_MODULE)
         { FC_CABLE, cablestar2_attach },
-#endif
-#if defined(CONFIG_DVB_MT312_MODULE)
         { FC_SKY_REV23, skystar2_rev23_attach },
-#endif
 };
 
 /* try to figure out the frontend */
@@ -738,6 +743,8 @@ int flexcop_frontend_init(struct flexcop_device *fc)
 {
         int i;
         for (i = 0; i < ARRAY_SIZE(flexcop_frontends); i++) {
+                if (!flexcop_frontends[i].attach)
+                        continue;
                 /* type needs to be set before, because of some workarounds
                  * done based on the probed card type */
                 fc->dev_type = flexcop_frontends[i].type;
diff --git a/drivers/media/dvb/frontends/af9013.c b/drivers/media/dvb/frontends/af9013.c
index 136c5863d81b..12e018b4107d 100644
--- a/drivers/media/dvb/frontends/af9013.c
+++ b/drivers/media/dvb/frontends/af9013.c
@@ -527,6 +527,10 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
         u8 i, buf[3] = {0, 0, 0};
         *auto_mode = 0; /* set if parameters are requested to auto set */
 
+        /* Try auto-detect transmission parameters in case of AUTO requested or
+           garbage parameters given by application for compatibility.
+           MPlayer seems to provide garbage parameters currently. */
+
         switch (params->transmission_mode) {
         case TRANSMISSION_MODE_AUTO:
                 *auto_mode = 1;
@@ -536,7 +540,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[0] |= (1 << 0);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid transmission_mode\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->guard_interval) {
@@ -554,7 +559,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[0] |= (3 << 2);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid guard_interval\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->hierarchy_information) {
@@ -572,7 +578,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[0] |= (3 << 4);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid hierarchy_information\n", __func__);
+                *auto_mode = 1;
         };
 
         switch (params->constellation) {
@@ -587,7 +594,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[1] |= (2 << 6);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid constellation\n", __func__);
+                *auto_mode = 1;
         }
 
         /* Use HP. How and which case we can switch to LP? */
@@ -611,7 +619,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[2] |= (4 << 0);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid code_rate_HP\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->code_rate_LP) {
@@ -638,7 +647,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 if (params->hierarchy_information == HIERARCHY_AUTO)
                         break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid code_rate_LP\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->bandwidth) {
@@ -651,7 +661,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[1] |= (2 << 2);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid bandwidth\n", __func__);
+                buf[1] |= (2 << 2); /* cannot auto-detect BW, try 8 MHz */
         }
 
         /* program */
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index fdb4adff3d28..ca6558c394be 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -3324,8 +3324,6 @@ void __devinit bttv_init_card1(struct bttv *btv)
 /* initialization part two -- after registering i2c bus */
 void __devinit bttv_init_card2(struct bttv *btv)
 {
-        int addr=ADDR_UNSET;
-
         btv->tuner_type = UNSET;
 
         if (BTTV_BOARD_UNKNOWN == btv->c.type) {
@@ -3470,9 +3468,6 @@ void __devinit bttv_init_card2(struct bttv *btv)
         btv->pll.pll_current = -1;
 
         /* tuner configuration (from card list / autodetect / insmod option) */
-        if (ADDR_UNSET != bttv_tvcards[btv->c.type].tuner_addr)
-                addr = bttv_tvcards[btv->c.type].tuner_addr;
-
         if (UNSET != bttv_tvcards[btv->c.type].tuner_type)
                 if (UNSET == btv->tuner_type)
                         btv->tuner_type = bttv_tvcards[btv->c.type].tuner_type;
@@ -3496,40 +3491,6 @@ void __devinit bttv_init_card2(struct bttv *btv)
         if (UNSET == btv->tuner_type)
                 btv->tuner_type = TUNER_ABSENT;
 
-        if (btv->tuner_type != TUNER_ABSENT) {
-                struct tuner_setup tun_setup;
-
-                /* Load tuner module before issuing tuner config call! */
-                if (bttv_tvcards[btv->c.type].has_radio)
-                        v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, "tuner", "tuner",
-                                v4l2_i2c_tuner_addrs(ADDRS_RADIO));
-                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, "tuner", "tuner",
-                                v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
-                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, "tuner", "tuner",
-                                v4l2_i2c_tuner_addrs(ADDRS_TV_WITH_DEMOD));
-
-                tun_setup.mode_mask = T_ANALOG_TV | T_DIGITAL_TV;
-                tun_setup.type = btv->tuner_type;
-                tun_setup.addr = addr;
-
-                if (bttv_tvcards[btv->c.type].has_radio)
-                        tun_setup.mode_mask |= T_RADIO;
-
-                bttv_call_all(btv, tuner, s_type_addr, &tun_setup);
-        }
-
-        if (btv->tda9887_conf) {
-                struct v4l2_priv_tun_config tda9887_cfg;
-
-                tda9887_cfg.tuner = TUNER_TDA9887;
-                tda9887_cfg.priv = &btv->tda9887_conf;
-
-                bttv_call_all(btv, tuner, s_config, &tda9887_cfg);
-        }
-
         btv->dig = bttv_tvcards[btv->c.type].has_dig_in ?
                    bttv_tvcards[btv->c.type].video_inputs - 1 : UNSET;
         btv->svhs = bttv_tvcards[btv->c.type].svhs == NO_SVHS ?
@@ -3540,15 +3501,15 @@ void __devinit bttv_init_card2(struct bttv *btv)
                 btv->has_remote = remote[btv->c.nr];
 
         if (bttv_tvcards[btv->c.type].has_radio)
-                btv->has_radio=1;
+                btv->has_radio = 1;
         if (bttv_tvcards[btv->c.type].has_remote)
-                btv->has_remote=1;
+                btv->has_remote = 1;
         if (!bttv_tvcards[btv->c.type].no_gpioirq)
-                btv->gpioirq=1;
+                btv->gpioirq = 1;
         if (bttv_tvcards[btv->c.type].volume_gpio)
-                btv->volume_gpio=bttv_tvcards[btv->c.type].volume_gpio;
+                btv->volume_gpio = bttv_tvcards[btv->c.type].volume_gpio;
         if (bttv_tvcards[btv->c.type].audio_mode_gpio)
-                btv->audio_mode_gpio=bttv_tvcards[btv->c.type].audio_mode_gpio;
+                btv->audio_mode_gpio = bttv_tvcards[btv->c.type].audio_mode_gpio;
 
         if (btv->tuner_type == TUNER_ABSENT)
                 return;  /* no tuner or related drivers to load */
@@ -3666,6 +3627,49 @@ no_audio:
 }
 
 
+/* initialize the tuner */
+void __devinit bttv_init_tuner(struct bttv *btv)
+{
+        int addr = ADDR_UNSET;
+
+        if (ADDR_UNSET != bttv_tvcards[btv->c.type].tuner_addr)
+                addr = bttv_tvcards[btv->c.type].tuner_addr;
+
+        if (btv->tuner_type != TUNER_ABSENT) {
+                struct tuner_setup tun_setup;
+
+                /* Load tuner module before issuing tuner config call! */
+                if (bttv_tvcards[btv->c.type].has_radio)
+                        v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
+                                &btv->c.i2c_adap, "tuner", "tuner",
+                                v4l2_i2c_tuner_addrs(ADDRS_RADIO));
+                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
+                                &btv->c.i2c_adap, "tuner", "tuner",
+                                v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
+                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
+                                &btv->c.i2c_adap, "tuner", "tuner",
+                                v4l2_i2c_tuner_addrs(ADDRS_TV_WITH_DEMOD));
+
+                tun_setup.mode_mask = T_ANALOG_TV | T_DIGITAL_TV;
+                tun_setup.type = btv->tuner_type;
+                tun_setup.addr = addr;
+
+                if (bttv_tvcards[btv->c.type].has_radio)
+                        tun_setup.mode_mask |= T_RADIO;
+
+                bttv_call_all(btv, tuner, s_type_addr, &tun_setup);
+        }
+
+        if (btv->tda9887_conf) {
+                struct v4l2_priv_tun_config tda9887_cfg;
+
+                tda9887_cfg.tuner = TUNER_TDA9887;
+                tda9887_cfg.priv = &btv->tda9887_conf;
+
+                bttv_call_all(btv, tuner, s_config, &tda9887_cfg);
+        }
+}
+
 /* ----------------------------------------------------------------------- */
 
 static void modtec_eeprom(struct bttv *btv)
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index d147d29bb0d3..8cc6dd28d6a7 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -4419,6 +4419,7 @@ static int __devinit bttv_probe(struct pci_dev *dev,
 
         /* some card-specific stuff (needs working i2c) */
         bttv_init_card2(btv);
+        bttv_init_tuner(btv);
         init_irqreg(btv);
 
         /* register video4linux + input */
diff --git a/drivers/media/video/bt8xx/bttv.h b/drivers/media/video/bt8xx/bttv.h
index 3d36daf206f3..3ec2402c6b4a 100644
--- a/drivers/media/video/bt8xx/bttv.h
+++ b/drivers/media/video/bt8xx/bttv.h
@@ -283,6 +283,7 @@ extern struct tvcard bttv_tvcards[];
 extern void bttv_idcard(struct bttv *btv);
 extern void bttv_init_card1(struct bttv *btv);
 extern void bttv_init_card2(struct bttv *btv);
+extern void bttv_init_tuner(struct bttv *btv);
 
 /* card-specific funtions */
 extern void tea5757_set_freq(struct bttv *btv, unsigned short freq);
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 428f0c45e6b7..e0cf21e0b1bf 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -58,7 +58,8 @@ MODULE_PARM_DESC(v4l_debug, "enable V4L debug messages");
 
 #define dprintk(level, fmt, arg...)\
         do { if (v4l_debug >= level) \
-                printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\
+                printk(KERN_DEBUG "%s: " fmt, \
+                (dev) ? dev->name : "cx23885[?]", ## arg); \
         } while (0)
 
 static struct cx23885_tvnorm cx23885_tvnorms[] = {
@@ -1677,6 +1678,7 @@ static struct v4l2_file_operations mpeg_fops = {
         .read          = mpeg_read,
         .poll          = mpeg_poll,
         .mmap          = mpeg_mmap,
+        .ioctl         = video_ioctl2,
 };
 
 static const struct v4l2_ioctl_ops mpeg_ioctl_ops = {
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index ebd24a25fb85..320f1f60276e 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -58,8 +58,6 @@ static unsigned int card[]     = {[0 ... (EM28XX_MAXBOARDS - 1)] = UNSET };
 module_param_array(card,  int, NULL, 0444);
 MODULE_PARM_DESC(card,     "card type");
 
-#define MT9V011_VERSION                 0x8243
-
 /* Bitmask marking allocated devices from 0 to EM28XX_MAXBOARDS */
 static unsigned long em28xx_devused;
 
@@ -159,6 +157,20 @@ static struct em28xx_reg_seq evga_indtube_digital[] = {
         { -1,                   -1,     -1,             -1},
 };
 
+/* Pinnacle Hybrid Pro eb1a:2881 */
+static struct em28xx_reg_seq pinnacle_hybrid_pro_analog[] = {
+        {EM28XX_R08_GPIO,       0xfd,   ~EM_GPIO_4,     10},
+        {       -1,             -1,     -1,             -1},
+};
+
+static struct em28xx_reg_seq pinnacle_hybrid_pro_digital[] = {
+        {EM28XX_R08_GPIO,       0x6e,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x04,   0xff,          100},/* zl10353 reset */
+        {EM2880_R04_GPO,        0x0c,   0xff,            1},
+        {       -1,             -1,     -1,             -1},
+};
+
+
 /* Callback for the most boards */
 static struct em28xx_reg_seq default_tuner_gpio[] = {
         {EM28XX_R08_GPIO,       EM_GPIO_4,      EM_GPIO_4,      10},
@@ -205,13 +217,15 @@ static struct em28xx_reg_seq silvercrest_reg_seq[] = {
  */
 struct em28xx_board em28xx_boards[] = {
         [EM2750_BOARD_UNKNOWN] = {
-                .name          = "Unknown EM2750/EM2751 webcam grabber",
+                .name          = "EM2710/EM2750/EM2751 webcam grabber",
                 .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
-                .tuner_type    = TUNER_ABSENT,  /* This is a webcam */
+                .tuner_type    = TUNER_ABSENT,
+                .is_webcam     = 1,
                 .input         = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
                         .amux     = EM28XX_AMUX_VIDEO,
+                        .gpio     = silvercrest_reg_seq,
                 } },
         },
         [EM2800_BOARD_UNKNOWN] = {
@@ -233,13 +247,15 @@ struct em28xx_board em28xx_boards[] = {
         [EM2820_BOARD_UNKNOWN] = {
                 .name          = "Unknown EM2750/28xx video grabber",
                 .tuner_type    = TUNER_ABSENT,
+                .is_webcam     = 1,     /* To enable sensor probe */
         },
         [EM2750_BOARD_DLCW_130] = {
                 /* Beijing Huaqi Information Digital Technology Co., Ltd */
                 .name          = "Huaqi DLCW-130",
                 .valid         = EM28XX_BOARD_NOT_VALIDATED,
                 .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
-                .tuner_type    = TUNER_ABSENT,  /* This is a webcam */
+                .tuner_type    = TUNER_ABSENT,
+                .is_webcam     = 1,
                 .input         = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -440,7 +456,8 @@ struct em28xx_board em28xx_boards[] = {
         [EM2820_BOARD_VIDEOLOGY_20K14XUSB] = {
                 .name         = "Videology 20K14XUSB USB2.0",
                 .valid        = EM28XX_BOARD_NOT_VALIDATED,
-                .tuner_type   = TUNER_ABSENT,   /* This is a webcam */
+                .tuner_type   = TUNER_ABSENT,
+                .is_webcam    = 1,
                 .input        = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -450,8 +467,7 @@ struct em28xx_board em28xx_boards[] = {
         [EM2820_BOARD_SILVERCREST_WEBCAM] = {
                 .name         = "Silvercrest Webcam 1.3mpix",
                 .tuner_type   = TUNER_ABSENT,
-                .is_27xx      = 1,
-                .decoder      = EM28XX_MT9V011,
+                .is_webcam    = 1,
                 .input        = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -500,7 +516,8 @@ struct em28xx_board em28xx_boards[] = {
                 /* Beijing Huaqi Information Digital Technology Co., Ltd */
                 .name         = "NetGMBH Cam",
                 .valid        = EM28XX_BOARD_NOT_VALIDATED,
-                .tuner_type   = TUNER_ABSENT,   /* This is a webcam */
+                .tuner_type   = TUNER_ABSENT,
+                .is_webcam    = 1,
                 .input        = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -1250,25 +1267,26 @@ struct em28xx_board em28xx_boards[] = {
         },
         [EM2881_BOARD_PINNACLE_HYBRID_PRO] = {
                 .name         = "Pinnacle Hybrid Pro",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                 .tuner_type   = TUNER_XC2028,
                 .tuner_gpio   = default_tuner_gpio,
                 .decoder      = EM28XX_TVP5150,
+                .has_dvb      = 1,
+                .dvb_gpio     = pinnacle_hybrid_pro_digital,
                 .input        = { {
                         .type     = EM28XX_VMUX_TELEVISION,
                         .vmux     = TVP5150_COMPOSITE0,
                         .amux     = EM28XX_AMUX_VIDEO,
-                        .gpio     = default_analog,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 }, {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = TVP5150_COMPOSITE1,
                         .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = default_analog,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 }, {
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = TVP5150_SVIDEO,
                         .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = default_analog,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 } },
         },
         [EM2882_BOARD_PINNACLE_HYBRID_PRO] = {
@@ -1638,6 +1656,7 @@ static struct em28xx_hash_table em28xx_eeprom_hash[] = {
         {0x966a0441, EM2880_BOARD_KWORLD_DVB_310U, TUNER_XC2028},
         {0x9567eb1a, EM2880_BOARD_EMPIRE_DUAL_TV, TUNER_XC2028},
         {0xcee44a99, EM2882_BOARD_EVGA_INDTUBE, TUNER_XC2028},
+        {0xb8846b20, EM2881_BOARD_PINNACLE_HYBRID_PRO, TUNER_XC2028},
 };
 
 /* I2C devicelist hash table for devices with generic USB IDs */
@@ -1704,6 +1723,32 @@ static inline void em28xx_set_model(struct em28xx *dev)
                                        EM28XX_I2C_FREQ_100_KHZ;
 }
 
+/* FIXME: Should be replaced by a proper mt9m001 driver */
+static int em28xx_initialize_mt9m001(struct em28xx *dev)
+{
+        int i;
+        unsigned char regs[][3] = {
+                { 0x0d, 0x00, 0x01, },
+                { 0x0d, 0x00, 0x00, },
+                { 0x04, 0x05, 0x00, },  /* hres = 1280 */
+                { 0x03, 0x04, 0x00, },  /* vres = 1024 */
+                { 0x20, 0x11, 0x00, },
+                { 0x06, 0x00, 0x10, },
+                { 0x2b, 0x00, 0x24, },
+                { 0x2e, 0x00, 0x24, },
+                { 0x35, 0x00, 0x24, },
+                { 0x2d, 0x00, 0x20, },
+                { 0x2c, 0x00, 0x20, },
+                { 0x09, 0x0a, 0xd4, },
+                { 0x35, 0x00, 0x57, },
+        };
+
+        for (i = 0; i < ARRAY_SIZE(regs); i++)
+                i2c_master_send(&dev->i2c_client, &regs[i][0], 3);
+
+        return 0;
+}
+
 /* HINT method: webcam I2C chips
  *
  * This method work for webcams with Micron sensors
@@ -1716,9 +1761,6 @@ static int em28xx_hint_sensor(struct em28xx *dev)
         __be16 version_be;
         u16 version;
 
-        if (dev->model != EM2820_BOARD_UNKNOWN)
-                return 0;
-
         dev->i2c_client.addr = 0xba >> 1;
         cmd = 0;
         i2c_master_send(&dev->i2c_client, &cmd, 1);
@@ -1729,16 +1771,38 @@ static int em28xx_hint_sensor(struct em28xx *dev)
         version = be16_to_cpu(version_be);
 
         switch (version) {
-        case MT9V011_VERSION:
+        case 0x8243:            /* mt9v011 640x480 1.3 Mpix sensor */
                 dev->model = EM2820_BOARD_SILVERCREST_WEBCAM;
                 sensor_name = "mt9v011";
+                dev->em28xx_sensor = EM28XX_MT9V011;
+                dev->sensor_xres = 640;
+                dev->sensor_yres = 480;
+                dev->sensor_xtal = 6300000;
+
+                /* probably means GRGB 16 bit bayer */
+                dev->vinmode = 0x0d;
+                dev->vinctl = 0x00;
+
+                break;
+        case 0x8431:
+                dev->model = EM2750_BOARD_UNKNOWN;
+                sensor_name = "mt9m001";
+                dev->em28xx_sensor = EM28XX_MT9M001;
+                em28xx_initialize_mt9m001(dev);
+                dev->sensor_xres = 1280;
+                dev->sensor_yres = 1024;
+
+                /* probably means BGGR 16 bit bayer */
+                dev->vinmode = 0x0c;
+                dev->vinctl = 0x00;
+
                 break;
         default:
-                printk("Unknown Sensor 0x%04x\n", be16_to_cpu(version));
+                printk("Unknown Micron Sensor 0x%04x\n", be16_to_cpu(version));
                 return -EINVAL;
         }
 
-        em28xx_errdev("Sensor is %s, assuming that webcam is %s\n",
+        em28xx_errdev("Sensor is %s, using model %s entry.\n",
                       sensor_name, em28xx_boards[dev->model].name);
 
         return 0;
@@ -1772,10 +1836,7 @@ void em28xx_pre_card_setup(struct em28xx *dev)
                         em28xx_info("chip ID is em2750\n");
                         break;
                 case CHIP_ID_EM2820:
-                        if (dev->board.is_27xx)
-                                em28xx_info("chip is em2710\n");
-                        else
-                                em28xx_info("chip ID is em2820\n");
+                        em28xx_info("chip ID is em2710 or em2820\n");
                         break;
                 case CHIP_ID_EM2840:
                         em28xx_info("chip ID is em2840\n");
@@ -1929,6 +1990,7 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                 ctl->demod = XC3028_FE_ZARLINK456;
                 break;
         case EM2880_BOARD_TERRATEC_HYBRID_XS:
+        case EM2881_BOARD_PINNACLE_HYBRID_PRO:
                 ctl->demod = XC3028_FE_ZARLINK456;
                 break;
         case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900_R2:
@@ -2225,6 +2287,7 @@ void em28xx_card_setup(struct em28xx *dev)
                    em28xx_set_mode() in em28xx_pre_card_setup() was a no-op,
                    so make the call now so the analog GPIOs are set properly
                    before probing the i2c bus. */
+                em28xx_gpio_set(dev, dev->board.tuner_gpio);
                 em28xx_set_mode(dev, EM28XX_ANALOG_MODE);
                 break;
         case EM2820_BOARD_SILVERCREST_WEBCAM:
@@ -2262,9 +2325,14 @@ void em28xx_card_setup(struct em28xx *dev)
                 v4l2_i2c_new_probed_subdev(&dev->v4l2_dev, &dev->i2c_adap,
                         "tvp5150", "tvp5150", tvp5150_addrs);
 
-        if (dev->board.decoder == EM28XX_MT9V011)
-                v4l2_i2c_new_probed_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                        "mt9v011", "mt9v011", mt9v011_addrs);
+        if (dev->em28xx_sensor == EM28XX_MT9V011) {
+                struct v4l2_subdev *sd;
+
+                sd = v4l2_i2c_new_probed_subdev(&dev->v4l2_dev,
+                         &dev->i2c_adap, "mt9v011", "mt9v011", mt9v011_addrs);
+                v4l2_subdev_call(sd, core, s_config, 0, &dev->sensor_xtal);
+        }
+
 
         if (dev->board.adecoder == EM28XX_TVAUDIO)
                 v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
@@ -2410,7 +2478,19 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                 return errCode;
         }
 
-        em28xx_hint_sensor(dev);
+        /*
+         * Default format, used for tvp5150 or saa711x output formats
+         */
+        dev->vinmode = 0x10;
+        dev->vinctl  = 0x11;
+
+        /*
+         * If the device can be a webcam, seek for a sensor.
+         * If sensor is not found, then it isn't a webcam.
+         */
+        if (dev->board.is_webcam)
+                if (em28xx_hint_sensor(dev) < 0)
+                        dev->board.is_webcam = 0;
 
         /* Do board specific init and eeprom reading */
         em28xx_card_setup(dev);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 079ab4d563a6..5b78e199abd1 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -648,28 +648,17 @@ int em28xx_capture_start(struct em28xx *dev, int start)
 int em28xx_set_outfmt(struct em28xx *dev)
 {
         int ret;
-        int vinmode, vinctl, outfmt;
-
-        outfmt  = dev->format->reg;
-
-        if (dev->board.is_27xx) {
-                vinmode = 0x0d;
-                vinctl  = 0x00;
-        } else {
-                vinmode = 0x10;
-                vinctl  = 0x11;
-        }
 
         ret = em28xx_write_reg_bits(dev, EM28XX_R27_OUTFMT,
-                                outfmt | 0x20, 0xff);
+                                dev->format->reg | 0x20, 0xff);
         if (ret < 0)
                         return ret;
 
-        ret = em28xx_write_reg(dev, EM28XX_R10_VINMODE, vinmode);
+        ret = em28xx_write_reg(dev, EM28XX_R10_VINMODE, dev->vinmode);
         if (ret < 0)
                 return ret;
 
-        return em28xx_write_reg(dev, EM28XX_R11_VINCTRL, vinctl);
+        return em28xx_write_reg(dev, EM28XX_R11_VINCTRL, dev->vinctl);
 }
 
 static int em28xx_accumulator_set(struct em28xx *dev, u8 xmin, u8 xmax,
@@ -707,10 +696,7 @@ static int em28xx_scaler_set(struct em28xx *dev, u16 h, u16 v)
         u8 mode;
         /* the em2800 scaler only supports scaling down to 50% */
 
-        if (dev->board.is_27xx) {
-                /* FIXME: Don't use the scaler yet */
-                mode = 0;
-        } else if (dev->board.is_em2800) {
+        if (dev->board.is_em2800) {
                 mode = (v ? 0x20 : 0x00) | (h ? 0x10 : 0x00);
         } else {
                 u8 buf[2];
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index 3da97c32b8fa..cf0ac7f2a30d 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -31,6 +31,8 @@
 #include "lgdt330x.h"
 #include "zl10353.h"
 #include "s5h1409.h"
+#include "mt352.h"
+#include "mt352_priv.h" /* FIXME */
 
 MODULE_DESCRIPTION("driver for em28xx based DVB cards");
 MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
@@ -243,7 +245,7 @@ static struct s5h1409_config em28xx_s5h1409_with_xc3028 = {
         .mpeg_timing   = S5H1409_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK
 };
 
-static struct zl10353_config em28xx_terratec_xs_zl10353_xc3028 = {
+static struct zl10353_config em28xx_zl10353_xc3028_no_i2c_gate = {
         .demod_address = (0x1e >> 1),
         .no_tuner = 1,
         .disable_i2c_gate_ctrl = 1,
@@ -258,6 +260,41 @@ static struct drx397xD_config em28xx_drx397xD_with_xc3028 = {
 };
 #endif
 
+static int mt352_terratec_xs_init(struct dvb_frontend *fe)
+{
+        /* Values extracted from a USB trace of the Terratec Windows driver */
+        static u8 clock_config[]   = { CLOCK_CTL,  0x38, 0x2c };
+        static u8 reset[]          = { RESET,      0x80 };
+        static u8 adc_ctl_1_cfg[]  = { ADC_CTL_1,  0x40 };
+        static u8 agc_cfg[]        = { AGC_TARGET, 0x28, 0xa0 };
+        static u8 input_freq_cfg[] = { INPUT_FREQ_1, 0x31, 0xb8 };
+        static u8 rs_err_cfg[]     = { RS_ERR_PER_1, 0x00, 0x4d };
+        static u8 capt_range_cfg[] = { CAPT_RANGE, 0x32 };
+        static u8 trl_nom_cfg[]    = { TRL_NOMINAL_RATE_1, 0x64, 0x00 };
+        static u8 tps_given_cfg[]  = { TPS_GIVEN_1, 0x40, 0x80, 0x50 };
+        static u8 tuner_go[]       = { TUNER_GO, 0x01};
+
+        mt352_write(fe, clock_config,   sizeof(clock_config));
+        udelay(200);
+        mt352_write(fe, reset,          sizeof(reset));
+        mt352_write(fe, adc_ctl_1_cfg,  sizeof(adc_ctl_1_cfg));
+        mt352_write(fe, agc_cfg,        sizeof(agc_cfg));
+        mt352_write(fe, input_freq_cfg, sizeof(input_freq_cfg));
+        mt352_write(fe, rs_err_cfg,     sizeof(rs_err_cfg));
+        mt352_write(fe, capt_range_cfg, sizeof(capt_range_cfg));
+        mt352_write(fe, trl_nom_cfg,    sizeof(trl_nom_cfg));
+        mt352_write(fe, tps_given_cfg,  sizeof(tps_given_cfg));
+        mt352_write(fe, tuner_go,       sizeof(tuner_go));
+        return 0;
+}
+
+static struct mt352_config terratec_xs_mt352_cfg = {
+        .demod_address = (0x1e >> 1),
+        .no_tuner = 1,
+        .if2 = 45600,
+        .demod_init = mt352_terratec_xs_init,
+};
+
 /* ------------------------------------------------------------------ */
 
 static int attach_xc3028(u8 addr, struct em28xx *dev)
@@ -440,7 +477,6 @@ static int dvb_init(struct em28xx *dev)
                         goto out_free;
                 }
                 break;
-        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
         case EM2880_BOARD_KWORLD_DVB_310U:
         case EM2880_BOARD_EMPIRE_DUAL_TV:
                 dvb->frontend = dvb_attach(zl10353_attach,
@@ -451,20 +487,28 @@ static int dvb_init(struct em28xx *dev)
                         goto out_free;
                 }
                 break;
+        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+                dvb->frontend = dvb_attach(zl10353_attach,
+                                           &em28xx_zl10353_xc3028_no_i2c_gate,
+                                           &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
         case EM2880_BOARD_TERRATEC_HYBRID_XS:
+        case EM2881_BOARD_PINNACLE_HYBRID_PRO:
                 dvb->frontend = dvb_attach(zl10353_attach,
-                                           &em28xx_terratec_xs_zl10353_xc3028,
+                                           &em28xx_zl10353_xc3028_no_i2c_gate,
                                            &dev->i2c_adap);
                 if (dvb->frontend == NULL) {
                         /* This board could have either a zl10353 or a mt352.
                            If the chip id isn't for zl10353, try mt352 */
-
-                        /* FIXME: make support for mt352 work */
-                        printk(KERN_ERR "version of this board with mt352 not "
-                               "currently supported\n");
-                        result = -EINVAL;
-                        goto out_free;
+                        dvb->frontend = dvb_attach(mt352_attach,
+                                                   &terratec_xs_mt352_cfg,
+                                                   &dev->i2c_adap);
                 }
+
                 if (attach_xc3028(0x61, dev) < 0) {
                         result = -EINVAL;
                         goto out_free;
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 14316c912179..ff37b4c15f44 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -657,8 +657,8 @@ static void get_scale(struct em28xx *dev,
                         unsigned int width, unsigned int height,
                         unsigned int *hscale, unsigned int *vscale)
 {
-        unsigned int          maxw   = norm_maxw(dev);
-        unsigned int          maxh   = norm_maxh(dev);
+        unsigned int          maxw = norm_maxw(dev);
+        unsigned int          maxh = norm_maxh(dev);
 
         *hscale = (((unsigned long)maxw) << 12) / width - 4096L;
         if (*hscale >= 0x4000)
@@ -726,11 +726,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        if (dev->board.is_27xx) {
-                /* FIXME: This is the only supported fmt */
-                width  = 640;
-                height = 480;
-        } else if (dev->board.is_em2800) {
+        if (dev->board.is_em2800) {
                 /* the em2800 can only scale down to 50% */
                 height = height > (3 * maxh / 4) ? maxh : maxh / 2;
                 width = width > (3 * maxw / 4) ? maxw : maxw / 2;
@@ -767,12 +763,6 @@ static int em28xx_set_video_format(struct em28xx *dev, unsigned int fourcc,
 {
         struct em28xx_fmt     *fmt;
 
-        /* FIXME: This is the only supported fmt */
-        if (dev->board.is_27xx) {
-                width  = 640;
-                height = 480;
-        }
-
         fmt = format_by_fourcc(fourcc);
         if (!fmt)
                 return -EINVAL;
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index d90fef463764..45bd513f62dc 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -358,10 +358,15 @@ struct em28xx_input {
 #define INPUT(nr) (&em28xx_boards[dev->model].input[nr])
 
 enum em28xx_decoder {
-        EM28XX_NODECODER,
+        EM28XX_NODECODER = 0,
         EM28XX_TVP5150,
         EM28XX_SAA711X,
+};
+
+enum em28xx_sensor {
+        EM28XX_NOSENSOR = 0,
         EM28XX_MT9V011,
+        EM28XX_MT9M001,
 };
 
 enum em28xx_adecoder {
@@ -390,7 +395,7 @@ struct em28xx_board {
         unsigned int max_range_640_480:1;
         unsigned int has_dvb:1;
         unsigned int has_snapshot_button:1;
-        unsigned int is_27xx:1;
+        unsigned int is_webcam:1;
         unsigned int valid:1;
 
         unsigned char xclk, i2c_speed;
@@ -474,6 +479,14 @@ struct em28xx {
         struct v4l2_device v4l2_dev;
         struct em28xx_board board;
 
+        /* Webcam specific fields */
+        enum em28xx_sensor em28xx_sensor;
+        int sensor_xres, sensor_yres;
+        int sensor_xtal;
+
+        /* Vinmode/Vinctl used at the driver */
+        int vinmode, vinctl;
+
         unsigned int stream_on:1;       /* Locks streams */
         unsigned int has_audio_class:1;
         unsigned int has_alsa_audio:1;
@@ -754,17 +767,23 @@ static inline int em28xx_gamma_set(struct em28xx *dev, s32 val)
 /*FIXME: maxw should be dependent of alt mode */
 static inline unsigned int norm_maxw(struct em28xx *dev)
 {
+        if (dev->board.is_webcam)
+                return dev->sensor_xres;
+
         if (dev->board.max_range_640_480)
                 return 640;
-        else
-                return 720;
+
+        return 720;
 }
 
 static inline unsigned int norm_maxh(struct em28xx *dev)
 {
+        if (dev->board.is_webcam)
+                return dev->sensor_yres;
+
         if (dev->board.max_range_640_480)
                 return 480;
-        else
-                return (dev->norm & V4L2_STD_625_50) ? 576 : 480;
+
+        return (dev->norm & V4L2_STD_625_50) ? 576 : 480;
 }
 #endif
diff --git a/drivers/media/video/gspca/Kconfig b/drivers/media/video/gspca/Kconfig
index 578dc4ffc965..34f46f2bc040 100644
--- a/drivers/media/video/gspca/Kconfig
+++ b/drivers/media/video/gspca/Kconfig
@@ -102,6 +102,22 @@ config USB_GSPCA_PAC7311
           To compile this driver as a module, choose M here: the
           module will be called gspca_pac7311.
 
+config USB_GSPCA_SN9C20X
+       tristate "SN9C20X USB Camera Driver"
+       depends on VIDEO_V4L2 && USB_GSPCA
+       help
+         Say Y here if you want support for cameras based on the
+         sn9c20x chips (SN9C201 and SN9C202).
+
+         To compile this driver as a module, choose M here: the
+         module will be called gspca_sn9c20x.
+
+config USB_GSPCA_SN9C20X_EVDEV
+       bool "Enable evdev support"
+       depends on USB_GSPCA_SN9C20X
+       ---help---
+         Say Y here in order to enable evdev support for sn9c20x webcam button.
+
 config USB_GSPCA_SONIXB
         tristate "SONIX Bayer USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
diff --git a/drivers/media/video/gspca/Makefile b/drivers/media/video/gspca/Makefile
index 8a6643e8eb96..f6d3b86e9ad5 100644
--- a/drivers/media/video/gspca/Makefile
+++ b/drivers/media/video/gspca/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_USB_GSPCA_OV519)    += gspca_ov519.o
 obj-$(CONFIG_USB_GSPCA_OV534)    += gspca_ov534.o
 obj-$(CONFIG_USB_GSPCA_PAC207)   += gspca_pac207.o
 obj-$(CONFIG_USB_GSPCA_PAC7311)  += gspca_pac7311.o
+obj-$(CONFIG_USB_GSPCA_SN9C20X)  += gspca_sn9c20x.o
 obj-$(CONFIG_USB_GSPCA_SONIXB)   += gspca_sonixb.o
 obj-$(CONFIG_USB_GSPCA_SONIXJ)   += gspca_sonixj.o
 obj-$(CONFIG_USB_GSPCA_SPCA500)  += gspca_spca500.o
@@ -35,6 +36,7 @@ gspca_ov519-objs    := ov519.o
 gspca_ov534-objs    := ov534.o
 gspca_pac207-objs   := pac207.o
 gspca_pac7311-objs  := pac7311.o
+gspca_sn9c20x-objs  := sn9c20x.o
 gspca_sonixb-objs   := sonixb.o
 gspca_sonixj-objs   := sonixj.o
 gspca_spca500-objs  := spca500.o
diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index 219cfa6fb877..8d48ea1742c2 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -846,6 +846,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 1e89600986c8..b8561dfb6c8c 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -727,6 +727,74 @@ static int gspca_get_mode(struct gspca_dev *gspca_dev,
         return -EINVAL;
 }
 
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int vidioc_g_register(struct file *file, void *priv,
+                        struct v4l2_dbg_register *reg)
+{
+        int ret;
+        struct gspca_dev *gspca_dev = priv;
+
+        if (!gspca_dev->sd_desc->get_chip_ident)
+                return -EINVAL;
+
+        if (!gspca_dev->sd_desc->get_register)
+                return -EINVAL;
+
+        if (mutex_lock_interruptible(&gspca_dev->usb_lock))
+                return -ERESTARTSYS;
+        if (gspca_dev->present)
+                ret = gspca_dev->sd_desc->get_register(gspca_dev, reg);
+        else
+                ret = -ENODEV;
+        mutex_unlock(&gspca_dev->usb_lock);
+
+        return ret;
+}
+
+static int vidioc_s_register(struct file *file, void *priv,
+                        struct v4l2_dbg_register *reg)
+{
+        int ret;
+        struct gspca_dev *gspca_dev = priv;
+
+        if (!gspca_dev->sd_desc->get_chip_ident)
+                return -EINVAL;
+
+        if (!gspca_dev->sd_desc->set_register)
+                return -EINVAL;
+
+        if (mutex_lock_interruptible(&gspca_dev->usb_lock))
+                return -ERESTARTSYS;
+        if (gspca_dev->present)
+                ret = gspca_dev->sd_desc->set_register(gspca_dev, reg);
+        else
+                ret = -ENODEV;
+        mutex_unlock(&gspca_dev->usb_lock);
+
+        return ret;
+}
+#endif
+
+static int vidioc_g_chip_ident(struct file *file, void *priv,
+                        struct v4l2_dbg_chip_ident *chip)
+{
+        int ret;
+        struct gspca_dev *gspca_dev = priv;
+
+        if (!gspca_dev->sd_desc->get_chip_ident)
+                return -EINVAL;
+
+        if (mutex_lock_interruptible(&gspca_dev->usb_lock))
+                return -ERESTARTSYS;
+        if (gspca_dev->present)
+                ret = gspca_dev->sd_desc->get_chip_ident(gspca_dev, chip);
+        else
+                ret = -ENODEV;
+        mutex_unlock(&gspca_dev->usb_lock);
+
+        return ret;
+}
+
 static int vidioc_enum_fmt_vid_cap(struct file *file, void  *priv,
                                 struct v4l2_fmtdesc *fmtdesc)
 {
@@ -1883,6 +1951,11 @@ static const struct v4l2_ioctl_ops dev_ioctl_ops = {
         .vidioc_s_parm          = vidioc_s_parm,
         .vidioc_s_std           = vidioc_s_std,
         .vidioc_enum_framesizes = vidioc_enum_framesizes,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        .vidioc_g_register      = vidioc_g_register,
+        .vidioc_s_register      = vidioc_s_register,
+#endif
+        .vidioc_g_chip_ident    = vidioc_g_chip_ident,
 #ifdef CONFIG_VIDEO_V4L1_COMPAT
         .vidiocgmbuf          = vidiocgmbuf,
 #endif
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index bd1faff88644..46c4effdfcd5 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -69,6 +69,10 @@ typedef void (*cam_v_op) (struct gspca_dev *);
 typedef int (*cam_cf_op) (struct gspca_dev *, const struct usb_device_id *);
 typedef int (*cam_jpg_op) (struct gspca_dev *,
                                 struct v4l2_jpegcompression *);
+typedef int (*cam_reg_op) (struct gspca_dev *,
+                                struct v4l2_dbg_register *);
+typedef int (*cam_ident_op) (struct gspca_dev *,
+                                struct v4l2_dbg_chip_ident *);
 typedef int (*cam_streamparm_op) (struct gspca_dev *,
                                   struct v4l2_streamparm *);
 typedef int (*cam_qmnu_op) (struct gspca_dev *,
@@ -105,6 +109,11 @@ struct sd_desc {
         cam_qmnu_op querymenu;
         cam_streamparm_op get_streamparm;
         cam_streamparm_op set_streamparm;
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        cam_reg_op set_register;
+        cam_reg_op get_register;
+#endif
+        cam_ident_op get_chip_ident;
 };
 
 /* packet types when moving from iso buf to frame buf */
diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
index 191bcd718979..0163903d1c0f 100644
--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
@@ -476,9 +476,6 @@ static int s5k4aa_set_vflip(struct gspca_dev *gspca_dev, __s32 val)
         err = m5602_write_sensor(sd, S5K4AA_PAGE_MAP, &data, 1);
         if (err < 0)
                 return err;
-        err = m5602_write_sensor(sd, S5K4AA_READ_MODE, &data, 1);
-        if (err < 0)
-                return err;
 
         err = m5602_read_sensor(sd, S5K4AA_READ_MODE, &data, 1);
         if (err < 0)
@@ -524,9 +521,6 @@ static int s5k4aa_set_hflip(struct gspca_dev *gspca_dev, __s32 val)
         err = m5602_write_sensor(sd, S5K4AA_PAGE_MAP, &data, 1);
         if (err < 0)
                 return err;
-        err = m5602_write_sensor(sd, S5K4AA_READ_MODE, &data, 1);
-        if (err < 0)
-                return err;
 
         err = m5602_read_sensor(sd, S5K4AA_READ_MODE, &data, 1);
         if (err < 0)
diff --git a/drivers/media/video/gspca/mars.c b/drivers/media/video/gspca/mars.c
index 75e8d14e4ac7..de769caf013d 100644
--- a/drivers/media/video/gspca/mars.c
+++ b/drivers/media/video/gspca/mars.c
@@ -201,6 +201,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x21);          /* JPEG 422 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
new file mode 100644
index 000000000000..fcfbbd329b4c
--- /dev/null
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -0,0 +1,2434 @@
+/*
+ *      Sonix sn9c201 sn9c202 library
+ *      Copyright (C) 2008-2009 microdia project <microdia@googlegroups.com>
+ *      Copyright (C) 2009 Brian Johnson <brijohn@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+#include <linux/kthread.h>
+#include <linux/freezer.h>
+#include <linux/usb/input.h>
+#include <linux/input.h>
+#endif
+
+#include "gspca.h"
+#include "jpeg.h"
+
+#include <media/v4l2-chip-ident.h>
+
+MODULE_AUTHOR("Brian Johnson <brijohn@gmail.com>, "
+                "microdia project <microdia@googlegroups.com>");
+MODULE_DESCRIPTION("GSPCA/SN9C20X USB Camera Driver");
+MODULE_LICENSE("GPL");
+
+#define MODULE_NAME "sn9c20x"
+
+#define MODE_RAW        0x10
+#define MODE_JPEG       0x20
+#define MODE_SXGA       0x80
+
+#define SENSOR_OV9650   0
+#define SENSOR_OV9655   1
+#define SENSOR_SOI968   2
+#define SENSOR_OV7660   3
+#define SENSOR_OV7670   4
+#define SENSOR_MT9V011  5
+#define SENSOR_MT9V111  6
+#define SENSOR_MT9V112  7
+#define SENSOR_MT9M001  8
+#define SENSOR_MT9M111  9
+#define SENSOR_HV7131R  10
+#define SENSOR_MT9VPRB  20
+
+/* specific webcam descriptor */
+struct sd {
+        struct gspca_dev gspca_dev;
+
+#define MIN_AVG_LUM 80
+#define MAX_AVG_LUM 130
+        atomic_t avg_lum;
+        u8 old_step;
+        u8 older_step;
+        u8 exposure_step;
+
+        u8 brightness;
+        u8 contrast;
+        u8 saturation;
+        s16 hue;
+        u8 gamma;
+        u8 red;
+        u8 blue;
+
+        u8 hflip;
+        u8 vflip;
+        u8 gain;
+        u16 exposure;
+        u8 auto_exposure;
+
+        u8 i2c_addr;
+        u8 sensor;
+        u8 hstart;
+        u8 vstart;
+
+        u8 *jpeg_hdr;
+        u8 quality;
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+        struct input_dev *input_dev;
+        u8 input_gpio;
+        struct task_struct *input_task;
+#endif
+};
+
+static int sd_setbrightness(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getbrightness(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setcontrast(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getcontrast(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setsaturation(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getsaturation(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_sethue(struct gspca_dev *gspca_dev, s32 val);
+static int sd_gethue(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setgamma(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getgamma(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setredbalance(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getredbalance(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setbluebalance(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getbluebalance(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setvflip(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getvflip(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_sethflip(struct gspca_dev *gspca_dev, s32 val);
+static int sd_gethflip(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setgain(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getgain(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setexposure(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getexposure(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setautoexposure(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getautoexposure(struct gspca_dev *gspca_dev, s32 *val);
+
+static struct ctrl sd_ctrls[] = {
+        {
+#define BRIGHTNESS_IDX 0
+            {
+                .id      = V4L2_CID_BRIGHTNESS,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Brightness",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define BRIGHTNESS_DEFAULT 0x7f
+                .default_value = BRIGHTNESS_DEFAULT,
+            },
+            .set = sd_setbrightness,
+            .get = sd_getbrightness,
+        },
+        {
+#define CONTRAST_IDX 1
+            {
+                .id      = V4L2_CID_CONTRAST,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Contrast",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define CONTRAST_DEFAULT 0x7f
+                .default_value = CONTRAST_DEFAULT,
+            },
+            .set = sd_setcontrast,
+            .get = sd_getcontrast,
+        },
+        {
+#define SATURATION_IDX 2
+            {
+                .id      = V4L2_CID_SATURATION,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Saturation",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define SATURATION_DEFAULT 0x7f
+                .default_value = SATURATION_DEFAULT,
+            },
+            .set = sd_setsaturation,
+            .get = sd_getsaturation,
+        },
+        {
+#define HUE_IDX 3
+            {
+                .id      = V4L2_CID_HUE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Hue",
+                .minimum = -180,
+                .maximum = 180,
+                .step    = 1,
+#define HUE_DEFAULT 0
+                .default_value = HUE_DEFAULT,
+            },
+            .set = sd_sethue,
+            .get = sd_gethue,
+        },
+        {
+#define GAMMA_IDX 4
+            {
+                .id      = V4L2_CID_GAMMA,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Gamma",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define GAMMA_DEFAULT 0x10
+                .default_value = GAMMA_DEFAULT,
+            },
+            .set = sd_setgamma,
+            .get = sd_getgamma,
+        },
+        {
+#define BLUE_IDX 5
+            {
+                .id      = V4L2_CID_BLUE_BALANCE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Blue Balance",
+                .minimum = 0,
+                .maximum = 0x7f,
+                .step    = 1,
+#define BLUE_DEFAULT 0x28
+                .default_value = BLUE_DEFAULT,
+            },
+            .set = sd_setbluebalance,
+            .get = sd_getbluebalance,
+        },
+        {
+#define RED_IDX 6
+            {
+                .id      = V4L2_CID_RED_BALANCE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Red Balance",
+                .minimum = 0,
+                .maximum = 0x7f,
+                .step    = 1,
+#define RED_DEFAULT 0x28
+                .default_value = RED_DEFAULT,
+            },
+            .set = sd_setredbalance,
+            .get = sd_getredbalance,
+        },
+        {
+#define HFLIP_IDX 7
+            {
+                .id      = V4L2_CID_HFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Horizontal Flip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+#define HFLIP_DEFAULT 0
+                .default_value = HFLIP_DEFAULT,
+            },
+            .set = sd_sethflip,
+            .get = sd_gethflip,
+        },
+        {
+#define VFLIP_IDX 8
+            {
+                .id      = V4L2_CID_VFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Vertical Flip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+#define VFLIP_DEFAULT 0
+                .default_value = VFLIP_DEFAULT,
+            },
+            .set = sd_setvflip,
+            .get = sd_getvflip,
+        },
+        {
+#define EXPOSURE_IDX 9
+            {
+                .id      = V4L2_CID_EXPOSURE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Exposure",
+                .minimum = 0,
+                .maximum = 0x1780,
+                .step    = 1,
+#define EXPOSURE_DEFAULT 0x33
+                .default_value = EXPOSURE_DEFAULT,
+            },
+            .set = sd_setexposure,
+            .get = sd_getexposure,
+        },
+        {
+#define GAIN_IDX 10
+            {
+                .id      = V4L2_CID_GAIN,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Gain",
+                .minimum = 0,
+                .maximum = 28,
+                .step    = 1,
+#define GAIN_DEFAULT 0x00
+                .default_value = GAIN_DEFAULT,
+            },
+            .set = sd_setgain,
+            .get = sd_getgain,
+        },
+        {
+#define AUTOGAIN_IDX 11
+            {
+                .id      = V4L2_CID_AUTOGAIN,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Auto Exposure",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+#define AUTO_EXPOSURE_DEFAULT 1
+                .default_value = AUTO_EXPOSURE_DEFAULT,
+            },
+            .set = sd_setautoexposure,
+            .get = sd_getautoexposure,
+        },
+};
+
+static const struct v4l2_pix_format vga_mode[] = {
+        {160, 120, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 0 | MODE_JPEG},
+        {160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 160,
+                .sizeimage = 160 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0 | MODE_RAW},
+        {160, 120, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0},
+        {320, 240, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 1 | MODE_JPEG},
+        {320, 240, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 320,
+                .sizeimage = 320 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1 | MODE_RAW},
+        {320, 240, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1},
+        {640, 480, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 2 | MODE_JPEG},
+        {640, 480, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 640,
+                .sizeimage = 640 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2 | MODE_RAW},
+        {640, 480, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2},
+};
+
+static const struct v4l2_pix_format sxga_mode[] = {
+        {160, 120, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 0 | MODE_JPEG},
+        {160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 160,
+                .sizeimage = 160 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0 | MODE_RAW},
+        {160, 120, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0},
+        {320, 240, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 1 | MODE_JPEG},
+        {320, 240, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 320,
+                .sizeimage = 320 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1 | MODE_RAW},
+        {320, 240, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1},
+        {640, 480, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 2 | MODE_JPEG},
+        {640, 480, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 640,
+                .sizeimage = 640 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2 | MODE_RAW},
+        {640, 480, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2},
+        {1280, 1024, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 1280,
+                .sizeimage = (1280 * 1024) + 64,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 3 | MODE_RAW | MODE_SXGA},
+};
+
+static const int hsv_red_x[] = {
+        41,  44,  46,  48,  50,  52,  54,  56,
+        58,  60,  62,  64,  66,  68,  70,  72,
+        74,  76,  78,  80,  81,  83,  85,  87,
+        88,  90,  92,  93,  95,  97,  98, 100,
+        101, 102, 104, 105, 107, 108, 109, 110,
+        112, 113, 114, 115, 116, 117, 118, 119,
+        120, 121, 122, 123, 123, 124, 125, 125,
+        126, 127, 127, 128, 128, 129, 129, 129,
+        130, 130, 130, 130, 131, 131, 131, 131,
+        131, 131, 131, 131, 130, 130, 130, 130,
+        129, 129, 129, 128, 128, 127, 127, 126,
+        125, 125, 124, 123, 122, 122, 121, 120,
+        119, 118, 117, 116, 115, 114, 112, 111,
+        110, 109, 107, 106, 105, 103, 102, 101,
+        99,  98,  96,  94,  93,  91,  90,  88,
+        86,  84,  83,  81,  79,  77,  75,  74,
+        72,  70,  68,  66,  64,  62,  60,  58,
+        56,  54,  52,  49,  47,  45,  43,  41,
+        39,  36,  34,  32,  30,  28,  25,  23,
+        21,  19,  16,  14,  12,   9,   7,   5,
+        3,   0,  -1,  -3,  -6,  -8, -10, -12,
+        -15, -17, -19, -22, -24, -26, -28, -30,
+        -33, -35, -37, -39, -41, -44, -46, -48,
+        -50, -52, -54, -56, -58, -60, -62, -64,
+        -66, -68, -70, -72, -74, -76, -78, -80,
+        -81, -83, -85, -87, -88, -90, -92, -93,
+        -95, -97, -98, -100, -101, -102, -104, -105,
+        -107, -108, -109, -110, -112, -113, -114, -115,
+        -116, -117, -118, -119, -120, -121, -122, -123,
+        -123, -124, -125, -125, -126, -127, -127, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -127, -127, -126, -125, -125, -124, -123,
+        -122, -122, -121, -120, -119, -118, -117, -116,
+        -115, -114, -112, -111, -110, -109, -107, -106,
+        -105, -103, -102, -101, -99, -98, -96, -94,
+        -93, -91, -90, -88, -86, -84, -83, -81,
+        -79, -77, -75, -74, -72, -70, -68, -66,
+        -64, -62, -60, -58, -56, -54, -52, -49,
+        -47, -45, -43, -41, -39, -36, -34, -32,
+        -30, -28, -25, -23, -21, -19, -16, -14,
+        -12,  -9,  -7,  -5,  -3,   0,   1,   3,
+        6,   8,  10,  12,  15,  17,  19,  22,
+        24,  26,  28,  30,  33,  35,  37,  39, 41
+};
+
+static const int hsv_red_y[] = {
+        82,  80,  78,  76,  74,  73,  71,  69,
+        67,  65,  63,  61,  58,  56,  54,  52,
+        50,  48,  46,  44,  41,  39,  37,  35,
+        32,  30,  28,  26,  23,  21,  19,  16,
+        14,  12,  10,   7,   5,   3,   0,  -1,
+        -3,  -6,  -8, -10, -13, -15, -17, -19,
+        -22, -24, -26, -29, -31, -33, -35, -38,
+        -40, -42, -44, -46, -48, -51, -53, -55,
+        -57, -59, -61, -63, -65, -67, -69, -71,
+        -73, -75, -77, -79, -81, -82, -84, -86,
+        -88, -89, -91, -93, -94, -96, -98, -99,
+        -101, -102, -104, -105, -106, -108, -109, -110,
+        -112, -113, -114, -115, -116, -117, -119, -120,
+        -120, -121, -122, -123, -124, -125, -126, -126,
+        -127, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -127, -127, -126, -125, -125, -124, -123, -122,
+        -121, -120, -119, -118, -117, -116, -115, -114,
+        -113, -111, -110, -109, -107, -106, -105, -103,
+        -102, -100, -99, -97, -96, -94, -92, -91,
+        -89, -87, -85, -84, -82, -80, -78, -76,
+        -74, -73, -71, -69, -67, -65, -63, -61,
+        -58, -56, -54, -52, -50, -48, -46, -44,
+        -41, -39, -37, -35, -32, -30, -28, -26,
+        -23, -21, -19, -16, -14, -12, -10,  -7,
+        -5,  -3,   0,   1,   3,   6,   8,  10,
+        13,  15,  17,  19,  22,  24,  26,  29,
+        31,  33,  35,  38,  40,  42,  44,  46,
+        48,  51,  53,  55,  57,  59,  61,  63,
+        65,  67,  69,  71,  73,  75,  77,  79,
+        81,  82,  84,  86,  88,  89,  91,  93,
+        94,  96,  98,  99, 101, 102, 104, 105,
+        106, 108, 109, 110, 112, 113, 114, 115,
+        116, 117, 119, 120, 120, 121, 122, 123,
+        124, 125, 126, 126, 127, 128, 128, 129,
+        129, 130, 130, 131, 131, 131, 131, 132,
+        132, 132, 132, 132, 132, 132, 132, 132,
+        132, 132, 132, 131, 131, 131, 130, 130,
+        130, 129, 129, 128, 127, 127, 126, 125,
+        125, 124, 123, 122, 121, 120, 119, 118,
+        117, 116, 115, 114, 113, 111, 110, 109,
+        107, 106, 105, 103, 102, 100,  99,  97,
+        96, 94, 92, 91, 89, 87, 85, 84, 82
+};
+
+static const int hsv_green_x[] = {
+        -124, -124, -125, -125, -125, -125, -125, -125,
+        -125, -126, -126, -125, -125, -125, -125, -125,
+        -125, -124, -124, -124, -123, -123, -122, -122,
+        -121, -121, -120, -120, -119, -118, -117, -117,
+        -116, -115, -114, -113, -112, -111, -110, -109,
+        -108, -107, -105, -104, -103, -102, -100, -99,
+        -98, -96, -95, -93, -92, -91, -89, -87,
+        -86, -84, -83, -81, -79, -77, -76, -74,
+        -72, -70, -69, -67, -65, -63, -61, -59,
+        -57, -55, -53, -51, -49, -47, -45, -43,
+        -41, -39, -37, -35, -33, -30, -28, -26,
+        -24, -22, -20, -18, -15, -13, -11,  -9,
+        -7,  -4,  -2,   0,   1,   3,   6,   8,
+        10,  12,  14,  17,  19,  21,  23,  25,
+        27,  29,  32,  34,  36,  38,  40,  42,
+        44,  46,  48,  50,  52,  54,  56,  58,
+        60,  62,  64,  66,  68,  70,  71,  73,
+        75,  77,  78,  80,  82,  83,  85,  87,
+        88,  90,  91,  93,  94,  96,  97,  98,
+        100, 101, 102, 104, 105, 106, 107, 108,
+        109, 111, 112, 113, 113, 114, 115, 116,
+        117, 118, 118, 119, 120, 120, 121, 122,
+        122, 123, 123, 124, 124, 124, 125, 125,
+        125, 125, 125, 125, 125, 126, 126, 125,
+        125, 125, 125, 125, 125, 124, 124, 124,
+        123, 123, 122, 122, 121, 121, 120, 120,
+        119, 118, 117, 117, 116, 115, 114, 113,
+        112, 111, 110, 109, 108, 107, 105, 104,
+        103, 102, 100,  99,  98,  96,  95,  93,
+        92,  91,  89,  87,  86,  84,  83,  81,
+        79,  77,  76,  74,  72,  70,  69,  67,
+        65,  63,  61,  59,  57,  55,  53,  51,
+        49,  47,  45,  43,  41,  39,  37,  35,
+        33,  30,  28,  26,  24,  22,  20,  18,
+        15,  13,  11,   9,   7,   4,   2,   0,
+        -1,  -3,  -6,  -8, -10, -12, -14, -17,
+        -19, -21, -23, -25, -27, -29, -32, -34,
+        -36, -38, -40, -42, -44, -46, -48, -50,
+        -52, -54, -56, -58, -60, -62, -64, -66,
+        -68, -70, -71, -73, -75, -77, -78, -80,
+        -82, -83, -85, -87, -88, -90, -91, -93,
+        -94, -96, -97, -98, -100, -101, -102, -104,
+        -105, -106, -107, -108, -109, -111, -112, -113,
+        -113, -114, -115, -116, -117, -118, -118, -119,
+        -120, -120, -121, -122, -122, -123, -123, -124, -124
+};
+
+static const int hsv_green_y[] = {
+        -100, -99, -98, -97, -95, -94, -93, -91,
+        -90, -89, -87, -86, -84, -83, -81, -80,
+        -78, -76, -75, -73, -71, -70, -68, -66,
+        -64, -63, -61, -59, -57, -55, -53, -51,
+        -49, -48, -46, -44, -42, -40, -38, -36,
+        -34, -32, -30, -27, -25, -23, -21, -19,
+        -17, -15, -13, -11,  -9,  -7,  -4,  -2,
+        0,   1,   3,   5,   7,   9,  11,  14,
+        16,  18,  20,  22,  24,  26,  28,  30,
+        32,  34,  36,  38,  40,  42,  44,  46,
+        48,  50,  52,  54,  56,  58,  59,  61,
+        63,  65,  67,  68,  70,  72,  74,  75,
+        77,  78,  80,  82,  83,  85,  86,  88,
+        89,  90,  92,  93,  95,  96,  97,  98,
+        100, 101, 102, 103, 104, 105, 106, 107,
+        108, 109, 110, 111, 112, 112, 113, 114,
+        115, 115, 116, 116, 117, 117, 118, 118,
+        119, 119, 119, 120, 120, 120, 120, 120,
+        121, 121, 121, 121, 121, 121, 120, 120,
+        120, 120, 120, 119, 119, 119, 118, 118,
+        117, 117, 116, 116, 115, 114, 114, 113,
+        112, 111, 111, 110, 109, 108, 107, 106,
+        105, 104, 103, 102, 100,  99,  98,  97,
+        95,  94,  93,  91,  90,  89,  87,  86,
+        84,  83,  81,  80,  78,  76,  75,  73,
+        71,  70,  68,  66,  64,  63,  61,  59,
+        57,  55,  53,  51,  49,  48,  46,  44,
+        42,  40,  38,  36,  34,  32,  30,  27,
+        25,  23,  21,  19,  17,  15,  13,  11,
+        9,   7,   4,   2,   0,  -1,  -3,  -5,
+        -7,  -9, -11, -14, -16, -18, -20, -22,
+        -24, -26, -28, -30, -32, -34, -36, -38,
+        -40, -42, -44, -46, -48, -50, -52, -54,
+        -56, -58, -59, -61, -63, -65, -67, -68,
+        -70, -72, -74, -75, -77, -78, -80, -82,
+        -83, -85, -86, -88, -89, -90, -92, -93,
+        -95, -96, -97, -98, -100, -101, -102, -103,
+        -104, -105, -106, -107, -108, -109, -110, -111,
+        -112, -112, -113, -114, -115, -115, -116, -116,
+        -117, -117, -118, -118, -119, -119, -119, -120,
+        -120, -120, -120, -120, -121, -121, -121, -121,
+        -121, -121, -120, -120, -120, -120, -120, -119,
+        -119, -119, -118, -118, -117, -117, -116, -116,
+        -115, -114, -114, -113, -112, -111, -111, -110,
+        -109, -108, -107, -106, -105, -104, -103, -102, -100
+};
+
+static const int hsv_blue_x[] = {
+        112, 113, 114, 114, 115, 116, 117, 117,
+        118, 118, 119, 119, 120, 120, 120, 121,
+        121, 121, 122, 122, 122, 122, 122, 122,
+        122, 122, 122, 122, 122, 122, 121, 121,
+        121, 120, 120, 120, 119, 119, 118, 118,
+        117, 116, 116, 115, 114, 113, 113, 112,
+        111, 110, 109, 108, 107, 106, 105, 104,
+        103, 102, 100,  99,  98,  97,  95,  94,
+        93,  91,  90,  88,  87,  85,  84,  82,
+        80,  79,  77,  76,  74,  72,  70,  69,
+        67,  65,  63,  61,  60,  58,  56,  54,
+        52,  50,  48,  46,  44,  42,  40,  38,
+        36,  34,  32,  30,  28,  26,  24,  22,
+        19,  17,  15,  13,  11,   9,   7,   5,
+        2,   0,  -1,  -3,  -5,  -7,  -9, -12,
+        -14, -16, -18, -20, -22, -24, -26, -28,
+        -31, -33, -35, -37, -39, -41, -43, -45,
+        -47, -49, -51, -53, -54, -56, -58, -60,
+        -62, -64, -66, -67, -69, -71, -73, -74,
+        -76, -78, -79, -81, -83, -84, -86, -87,
+        -89, -90, -92, -93, -94, -96, -97, -98,
+        -99, -101, -102, -103, -104, -105, -106, -107,
+        -108, -109, -110, -111, -112, -113, -114, -114,
+        -115, -116, -117, -117, -118, -118, -119, -119,
+        -120, -120, -120, -121, -121, -121, -122, -122,
+        -122, -122, -122, -122, -122, -122, -122, -122,
+        -122, -122, -121, -121, -121, -120, -120, -120,
+        -119, -119, -118, -118, -117, -116, -116, -115,
+        -114, -113, -113, -112, -111, -110, -109, -108,
+        -107, -106, -105, -104, -103, -102, -100, -99,
+        -98, -97, -95, -94, -93, -91, -90, -88,
+        -87, -85, -84, -82, -80, -79, -77, -76,
+        -74, -72, -70, -69, -67, -65, -63, -61,
+        -60, -58, -56, -54, -52, -50, -48, -46,
+        -44, -42, -40, -38, -36, -34, -32, -30,
+        -28, -26, -24, -22, -19, -17, -15, -13,
+        -11,  -9,  -7,  -5,  -2,   0,   1,   3,
+        5,   7,   9,  12,  14,  16,  18,  20,
+        22,  24,  26,  28,  31,  33,  35,  37,
+        39,  41,  43,  45,  47,  49,  51,  53,
+        54,  56,  58,  60,  62,  64,  66,  67,
+        69,  71,  73,  74,  76,  78,  79,  81,
+        83,  84,  86,  87,  89,  90,  92,  93,
+        94,  96,  97,  98,  99, 101, 102, 103,
+        104, 105, 106, 107, 108, 109, 110, 111, 112
+};
+
+static const int hsv_blue_y[] = {
+        -11, -13, -15, -17, -19, -21, -23, -25,
+        -27, -29, -31, -33, -35, -37, -39, -41,
+        -43, -45, -46, -48, -50, -52, -54, -55,
+        -57, -59, -61, -62, -64, -66, -67, -69,
+        -71, -72, -74, -75, -77, -78, -80, -81,
+        -83, -84, -86, -87, -88, -90, -91, -92,
+        -93, -95, -96, -97, -98, -99, -100, -101,
+        -102, -103, -104, -105, -106, -106, -107, -108,
+        -109, -109, -110, -111, -111, -112, -112, -113,
+        -113, -114, -114, -114, -115, -115, -115, -115,
+        -116, -116, -116, -116, -116, -116, -116, -116,
+        -116, -115, -115, -115, -115, -114, -114, -114,
+        -113, -113, -112, -112, -111, -111, -110, -110,
+        -109, -108, -108, -107, -106, -105, -104, -103,
+        -102, -101, -100, -99, -98, -97, -96, -95,
+        -94, -93, -91, -90, -89, -88, -86, -85,
+        -84, -82, -81, -79, -78, -76, -75, -73,
+        -71, -70, -68, -67, -65, -63, -62, -60,
+        -58, -56, -55, -53, -51, -49, -47, -45,
+        -44, -42, -40, -38, -36, -34, -32, -30,
+        -28, -26, -24, -22, -20, -18, -16, -14,
+        -12, -10,  -8,  -6,  -4,  -2,   0,   1,
+        3,   5,   7,   9,  11,  13,  15,  17,
+        19,  21,  23,  25,  27,  29,  31,  33,
+        35,  37,  39,  41,  43,  45,  46,  48,
+        50,  52,  54,  55,  57,  59,  61,  62,
+        64,  66,  67,  69,  71,  72,  74,  75,
+        77,  78,  80,  81,  83,  84,  86,  87,
+        88,  90,  91,  92,  93,  95,  96,  97,
+        98,  99, 100, 101, 102, 103, 104, 105,
+        106, 106, 107, 108, 109, 109, 110, 111,
+        111, 112, 112, 113, 113, 114, 114, 114,
+        115, 115, 115, 115, 116, 116, 116, 116,
+        116, 116, 116, 116, 116, 115, 115, 115,
+        115, 114, 114, 114, 113, 113, 112, 112,
+        111, 111, 110, 110, 109, 108, 108, 107,
+        106, 105, 104, 103, 102, 101, 100,  99,
+        98,  97,  96,  95,  94,  93,  91,  90,
+        89,  88,  86,  85,  84,  82,  81,  79,
+        78,  76,  75,  73,  71,  70,  68,  67,
+        65,  63,  62,  60,  58,  56,  55,  53,
+        51,  49,  47,  45,  44,  42,  40,  38,
+        36,  34,  32,  30,  28,  26,  24,  22,
+        20,  18,  16,  14,  12,  10,   8,   6,
+        4,   2,   0,  -1,  -3,  -5,  -7,  -9, -11
+};
+
+static u16 i2c_ident[] = {
+        V4L2_IDENT_OV9650,
+        V4L2_IDENT_OV9655,
+        V4L2_IDENT_SOI968,
+        V4L2_IDENT_OV7660,
+        V4L2_IDENT_OV7670,
+        V4L2_IDENT_MT9V011,
+        V4L2_IDENT_MT9V111,
+        V4L2_IDENT_MT9V112,
+        V4L2_IDENT_MT9M001C12ST,
+        V4L2_IDENT_MT9M111,
+        V4L2_IDENT_HV7131R,
+};
+
+static u16 bridge_init[][2] = {
+        {0x1000, 0x78}, {0x1001, 0x40}, {0x1002, 0x1c},
+        {0x1020, 0x80}, {0x1061, 0x01}, {0x1067, 0x40},
+        {0x1068, 0x30}, {0x1069, 0x20}, {0x106a, 0x10},
+        {0x106b, 0x08}, {0x1188, 0x87}, {0x11a1, 0x00},
+        {0x11a2, 0x00}, {0x11a3, 0x6a}, {0x11a4, 0x50},
+        {0x11ab, 0x00}, {0x11ac, 0x00}, {0x11ad, 0x50},
+        {0x11ae, 0x3c}, {0x118a, 0x04}, {0x0395, 0x04},
+        {0x11b8, 0x3a}, {0x118b, 0x0e}, {0x10f7, 0x05},
+        {0x10f8, 0x14}, {0x10fa, 0xff}, {0x10f9, 0x00},
+        {0x11ba, 0x0a}, {0x11a5, 0x2d}, {0x11a6, 0x2d},
+        {0x11a7, 0x3a}, {0x11a8, 0x05}, {0x11a9, 0x04},
+        {0x11aa, 0x3f}, {0x11af, 0x28}, {0x11b0, 0xd8},
+        {0x11b1, 0x14}, {0x11b2, 0xec}, {0x11b3, 0x32},
+        {0x11b4, 0xdd}, {0x11b5, 0x32}, {0x11b6, 0xdd},
+        {0x10e0, 0x2c}, {0x11bc, 0x40}, {0x11bd, 0x01},
+        {0x11be, 0xf0}, {0x11bf, 0x00}, {0x118c, 0x1f},
+        {0x118d, 0x1f}, {0x118e, 0x1f}, {0x118f, 0x1f},
+        {0x1180, 0x01}, {0x1181, 0x00}, {0x1182, 0x01},
+        {0x1183, 0x00}, {0x1184, 0x50}, {0x1185, 0x80}
+};
+
+/* Gain = (bit[3:0] / 16 + 1) * (bit[4] + 1) * (bit[5] + 1) * (bit[6] + 1) */
+static u8 ov_gain[] = {
+        0x00 /* 1x */, 0x04 /* 1.25x */, 0x08 /* 1.5x */, 0x0c /* 1.75x */,
+        0x10 /* 2x */, 0x12 /* 2.25x */, 0x14 /* 2.5x */, 0x16 /* 2.75x */,
+        0x18 /* 3x */, 0x1a /* 3.25x */, 0x1c /* 3.5x */, 0x1e /* 3.75x */,
+        0x30 /* 4x */, 0x31 /* 4.25x */, 0x32 /* 4.5x */, 0x33 /* 4.75x */,
+        0x34 /* 5x */, 0x35 /* 5.25x */, 0x36 /* 5.5x */, 0x37 /* 5.75x */,
+        0x38 /* 6x */, 0x39 /* 6.25x */, 0x3a /* 6.5x */, 0x3b /* 6.75x */,
+        0x3c /* 7x */, 0x3d /* 7.25x */, 0x3e /* 7.5x */, 0x3f /* 7.75x */,
+        0x70 /* 8x */
+};
+
+/* Gain = (bit[8] + 1) * (bit[7] + 1) * (bit[6:0] * 0.03125) */
+static u16 micron1_gain[] = {
+        /* 1x   1.25x   1.5x    1.75x */
+        0x0020, 0x0028, 0x0030, 0x0038,
+        /* 2x   2.25x   2.5x    2.75x */
+        0x00a0, 0x00a4, 0x00a8, 0x00ac,
+        /* 3x   3.25x   3.5x    3.75x */
+        0x00b0, 0x00b4, 0x00b8, 0x00bc,
+        /* 4x   4.25x   4.5x    4.75x */
+        0x00c0, 0x00c4, 0x00c8, 0x00cc,
+        /* 5x   5.25x   5.5x    5.75x */
+        0x00d0, 0x00d4, 0x00d8, 0x00dc,
+        /* 6x   6.25x   6.5x    6.75x */
+        0x00e0, 0x00e4, 0x00e8, 0x00ec,
+        /* 7x   7.25x   7.5x    7.75x */
+        0x00f0, 0x00f4, 0x00f8, 0x00fc,
+        /* 8x */
+        0x01c0
+};
+
+/* mt9m001 sensor uses a different gain formula then other micron sensors */
+/* Gain = (bit[6] + 1) * (bit[5-0] * 0.125) */
+static u16 micron2_gain[] = {
+        /* 1x   1.25x   1.5x    1.75x */
+        0x0008, 0x000a, 0x000c, 0x000e,
+        /* 2x   2.25x   2.5x    2.75x */
+        0x0010, 0x0012, 0x0014, 0x0016,
+        /* 3x   3.25x   3.5x    3.75x */
+        0x0018, 0x001a, 0x001c, 0x001e,
+        /* 4x   4.25x   4.5x    4.75x */
+        0x0020, 0x0051, 0x0052, 0x0053,
+        /* 5x   5.25x   5.5x    5.75x */
+        0x0054, 0x0055, 0x0056, 0x0057,
+        /* 6x   6.25x   6.5x    6.75x */
+        0x0058, 0x0059, 0x005a, 0x005b,
+        /* 7x   7.25x   7.5x    7.75x */
+        0x005c, 0x005d, 0x005e, 0x005f,
+        /* 8x */
+        0x0060
+};
+
+/* Gain = .5 + bit[7:0] / 16 */
+static u8 hv7131r_gain[] = {
+        0x08 /* 1x */, 0x0c /* 1.25x */, 0x10 /* 1.5x */, 0x14 /* 1.75x */,
+        0x18 /* 2x */, 0x1c /* 2.25x */, 0x20 /* 2.5x */, 0x24 /* 2.75x */,
+        0x28 /* 3x */, 0x2c /* 3.25x */, 0x30 /* 3.5x */, 0x34 /* 3.75x */,
+        0x38 /* 4x */, 0x3c /* 4.25x */, 0x40 /* 4.5x */, 0x44 /* 4.75x */,
+        0x48 /* 5x */, 0x4c /* 5.25x */, 0x50 /* 5.5x */, 0x54 /* 5.75x */,
+        0x58 /* 6x */, 0x5c /* 6.25x */, 0x60 /* 6.5x */, 0x64 /* 6.75x */,
+        0x68 /* 7x */, 0x6c /* 7.25x */, 0x70 /* 7.5x */, 0x74 /* 7.75x */,
+        0x78 /* 8x */
+};
+
+static u8 soi968_init[][2] = {
+        {0x12, 0x80}, {0x0c, 0x00}, {0x0f, 0x1f},
+        {0x11, 0x80}, {0x38, 0x52}, {0x1e, 0x00},
+        {0x33, 0x08}, {0x35, 0x8c}, {0x36, 0x0c},
+        {0x37, 0x04}, {0x45, 0x04}, {0x47, 0xff},
+        {0x3e, 0x00}, {0x3f, 0x00}, {0x3b, 0x20},
+        {0x3a, 0x96}, {0x3d, 0x0a}, {0x14, 0x8e},
+        {0x13, 0x8a}, {0x12, 0x40}, {0x17, 0x13},
+        {0x18, 0x63}, {0x19, 0x01}, {0x1a, 0x79},
+        {0x32, 0x24}, {0x03, 0x00}, {0x11, 0x40},
+        {0x2a, 0x10}, {0x2b, 0xe0}, {0x10, 0x32},
+        {0x00, 0x00}, {0x01, 0x80}, {0x02, 0x80},
+};
+
+static u8 ov7660_init[][2] = {
+        {0x0e, 0x80}, {0x0d, 0x08}, {0x0f, 0xc3},
+        {0x04, 0xc3}, {0x10, 0x40}, {0x11, 0x40},
+        {0x12, 0x05}, {0x13, 0xba}, {0x14, 0x2a},
+        {0x37, 0x0f}, {0x38, 0x02}, {0x39, 0x43},
+        {0x3a, 0x00}, {0x69, 0x90}, {0x2d, 0xf6},
+        {0x2e, 0x0b}, {0x01, 0x78}, {0x02, 0x50},
+};
+
+static u8 ov7670_init[][2] = {
+        {0x12, 0x80}, {0x11, 0x80}, {0x3a, 0x04}, {0x12, 0x01},
+        {0x32, 0xb6}, {0x03, 0x0a}, {0x0c, 0x00}, {0x3e, 0x00},
+        {0x70, 0x3a}, {0x71, 0x35}, {0x72, 0x11}, {0x73, 0xf0},
+        {0xa2, 0x02}, {0x13, 0xe0}, {0x00, 0x00}, {0x10, 0x00},
+        {0x0d, 0x40}, {0x14, 0x28}, {0xa5, 0x05}, {0xab, 0x07},
+        {0x24, 0x95}, {0x25, 0x33}, {0x26, 0xe3}, {0x9f, 0x75},
+        {0xa0, 0x65}, {0xa1, 0x0b}, {0xa6, 0xd8}, {0xa7, 0xd8},
+        {0xa8, 0xf0}, {0xa9, 0x90}, {0xaa, 0x94}, {0x13, 0xe5},
+        {0x0e, 0x61}, {0x0f, 0x4b}, {0x16, 0x02}, {0x1e, 0x27},
+        {0x21, 0x02}, {0x22, 0x91}, {0x29, 0x07}, {0x33, 0x0b},
+        {0x35, 0x0b}, {0x37, 0x1d}, {0x38, 0x71}, {0x39, 0x2a},
+        {0x3c, 0x78}, {0x4d, 0x40}, {0x4e, 0x20}, {0x69, 0x00},
+        {0x74, 0x19}, {0x8d, 0x4f}, {0x8e, 0x00}, {0x8f, 0x00},
+        {0x90, 0x00}, {0x91, 0x00}, {0x96, 0x00}, {0x9a, 0x80},
+        {0xb0, 0x84}, {0xb1, 0x0c}, {0xb2, 0x0e}, {0xb3, 0x82},
+        {0xb8, 0x0a}, {0x43, 0x0a}, {0x44, 0xf0}, {0x45, 0x20},
+        {0x46, 0x7d}, {0x47, 0x29}, {0x48, 0x4a}, {0x59, 0x8c},
+        {0x5a, 0xa5}, {0x5b, 0xde}, {0x5c, 0x96}, {0x5d, 0x66},
+        {0x5e, 0x10}, {0x6c, 0x0a}, {0x6d, 0x55}, {0x6e, 0x11},
+        {0x6f, 0x9e}, {0x6a, 0x40}, {0x01, 0x40}, {0x02, 0x40},
+        {0x13, 0xe7}, {0x4f, 0x6e}, {0x50, 0x70}, {0x51, 0x02},
+        {0x52, 0x1d}, {0x53, 0x56}, {0x54, 0x73}, {0x55, 0x0a},
+        {0x56, 0x55}, {0x57, 0x80}, {0x58, 0x9e}, {0x41, 0x08},
+        {0x3f, 0x02}, {0x75, 0x03}, {0x76, 0x63}, {0x4c, 0x04},
+        {0x77, 0x06}, {0x3d, 0x02}, {0x4b, 0x09}, {0xc9, 0x30},
+        {0x41, 0x08}, {0x56, 0x48}, {0x34, 0x11}, {0xa4, 0x88},
+        {0x96, 0x00}, {0x97, 0x30}, {0x98, 0x20}, {0x99, 0x30},
+        {0x9a, 0x84}, {0x9b, 0x29}, {0x9c, 0x03}, {0x9d, 0x99},
+        {0x9e, 0x7f}, {0x78, 0x04}, {0x79, 0x01}, {0xc8, 0xf0},
+        {0x79, 0x0f}, {0xc8, 0x00}, {0x79, 0x10}, {0xc8, 0x7e},
+        {0x79, 0x0a}, {0xc8, 0x80}, {0x79, 0x0b}, {0xc8, 0x01},
+        {0x79, 0x0c}, {0xc8, 0x0f}, {0x79, 0x0d}, {0xc8, 0x20},
+        {0x79, 0x09}, {0xc8, 0x80}, {0x79, 0x02}, {0xc8, 0xc0},
+        {0x79, 0x03}, {0xc8, 0x40}, {0x79, 0x05}, {0xc8, 0x30},
+        {0x79, 0x26}, {0x62, 0x20}, {0x63, 0x00}, {0x64, 0x06},
+        {0x65, 0x00}, {0x66, 0x05}, {0x94, 0x05}, {0x95, 0x0a},
+        {0x17, 0x13}, {0x18, 0x01}, {0x19, 0x02}, {0x1a, 0x7a},
+        {0x46, 0x59}, {0x47, 0x30}, {0x58, 0x9a}, {0x59, 0x84},
+        {0x5a, 0x91}, {0x5b, 0x57}, {0x5c, 0x75}, {0x5d, 0x6d},
+        {0x5e, 0x13}, {0x64, 0x07}, {0x94, 0x07}, {0x95, 0x0d},
+        {0xa6, 0xdf}, {0xa7, 0xdf}, {0x48, 0x4d}, {0x51, 0x00},
+        {0x6b, 0x0a}, {0x11, 0x80}, {0x2a, 0x00}, {0x2b, 0x00},
+        {0x92, 0x00}, {0x93, 0x00}, {0x55, 0x0a}, {0x56, 0x60},
+        {0x4f, 0x6e}, {0x50, 0x70}, {0x51, 0x00}, {0x52, 0x1d},
+        {0x53, 0x56}, {0x54, 0x73}, {0x58, 0x9a}, {0x4f, 0x6e},
+        {0x50, 0x70}, {0x51, 0x00}, {0x52, 0x1d}, {0x53, 0x56},
+        {0x54, 0x73}, {0x58, 0x9a}, {0x3f, 0x01}, {0x7b, 0x03},
+        {0x7c, 0x09}, {0x7d, 0x16}, {0x7e, 0x38}, {0x7f, 0x47},
+        {0x80, 0x53}, {0x81, 0x5e}, {0x82, 0x6a}, {0x83, 0x74},
+        {0x84, 0x80}, {0x85, 0x8c}, {0x86, 0x9b}, {0x87, 0xb2},
+        {0x88, 0xcc}, {0x89, 0xe5}, {0x7a, 0x24}, {0x3b, 0x00},
+        {0x9f, 0x76}, {0xa0, 0x65}, {0x13, 0xe2}, {0x6b, 0x0a},
+        {0x11, 0x80}, {0x2a, 0x00}, {0x2b, 0x00}, {0x92, 0x00},
+        {0x93, 0x00},
+};
+
+static u8 ov9650_init[][2] = {
+        {0x12, 0x80}, {0x00, 0x00}, {0x01, 0x78},
+        {0x02, 0x78}, {0x03, 0x36}, {0x04, 0x03},
+        {0x05, 0x00}, {0x06, 0x00}, {0x08, 0x00},
+        {0x09, 0x01}, {0x0c, 0x00}, {0x0d, 0x00},
+        {0x0e, 0xa0}, {0x0f, 0x52}, {0x10, 0x7c},
+        {0x11, 0x80}, {0x12, 0x45}, {0x13, 0xc2},
+        {0x14, 0x2e}, {0x15, 0x00}, {0x16, 0x07},
+        {0x17, 0x24}, {0x18, 0xc5}, {0x19, 0x00},
+        {0x1a, 0x3c}, {0x1b, 0x00}, {0x1e, 0x04},
+        {0x1f, 0x00}, {0x24, 0x78}, {0x25, 0x68},
+        {0x26, 0xd4}, {0x27, 0x80}, {0x28, 0x80},
+        {0x29, 0x30}, {0x2a, 0x00}, {0x2b, 0x00},
+        {0x2c, 0x80}, {0x2d, 0x00}, {0x2e, 0x00},
+        {0x2f, 0x00}, {0x30, 0x08}, {0x31, 0x30},
+        {0x32, 0x84}, {0x33, 0xe2}, {0x34, 0xbf},
+        {0x35, 0x81}, {0x36, 0xf9}, {0x37, 0x00},
+        {0x38, 0x93}, {0x39, 0x50}, {0x3a, 0x01},
+        {0x3b, 0x01}, {0x3c, 0x73}, {0x3d, 0x19},
+        {0x3e, 0x0b}, {0x3f, 0x80}, {0x40, 0xc1},
+        {0x41, 0x00}, {0x42, 0x08}, {0x67, 0x80},
+        {0x68, 0x80}, {0x69, 0x40}, {0x6a, 0x00},
+        {0x6b, 0x0a}, {0x8b, 0x06}, {0x8c, 0x20},
+        {0x8d, 0x00}, {0x8e, 0x00}, {0x8f, 0xdf},
+        {0x92, 0x00}, {0x93, 0x00}, {0x94, 0x88},
+        {0x95, 0x88}, {0x96, 0x04}, {0xa1, 0x00},
+        {0xa5, 0x80}, {0xa8, 0x80}, {0xa9, 0xb8},
+        {0xaa, 0x92}, {0xab, 0x0a},
+};
+
+static u8 ov9655_init[][2] = {
+        {0x12, 0x80}, {0x12, 0x01}, {0x0d, 0x00}, {0x0e, 0x61},
+        {0x11, 0x80}, {0x13, 0xba}, {0x14, 0x2e}, {0x16, 0x24},
+        {0x1e, 0x04}, {0x1e, 0x04}, {0x1e, 0x04}, {0x27, 0x08},
+        {0x28, 0x08}, {0x29, 0x15}, {0x2c, 0x08}, {0x32, 0xbf},
+        {0x34, 0x3d}, {0x35, 0x00}, {0x36, 0xf8}, {0x38, 0x12},
+        {0x39, 0x57}, {0x3a, 0x00}, {0x3b, 0xcc}, {0x3c, 0x0c},
+        {0x3d, 0x19}, {0x3e, 0x0c}, {0x3f, 0x01}, {0x41, 0x40},
+        {0x42, 0x80}, {0x45, 0x46}, {0x46, 0x62}, {0x47, 0x2a},
+        {0x48, 0x3c}, {0x4a, 0xf0}, {0x4b, 0xdc}, {0x4c, 0xdc},
+        {0x4d, 0xdc}, {0x4e, 0xdc}, {0x69, 0x02}, {0x6c, 0x04},
+        {0x6f, 0x9e}, {0x70, 0x05}, {0x71, 0x78}, {0x77, 0x02},
+        {0x8a, 0x23}, {0x8c, 0x0d}, {0x90, 0x7e}, {0x91, 0x7c},
+        {0x9f, 0x6e}, {0xa0, 0x6e}, {0xa5, 0x68}, {0xa6, 0x60},
+        {0xa8, 0xc1}, {0xa9, 0xfa}, {0xaa, 0x92}, {0xab, 0x04},
+        {0xac, 0x80}, {0xad, 0x80}, {0xae, 0x80}, {0xaf, 0x80},
+        {0xb2, 0xf2}, {0xb3, 0x20}, {0xb5, 0x00}, {0xb6, 0xaf},
+        {0xbb, 0xae}, {0xbc, 0x44}, {0xbd, 0x44}, {0xbe, 0x3b},
+        {0xbf, 0x3a}, {0xc0, 0xe2}, {0xc1, 0xc8}, {0xc2, 0x01},
+        {0xc4, 0x00}, {0xc6, 0x85}, {0xc7, 0x81}, {0xc9, 0xe0},
+        {0xca, 0xe8}, {0xcc, 0xd8}, {0xcd, 0x93}, {0x12, 0x61},
+        {0x36, 0xfa}, {0x8c, 0x8d}, {0xc0, 0xaa}, {0x69, 0x0a},
+        {0x03, 0x12}, {0x17, 0x14}, {0x18, 0x00}, {0x19, 0x01},
+        {0x1a, 0x3d}, {0x32, 0xbf}, {0x11, 0x80}, {0x2a, 0x10},
+        {0x2b, 0x0a}, {0x92, 0x00}, {0x93, 0x00}, {0x1e, 0x04},
+        {0x1e, 0x04}, {0x10, 0x7c}, {0x04, 0x03}, {0xa1, 0x00},
+        {0x2d, 0x00}, {0x2e, 0x00}, {0x00, 0x00}, {0x01, 0x80},
+        {0x02, 0x80}, {0x12, 0x61}, {0x36, 0xfa}, {0x8c, 0x8d},
+        {0xc0, 0xaa}, {0x69, 0x0a}, {0x03, 0x12}, {0x17, 0x14},
+        {0x18, 0x00}, {0x19, 0x01}, {0x1a, 0x3d}, {0x32, 0xbf},
+        {0x11, 0x80}, {0x2a, 0x10}, {0x2b, 0x0a}, {0x92, 0x00},
+        {0x93, 0x00}, {0x04, 0x01}, {0x10, 0x1f}, {0xa1, 0x00},
+        {0x00, 0x0a}, {0xa1, 0x00}, {0x10, 0x5d}, {0x04, 0x03},
+        {0x00, 0x01}, {0xa1, 0x00}, {0x10, 0x7c}, {0x04, 0x03},
+        {0x00, 0x03}, {0x00, 0x0a}, {0x00, 0x10}, {0x00, 0x13},
+};
+
+static u16 mt9v112_init[][2] = {
+        {0xf0, 0x0000}, {0x0d, 0x0021}, {0x0d, 0x0020},
+        {0x34, 0xc019}, {0x0a, 0x0011}, {0x0b, 0x000b},
+        {0x20, 0x0703}, {0x35, 0x2022}, {0xf0, 0x0001},
+        {0x05, 0x0000}, {0x06, 0x340c}, {0x3b, 0x042a},
+        {0x3c, 0x0400}, {0xf0, 0x0002}, {0x2e, 0x0c58},
+        {0x5b, 0x0001}, {0xc8, 0x9f0b}, {0xf0, 0x0001},
+        {0x9b, 0x5300}, {0xf0, 0x0000}, {0x2b, 0x0020},
+        {0x2c, 0x002a}, {0x2d, 0x0032}, {0x2e, 0x0020},
+        {0x09, 0x01dc}, {0x01, 0x000c}, {0x02, 0x0020},
+        {0x03, 0x01e0}, {0x04, 0x0280}, {0x06, 0x000c},
+        {0x05, 0x0098}, {0x20, 0x0703}, {0x09, 0x01f2},
+        {0x2b, 0x00a0}, {0x2c, 0x00a0}, {0x2d, 0x00a0},
+        {0x2e, 0x00a0}, {0x01, 0x000c}, {0x02, 0x0020},
+        {0x03, 0x01e0}, {0x04, 0x0280}, {0x06, 0x000c},
+        {0x05, 0x0098}, {0x09, 0x01c1}, {0x2b, 0x00ae},
+        {0x2c, 0x00ae}, {0x2d, 0x00ae}, {0x2e, 0x00ae},
+};
+
+static u16 mt9v111_init[][2] = {
+        {0x01, 0x0004}, {0x0d, 0x0001}, {0x0d, 0x0000},
+        {0x01, 0x0001}, {0x02, 0x0016}, {0x03, 0x01e1},
+        {0x04, 0x0281}, {0x05, 0x0004}, {0x07, 0x3002},
+        {0x21, 0x0000}, {0x25, 0x4024}, {0x26, 0xff03},
+        {0x27, 0xff10}, {0x2b, 0x7828}, {0x2c, 0xb43c},
+        {0x2d, 0xf0a0}, {0x2e, 0x0c64}, {0x2f, 0x0064},
+        {0x67, 0x4010}, {0x06, 0x301e}, {0x08, 0x0480},
+        {0x01, 0x0004}, {0x02, 0x0016}, {0x03, 0x01e6},
+        {0x04, 0x0286}, {0x05, 0x0004}, {0x06, 0x0000},
+        {0x07, 0x3002}, {0x08, 0x0008}, {0x0c, 0x0000},
+        {0x0d, 0x0000}, {0x0e, 0x0000}, {0x0f, 0x0000},
+        {0x10, 0x0000}, {0x11, 0x0000}, {0x12, 0x00b0},
+        {0x13, 0x007c}, {0x14, 0x0000}, {0x15, 0x0000},
+        {0x16, 0x0000}, {0x17, 0x0000}, {0x18, 0x0000},
+        {0x19, 0x0000}, {0x1a, 0x0000}, {0x1b, 0x0000},
+        {0x1c, 0x0000}, {0x1d, 0x0000}, {0x30, 0x0000},
+        {0x30, 0x0005}, {0x31, 0x0000}, {0x02, 0x0016},
+        {0x03, 0x01e1}, {0x04, 0x0281}, {0x05, 0x0004},
+        {0x06, 0x0000}, {0x07, 0x3002}, {0x06, 0x002d},
+        {0x05, 0x0004}, {0x09, 0x0064}, {0x2b, 0x00a0},
+        {0x2c, 0x00a0}, {0x2d, 0x00a0}, {0x2e, 0x00a0},
+        {0x02, 0x0016}, {0x03, 0x01e1}, {0x04, 0x0281},
+        {0x05, 0x0004}, {0x06, 0x002d}, {0x07, 0x3002},
+        {0x0e, 0x0008}, {0x06, 0x002d}, {0x05, 0x0004},
+};
+
+static u16 mt9v011_init[][2] = {
+        {0x07, 0x0002}, {0x0d, 0x0001}, {0x0d, 0x0000},
+        {0x01, 0x0008}, {0x02, 0x0016}, {0x03, 0x01e1},
+        {0x04, 0x0281}, {0x05, 0x0083}, {0x06, 0x0006},
+        {0x0d, 0x0002}, {0x0a, 0x0000}, {0x0b, 0x0000},
+        {0x0c, 0x0000}, {0x0d, 0x0000}, {0x0e, 0x0000},
+        {0x0f, 0x0000}, {0x10, 0x0000}, {0x11, 0x0000},
+        {0x12, 0x0000}, {0x13, 0x0000}, {0x14, 0x0000},
+        {0x15, 0x0000}, {0x16, 0x0000}, {0x17, 0x0000},
+        {0x18, 0x0000}, {0x19, 0x0000}, {0x1a, 0x0000},
+        {0x1b, 0x0000}, {0x1c, 0x0000}, {0x1d, 0x0000},
+        {0x32, 0x0000}, {0x20, 0x1101}, {0x21, 0x0000},
+        {0x22, 0x0000}, {0x23, 0x0000}, {0x24, 0x0000},
+        {0x25, 0x0000}, {0x26, 0x0000}, {0x27, 0x0024},
+        {0x2f, 0xf7b0}, {0x30, 0x0005}, {0x31, 0x0000},
+        {0x32, 0x0000}, {0x33, 0x0000}, {0x34, 0x0100},
+        {0x3d, 0x068f}, {0x40, 0x01e0}, {0x41, 0x00d1},
+        {0x44, 0x0082}, {0x5a, 0x0000}, {0x5b, 0x0000},
+        {0x5c, 0x0000}, {0x5d, 0x0000}, {0x5e, 0x0000},
+        {0x5f, 0xa31d}, {0x62, 0x0611}, {0x0a, 0x0000},
+        {0x06, 0x0029}, {0x05, 0x0009}, {0x20, 0x1101},
+        {0x20, 0x1101}, {0x09, 0x0064}, {0x07, 0x0003},
+        {0x2b, 0x0033}, {0x2c, 0x00a0}, {0x2d, 0x00a0},
+        {0x2e, 0x0033}, {0x07, 0x0002}, {0x06, 0x0000},
+        {0x06, 0x0029}, {0x05, 0x0009},
+};
+
+static u16 mt9m001_init[][2] = {
+        {0x0d, 0x0001}, {0x0d, 0x0000}, {0x01, 0x000e},
+        {0x02, 0x0014}, {0x03, 0x03c1}, {0x04, 0x0501},
+        {0x05, 0x0083}, {0x06, 0x0006}, {0x0d, 0x0002},
+        {0x0a, 0x0000}, {0x0c, 0x0000}, {0x11, 0x0000},
+        {0x1e, 0x8000}, {0x5f, 0x8904}, {0x60, 0x0000},
+        {0x61, 0x0000}, {0x62, 0x0498}, {0x63, 0x0000},
+        {0x64, 0x0000}, {0x20, 0x111d}, {0x06, 0x00f2},
+        {0x05, 0x0013}, {0x09, 0x10f2}, {0x07, 0x0003},
+        {0x2b, 0x002a}, {0x2d, 0x002a}, {0x2c, 0x002a},
+        {0x2e, 0x0029}, {0x07, 0x0002},
+};
+
+static u16 mt9m111_init[][2] = {
+        {0xf0, 0x0000}, {0x0d, 0x0008}, {0x0d, 0x0009},
+        {0x0d, 0x0008}, {0xf0, 0x0001}, {0x3a, 0x4300},
+        {0x9b, 0x4300}, {0xa1, 0x0280}, {0xa4, 0x0200},
+        {0x06, 0x308e}, {0xf0, 0x0000},
+};
+
+static u8 hv7131r_init[][2] = {
+        {0x02, 0x08}, {0x02, 0x00}, {0x01, 0x08},
+        {0x02, 0x00}, {0x20, 0x00}, {0x21, 0xd0},
+        {0x22, 0x00}, {0x23, 0x09}, {0x01, 0x08},
+        {0x01, 0x08}, {0x01, 0x08}, {0x25, 0x07},
+        {0x26, 0xc3}, {0x27, 0x50}, {0x30, 0x62},
+        {0x31, 0x10}, {0x32, 0x06}, {0x33, 0x10},
+        {0x20, 0x00}, {0x21, 0xd0}, {0x22, 0x00},
+        {0x23, 0x09}, {0x01, 0x08},
+};
+
+int reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length)
+{
+        struct usb_device *dev = gspca_dev->dev;
+        int result;
+        result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+                        0x00,
+                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                        reg,
+                        0x00,
+                        gspca_dev->usb_buf,
+                        length,
+                        500);
+        if (unlikely(result < 0 || result != length)) {
+                err("Read register failed 0x%02X", reg);
+                return -EIO;
+        }
+        return 0;
+}
+
+int reg_w(struct gspca_dev *gspca_dev, u16 reg, const u8 *buffer, int length)
+{
+        struct usb_device *dev = gspca_dev->dev;
+        int result;
+        memcpy(gspca_dev->usb_buf, buffer, length);
+        result = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+                        0x08,
+                        USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                        reg,
+                        0x00,
+                        gspca_dev->usb_buf,
+                        length,
+                        500);
+        if (unlikely(result < 0 || result != length)) {
+                err("Write register failed index 0x%02X", reg);
+                return -EIO;
+        }
+        return 0;
+}
+
+int reg_w1(struct gspca_dev *gspca_dev, u16 reg, const u8 value)
+{
+        u8 data[1] = {value};
+        return reg_w(gspca_dev, reg, data, 1);
+}
+
+int i2c_w(struct gspca_dev *gspca_dev, const u8 *buffer)
+{
+        int i;
+        reg_w(gspca_dev, 0x10c0, buffer, 8);
+        for (i = 0; i < 5; i++) {
+                reg_r(gspca_dev, 0x10c0, 1);
+                if (gspca_dev->usb_buf[0] & 0x04) {
+                        if (gspca_dev->usb_buf[0] & 0x08)
+                                return -1;
+                        return 0;
+                }
+                msleep(1);
+        }
+        return -1;
+}
+
+int i2c_w1(struct gspca_dev *gspca_dev, u8 reg, u8 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        u8 row[8];
+
+        /*
+         * from the point of view of the bridge, the length
+         * includes the address
+         */
+        row[0] = 0x81 | (2 << 4);
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = val;
+        row[4] = 0x00;
+        row[5] = 0x00;
+        row[6] = 0x00;
+        row[7] = 0x10;
+
+        return i2c_w(gspca_dev, row);
+}
+
+int i2c_w2(struct gspca_dev *gspca_dev, u8 reg, u16 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 row[8];
+
+        /*
+         * from the point of view of the bridge, the length
+         * includes the address
+         */
+        row[0] = 0x81 | (3 << 4);
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = (val >> 8) & 0xff;
+        row[4] = val & 0xff;
+        row[5] = 0x00;
+        row[6] = 0x00;
+        row[7] = 0x10;
+
+        return i2c_w(gspca_dev, row);
+}
+
+int i2c_r1(struct gspca_dev *gspca_dev, u8 reg, u8 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 row[8];
+
+        row[0] = 0x81 | 0x10;
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = 0;
+        row[4] = 0;
+        row[5] = 0;
+        row[6] = 0;
+        row[7] = 0x10;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        row[0] = 0x81 | (2 << 4) | 0x02;
+        row[2] = 0;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        reg_r(gspca_dev, 0x10c2, 5);
+        *val = gspca_dev->usb_buf[3];
+        return 0;
+}
+
+int i2c_r2(struct gspca_dev *gspca_dev, u8 reg, u16 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 row[8];
+
+        row[0] = 0x81 | 0x10;
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = 0;
+        row[4] = 0;
+        row[5] = 0;
+        row[6] = 0;
+        row[7] = 0x10;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        row[0] = 0x81 | (3 << 4) | 0x02;
+        row[2] = 0;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        reg_r(gspca_dev, 0x10c2, 5);
+        *val = (gspca_dev->usb_buf[2] << 8) | gspca_dev->usb_buf[3];
+        return 0;
+}
+
+static int ov9650_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov9650_init); i++) {
+                if (i2c_w1(gspca_dev, ov9650_init[i][0],
+                                ov9650_init[i][1]) < 0) {
+                        err("OV9650 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        sd->hstart = 1;
+        sd->vstart = 7;
+        return 0;
+}
+
+static int ov9655_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov9655_init); i++) {
+                if (i2c_w1(gspca_dev, ov9655_init[i][0],
+                                ov9655_init[i][1]) < 0) {
+                        err("OV9655 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 0;
+        sd->vstart = 7;
+        return 0;
+}
+
+static int soi968_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(soi968_init); i++) {
+                if (i2c_w1(gspca_dev, soi968_init[i][0],
+                                soi968_init[i][1]) < 0) {
+                        err("SOI968 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 60;
+        sd->vstart = 11;
+        return 0;
+}
+
+static int ov7660_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov7660_init); i++) {
+                if (i2c_w1(gspca_dev, ov7660_init[i][0],
+                                ov7660_init[i][1]) < 0) {
+                        err("OV7660 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 1;
+        sd->vstart = 1;
+        return 0;
+}
+
+static int ov7670_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov7670_init); i++) {
+                if (i2c_w1(gspca_dev, ov7670_init[i][0],
+                                ov7670_init[i][1]) < 0) {
+                        err("OV7670 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 0;
+        sd->vstart = 1;
+        return 0;
+}
+
+static int mt9v_init_sensor(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        u16 value;
+        int ret;
+
+        sd->i2c_addr = 0x5d;
+        ret = i2c_r2(gspca_dev, 0xff, &value);
+        if ((ret == 0) && (value == 0x8243)) {
+                for (i = 0; i < ARRAY_SIZE(mt9v011_init); i++) {
+                        if (i2c_w2(gspca_dev, mt9v011_init[i][0],
+                                        mt9v011_init[i][1]) < 0) {
+                                err("MT9V011 sensor initialization failed");
+                                return -ENODEV;
+                        }
+                }
+                sd->hstart = 2;
+                sd->vstart = 2;
+                sd->sensor = SENSOR_MT9V011;
+                info("MT9V011 sensor detected");
+                return 0;
+        }
+
+        sd->i2c_addr = 0x5c;
+        i2c_w2(gspca_dev, 0x01, 0x0004);
+        ret = i2c_r2(gspca_dev, 0xff, &value);
+        if ((ret == 0) && (value == 0x823a)) {
+                for (i = 0; i < ARRAY_SIZE(mt9v111_init); i++) {
+                        if (i2c_w2(gspca_dev, mt9v111_init[i][0],
+                                        mt9v111_init[i][1]) < 0) {
+                                err("MT9V111 sensor initialization failed");
+                                return -ENODEV;
+                        }
+                }
+                sd->hstart = 2;
+                sd->vstart = 2;
+                sd->sensor = SENSOR_MT9V111;
+                info("MT9V111 sensor detected");
+                return 0;
+        }
+
+        sd->i2c_addr = 0x5d;
+        ret = i2c_w2(gspca_dev, 0xf0, 0x0000);
+        if (ret < 0) {
+                sd->i2c_addr = 0x48;
+                i2c_w2(gspca_dev, 0xf0, 0x0000);
+        }
+        ret = i2c_r2(gspca_dev, 0x00, &value);
+        if ((ret == 0) && (value == 0x1229)) {
+                for (i = 0; i < ARRAY_SIZE(mt9v112_init); i++) {
+                        if (i2c_w2(gspca_dev, mt9v112_init[i][0],
+                                        mt9v112_init[i][1]) < 0) {
+                                err("MT9V112 sensor initialization failed");
+                                return -ENODEV;
+                        }
+                }
+                sd->hstart = 6;
+                sd->vstart = 2;
+                sd->sensor = SENSOR_MT9V112;
+                info("MT9V112 sensor detected");
+                return 0;
+        }
+
+        return -ENODEV;
+}
+
+static int mt9m111_init_sensor(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(mt9m111_init); i++) {
+                if (i2c_w2(gspca_dev, mt9m111_init[i][0],
+                                mt9m111_init[i][1]) < 0) {
+                        err("MT9M111 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        sd->hstart = 0;
+        sd->vstart = 2;
+        return 0;
+}
+
+static int mt9m001_init_sensor(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(mt9m001_init); i++) {
+                if (i2c_w2(gspca_dev, mt9m001_init[i][0],
+                                mt9m001_init[i][1]) < 0) {
+                        err("MT9M001 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 2;
+        sd->vstart = 2;
+        return 0;
+}
+
+static int hv7131r_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(hv7131r_init); i++) {
+                if (i2c_w1(gspca_dev, hv7131r_init[i][0],
+                                hv7131r_init[i][1]) < 0) {
+                        err("HV7131R Sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        sd->hstart = 0;
+        sd->vstart = 1;
+        return 0;
+}
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+static int input_kthread(void *data)
+{
+        struct gspca_dev *gspca_dev = (struct gspca_dev *)data;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        DECLARE_WAIT_QUEUE_HEAD(wait);
+        set_freezable();
+        for (;;) {
+                if (kthread_should_stop())
+                        break;
+
+                if (reg_r(gspca_dev, 0x1005, 1) < 0)
+                        continue;
+
+                input_report_key(sd->input_dev,
+                                 KEY_CAMERA,
+                                 gspca_dev->usb_buf[0] & sd->input_gpio);
+                input_sync(sd->input_dev);
+
+                wait_event_freezable_timeout(wait,
+                                             kthread_should_stop(),
+                                             msecs_to_jiffies(100));
+        }
+        return 0;
+}
+
+
+static int sn9c20x_input_init(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        if (sd->input_gpio == 0)
+                return 0;
+
+        sd->input_dev = input_allocate_device();
+        if (!sd->input_dev)
+                return -ENOMEM;
+
+        sd->input_dev->name = "SN9C20X Webcam";
+
+        sd->input_dev->phys = kasprintf(GFP_KERNEL, "usb-%s-%s",
+                                         gspca_dev->dev->bus->bus_name,
+                                         gspca_dev->dev->devpath);
+
+        if (!sd->input_dev->phys)
+                return -ENOMEM;
+
+        usb_to_input_id(gspca_dev->dev, &sd->input_dev->id);
+        sd->input_dev->dev.parent = &gspca_dev->dev->dev;
+
+        set_bit(EV_KEY, sd->input_dev->evbit);
+        set_bit(KEY_CAMERA, sd->input_dev->keybit);
+
+        if (input_register_device(sd->input_dev))
+                return -EINVAL;
+
+        sd->input_task = kthread_run(input_kthread, gspca_dev, "sn9c20x/%d",
+                                     gspca_dev->vdev.minor);
+
+        if (IS_ERR(sd->input_task))
+                return -EINVAL;
+
+        return 0;
+}
+
+static void sn9c20x_input_cleanup(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        if (sd->input_task != NULL && !IS_ERR(sd->input_task))
+                kthread_stop(sd->input_task);
+
+        if (sd->input_dev != NULL) {
+                input_unregister_device(sd->input_dev);
+                kfree(sd->input_dev->phys);
+                input_free_device(sd->input_dev);
+                sd->input_dev = NULL;
+        }
+}
+#endif
+
+static int set_cmatrix(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        s32 hue_coord, hue_index = 180 + sd->hue;
+        u8 cmatrix[21];
+        memset(cmatrix, 0, 21);
+
+        cmatrix[2] = (sd->contrast * 0x25 / 0x100) + 0x26;
+        cmatrix[0] = 0x13 + (cmatrix[2] - 0x26) * 0x13 / 0x25;
+        cmatrix[4] = 0x07 + (cmatrix[2] - 0x26) * 0x07 / 0x25;
+        cmatrix[18] = sd->brightness - 0x80;
+
+        hue_coord = (hsv_red_x[hue_index] * sd->saturation) >> 8;
+        cmatrix[6] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[7] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_red_y[hue_index] * sd->saturation) >> 8;
+        cmatrix[8] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[9] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_green_x[hue_index] * sd->saturation) >> 8;
+        cmatrix[10] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[11] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_green_y[hue_index] * sd->saturation) >> 8;
+        cmatrix[12] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[13] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_blue_x[hue_index] * sd->saturation) >> 8;
+        cmatrix[14] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[15] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_blue_y[hue_index] * sd->saturation) >> 8;
+        cmatrix[16] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[17] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        return reg_w(gspca_dev, 0x10e1, cmatrix, 21);
+}
+
+static int set_gamma(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 gamma[17];
+        u8 gval = sd->gamma * 0xb8 / 0x100;
+
+
+        gamma[0] = 0x0a;
+        gamma[1] = 0x13 + (gval * (0xcb - 0x13) / 0xb8);
+        gamma[2] = 0x25 + (gval * (0xee - 0x25) / 0xb8);
+        gamma[3] = 0x37 + (gval * (0xfa - 0x37) / 0xb8);
+        gamma[4] = 0x45 + (gval * (0xfc - 0x45) / 0xb8);
+        gamma[5] = 0x55 + (gval * (0xfb - 0x55) / 0xb8);
+        gamma[6] = 0x65 + (gval * (0xfc - 0x65) / 0xb8);
+        gamma[7] = 0x74 + (gval * (0xfd - 0x74) / 0xb8);
+        gamma[8] = 0x83 + (gval * (0xfe - 0x83) / 0xb8);
+        gamma[9] = 0x92 + (gval * (0xfc - 0x92) / 0xb8);
+        gamma[10] = 0xa1 + (gval * (0xfc - 0xa1) / 0xb8);
+        gamma[11] = 0xb0 + (gval * (0xfc - 0xb0) / 0xb8);
+        gamma[12] = 0xbf + (gval * (0xfb - 0xbf) / 0xb8);
+        gamma[13] = 0xce + (gval * (0xfb - 0xce) / 0xb8);
+        gamma[14] = 0xdf + (gval * (0xfd - 0xdf) / 0xb8);
+        gamma[15] = 0xea + (gval * (0xf9 - 0xea) / 0xb8);
+        gamma[16] = 0xf5;
+
+        return reg_w(gspca_dev, 0x1190, gamma, 17);
+}
+
+static int set_redblue(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        reg_w1(gspca_dev, 0x118c, sd->red);
+        reg_w1(gspca_dev, 0x118f, sd->blue);
+        return 0;
+}
+
+static int set_hvflip(struct gspca_dev *gspca_dev)
+{
+        u8 value, tslb;
+        u16 value2;
+        struct sd *sd = (struct sd *) gspca_dev;
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                i2c_r1(gspca_dev, 0x1e, &value);
+                value &= ~0x30;
+                tslb = 0x01;
+                if (sd->hflip)
+                        value |= 0x20;
+                if (sd->vflip) {
+                        value |= 0x10;
+                        tslb = 0x49;
+                }
+                i2c_w1(gspca_dev, 0x1e, value);
+                i2c_w1(gspca_dev, 0x3a, tslb);
+                break;
+        case SENSOR_MT9V111:
+        case SENSOR_MT9V011:
+                i2c_r2(gspca_dev, 0x20, &value2);
+                value2 &= ~0xc0a0;
+                if (sd->hflip)
+                        value2 |= 0x8080;
+                if (sd->vflip)
+                        value2 |= 0x4020;
+                i2c_w2(gspca_dev, 0x20, value2);
+                break;
+        case SENSOR_MT9M111:
+        case SENSOR_MT9V112:
+                i2c_r2(gspca_dev, 0x20, &value2);
+                value2 &= ~0x0003;
+                if (sd->hflip)
+                        value2 |= 0x0002;
+                if (sd->vflip)
+                        value2 |= 0x0001;
+                i2c_w2(gspca_dev, 0x20, value2);
+                break;
+        case SENSOR_HV7131R:
+                i2c_r1(gspca_dev, 0x01, &value);
+                value &= ~0x03;
+                if (sd->vflip)
+                        value |= 0x01;
+                if (sd->hflip)
+                        value |= 0x02;
+                i2c_w1(gspca_dev, 0x01, value);
+                break;
+        }
+        return 0;
+}
+
+static int set_exposure(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 exp[8] = {0x81, sd->i2c_addr, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e};
+        switch (sd->sensor) {
+        case SENSOR_OV7660:
+        case SENSOR_OV7670:
+        case SENSOR_SOI968:
+        case SENSOR_OV9655:
+        case SENSOR_OV9650:
+                exp[0] |= (3 << 4);
+                exp[2] = 0x2d;
+                exp[3] = sd->exposure & 0xff;
+                exp[4] = sd->exposure >> 8;
+                break;
+        case SENSOR_MT9M001:
+        case SENSOR_MT9M111:
+        case SENSOR_MT9V112:
+        case SENSOR_MT9V111:
+        case SENSOR_MT9V011:
+                exp[0] |= (3 << 4);
+                exp[2] = 0x09;
+                exp[3] = sd->exposure >> 8;
+                exp[4] = sd->exposure & 0xff;
+                break;
+        case SENSOR_HV7131R:
+                exp[0] |= (4 << 4);
+                exp[2] = 0x25;
+                exp[3] = ((sd->exposure * 0xffffff) / 0xffff) >> 16;
+                exp[4] = ((sd->exposure * 0xffffff) / 0xffff) >> 8;
+                exp[5] = ((sd->exposure * 0xffffff) / 0xffff) & 0xff;
+                break;
+        }
+        i2c_w(gspca_dev, exp);
+        return 0;
+}
+
+static int set_gain(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 gain[8] = {0x81, sd->i2c_addr, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1d};
+        switch (sd->sensor) {
+        case SENSOR_OV7660:
+        case SENSOR_OV7670:
+        case SENSOR_SOI968:
+        case SENSOR_OV9655:
+        case SENSOR_OV9650:
+                gain[0] |= (2 << 4);
+                gain[3] = ov_gain[sd->gain];
+                break;
+        case SENSOR_MT9V011:
+        case SENSOR_MT9V111:
+                gain[0] |= (3 << 4);
+                gain[2] = 0x35;
+                gain[3] = micron1_gain[sd->gain] >> 8;
+                gain[4] = micron1_gain[sd->gain] & 0xff;
+                break;
+        case SENSOR_MT9V112:
+        case SENSOR_MT9M111:
+                gain[0] |= (3 << 4);
+                gain[2] = 0x2f;
+                gain[3] = micron1_gain[sd->gain] >> 8;
+                gain[4] = micron1_gain[sd->gain] & 0xff;
+                break;
+        case SENSOR_MT9M001:
+                gain[0] |= (3 << 4);
+                gain[2] = 0x2f;
+                gain[3] = micron2_gain[sd->gain] >> 8;
+                gain[4] = micron2_gain[sd->gain] & 0xff;
+                break;
+        case SENSOR_HV7131R:
+                gain[0] |= (2 << 4);
+                gain[2] = 0x30;
+                gain[3] = hv7131r_gain[sd->gain];
+                break;
+        }
+        i2c_w(gspca_dev, gain);
+        return 0;
+}
+
+static int sd_setbrightness(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->brightness = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_getbrightness(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->brightness;
+        return 0;
+}
+
+
+static int sd_setcontrast(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->contrast = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_getcontrast(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->contrast;
+        return 0;
+}
+
+static int sd_setsaturation(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->saturation = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_getsaturation(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->saturation;
+        return 0;
+}
+
+static int sd_sethue(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->hue = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_gethue(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->hue;
+        return 0;
+}
+
+static int sd_setgamma(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->gamma = val;
+        if (gspca_dev->streaming)
+                return set_gamma(gspca_dev);
+        return 0;
+}
+
+static int sd_getgamma(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->gamma;
+        return 0;
+}
+
+static int sd_setredbalance(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->red = val;
+        if (gspca_dev->streaming)
+                return set_redblue(gspca_dev);
+        return 0;
+}
+
+static int sd_getredbalance(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->red;
+        return 0;
+}
+
+static int sd_setbluebalance(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->blue = val;
+        if (gspca_dev->streaming)
+                return set_redblue(gspca_dev);
+        return 0;
+}
+
+static int sd_getbluebalance(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->blue;
+        return 0;
+}
+
+static int sd_sethflip(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->hflip = val;
+        if (gspca_dev->streaming)
+                return set_hvflip(gspca_dev);
+        return 0;
+}
+
+static int sd_gethflip(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->hflip;
+        return 0;
+}
+
+static int sd_setvflip(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->vflip = val;
+        if (gspca_dev->streaming)
+                return set_hvflip(gspca_dev);
+        return 0;
+}
+
+static int sd_getvflip(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->vflip;
+        return 0;
+}
+
+static int sd_setexposure(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->exposure = val;
+        if (gspca_dev->streaming)
+                return set_exposure(gspca_dev);
+        return 0;
+}
+
+static int sd_getexposure(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->exposure;
+        return 0;
+}
+
+static int sd_setgain(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->gain = val;
+        if (gspca_dev->streaming)
+                return set_gain(gspca_dev);
+        return 0;
+}
+
+static int sd_getgain(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->gain;
+        return 0;
+}
+
+static int sd_setautoexposure(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        sd->auto_exposure = val;
+        return 0;
+}
+
+static int sd_getautoexposure(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->auto_exposure;
+        return 0;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int sd_dbg_g_register(struct gspca_dev *gspca_dev,
+                        struct v4l2_dbg_register *reg)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        switch (reg->match.type) {
+        case V4L2_CHIP_MATCH_HOST:
+                if (reg->match.addr != 0)
+                        return -EINVAL;
+                if (reg->reg < 0x1000 || reg->reg > 0x11ff)
+                        return -EINVAL;
+                if (reg_r(gspca_dev, reg->reg, 1) < 0)
+                        return -EINVAL;
+                reg->val = gspca_dev->usb_buf[0];
+                return 0;
+        case V4L2_CHIP_MATCH_I2C_ADDR:
+                if (reg->match.addr != sd->i2c_addr)
+                        return -EINVAL;
+                if (sd->sensor >= SENSOR_MT9V011 &&
+                    sd->sensor <= SENSOR_MT9M111) {
+                        if (i2c_r2(gspca_dev, reg->reg, (u16 *)&reg->val) < 0)
+                                return -EINVAL;
+                } else {
+                        if (i2c_r1(gspca_dev, reg->reg, (u8 *)&reg->val) < 0)
+                                return -EINVAL;
+                }
+                return 0;
+        }
+        return -EINVAL;
+}
+
+static int sd_dbg_s_register(struct gspca_dev *gspca_dev,
+                        struct v4l2_dbg_register *reg)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        switch (reg->match.type) {
+        case V4L2_CHIP_MATCH_HOST:
+                if (reg->match.addr != 0)
+                        return -EINVAL;
+                if (reg->reg < 0x1000 || reg->reg > 0x11ff)
+                        return -EINVAL;
+                if (reg_w1(gspca_dev, reg->reg, reg->val) < 0)
+                        return -EINVAL;
+                return 0;
+        case V4L2_CHIP_MATCH_I2C_ADDR:
+                if (reg->match.addr != sd->i2c_addr)
+                        return -EINVAL;
+                if (sd->sensor >= SENSOR_MT9V011 &&
+                    sd->sensor <= SENSOR_MT9M111) {
+                        if (i2c_w2(gspca_dev, reg->reg, reg->val) < 0)
+                                return -EINVAL;
+                } else {
+                        if (i2c_w1(gspca_dev, reg->reg, reg->val) < 0)
+                                return -EINVAL;
+                }
+                return 0;
+        }
+        return -EINVAL;
+}
+#endif
+
+static int sd_chip_ident(struct gspca_dev *gspca_dev,
+                        struct v4l2_dbg_chip_ident *chip)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        switch (chip->match.type) {
+        case V4L2_CHIP_MATCH_HOST:
+                if (chip->match.addr != 0)
+                        return -EINVAL;
+                chip->revision = 0;
+                chip->ident = V4L2_IDENT_SN9C20X;
+                return 0;
+        case V4L2_CHIP_MATCH_I2C_ADDR:
+                if (chip->match.addr != sd->i2c_addr)
+                        return -EINVAL;
+                chip->revision = 0;
+                chip->ident = i2c_ident[sd->sensor];
+                return 0;
+        }
+        return -EINVAL;
+}
+
+static int sd_config(struct gspca_dev *gspca_dev,
+                        const struct usb_device_id *id)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        struct cam *cam;
+
+        cam = &gspca_dev->cam;
+
+        sd->sensor = (id->driver_info >> 8) & 0xff;
+        sd->i2c_addr = id->driver_info & 0xff;
+
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                cam->cam_mode = sxga_mode;
+                cam->nmodes = ARRAY_SIZE(sxga_mode);
+                break;
+        default:
+                cam->cam_mode = vga_mode;
+                cam->nmodes = ARRAY_SIZE(vga_mode);
+        }
+
+        sd->old_step = 0;
+        sd->older_step = 0;
+        sd->exposure_step = 16;
+
+        sd->brightness = BRIGHTNESS_DEFAULT;
+        sd->contrast = CONTRAST_DEFAULT;
+        sd->saturation = SATURATION_DEFAULT;
+        sd->hue = HUE_DEFAULT;
+        sd->gamma = GAMMA_DEFAULT;
+        sd->red = RED_DEFAULT;
+        sd->blue = BLUE_DEFAULT;
+
+        sd->hflip = HFLIP_DEFAULT;
+        sd->vflip = VFLIP_DEFAULT;
+        sd->exposure = EXPOSURE_DEFAULT;
+        sd->gain = GAIN_DEFAULT;
+        sd->auto_exposure = AUTO_EXPOSURE_DEFAULT;
+
+        sd->quality = 95;
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+        sd->input_gpio = (id->driver_info >> 16) & 0xff;
+        if (sn9c20x_input_init(gspca_dev) < 0)
+                return -ENODEV;
+#endif
+        return 0;
+}
+
+static int sd_init(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        u8 value;
+        u8 i2c_init[9] =
+                {0x80, sd->i2c_addr, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03};
+
+        for (i = 0; i < ARRAY_SIZE(bridge_init); i++) {
+                value = bridge_init[i][1];
+                if (reg_w(gspca_dev, bridge_init[i][0], &value, 1) < 0) {
+                        err("Device initialization failed");
+                        return -ENODEV;
+                }
+        }
+
+        if (reg_w(gspca_dev, 0x10c0, i2c_init, 9) < 0) {
+                err("Device initialization failed");
+                return -ENODEV;
+        }
+
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                if (ov9650_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV9650 sensor detected");
+                break;
+        case SENSOR_OV9655:
+                if (ov9655_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV9655 sensor detected");
+                break;
+        case SENSOR_SOI968:
+                if (soi968_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("SOI968 sensor detected");
+                break;
+        case SENSOR_OV7660:
+                if (ov7660_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV7660 sensor detected");
+                break;
+        case SENSOR_OV7670:
+                if (ov7670_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV7670 sensor detected");
+                break;
+        case SENSOR_MT9VPRB:
+                if (mt9v_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                break;
+        case SENSOR_MT9M111:
+                if (mt9m111_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("MT9M111 sensor detected");
+                break;
+        case SENSOR_MT9M001:
+                if (mt9m001_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("MT9M001 sensor detected");
+                break;
+        case SENSOR_HV7131R:
+                if (hv7131r_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("HV7131R sensor detected");
+                break;
+        default:
+                info("Unsupported Sensor");
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+static void configure_sensor_output(struct gspca_dev *gspca_dev, int mode)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 value;
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                if (mode & MODE_SXGA) {
+                        i2c_w1(gspca_dev, 0x17, 0x1b);
+                        i2c_w1(gspca_dev, 0x18, 0xbc);
+                        i2c_w1(gspca_dev, 0x19, 0x01);
+                        i2c_w1(gspca_dev, 0x1a, 0x82);
+                        i2c_r1(gspca_dev, 0x12, &value);
+                        i2c_w1(gspca_dev, 0x12, value & 0x07);
+                } else {
+                        i2c_w1(gspca_dev, 0x17, 0x24);
+                        i2c_w1(gspca_dev, 0x18, 0xc5);
+                        i2c_w1(gspca_dev, 0x19, 0x00);
+                        i2c_w1(gspca_dev, 0x1a, 0x3c);
+                        i2c_r1(gspca_dev, 0x12, &value);
+                        i2c_w1(gspca_dev, 0x12, (value & 0x7) | 0x40);
+                }
+                break;
+        }
+}
+
+#define HW_WIN(mode, hstart, vstart) \
+((const u8 []){hstart & 0xff, hstart >> 8, \
+vstart & 0xff, vstart >> 8, \
+(mode & MODE_SXGA ? 1280 >> 4 : 640 >> 4), \
+(mode & MODE_SXGA ? 1024 >> 3 : 480 >> 3)})
+
+#define CLR_WIN(width, height) \
+((const u8 [])\
+{0, width >> 2, 0, height >> 1,\
+((width >> 10) & 0x01) | ((height >> 8) & 0x6)})
+
+static int sd_start(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
+        int width = gspca_dev->width;
+        int height = gspca_dev->height;
+        u8 fmt, scale = 0;
+
+        sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (sd->jpeg_hdr == NULL)
+                return -ENOMEM;
+
+        jpeg_define(sd->jpeg_hdr, height, width,
+                        0x21);
+        jpeg_set_qual(sd->jpeg_hdr, sd->quality);
+
+        if (mode & MODE_RAW)
+                fmt = 0x2d;
+        else if (mode & MODE_JPEG)
+                fmt = 0x2c;
+        else
+                fmt = 0x2f;
+
+        switch (mode & 0x0f) {
+        case 3:
+                scale = 0xc0;
+                info("Set 1280x1024");
+                break;
+        case 2:
+                scale = 0x80;
+                info("Set 640x480");
+                break;
+        case 1:
+                scale = 0x90;
+                info("Set 320x240");
+                break;
+        case 0:
+                scale = 0xa0;
+                info("Set 160x120");
+                break;
+        }
+
+        configure_sensor_output(gspca_dev, mode);
+        reg_w(gspca_dev, 0x1100, sd->jpeg_hdr + JPEG_QT0_OFFSET, 64);
+        reg_w(gspca_dev, 0x1140, sd->jpeg_hdr + JPEG_QT1_OFFSET, 64);
+        reg_w(gspca_dev, 0x10fb, CLR_WIN(width, height), 5);
+        reg_w(gspca_dev, 0x1180, HW_WIN(mode, sd->hstart, sd->vstart), 6);
+        reg_w1(gspca_dev, 0x1189, scale);
+        reg_w1(gspca_dev, 0x10e0, fmt);
+
+        set_cmatrix(gspca_dev);
+        set_gamma(gspca_dev);
+        set_redblue(gspca_dev);
+        set_gain(gspca_dev);
+        set_exposure(gspca_dev);
+        set_hvflip(gspca_dev);
+
+        reg_r(gspca_dev, 0x1061, 1);
+        reg_w1(gspca_dev, 0x1061, gspca_dev->usb_buf[0] | 0x02);
+        return 0;
+}
+
+static void sd_stopN(struct gspca_dev *gspca_dev)
+{
+        reg_r(gspca_dev, 0x1061, 1);
+        reg_w1(gspca_dev, 0x1061, gspca_dev->usb_buf[0] & ~0x02);
+}
+
+static void sd_stop0(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        kfree(sd->jpeg_hdr);
+}
+
+static void do_autoexposure(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int avg_lum, new_exp;
+
+        if (!sd->auto_exposure)
+                return;
+
+        avg_lum = atomic_read(&sd->avg_lum);
+
+        /*
+         * some hardcoded values are present
+         * like those for maximal/minimal exposure
+         * and exposure steps
+         */
+        if (avg_lum < MIN_AVG_LUM) {
+                if (sd->exposure > 0x1770)
+                        return;
+
+                new_exp = sd->exposure + sd->exposure_step;
+                if (new_exp > 0x1770)
+                        new_exp = 0x1770;
+                if (new_exp < 0x10)
+                        new_exp = 0x10;
+                sd->exposure = new_exp;
+                set_exposure(gspca_dev);
+
+                sd->older_step = sd->old_step;
+                sd->old_step = 1;
+
+                if (sd->old_step ^ sd->older_step)
+                        sd->exposure_step /= 2;
+                else
+                        sd->exposure_step += 2;
+        }
+        if (avg_lum > MAX_AVG_LUM) {
+                if (sd->exposure < 0x10)
+                        return;
+                new_exp = sd->exposure - sd->exposure_step;
+                if (new_exp > 0x1700)
+                        new_exp = 0x1770;
+                if (new_exp < 0x10)
+                        new_exp = 0x10;
+                sd->exposure = new_exp;
+                set_exposure(gspca_dev);
+                sd->older_step = sd->old_step;
+                sd->old_step = 0;
+
+                if (sd->old_step ^ sd->older_step)
+                        sd->exposure_step /= 2;
+                else
+                        sd->exposure_step += 2;
+        }
+}
+
+static void sd_pkt_scan(struct gspca_dev *gspca_dev,
+                        struct gspca_frame *frame,      /* target */
+                        u8 *data,                       /* isoc packet */
+                        int len)                        /* iso packet length */
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int avg_lum;
+        static unsigned char frame_header[] =
+                {0xff, 0xff, 0x00, 0xc4, 0xc4, 0x96};
+        if (len == 64 && memcmp(data, frame_header, 6) == 0) {
+                avg_lum = ((data[35] >> 2) & 3) |
+                           (data[20] << 2) |
+                           (data[19] << 10);
+                avg_lum += ((data[35] >> 4) & 3) |
+                            (data[22] << 2) |
+                            (data[21] << 10);
+                avg_lum += ((data[35] >> 6) & 3) |
+                            (data[24] << 2) |
+                            (data[23] << 10);
+                avg_lum += (data[36] & 3) |
+                           (data[26] << 2) |
+                           (data[25] << 10);
+                avg_lum += ((data[36] >> 2) & 3) |
+                            (data[28] << 2) |
+                            (data[27] << 10);
+                avg_lum += ((data[36] >> 4) & 3) |
+                            (data[30] << 2) |
+                            (data[29] << 10);
+                avg_lum += ((data[36] >> 6) & 3) |
+                            (data[32] << 2) |
+                            (data[31] << 10);
+                avg_lum += ((data[44] >> 4) & 3) |
+                            (data[34] << 2) |
+                            (data[33] << 10);
+                avg_lum >>= 9;
+                atomic_set(&sd->avg_lum, avg_lum);
+                gspca_frame_add(gspca_dev, LAST_PACKET,
+                                frame, data, len);
+                return;
+        }
+        if (gspca_dev->last_packet_type == LAST_PACKET) {
+                if (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv
+                                & MODE_JPEG) {
+                        gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+                                sd->jpeg_hdr, JPEG_HDR_SZ);
+                        gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+                                data, len);
+                } else {
+                        gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+                                data, len);
+                }
+        } else {
+                gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+        }
+}
+
+/* sub-driver description */
+static const struct sd_desc sd_desc = {
+        .name = MODULE_NAME,
+        .ctrls = sd_ctrls,
+        .nctrls = ARRAY_SIZE(sd_ctrls),
+        .config = sd_config,
+        .init = sd_init,
+        .start = sd_start,
+        .stopN = sd_stopN,
+        .stop0 = sd_stop0,
+        .pkt_scan = sd_pkt_scan,
+        .dq_callback = do_autoexposure,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        .set_register = sd_dbg_s_register,
+        .get_register = sd_dbg_g_register,
+#endif
+        .get_chip_ident = sd_chip_ident,
+};
+
+#define SN9C20X(sensor, i2c_addr, button_mask) \
+        .driver_info =  (button_mask << 16) \
+                        | (SENSOR_ ## sensor << 8) \
+                        | (i2c_addr)
+
+static const __devinitdata struct usb_device_id device_table[] = {
+        {USB_DEVICE(0x0c45, 0x6240), SN9C20X(MT9M001, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6242), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6248), SN9C20X(OV9655, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x624e), SN9C20X(SOI968, 0x30, 0x10)},
+        {USB_DEVICE(0x0c45, 0x624f), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6251), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6253), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6260), SN9C20X(OV7670, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x6270), SN9C20X(MT9VPRB, 0x00, 0)},
+        {USB_DEVICE(0x0c45, 0x627b), SN9C20X(OV7660, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x627c), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0x0c45, 0x627f), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6280), SN9C20X(MT9M001, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6282), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6288), SN9C20X(OV9655, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x628e), SN9C20X(SOI968, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x628f), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x62a0), SN9C20X(OV7670, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x62b0), SN9C20X(MT9VPRB, 0x00, 0)},
+        {USB_DEVICE(0x0c45, 0x62b3), SN9C20X(OV9655, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x62bb), SN9C20X(OV7660, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x62bc), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0x045e, 0x00f4), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x145f, 0x013d), SN9C20X(OV7660, 0x21, 0)},
+        {USB_DEVICE(0x0458, 0x7029), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0610), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0611), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0613), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0618), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0614), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0xa168, 0x0615), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0xa168, 0x0617), SN9C20X(MT9M111, 0x5d, 0)},
+        {}
+};
+MODULE_DEVICE_TABLE(usb, device_table);
+
+/* -- device connect -- */
+static int sd_probe(struct usb_interface *intf,
+                    const struct usb_device_id *id)
+{
+        return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
+                                THIS_MODULE);
+}
+
+static void sd_disconnect(struct usb_interface *intf)
+{
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+        struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
+
+        sn9c20x_input_cleanup(gspca_dev);
+#endif
+
+        gspca_disconnect(intf);
+}
+
+static struct usb_driver sd_driver = {
+        .name = MODULE_NAME,
+        .id_table = device_table,
+        .probe = sd_probe,
+        .disconnect = sd_disconnect,
+#ifdef CONFIG_PM
+        .suspend = gspca_suspend,
+        .resume = gspca_resume,
+        .reset_resume = gspca_resume,
+#endif
+};
+
+/* -- module insert / remove -- */
+static int __init sd_mod_init(void)
+{
+        int ret;
+        ret = usb_register(&sd_driver);
+        if (ret < 0)
+                return ret;
+        info("registered");
+        return 0;
+}
+static void __exit sd_mod_exit(void)
+{
+        usb_deregister(&sd_driver);
+        info("deregistered");
+}
+
+module_init(sd_mod_init);
+module_exit(sd_mod_exit);
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index 0d02f41fa7d0..d6332ab80669 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -1634,6 +1634,8 @@ static void setfreq(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
+        if (gspca_dev->ctrl_dis & (1 << FREQ_IDX))
+                return;
         if (sd->sensor == SENSOR_OV7660) {
                 switch (sd->freq) {
                 case 0: /* Banding filter disabled */
@@ -1735,6 +1737,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x21);          /* JPEG 422 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/spca500.c b/drivers/media/video/gspca/spca500.c
index 8806b2ff82be..fab7ef85a6c1 100644
--- a/drivers/media/video/gspca/spca500.c
+++ b/drivers/media/video/gspca/spca500.c
@@ -670,6 +670,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/stk014.c b/drivers/media/video/gspca/stk014.c
index f25be20cf1a6..47628964801e 100644
--- a/drivers/media/video/gspca/stk014.c
+++ b/drivers/media/video/gspca/stk014.c
@@ -333,6 +333,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c b/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c
index 3039ec208f3a..e5024c8496ef 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c
@@ -64,7 +64,7 @@ static struct v4l2_pix_format hdcs1x00_mode[] = {
         {
                 HDCS_1X00_DEF_WIDTH,
                 HDCS_1X00_DEF_HEIGHT,
-                V4L2_PIX_FMT_SBGGR8,
+                V4L2_PIX_FMT_SGRBG8,
                 V4L2_FIELD_NONE,
                 .sizeimage =
                         HDCS_1X00_DEF_WIDTH * HDCS_1X00_DEF_HEIGHT,
@@ -80,7 +80,7 @@ static struct v4l2_pix_format hdcs1020_mode[] = {
         {
                 HDCS_1020_DEF_WIDTH,
                 HDCS_1020_DEF_HEIGHT,
-                V4L2_PIX_FMT_SBGGR8,
+                V4L2_PIX_FMT_SGRBG8,
                 V4L2_FIELD_NONE,
                 .sizeimage =
                         HDCS_1020_DEF_WIDTH * HDCS_1020_DEF_HEIGHT,
@@ -131,9 +131,11 @@ static int hdcs_reg_write_seq(struct sd *sd, u8 reg, u8 *vals, u8 len)
                      (reg + len > 0xff)))
                 return -EINVAL;
 
-        for (i = 0; i < len; i++, reg++) {
-                regs[2*i] = reg;
-                regs[2*i+1] = vals[i];
+        for (i = 0; i < len; i++) {
+                regs[2 * i] = reg;
+                regs[2 * i + 1] = vals[i];
+                /* All addresses are shifted left one bit as bit 0 toggles r/w */
+                reg += 2;
         }
 
         return stv06xx_write_sensor_bytes(sd, regs, len);
@@ -174,7 +176,9 @@ static int hdcs_set_state(struct sd *sd, enum hdcs_power_state state)
         }
 
         ret = stv06xx_write_sensor(sd, HDCS_REG_CONTROL(sd), val);
-        if (ret < 0)
+
+        /* Update the state if the write succeeded */
+        if (!ret)
                 hdcs->state = state;
 
         return ret;
diff --git a/drivers/media/video/gspca/sunplus.c b/drivers/media/video/gspca/sunplus.c
index 9623f294bdac..5127bbf9dd26 100644
--- a/drivers/media/video/gspca/sunplus.c
+++ b/drivers/media/video/gspca/sunplus.c
@@ -973,6 +973,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 08422d315e68..3d2756f7874a 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -7243,6 +7243,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x21);          /* JPEG 422 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/mt9v011.c b/drivers/media/video/mt9v011.c
index 1fe8fc9183a7..b2260de645f0 100644
--- a/drivers/media/video/mt9v011.c
+++ b/drivers/media/video/mt9v011.c
@@ -8,6 +8,7 @@
 #include <linux/i2c.h>
 #include <linux/videodev2.h>
 #include <linux/delay.h>
+#include <asm/div64.h>
 #include <media/v4l2-device.h>
 #include "mt9v011.h"
 #include <media/v4l2-i2c-drv.h>
@@ -57,6 +58,7 @@ static struct v4l2_queryctrl mt9v011_qctrl[] = {
 struct mt9v011 {
         struct v4l2_subdev sd;
         unsigned width, height;
+        unsigned xtal;
 
         u16 global_gain, red_bal, blue_bal;
 };
@@ -131,7 +133,7 @@ static const struct i2c_reg_value mt9v011_init_default[] = {
                 { R1E_MT9V011_DIGITAL_ZOOM,  0x0000 },
                 { R20_MT9V011_READ_MODE, 0x1000 },
 
-                { R07_MT9V011_OUT_CTRL, 0x000a },       /* chip enable */
+                { R07_MT9V011_OUT_CTRL, 0x0002 },       /* chip enable */
 };
 
 static void set_balance(struct v4l2_subdev *sd)
@@ -154,6 +156,31 @@ static void set_balance(struct v4l2_subdev *sd)
         mt9v011_write(sd, R2D_MT9V011_RED_GAIN, red_gain);
 }
 
+static void calc_fps(struct v4l2_subdev *sd)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned height, width, hblank, vblank, speed;
+        unsigned row_time, t_time;
+        u64 frames_per_ms;
+        unsigned tmp;
+
+        height = mt9v011_read(sd, R03_MT9V011_HEIGHT);
+        width = mt9v011_read(sd, R04_MT9V011_WIDTH);
+        hblank = mt9v011_read(sd, R05_MT9V011_HBLANK);
+        vblank = mt9v011_read(sd, R06_MT9V011_VBLANK);
+        speed = mt9v011_read(sd, R0A_MT9V011_CLK_SPEED);
+
+        row_time = (width + 113 + hblank) * (speed + 2);
+        t_time = row_time * (height + vblank + 1);
+
+        frames_per_ms = core->xtal * 1000l;
+        do_div(frames_per_ms, t_time);
+        tmp = frames_per_ms;
+
+        v4l2_dbg(1, debug, sd, "Programmed to %u.%03u fps (%d pixel clcks)\n",
+                tmp / 1000, tmp % 1000, t_time);
+}
+
 static void set_res(struct v4l2_subdev *sd)
 {
         struct mt9v011 *core = to_mt9v011(sd);
@@ -175,10 +202,12 @@ static void set_res(struct v4l2_subdev *sd)
         mt9v011_write(sd, R04_MT9V011_WIDTH, core->width);
         mt9v011_write(sd, R05_MT9V011_HBLANK, 771 - core->width);
 
-        vstart = 8 + (640 - core->height) / 2;
+        vstart = 8 + (480 - core->height) / 2;
         mt9v011_write(sd, R01_MT9V011_ROWSTART, vstart);
         mt9v011_write(sd, R03_MT9V011_HEIGHT, core->height);
         mt9v011_write(sd, R06_MT9V011_VBLANK, 508 - core->height);
+
+        calc_fps(sd);
 };
 
 static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
@@ -215,6 +244,23 @@ static int mt9v011_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
         return -EINVAL;
 }
 
+static int mt9v011_queryctrl(struct v4l2_subdev *sd, struct v4l2_queryctrl *qc)
+{
+        int i;
+
+        v4l2_dbg(1, debug, sd, "queryctrl called\n");
+
+        for (i = 0; i < ARRAY_SIZE(mt9v011_qctrl); i++)
+                if (qc->id && qc->id == mt9v011_qctrl[i].id) {
+                        memcpy(qc, &(mt9v011_qctrl[i]),
+                               sizeof(*qc));
+                        return 0;
+                }
+
+        return -EINVAL;
+}
+
+
 static int mt9v011_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 {
         struct mt9v011 *core = to_mt9v011(sd);
@@ -294,6 +340,22 @@ static int mt9v011_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
         return 0;
 }
 
+static int mt9v011_s_config(struct v4l2_subdev *sd, int dumb, void *data)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned *xtal = data;
+
+        v4l2_dbg(1, debug, sd, "s_config called\n");
+
+        if (xtal) {
+                core->xtal = *xtal;
+                v4l2_dbg(1, debug, sd, "xtal set to %d.%03d MHz\n",
+                         *xtal / 1000000, (*xtal / 1000) % 1000);
+        }
+
+        return 0;
+}
+
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
 static int mt9v011_g_register(struct v4l2_subdev *sd,
@@ -338,9 +400,11 @@ static int mt9v011_g_chip_ident(struct v4l2_subdev *sd,
 }
 
 static const struct v4l2_subdev_core_ops mt9v011_core_ops = {
+        .queryctrl = mt9v011_queryctrl,
         .g_ctrl = mt9v011_g_ctrl,
         .s_ctrl = mt9v011_s_ctrl,
         .reset = mt9v011_reset,
+        .s_config = mt9v011_s_config,
         .g_chip_ident = mt9v011_g_chip_ident,
 #ifdef CONFIG_VIDEO_ADV_DEBUG
         .g_register = mt9v011_g_register,
@@ -395,6 +459,7 @@ static int mt9v011_probe(struct i2c_client *c,
         core->global_gain = 0x0024;
         core->width  = 640;
         core->height = 480;
+        core->xtal = 27000000;  /* Hz */
 
         v4l_info(c, "chip found @ 0x%02x (%s)\n",
                  c->addr << 1, c->adapter->name);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index b5a7513df4eb..5f6509a5f640 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1732,6 +1732,7 @@ config KS8842
 config KS8851
        tristate "Micrel KS8851 SPI"
        depends on SPI
+       select MII
        help
          SPI driver for Micrel KS8851 SPI attached network chip.
 
diff --git a/drivers/net/arm/at91_ether.c b/drivers/net/arm/at91_ether.c
index 2e7419a61191..5041d10bae9d 100644
--- a/drivers/net/arm/at91_ether.c
+++ b/drivers/net/arm/at91_ether.c
@@ -1228,7 +1228,6 @@ static int at91ether_resume(struct platform_device *pdev)
 #endif
 
 static struct platform_driver at91ether_driver = {
-        .probe          = at91ether_probe,
         .remove         = __devexit_p(at91ether_remove),
         .suspend        = at91ether_suspend,
         .resume         = at91ether_resume,
@@ -1240,7 +1239,7 @@ static struct platform_driver at91ether_driver = {
 
 static int __init at91ether_init(void)
 {
-        return platform_driver_register(&at91ether_driver);
+        return platform_driver_probe(&at91ether_driver, at91ether_probe);
 }
 
 static void __exit at91ether_exit(void)
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 18b566ad4fd1..cf30e278f182 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr)
                                 pos3 = mca_read_stored_pos( slot, 3 );
                                 pos4 = mca_read_stored_pos( slot, 4 );
 
-                                for (l_i = 0; l_i < 0x09; l_i++)
+                                for (l_i = 0; l_i < 8; l_i++)
                                         if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i])
                                                 break;
                                 ioaddr = at1700_mca_probe_list[l_i];
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index c43f6a119295..dea3155688bb 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -667,7 +667,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         struct be_queue_info *rxq = &adapter->rx_obj.q;
         struct be_rx_page_info *page_info;
         u16 rxq_idx, i, num_rcvd, j;
-        u32 pktsize, hdr_len, curr_frag_len;
+        u32 pktsize, hdr_len, curr_frag_len, size;
         u8 *start;
 
         rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
@@ -708,12 +708,13 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         }
 
         /* More frags present for this completion */
-        pktsize -= curr_frag_len; /* account for above copied frag */
+        size = pktsize;
         for (i = 1, j = 0; i < num_rcvd; i++) {
+                size -= curr_frag_len;
                 index_inc(&rxq_idx, rxq->len);
                 page_info = get_rx_page_info(adapter, rxq_idx);
 
-                curr_frag_len = min(pktsize, rx_frag_size);
+                curr_frag_len = min(size, rx_frag_size);
 
                 /* Coalesce all frags from the same physical page in one slot */
                 if (page_info->page_offset == 0) {
@@ -731,7 +732,6 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
                 skb_shinfo(skb)->frags[j].size += curr_frag_len;
                 skb->len += curr_frag_len;
                 skb->data_len += curr_frag_len;
-                pktsize -= curr_frag_len;
 
                 memset(page_info, 0, sizeof(*page_info));
         }
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4d1515f45ba2..4869d77cbe91 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
         }
 
         rcu_read_lock();
-        ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
+        ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
         if (ulp_ops)
                 ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
         rcu_read_unlock();
@@ -319,6 +319,20 @@ static int cnic_abort_prep(struct cnic_sock *csk)
         return 0;
 }
 
+static void cnic_uio_stop(void)
+{
+        struct cnic_dev *dev;
+
+        read_lock(&cnic_dev_lock);
+        list_for_each_entry(dev, &cnic_dev_list, list) {
+                struct cnic_local *cp = dev->cnic_priv;
+
+                if (cp->cnic_uinfo)
+                        cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+        }
+        read_unlock(&cnic_dev_lock);
+}
+
 int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 {
         struct cnic_dev *dev;
@@ -390,6 +404,9 @@ int cnic_unregister_driver(int ulp_type)
         }
         read_unlock(&cnic_dev_lock);
 
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_uio_stop();
+
         rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
 
         mutex_unlock(&cnic_lock);
@@ -632,7 +649,6 @@ static void cnic_free_resc(struct cnic_dev *dev)
         int i = 0;
 
         if (cp->cnic_uinfo) {
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
                 while (cp->uio_dev != -1 && i < 15) {
                         msleep(100);
                         i++;
@@ -1057,6 +1073,9 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         int if_type;
 
+        if (cp->cnic_uinfo)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+
         rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index cc2ab6412c73..4f7003485348 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1784,7 +1784,7 @@ int __init init_module(void)
                 printk(KERN_INFO "eepro_init_module: Auto-detecting boards (May God protect us...)\n");
         }
 
-        for (i = 0; io[i] != -1 && i < MAX_EEPRO; i++) {
+        for (i = 0; i < MAX_EEPRO && io[i] != -1; i++) {
                 dev = alloc_etherdev(sizeof(struct eepro_local));
                 if (!dev)
                         break;
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index 48385c42ab57..160655d24581 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -584,7 +584,8 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
         if (np->flags == HAS_MII_XCVR) {
                 int phy, phy_idx = 0;
 
-                for (phy = 1; phy < 32 && phy_idx < 4; phy++) {
+                for (phy = 1; phy < 32 && phy_idx < ARRAY_SIZE(np->phys);
+                               phy++) {
                         int mii_status = mdio_read(dev, phy, 1);
 
                         if (mii_status != 0xffff && mii_status != 0x0000) {
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index b892c3ad9a74..2bc2d2b20644 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -754,17 +754,16 @@ static int fs_init_phy(struct net_device *dev)
         fep->oldlink = 0;
         fep->oldspeed = 0;
         fep->oldduplex = -1;
-        if(fep->fpi->phy_node)
-                phydev = of_phy_connect(dev, fep->fpi->phy_node,
-                                        &fs_adjust_link, 0,
-                                        PHY_INTERFACE_MODE_MII);
-        else {
-                printk("No phy bus ID specified in BSP code\n");
-                return -EINVAL;
+
+        phydev = of_phy_connect(dev, fep->fpi->phy_node, &fs_adjust_link, 0,
+                                PHY_INTERFACE_MODE_MII);
+        if (!phydev) {
+                phydev = of_phy_connect_fixed_link(dev, &fs_adjust_link,
+                                                   PHY_INTERFACE_MODE_MII);
         }
-        if (IS_ERR(phydev)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(phydev);
+        if (!phydev) {
+                dev_err(&dev->dev, "Could not attach to PHY\n");
+                return -ENODEV;
         }
 
         fep->phydev = phydev;
@@ -1005,6 +1004,7 @@ static int __devinit fs_enet_probe(struct of_device *ofdev,
                 goto out_free_fpi;
         }
 
+        SET_NETDEV_DEV(ndev, &ofdev->dev);
         dev_set_drvdata(&ofdev->dev, ndev);
 
         fep = netdev_priv(ndev);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 43d813ed9f45..f8ffcbf0bc39 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -264,15 +264,6 @@ static int gfar_of_init(struct net_device *dev)
                 priv->device_flags |= FSL_GIANFAR_DEV_HAS_MAGIC_PACKET;
 
         priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
-        if (!priv->phy_node) {
-                u32 *fixed_link;
-
-                fixed_link = (u32 *)of_get_property(np, "fixed-link", NULL);
-                if (!fixed_link) {
-                        err = -ENODEV;
-                        goto err_out;
-                }
-        }
 
         /* Find the TBI PHY.  If it's not there, we don't support SGMII */
         priv->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -659,13 +650,14 @@ static int init_phy(struct net_device *dev)
 
         interface = gfar_get_interface(dev);
 
-        if (priv->phy_node) {
-                priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link,
-                                              0, interface);
-                if (!priv->phydev) {
-                        dev_err(&dev->dev, "error: Could not attach to PHY\n");
-                        return -ENODEV;
-                }
+        priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link, 0,
+                                      interface);
+        if (!priv->phydev)
+                priv->phydev = of_phy_connect_fixed_link(dev, &adjust_link,
+                                                         interface);
+        if (!priv->phydev) {
+                dev_err(&dev->dev, "could not attach to PHY\n");
+                return -ENODEV;
         }
 
         if (interface == PHY_INTERFACE_MODE_SGMII)
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index cd22323cfd22..1b12c7ba275f 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -327,6 +327,7 @@ struct ixgbe_adapter {
 #define IXGBE_FLAG_IN_SFP_MOD_TASK              (u32)(1 << 25)
 #define IXGBE_FLAG_FDIR_HASH_CAPABLE            (u32)(1 << 26)
 #define IXGBE_FLAG_FDIR_PERFECT_CAPABLE         (u32)(1 << 27)
+#define IXGBE_FLAG_FCOE_CAPABLE                 (u32)(1 << 28)
 #define IXGBE_FLAG_FCOE_ENABLED                 (u32)(1 << 29)
 
         u32 flags2;
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index da2c8514b8d0..1c7265732900 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -139,6 +139,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->flags &= ~IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
                 }
                 adapter->flags |= IXGBE_FLAG_DCB_ENABLED;
+#ifdef IXGBE_FCOE
+                /* Turn on FCoE offload */
+                if ((adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) &&
+                    (!(adapter->flags & IXGBE_FLAG_FCOE_ENABLED))) {
+                        adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
+                        adapter->ring_feature[RING_F_FCOE].indices =
+                                IXGBE_FCRETA_SIZE;
+                        netdev->features |= NETIF_F_FCOE_CRC;
+                        netdev->features |= NETIF_F_FSO;
+                        netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
+                }
+#endif /* IXGBE_FCOE */
                 ixgbe_init_interrupt_scheme(adapter);
                 if (netif_running(netdev))
                         netdev->netdev_ops->ndo_open(netdev);
@@ -156,6 +168,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->flags |= IXGBE_FLAG_RSS_ENABLED;
                         if (adapter->hw.mac.type == ixgbe_mac_82599EB)
                                 adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
+
+#ifdef IXGBE_FCOE
+                        /* Turn off FCoE offload */
+                        if (adapter->flags & (IXGBE_FLAG_FCOE_CAPABLE |
+                             IXGBE_FLAG_FCOE_ENABLED)) {
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                                adapter->ring_feature[RING_F_FCOE].indices = 0;
+                                netdev->features &= ~NETIF_F_FCOE_CRC;
+                                netdev->features &= ~NETIF_F_FSO;
+                                netdev->fcoe_ddp_xid = 0;
+                        }
+#endif /* IXGBE_FCOE */
                         ixgbe_init_interrupt_scheme(adapter);
                         if (netif_running(netdev))
                                 netdev->netdev_ops->ndo_open(netdev);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e3442f47f932..200454f30f6a 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -34,6 +34,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
+#include <linux/pkt_sched.h>
 #include <linux/ipv6.h>
 #include <net/checksum.h>
 #include <net/ip6_checksum.h>
@@ -510,8 +511,11 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
  * @skb: skb currently being received and modified
  **/
 static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
-                                     u32 status_err, struct sk_buff *skb)
+                                     union ixgbe_adv_rx_desc *rx_desc,
+                                     struct sk_buff *skb)
 {
+        u32 status_err = le32_to_cpu(rx_desc->wb.upper.status_error);
+
         skb->ip_summed = CHECKSUM_NONE;
 
         /* Rx csum disabled */
@@ -529,6 +533,16 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
                 return;
 
         if (status_err & IXGBE_RXDADV_ERR_TCPE) {
+                u16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
+
+                /*
+                 * 82599 errata, UDP frames with a 0 checksum can be marked as
+                 * checksum errors.
+                 */
+                if ((pkt_info & IXGBE_RXDADV_PKTTYPE_UDP) &&
+                    (adapter->hw.mac.type == ixgbe_mac_82599EB))
+                        return;
+
                 adapter->hw_csum_rx_error++;
                 return;
         }
@@ -802,7 +816,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         goto next_desc;
                 }
 
-                ixgbe_rx_checksum(adapter, staterr, skb);
+                ixgbe_rx_checksum(adapter, rx_desc, skb);
 
                 /* probably a little skewed due to removing CRC */
                 total_rx_bytes += skb->len;
@@ -3806,8 +3820,9 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                 adapter->atr_sample_rate = 20;
                 adapter->fdir_pballoc = 0;
 #ifdef IXGBE_FCOE
-                adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
-                adapter->ring_feature[RING_F_FCOE].indices = IXGBE_FCRETA_SIZE;
+                adapter->flags |= IXGBE_FLAG_FCOE_CAPABLE;
+                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                adapter->ring_feature[RING_F_FCOE].indices = 0;
 #endif /* IXGBE_FCOE */
         }
 
@@ -5125,9 +5140,6 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         int count = 0;
         unsigned int f;
 
-        r_idx = skb->queue_mapping;
-        tx_ring = &adapter->tx_ring[r_idx];
-
         if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
                 tx_flags |= vlan_tx_tag_get(skb);
                 if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
@@ -5137,11 +5149,19 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
                 tx_flags |= IXGBE_TX_FLAGS_VLAN;
         } else if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                tx_flags |= (skb->queue_mapping << 13);
-                tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
-                tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                if (skb->priority != TC_PRIO_CONTROL) {
+                        tx_flags |= (skb->queue_mapping << 13);
+                        tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
+                        tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                } else {
+                        skb->queue_mapping =
+                                adapter->ring_feature[RING_F_DCB].indices-1;
+                }
         }
 
+        r_idx = skb->queue_mapping;
+        tx_ring = &adapter->tx_ring[r_idx];
+
         if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
             (skb->protocol == htons(ETH_P_FCOE)))
                 tx_flags |= IXGBE_TX_FLAGS_FCOE;
@@ -5580,16 +5600,11 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 #endif
 
 #ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
+        if (adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) {
                 if (hw->mac.ops.get_device_caps) {
                         hw->mac.ops.get_device_caps(hw, &device_caps);
-                        if (!(device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)) {
-                                netdev->features |= NETIF_F_FCOE_CRC;
-                                netdev->features |= NETIF_F_FSO;
-                                netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
-                        } else {
-                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
-                        }
+                        if (device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_CAPABLE;
                 }
         }
 #endif /* IXGBE_FCOE */
@@ -5638,7 +5653,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 adapter->wol = 0;
                 break;
         }
-        device_init_wakeup(&adapter->pdev->dev, true);
         device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* pick up the PCI bus settings for reporting later */
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 5d3343ef3d86..7acf204e38c9 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,6 +184,13 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
         kfree(recv_ctx->rds_rings);
 
 skip_rds:
+        if (recv_ctx->sds_rings == NULL)
+                goto skip_sds;
+
+        for(ring = 0; ring < adapter->max_sds_rings; ring++)
+                recv_ctx->sds_rings[ring].consumer = 0;
+
+skip_sds:
         if (adapter->tx_ring == NULL)
                 return;
 
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 33984b737233..22cdd451fb82 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -30,6 +30,7 @@
 
 #ifdef CONFIG_OF_GPIO
 #include <linux/of_gpio.h>
+#include <linux/of_mdio.h>
 #include <linux/of_platform.h>
 #endif
 
@@ -81,13 +82,12 @@ static struct mdiobb_ops mdio_gpio_ops = {
         .get_mdio_data = mdio_get,
 };
 
-static int __devinit mdio_gpio_bus_init(struct device *dev,
+static struct mii_bus * __devinit mdio_gpio_bus_init(struct device *dev,
                                         struct mdio_gpio_platform_data *pdata,
                                         int bus_id)
 {
         struct mii_bus *new_bus;
         struct mdio_gpio_info *bitbang;
-        int ret = -ENOMEM;
         int i;
 
         bitbang = kzalloc(sizeof(*bitbang), GFP_KERNEL);
@@ -104,8 +104,6 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
 
         new_bus->name = "GPIO Bitbanged MDIO",
 
-        ret = -ENODEV;
-
         new_bus->phy_mask = pdata->phy_mask;
         new_bus->irq = pdata->irqs;
         new_bus->parent = dev;
@@ -129,15 +127,8 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
 
         dev_set_drvdata(dev, new_bus);
 
-        ret = mdiobus_register(new_bus);
-        if (ret)
-                goto out_free_all;
-
-        return 0;
+        return new_bus;
 
-out_free_all:
-        dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdio);
 out_free_mdc:
         gpio_free(bitbang->mdc);
 out_free_bus:
@@ -145,30 +136,47 @@ out_free_bus:
 out_free_bitbang:
         kfree(bitbang);
 out:
-        return ret;
+        return NULL;
 }
 
-static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+static void __devinit mdio_gpio_bus_deinit(struct device *dev)
 {
         struct mii_bus *bus = dev_get_drvdata(dev);
         struct mdio_gpio_info *bitbang = bus->priv;
 
-        mdiobus_unregister(bus);
-        free_mdio_bitbang(bus);
         dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdc);
         gpio_free(bitbang->mdio);
+        gpio_free(bitbang->mdc);
+        free_mdio_bitbang(bus);
         kfree(bitbang);
 }
 
+static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+{
+        struct mii_bus *bus = dev_get_drvdata(dev);
+
+        mdiobus_unregister(bus);
+        mdio_gpio_bus_deinit(dev);
+}
+
 static int __devinit mdio_gpio_probe(struct platform_device *pdev)
 {
         struct mdio_gpio_platform_data *pdata = pdev->dev.platform_data;
+        struct mii_bus *new_bus;
+        int ret;
 
         if (!pdata)
                 return -ENODEV;
 
-        return mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        new_bus = mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        if (!new_bus)
+                return -ENODEV;
+
+        ret = mdiobus_register(new_bus);
+        if (ret)
+                mdio_gpio_bus_deinit(&pdev->dev);
+
+        return ret;
 }
 
 static int __devexit mdio_gpio_remove(struct platform_device *pdev)
@@ -179,29 +187,12 @@ static int __devexit mdio_gpio_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_OF_GPIO
-static void __devinit add_phy(struct mdio_gpio_platform_data *pdata,
-                              struct device_node *np)
-{
-        const u32 *data;
-        int len, id, irq;
-
-        data = of_get_property(np, "reg", &len);
-        if (!data || len != 4)
-                return;
-
-        id = *data;
-        pdata->phy_mask &= ~(1 << id);
-
-        irq = of_irq_to_resource(np, 0, NULL);
-        if (irq)
-                pdata->irqs[id] = irq;
-}
 
 static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
                                         const struct of_device_id *match)
 {
-        struct device_node *np = NULL;
         struct mdio_gpio_platform_data *pdata;
+        struct mii_bus *new_bus;
         int ret;
 
         pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
@@ -215,14 +206,18 @@ static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
 
         ret = of_get_gpio(ofdev->node, 1);
         if (ret < 0)
-                goto out_free;
+                goto out_free;
         pdata->mdio = ret;
 
-        while ((np = of_get_next_child(ofdev->node, np)))
-                if (!strcmp(np->type, "ethernet-phy"))
-                        add_phy(pdata, np);
+        new_bus = mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
+        if (!new_bus)
+                return -ENODEV;
 
-        return mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
+        ret = of_mdiobus_register(new_bus, ofdev->node);
+        if (ret)
+                mdio_gpio_bus_deinit(&ofdev->dev);
+
+        return ret;
 
 out_free:
         kfree(pdata);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4b53b58d75fc..b82780d805f5 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2060,8 +2060,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
 
-        pci_set_master(pdev);
-
         /* ioremap MMIO region */
         ioaddr = ioremap(pci_resource_start(pdev, region), R8169_REGS_SIZE);
         if (!ioaddr) {
@@ -2089,6 +2087,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         RTL_W16(IntrStatus, 0xffff);
 
+        pci_set_master(pdev);
+
         /* Identify chip attached to board */
         rtl8169_get_mac_version(tp, ioaddr);
 
@@ -3874,6 +3874,15 @@ static void rtl_shutdown(struct pci_dev *pdev)
         spin_unlock_irq(&tp->lock);
 
         if (system_state == SYSTEM_POWER_OFF) {
+                /* WoL fails with some 8168 when the receiver is disabled. */
+                if (tp->features & RTL_FEATURE_WOL) {
+                        pci_clear_master(pdev);
+
+                        RTL_W8(ChipCmd, CmdRxEnb);
+                        /* PCI commit */
+                        RTL_R8(ChipCmd);
+                }
+
                 pci_wake_from_d3(pdev, true);
                 pci_set_power_state(pdev, PCI_D3hot);
         }
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 60d502eef4fc..543af2044f40 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3854,8 +3854,10 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
         skge->speed = -1;
         skge->advertising = skge_supported_modes(hw);
 
-        if (device_may_wakeup(&hw->pdev->dev))
+        if (device_can_wakeup(&hw->pdev->dev)) {
                 skge->wol = wol_supported(hw) & WAKE_MAGIC;
+                device_set_wakeup_enable(&hw->pdev->dev, skge->wol);
+        }
 
         hw->dev[port] = dev;
 
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index f1f773b17fe1..57a159fac99f 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -186,7 +186,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
-#elif   defined(CONFIG_MACH_LOGICPD_PXA270)
+#elif   defined(CONFIG_MACH_LOGICPD_PXA270) \
+        || defined(CONFIG_MACH_NOMADIK_8815NHK)
 
 #define SMC_CAN_USE_8BIT        0
 #define SMC_CAN_USE_16BIT       1
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 9d896116cf76..08a6c41c1599 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
 
         find_turbo_adapters(io);
 
-        for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+        for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
                 struct net_device *dev;
                 irq[i] = 0;
                 mem[i] = 0;
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 40c6eba775ce..3b957e6412ee 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1590,13 +1590,13 @@ static int init_phy(struct net_device *dev)
         priv->oldspeed = 0;
         priv->oldduplex = -1;
 
-        if (!ug_info->phy_node)
-                return 0;
-
         phydev = of_phy_connect(dev, ug_info->phy_node, &adjust_link, 0,
                                 priv->phy_interface);
+        if (!phydev)
+                phydev = of_phy_connect_fixed_link(dev, &adjust_link,
+                                                   priv->phy_interface);
         if (!phydev) {
-                printk("%s: Could not attach to PHY\n", dev->name);
+                dev_err(&dev->dev, "Could not attach to PHY\n");
                 return -ENODEV;
         }
 
@@ -3608,9 +3608,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         struct ucc_geth_private *ugeth = NULL;
         struct ucc_geth_info *ug_info;
         struct resource res;
-        struct device_node *phy;
         int err, ucc_num, max_speed = 0;
-        const u32 *fixed_link;
         const unsigned int *prop;
         const char *sprop;
         const void *mac_addr;
@@ -3708,15 +3706,8 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
 
         ug_info->uf_info.regs = res.start;
         ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
-        fixed_link = of_get_property(np, "fixed-link", NULL);
-        if (fixed_link) {
-                phy = NULL;
-        } else {
-                phy = of_parse_phandle(np, "phy-handle", 0);
-                if (phy == NULL)
-                        return -ENODEV;
-        }
-        ug_info->phy_node = phy;
+
+        ug_info->phy_node = of_parse_phandle(np, "phy-handle", 0);
 
         /* Find the TBI PHY node.  If it's not there, we don't support SGMII */
         ug_info->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -3725,7 +3716,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         prop = of_get_property(np, "phy-connection-type", NULL);
         if (!prop) {
                 /* handle interface property present in old trees */
-                prop = of_get_property(phy, "interface", NULL);
+                prop = of_get_property(ug_info->phy_node, "interface", NULL);
                 if (prop != NULL) {
                         phy_interface = enet_to_phy_interface[*prop];
                         max_speed = enet_to_speed[*prop];
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index ea045151f953..029c1bc7468f 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2970,6 +2970,9 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (modparam_nohwcrypt)
                 return -EOPNOTSUPP;
 
+        if (sc->opmode == NL80211_IFTYPE_AP)
+                return -EOPNOTSUPP;
+
         switch (key->alg) {
         case ALG_WEP:
         case ALG_TKIP:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 1aeafb511ddd..aad259b4c197 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -478,6 +478,18 @@ void ath9k_ani_reset(struct ath_hw *ah)
                         "Reset ANI state opmode %u\n", ah->opmode);
                 ah->stats.ast_ani_reset++;
 
+                if (ah->opmode == NL80211_IFTYPE_AP) {
+                        /*
+                         * ath9k_hw_ani_control() will only process items set on
+                         * ah->ani_function
+                         */
+                        if (IS_CHAN_2GHZ(chan))
+                                ah->ani_function = (ATH9K_ANI_SPUR_IMMUNITY_LEVEL |
+                                                    ATH9K_ANI_FIRSTEP_LEVEL);
+                        else
+                                ah->ani_function = 0;
+                }
+
                 ath9k_hw_ani_control(ah, ATH9K_ANI_NOISE_IMMUNITY_LEVEL, 0);
                 ath9k_hw_ani_control(ah, ATH9K_ANI_SPUR_IMMUNITY_LEVEL, 0);
                 ath9k_hw_ani_control(ah, ATH9K_ANI_FIRSTEP_LEVEL, 0);
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index eef370bd1211..bf3d25ba7be1 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -474,6 +474,21 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
         return 0;
 }
 
+/*
+ * Some users have reported their EEPROM programmed with
+ * 0x8000 set, this is not a supported regulatory domain
+ * but since we have more than one user with it we need
+ * a solution for them. We default to 0x64, which is the
+ * default Atheros world regulatory domain.
+ */
+static void ath_regd_sanitize(struct ath_regulatory *reg)
+{
+        if (reg->current_rd != COUNTRY_ERD_FLAG)
+                return;
+        printk(KERN_DEBUG "ath: EEPROM regdomain sanitized\n");
+        reg->current_rd = 0x64;
+}
+
 int
 ath_regd_init(struct ath_regulatory *reg,
               struct wiphy *wiphy,
@@ -486,6 +501,8 @@ ath_regd_init(struct ath_regulatory *reg,
         if (!reg)
                 return -EINVAL;
 
+        ath_regd_sanitize(reg);
+
         printk(KERN_DEBUG "ath: EEPROM regdomain: 0x%0x\n", reg->current_rd);
 
         if (!ath_regd_is_eeprom_valid(reg)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 6d1519e1f011..355f50ea7fef 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2675,12 +2675,10 @@ static ssize_t show_power_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        p += sprintf(p, "INDEX:%d\t", level);
-        p += sprintf(p, "USER:%d\n", mode);
+        p += sprintf(p, "%d\n", level);
         return p - buf + 1;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 85ae7a62109c..9bbeec9427f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -872,7 +872,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
 
         /* Set up entry for this TFD in Tx byte-count array */
-        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
                                                      le16_to_cpu(tx_cmd->len));
 
         pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index cb9bd4c8f25e..956798f2c80c 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3643,12 +3643,10 @@ static ssize_t show_power_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        p += sprintf(p, "INDEX:%d\t", level);
-        p += sprintf(p, "USER:%d\n", mode);
+        p += sprintf(p, "%d\n", level);
         return p - buf + 1;
 }
 
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index aaa20c6885c8..aea5ccf24ccf 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -151,8 +151,8 @@ void iwm_if_free(struct iwm_priv *iwm)
                 return;
 
         free_netdev(iwm_to_ndev(iwm));
-        iwm_wdev_free(iwm);
         iwm_priv_deinit(iwm);
+        iwm_wdev_free(iwm);
 }
 
 int iwm_if_add(struct iwm_priv *iwm)
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 01db705a38ec..685098148e10 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -135,8 +135,14 @@ int lbs_update_hw_spec(struct lbs_private *priv)
         /* Clamp region code to 8-bit since FW spec indicates that it should
          * only ever be 8-bit, even though the field size is 16-bit.  Some firmware
          * returns non-zero high 8 bits here.
+         *
+         * Firmware version 4.0.102 used in CF8381 has region code shifted.  We
+         * need to check for this problem and handle it properly.
          */
-        priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V4)
+                priv->regioncode = (le16_to_cpu(cmd.regioncode) >> 8) & 0xFF;
+        else
+                priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
 
         for (i = 0; i < MRVDRV_MAX_REGION_CODE; i++) {
                 /* use the region code to search for the index */
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 48da157d6cda..72f3479a4d70 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -234,6 +234,8 @@ static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, in
 /** Mesh enable bit in FW capability */
 #define MESH_CAPINFO_ENABLE_MASK                        (1<<16)
 
+/** FW definition from Marvell v4 */
+#define MRVL_FW_V4                                      (0x04)
 /** FW definition from Marvell v5 */
 #define MRVL_FW_V5                                      (0x05)
 /** FW definition from Marvell v10 */
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a111bda392e2..7916ca3f84c8 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -709,7 +709,7 @@ static const struct ieee80211_ops mac80211_hwsim_ops =
 static void mac80211_hwsim_free(void)
 {
         struct list_head tmplist, *i, *tmp;
-        struct mac80211_hwsim_data *data;
+        struct mac80211_hwsim_data *data, *tmpdata;
 
         INIT_LIST_HEAD(&tmplist);
 
@@ -718,7 +718,7 @@ static void mac80211_hwsim_free(void)
                 list_move(i, &tmplist);
         spin_unlock_bh(&hwsim_radio_lock);
 
-        list_for_each_entry(data, &tmplist, list) {
+        list_for_each_entry_safe(data, tmpdata, &tmplist, list) {
                 debugfs_remove(data->debugfs_group);
                 debugfs_remove(data->debugfs_ps);
                 debugfs_remove(data->debugfs);
@@ -1167,8 +1167,8 @@ static void __exit exit_mac80211_hwsim(void)
 {
         printk(KERN_DEBUG "mac80211_hwsim: unregister radios\n");
 
-        unregister_netdev(hwsim_mon);
         mac80211_hwsim_free();
+        unregister_netdev(hwsim_mon);
 }
 
 
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 83116baeb110..72c7dbd39d0a 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -635,7 +635,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
 
         hw = p54_init_common(sizeof(*priv));
         if (!hw) {
-                dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+                dev_err(&spi->dev, "could not alloc ieee80211_hw");
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 66daf68ff0ee..ce75426764a1 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1550,7 +1550,9 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         rt2500usb_register_read(rt2x00dev, MAC_CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2570, value, reg);
 
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0)) {
+        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0) ||
+            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
+
                 ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                 return -ENODEV;
         }
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index b44253592243..cf9f899fe0e6 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -208,11 +208,12 @@ void rtl8187_leds_exit(struct ieee80211_hw *dev)
 {
         struct rtl8187_priv *priv = dev->priv;
 
-        rtl8187_unregister_led(&priv->led_tx);
         /* turn the LED off before exiting */
         queue_delayed_work(dev->workqueue, &priv->led_off, 0);
         cancel_delayed_work_sync(&priv->led_off);
+        cancel_delayed_work_sync(&priv->led_on);
         rtl8187_unregister_led(&priv->led_rx);
+        rtl8187_unregister_led(&priv->led_tx);
 }
 #endif /* def CONFIG_RTL8187_LED */
 
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index aee967d7f760..bacaa536fd51 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -9,6 +9,10 @@
  * out of the OpenFirmware device tree and using it to populate an mii_bus.
  */
 
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/netdevice.h>
+#include <linux/err.h>
 #include <linux/phy.h>
 #include <linux/of.h>
 #include <linux/of_mdio.h>
@@ -137,3 +141,41 @@ struct phy_device *of_phy_connect(struct net_device *dev,
         return phy_connect_direct(dev, phy, hndlr, flags, iface) ? NULL : phy;
 }
 EXPORT_SYMBOL(of_phy_connect);
+
+/**
+ * of_phy_connect_fixed_link - Parse fixed-link property and return a dummy phy
+ * @dev: pointer to net_device claiming the phy
+ * @hndlr: Link state callback for the network device
+ * @iface: PHY data interface type
+ *
+ * This function is a temporary stop-gap and will be removed soon.  It is
+ * only to support the fs_enet, ucc_geth and gianfar Ethernet drivers.  Do
+ * not call this function from new drivers.
+ */
+struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                             void (*hndlr)(struct net_device *),
+                                             phy_interface_t iface)
+{
+        struct device_node *net_np;
+        char bus_id[MII_BUS_ID_SIZE + 3];
+        struct phy_device *phy;
+        const u32 *phy_id;
+        int sz;
+
+        if (!dev->dev.parent)
+                return NULL;
+
+        net_np = dev_archdata_get_node(&dev->dev.parent->archdata);
+        if (!net_np)
+                return NULL;
+
+        phy_id = of_get_property(net_np, "fixed-link", &sz);
+        if (!phy_id || sz < sizeof(*phy_id))
+                return NULL;
+
+        sprintf(bus_id, PHY_ID_FMT, "0", phy_id[0]);
+
+        phy = phy_connect(dev, bus_id, hndlr, 0, iface);
+        return IS_ERR(phy) ? NULL : phy;
+}
+EXPORT_SYMBOL(of_phy_connect_fixed_link);
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index be2fd6f91639..fb45f5ee8df1 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -973,7 +973,7 @@ static int acer_rfkill_set(void *data, bool blocked)
 {
         acpi_status status;
         u32 cap = (unsigned long)data;
-        status = set_u32(!!blocked, cap);
+        status = set_u32(!blocked, cap);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
         return 0;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 727a809636d8..ed3dcdea7fe1 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1145,12 +1145,17 @@ ap_config_timeout(unsigned long ptr)
  */
 static inline void ap_schedule_poll_timer(void)
 {
+        ktime_t hr_time;
         if (ap_using_interrupts() || ap_suspend_flag)
                 return;
         if (hrtimer_is_queued(&ap_poll_timer))
                 return;
-        hrtimer_start(&ap_poll_timer, ktime_set(0, poll_timeout),
-                      HRTIMER_MODE_ABS);
+        if (ktime_to_ns(hrtimer_expires_remaining(&ap_poll_timer)) <= 0) {
+                hr_time = ktime_set(0, poll_timeout);
+                hrtimer_forward_now(&ap_poll_timer, hr_time);
+                hrtimer_restart(&ap_poll_timer);
+        }
+        return;
 }
 
 /**
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index 348bf61a8fec..975ecddbce30 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -103,8 +103,6 @@ source "drivers/staging/pohmelfs/Kconfig"
 
 source "drivers/staging/stlc45xx/Kconfig"
 
-source "drivers/staging/uc2322/Kconfig"
-
 source "drivers/staging/b3dfg/Kconfig"
 
 source "drivers/staging/phison/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 8d61d7b4debf..2241ae1b21ee 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -34,7 +34,6 @@ obj-$(CONFIG_ANDROID)		+= android/
 obj-$(CONFIG_DST)               += dst/
 obj-$(CONFIG_POHMELFS)          += pohmelfs/
 obj-$(CONFIG_STLC45XX)          += stlc45xx/
-obj-$(CONFIG_USB_SERIAL_ATEN2011)       += uc2322/
 obj-$(CONFIG_B3DFG)             += b3dfg/
 obj-$(CONFIG_IDE_PHISON)        += phison/
 obj-$(CONFIG_PLAN9AUTH)         += p9auth/
diff --git a/drivers/staging/android/lowmemorykiller.c b/drivers/staging/android/lowmemorykiller.c
index fe72240f5a9e..f934393f3959 100644
--- a/drivers/staging/android/lowmemorykiller.c
+++ b/drivers/staging/android/lowmemorykiller.c
@@ -96,19 +96,21 @@ static int lowmem_shrink(int nr_to_scan, gfp_t gfp_mask)
 
         read_lock(&tasklist_lock);
         for_each_process(p) {
+                struct mm_struct *mm;
                 int oom_adj;
 
                 task_lock(p);
-                if (!p->mm) {
+                mm = p->mm;
+                if (!mm) {
                         task_unlock(p);
                         continue;
                 }
-                oom_adj = p->oomkilladj;
+                oom_adj = mm->oom_adj;
                 if (oom_adj < min_adj) {
                         task_unlock(p);
                         continue;
                 }
-                tasksize = get_mm_rss(p->mm);
+                tasksize = get_mm_rss(mm);
                 task_unlock(p);
                 if (tasksize <= 0)
                         continue;
diff --git a/drivers/staging/serqt_usb2/serqt_usb2.c b/drivers/staging/serqt_usb2/serqt_usb2.c
index a9bd4106beb7..0fdf8c6dc648 100644
--- a/drivers/staging/serqt_usb2/serqt_usb2.c
+++ b/drivers/staging/serqt_usb2/serqt_usb2.c
@@ -360,18 +360,18 @@ static void qt_read_bulk_callback(struct urb *urb)
         if (port_paranoia_check(port, __func__) != 0) {
                 dbg("%s - port_paranoia_check, exiting\n", __func__);
                 qt_port->ReadBulkStopped = 1;
-                return;
+                goto exit;
         }
 
         if (!serial) {
                 dbg("%s - bad serial pointer, exiting\n", __func__);
-                return;
+                goto exit;
         }
         if (qt_port->closePending == 1) {
                 /* Were closing , stop reading */
                 dbg("%s - (qt_port->closepending == 1\n", __func__);
                 qt_port->ReadBulkStopped = 1;
-                return;
+                goto exit;
         }
 
         /*
@@ -381,7 +381,7 @@ static void qt_read_bulk_callback(struct urb *urb)
          */
         if (qt_port->RxHolding == 1) {
                 qt_port->ReadBulkStopped = 1;
-                return;
+                goto exit;
         }
 
         if (urb->status) {
@@ -389,7 +389,7 @@ static void qt_read_bulk_callback(struct urb *urb)
 
                 dbg("%s - nonzero read bulk status received: %d\n",
                     __func__, urb->status);
-                return;
+                goto exit;
         }
 
         if (tty && RxCount) {
@@ -463,6 +463,8 @@ static void qt_read_bulk_callback(struct urb *urb)
         }
 
         schedule_work(&port->work);
+exit:
+        tty_kref_put(tty);
 }
 
 /*
@@ -736,6 +738,11 @@ static int qt_startup(struct usb_serial *serial)
                 if (!qt_port) {
                         dbg("%s: kmalloc for quatech_port (%d) failed!.",
                             __func__, i);
+                        for(--i; i >= 0; i--) {
+                                port = serial->port[i];
+                                kfree(usb_get_serial_port_data(port));
+                                usb_set_serial_port_data(port, NULL);
+                        }
                         return -ENOMEM;
                 }
                 spin_lock_init(&qt_port->lock);
@@ -1041,7 +1048,7 @@ static void qt_block_until_empty(struct tty_struct *tty,
         }
 }
 
-static void qt_close( struct usb_serial_port *port)
+static void qt_close(struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         struct quatech_port *qt_port;
@@ -1068,6 +1075,7 @@ static void qt_close( struct usb_serial_port *port)
         /* wait up to for transmitter to empty */
         if (serial->dev)
                 qt_block_until_empty(tty, qt_port);
+        tty_kref_put(tty);
 
         /* Close uart channel */
         status = qt_close_channel(serial, index);
diff --git a/drivers/staging/uc2322/Kconfig b/drivers/staging/uc2322/Kconfig
deleted file mode 100644
index 2e0c6e79df2b..000000000000
--- a/drivers/staging/uc2322/Kconfig
+++ /dev/null
@@ -1,10 +0,0 @@
-config USB_SERIAL_ATEN2011
-        tristate "ATEN 2011 USB to serial device support"
-        depends on USB_SERIAL
-        default N
-        ---help---
-          Say Y here if you want to use a ATEN 2011 dual port USB to serial
-          adapter.
-
-          To compile this driver as a module, choose M here: the module will be
-          called aten2011.
diff --git a/drivers/staging/uc2322/Makefile b/drivers/staging/uc2322/Makefile
deleted file mode 100644
index 49c18d6e579f..000000000000
--- a/drivers/staging/uc2322/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_USB_SERIAL_ATEN2011)       += aten2011.o
diff --git a/drivers/staging/uc2322/TODO b/drivers/staging/uc2322/TODO
deleted file mode 100644
index c189a64c4185..000000000000
--- a/drivers/staging/uc2322/TODO
+++ /dev/null
@@ -1,7 +0,0 @@
-TODO:
-        - checkpatch.pl cleanups
-        - remove dead and useless code (auditing the tty ioctls to
-          verify that they really are correct and needed.)
-
-Please send any patches to Greg Kroah-Hartman <greg@kroah.com> and
-Russell Lang <gsview@ghostgum.com.au>.
diff --git a/drivers/staging/uc2322/aten2011.c b/drivers/staging/uc2322/aten2011.c
deleted file mode 100644
index 39d0926d1a90..000000000000
--- a/drivers/staging/uc2322/aten2011.c
+++ /dev/null
@@ -1,2430 +0,0 @@
-/*
- * Aten 2011 USB serial driver for 4 port devices
- *
- * Copyright (C) 2000 Inside Out Networks
- * Copyright (C) 2001-2002, 2009 Greg Kroah-Hartman <greg@kroah.com>
- * Copyright (C) 2009 Novell Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- */
-
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/tty.h>
-#include <linux/tty_driver.h>
-#include <linux/tty_flip.h>
-#include <linux/module.h>
-#include <linux/serial.h>
-#include <linux/uaccess.h>
-#include <linux/usb.h>
-#include <linux/usb/serial.h>
-
-
-#define ZLP_REG1                0x3A    /* Zero_Flag_Reg1 58 */
-#define ZLP_REG2                0x3B    /* Zero_Flag_Reg2 59 */
-#define ZLP_REG3                0x3C    /* Zero_Flag_Reg3 60 */
-#define ZLP_REG4                0x3D    /* Zero_Flag_Reg4 61 */
-#define ZLP_REG5                0x3E    /* Zero_Flag_Reg5 62 */
-
-/* Interrupt Rotinue Defines    */
-#define SERIAL_IIR_RLS          0x06
-#define SERIAL_IIR_RDA          0x04
-#define SERIAL_IIR_CTI          0x0c
-#define SERIAL_IIR_THR          0x02
-#define SERIAL_IIR_MS           0x00
-
-/* Emulation of the bit mask on the LINE STATUS REGISTER.  */
-#define SERIAL_LSR_DR           0x0001
-#define SERIAL_LSR_OE           0x0002
-#define SERIAL_LSR_PE           0x0004
-#define SERIAL_LSR_FE           0x0008
-#define SERIAL_LSR_BI           0x0010
-#define SERIAL_LSR_THRE         0x0020
-#define SERIAL_LSR_TEMT         0x0040
-#define SERIAL_LSR_FIFOERR      0x0080
-
-/* MSR bit defines(place holders) */
-#define ATEN_MSR_DELTA_CTS      0x10
-#define ATEN_MSR_DELTA_DSR      0x20
-#define ATEN_MSR_DELTA_RI       0x40
-#define ATEN_MSR_DELTA_CD       0x80
-
-/* Serial Port register Address */
-#define RECEIVE_BUFFER_REGISTER         ((__u16)(0x00))
-#define TRANSMIT_HOLDING_REGISTER       ((__u16)(0x00))
-#define INTERRUPT_ENABLE_REGISTER       ((__u16)(0x01))
-#define INTERRUPT_IDENT_REGISTER        ((__u16)(0x02))
-#define FIFO_CONTROL_REGISTER           ((__u16)(0x02))
-#define LINE_CONTROL_REGISTER           ((__u16)(0x03))
-#define MODEM_CONTROL_REGISTER          ((__u16)(0x04))
-#define LINE_STATUS_REGISTER            ((__u16)(0x05))
-#define MODEM_STATUS_REGISTER           ((__u16)(0x06))
-#define SCRATCH_PAD_REGISTER            ((__u16)(0x07))
-#define DIVISOR_LATCH_LSB               ((__u16)(0x00))
-#define DIVISOR_LATCH_MSB               ((__u16)(0x01))
-
-#define SP1_REGISTER                    ((__u16)(0x00))
-#define CONTROL1_REGISTER               ((__u16)(0x01))
-#define CLK_MULTI_REGISTER              ((__u16)(0x02))
-#define CLK_START_VALUE_REGISTER        ((__u16)(0x03))
-#define DCR1_REGISTER                   ((__u16)(0x04))
-#define GPIO_REGISTER                   ((__u16)(0x07))
-
-#define SERIAL_LCR_DLAB                 ((__u16)(0x0080))
-
-/*
- * URB POOL related defines
- */
-#define NUM_URBS                        16      /* URB Count */
-#define URB_TRANSFER_BUFFER_SIZE        32      /* URB Size  */
-
-#define USB_VENDOR_ID_ATENINTL          0x0557
-#define ATENINTL_DEVICE_ID_2011         0x2011
-#define ATENINTL_DEVICE_ID_7820         0x7820
-
-static struct usb_device_id id_table[] = {
-        { USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_2011) },
-        { USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_7820) },
-        { } /* terminating entry */
-};
-MODULE_DEVICE_TABLE(usb, id_table);
-
-/* This structure holds all of the local port information */
-struct ATENINTL_port {
-        int             port_num;          /*Actual port number in the device(1,2,etc)*/
-        __u8            bulk_out_endpoint;      /* the bulk out endpoint handle */
-        unsigned char   *bulk_out_buffer;       /* buffer used for the bulk out endpoint */
-        struct urb      *write_urb;             /* write URB for this port */
-        __u8            bulk_in_endpoint;       /* the bulk in endpoint handle */
-        unsigned char   *bulk_in_buffer;        /* the buffer we use for the bulk in endpoint */
-        struct urb      *read_urb;              /* read URB for this port */
-        __u8            shadowLCR;              /* last LCR value received */
-        __u8            shadowMCR;              /* last MCR value received */
-        char            open;
-        char            chaseResponsePending;
-        wait_queue_head_t       wait_chase;             /* for handling sleeping while waiting for chase to finish */
-        wait_queue_head_t       wait_command;           /* for handling sleeping while waiting for command to finish */
-        struct async_icount     icount;
-        struct usb_serial_port  *port;                  /* loop back to the owner of this object */
-        /*Offsets*/
-        __u8            SpRegOffset;
-        __u8            ControlRegOffset;
-        __u8            DcrRegOffset;
-        /* for processing control URBS in interrupt context */
-        struct urb      *control_urb;
-        char            *ctrl_buf;
-        int             MsrLsr;
-
-        struct urb      *write_urb_pool[NUM_URBS];
-        /* we pass a pointer to this as the arguement sent to cypress_set_termios old_termios */
-        struct ktermios tmp_termios;        /* stores the old termios settings */
-        spinlock_t      lock;                   /* private lock */
-};
-
-/* This structure holds all of the individual serial device information */
-struct ATENINTL_serial {
-        __u8            interrupt_in_endpoint;          /* the interrupt endpoint handle */
-        unsigned char   *interrupt_in_buffer;           /* the buffer we use for the interrupt endpoint */
-        struct urb      *interrupt_read_urb;    /* our interrupt urb */
-        __u8            bulk_in_endpoint;       /* the bulk in endpoint handle */
-        unsigned char   *bulk_in_buffer;                /* the buffer we use for the bulk in endpoint */
-        struct urb      *read_urb;              /* our bulk read urb */
-        __u8            bulk_out_endpoint;      /* the bulk out endpoint handle */
-        struct usb_serial       *serial;        /* loop back to the owner of this object */
-        int     ATEN2011_spectrum_2or4ports;    /* this says the number of ports in the device */
-        /* Indicates about the no.of opened ports of an individual USB-serial adapater. */
-        unsigned int    NoOfOpenPorts;
-        /* a flag for Status endpoint polling */
-        unsigned char   status_polling_started;
-};
-
-static void ATEN2011_set_termios(struct tty_struct *tty,
-                                 struct usb_serial_port *port,
-                                 struct ktermios *old_termios);
-static void ATEN2011_change_port_settings(struct tty_struct *tty,
-                                          struct ATENINTL_port *ATEN2011_port,
-                                          struct ktermios *old_termios);
-
-/*************************************
- * Bit definitions for each register *
- *************************************/
-#define LCR_BITS_5              0x00    /* 5 bits/char */
-#define LCR_BITS_6              0x01    /* 6 bits/char */
-#define LCR_BITS_7              0x02    /* 7 bits/char */
-#define LCR_BITS_8              0x03    /* 8 bits/char */
-#define LCR_BITS_MASK           0x03    /* Mask for bits/char field */
-
-#define LCR_STOP_1              0x00    /* 1 stop bit */
-#define LCR_STOP_1_5            0x04    /* 1.5 stop bits (if 5   bits/char) */
-#define LCR_STOP_2              0x04    /* 2 stop bits   (if 6-8 bits/char) */
-#define LCR_STOP_MASK           0x04    /* Mask for stop bits field */
-
-#define LCR_PAR_NONE            0x00    /* No parity */
-#define LCR_PAR_ODD             0x08    /* Odd parity */
-#define LCR_PAR_EVEN            0x18    /* Even parity */
-#define LCR_PAR_MARK            0x28    /* Force parity bit to 1 */
-#define LCR_PAR_SPACE           0x38    /* Force parity bit to 0 */
-#define LCR_PAR_MASK            0x38    /* Mask for parity field */
-
-#define LCR_SET_BREAK           0x40    /* Set Break condition */
-#define LCR_DL_ENABLE           0x80    /* Enable access to divisor latch */
-
-#define MCR_DTR                 0x01    /* Assert DTR */
-#define MCR_RTS                 0x02    /* Assert RTS */
-#define MCR_OUT1                0x04    /* Loopback only: Sets state of RI */
-#define MCR_MASTER_IE           0x08    /* Enable interrupt outputs */
-#define MCR_LOOPBACK            0x10    /* Set internal (digital) loopback mode */
-#define MCR_XON_ANY             0x20    /* Enable any char to exit XOFF mode */
-
-#define ATEN2011_MSR_CTS        0x10    /* Current state of CTS */
-#define ATEN2011_MSR_DSR        0x20    /* Current state of DSR */
-#define ATEN2011_MSR_RI         0x40    /* Current state of RI */
-#define ATEN2011_MSR_CD         0x80    /* Current state of CD */
-
-
-static int debug;
-
-/*
- * Version Information
- */
-#define DRIVER_VERSION "2.0"
-#define DRIVER_DESC "ATENINTL 2011 USB Serial Adapter"
-
-/*
- * Defines used for sending commands to port
- */
-
-#define ATEN_WDR_TIMEOUT        (50)    /* default urb timeout */
-
-/* Requests */
-#define ATEN_RD_RTYPE           0xC0
-#define ATEN_WR_RTYPE           0x40
-#define ATEN_RDREQ              0x0D
-#define ATEN_WRREQ              0x0E
-#define ATEN_CTRL_TIMEOUT       500
-#define VENDOR_READ_LENGTH      (0x01)
-
-/* set to 1 for RS485 mode and 0 for RS232 mode */
-/* FIXME make this somehow dynamic and not build time specific */
-static int RS485mode;
-
-static int set_reg_sync(struct usb_serial_port *port, __u16 reg, __u16 val)
-{
-        struct usb_device *dev = port->serial->dev;
-        val = val & 0x00ff;
-
-        dbg("%s: is %x, value %x", __func__, reg, val);
-
-        return usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ATEN_WRREQ,
-                               ATEN_WR_RTYPE, val, reg, NULL, 0,
-                               ATEN_WDR_TIMEOUT);
-}
-
-static int get_reg_sync(struct usb_serial_port *port, __u16 reg, __u16 *val)
-{
-        struct usb_device *dev = port->serial->dev;
-        int ret;
-
-        ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ATEN_RDREQ,
-                              ATEN_RD_RTYPE, 0, reg, val, VENDOR_READ_LENGTH,
-                              ATEN_WDR_TIMEOUT);
-        dbg("%s: offset is %x, return val %x", __func__, reg, *val);
-        *val = (*val) & 0x00ff;
-        return ret;
-}
-
-static int set_uart_reg(struct usb_serial_port *port, __u16 reg, __u16 val)
-{
-        struct usb_device *dev = port->serial->dev;
-        struct ATENINTL_serial *a_serial;
-        __u16 minor;
-
-        a_serial = usb_get_serial_data(port->serial);
-        minor = port->serial->minor;
-        if (minor == SERIAL_TTY_NO_MINOR)
-                minor = 0;
-        val = val & 0x00ff;
-
-        /*
-         * For the UART control registers,
-         * the application number need to be Or'ed
-         */
-        if (a_serial->ATEN2011_spectrum_2or4ports == 4)
-                val |= (((__u16)port->number - minor) + 1) << 8;
-        else {
-                if (((__u16) port->number - minor) == 0)
-                        val |= (((__u16)port->number - minor) + 1) << 8;
-                else
-                        val |= (((__u16)port->number - minor) + 2) << 8;
-        }
-        dbg("%s: application number is %x", __func__, val);
-
-        return usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ATEN_WRREQ,
-                               ATEN_WR_RTYPE, val, reg, NULL, 0,
-                               ATEN_WDR_TIMEOUT);
-}
-
-static int get_uart_reg(struct usb_serial_port *port, __u16 reg, __u16 *val)
-{
-        struct usb_device *dev = port->serial->dev;
-        int ret = 0;
-        __u16 wval;
-        struct ATENINTL_serial *a_serial;
-        __u16 minor = port->serial->minor;
-
-        a_serial = usb_get_serial_data(port->serial);
-        if (minor == SERIAL_TTY_NO_MINOR)
-                minor = 0;
-
-        /* wval is same as application number */
-        if (a_serial->ATEN2011_spectrum_2or4ports == 4)
-                wval = (((__u16)port->number - minor) + 1) << 8;
-        else {
-                if (((__u16) port->number - minor) == 0)
-                        wval = (((__u16) port->number - minor) + 1) << 8;
-                else
-                        wval = (((__u16) port->number - minor) + 2) << 8;
-        }
-        dbg("%s: application number is %x", __func__, wval);
-        ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ATEN_RDREQ,
-                              ATEN_RD_RTYPE, wval, reg, val, VENDOR_READ_LENGTH,
-                              ATEN_WDR_TIMEOUT);
-        *val = (*val) & 0x00ff;
-        return ret;
-}
-
-static int handle_newMsr(struct ATENINTL_port *port, __u8 newMsr)
-{
-        struct ATENINTL_port *ATEN2011_port;
-        struct async_icount *icount;
-        ATEN2011_port = port;
-        icount = &ATEN2011_port->icount;
-        if (newMsr &
-            (ATEN_MSR_DELTA_CTS | ATEN_MSR_DELTA_DSR | ATEN_MSR_DELTA_RI |
-             ATEN_MSR_DELTA_CD)) {
-                icount = &ATEN2011_port->icount;
-
-                /* update input line counters */
-                if (newMsr & ATEN_MSR_DELTA_CTS)
-                        icount->cts++;
-                if (newMsr & ATEN_MSR_DELTA_DSR)
-                        icount->dsr++;
-                if (newMsr & ATEN_MSR_DELTA_CD)
-                        icount->dcd++;
-                if (newMsr & ATEN_MSR_DELTA_RI)
-                        icount->rng++;
-        }
-
-        return 0;
-}
-
-static int handle_newLsr(struct ATENINTL_port *port, __u8 newLsr)
-{
-        struct async_icount *icount;
-
-        dbg("%s - %02x", __func__, newLsr);
-
-        if (newLsr & SERIAL_LSR_BI) {
-                /*
-                 * Parity and Framing errors only count if they occur exclusive
-                 * of a break being received.
-                 */
-                newLsr &= (__u8) (SERIAL_LSR_OE | SERIAL_LSR_BI);
-        }
-
-        /* update input line counters */
-        icount = &port->icount;
-        if (newLsr & SERIAL_LSR_BI)
-                icount->brk++;
-        if (newLsr & SERIAL_LSR_OE)
-                icount->overrun++;
-        if (newLsr & SERIAL_LSR_PE)
-                icount->parity++;
-        if (newLsr & SERIAL_LSR_FE)
-                icount->frame++;
-
-        return 0;
-}
-
-static void ATEN2011_control_callback(struct urb *urb)
-{
-        unsigned char *data;
-        struct ATENINTL_port *ATEN2011_port;
-        __u8 regval = 0x0;
-
-        switch (urb->status) {
-        case 0:
-                /* success */
-                break;
-        case -ECONNRESET:
-        case -ENOENT:
-        case -ESHUTDOWN:
-                /* this urb is terminated, clean up */
-                dbg("%s - urb shutting down with status: %d", __func__,
-                    urb->status);
-                return;
-        default:
-                dbg("%s - nonzero urb status received: %d", __func__,
-                    urb->status);
-                goto exit;
-        }
-
-        ATEN2011_port = (struct ATENINTL_port *)urb->context;
-
-        dbg("%s urb buffer size is %d", __func__, urb->actual_length);
-        dbg("%s ATEN2011_port->MsrLsr is %d port %d", __func__,
-                ATEN2011_port->MsrLsr, ATEN2011_port->port_num);
-        data = urb->transfer_buffer;
-        regval = (__u8) data[0];
-        dbg("%s data is %x", __func__, regval);
-        if (ATEN2011_port->MsrLsr == 0)
-                handle_newMsr(ATEN2011_port, regval);
-        else if (ATEN2011_port->MsrLsr == 1)
-                handle_newLsr(ATEN2011_port, regval);
-
-exit:
-        return;
-}
-
-static int ATEN2011_get_reg(struct ATENINTL_port *ATEN, __u16 Wval, __u16 reg,
-                            __u16 *val)
-{
-        struct usb_device *dev = ATEN->port->serial->dev;
-        struct usb_ctrlrequest *dr = NULL;
-        unsigned char *buffer = NULL;
-        int ret = 0;
-        buffer = (__u8 *) ATEN->ctrl_buf;
-
-        dr = (void *)(buffer + 2);
-        dr->bRequestType = ATEN_RD_RTYPE;
-        dr->bRequest = ATEN_RDREQ;
-        dr->wValue = cpu_to_le16(Wval);
-        dr->wIndex = cpu_to_le16(reg);
-        dr->wLength = cpu_to_le16(2);
-
-        usb_fill_control_urb(ATEN->control_urb, dev, usb_rcvctrlpipe(dev, 0),
-                             (unsigned char *)dr, buffer, 2,
-                             ATEN2011_control_callback, ATEN);
-        ATEN->control_urb->transfer_buffer_length = 2;
-        ret = usb_submit_urb(ATEN->control_urb, GFP_ATOMIC);
-        return ret;
-}
-
-static void ATEN2011_interrupt_callback(struct urb *urb)
-{
-        int result;
-        int length;
-        struct ATENINTL_port *ATEN2011_port;
-        struct ATENINTL_serial *ATEN2011_serial;
-        struct usb_serial *serial;
-        __u16 Data;
-        unsigned char *data;
-        __u8 sp[5], st;
-        int i;
-        __u16 wval;
-        int minor;
-
-        dbg("%s", " : Entering");
-
-        ATEN2011_serial = (struct ATENINTL_serial *)urb->context;
-
-        switch (urb->status) {
-        case 0:
-                /* success */
-                break;
-        case -ECONNRESET:
-        case -ENOENT:
-        case -ESHUTDOWN:
-                /* this urb is terminated, clean up */
-                dbg("%s - urb shutting down with status: %d", __func__,
-                    urb->status);
-                return;
-        default:
-                dbg("%s - nonzero urb status received: %d", __func__,
-                    urb->status);
-                goto exit;
-        }
-        length = urb->actual_length;
-        data = urb->transfer_buffer;
-
-        serial = ATEN2011_serial->serial;
-
-        /* ATENINTL get 5 bytes
-         * Byte 1 IIR Port 1 (port.number is 0)
-         * Byte 2 IIR Port 2 (port.number is 1)
-         * Byte 3 IIR Port 3 (port.number is 2)
-         * Byte 4 IIR Port 4 (port.number is 3)
-         * Byte 5 FIFO status for both */
-
-        if (length && length > 5) {
-                dbg("%s", "Wrong data !!!");
-                return;
-        }
-
-        /* MATRIX */
-        if (ATEN2011_serial->ATEN2011_spectrum_2or4ports == 4) {
-                sp[0] = (__u8) data[0];
-                sp[1] = (__u8) data[1];
-                sp[2] = (__u8) data[2];
-                sp[3] = (__u8) data[3];
-                st = (__u8) data[4];
-        } else {
-                sp[0] = (__u8) data[0];
-                sp[1] = (__u8) data[2];
-                /* sp[2]=(__u8)data[2]; */
-                /* sp[3]=(__u8)data[3]; */
-                st = (__u8) data[4];
-
-        }
-        for (i = 0; i < serial->num_ports; i++) {
-                ATEN2011_port = usb_get_serial_port_data(serial->port[i]);
-                minor = serial->minor;
-                if (minor == SERIAL_TTY_NO_MINOR)
-                        minor = 0;
-                if ((ATEN2011_serial->ATEN2011_spectrum_2or4ports == 2)
-                    && (i != 0))
-                        wval =
-                            (((__u16) serial->port[i]->number -
-                              (__u16) (minor)) + 2) << 8;
-                else
-                        wval =
-                            (((__u16) serial->port[i]->number -
-                              (__u16) (minor)) + 1) << 8;
-                if (ATEN2011_port->open != 0) {
-                        if (sp[i] & 0x01) {
-                                dbg("SP%d No Interrupt !!!", i);
-                        } else {
-                                switch (sp[i] & 0x0f) {
-                                case SERIAL_IIR_RLS:
-                                        dbg("Serial Port %d: Receiver status error or address bit detected in 9-bit mode", i);
-                                        ATEN2011_port->MsrLsr = 1;
-                                        ATEN2011_get_reg(ATEN2011_port, wval,
-                                                         LINE_STATUS_REGISTER,
-                                                         &Data);
-                                        break;
-                                case SERIAL_IIR_MS:
-                                        dbg("Serial Port %d: Modem status change", i);
-                                        ATEN2011_port->MsrLsr = 0;
-                                        ATEN2011_get_reg(ATEN2011_port, wval,
-                                                         MODEM_STATUS_REGISTER,
-                                                         &Data);
-                                        break;
-                                }
-                        }
-                }
-
-        }
-exit:
-        if (ATEN2011_serial->status_polling_started == 0)
-                return;
-
-        result = usb_submit_urb(urb, GFP_ATOMIC);
-        if (result) {
-                dev_err(&urb->dev->dev,
-                        "%s - Error %d submitting interrupt urb\n",
-                        __func__, result);
-        }
-
-        return;
-}
-
-static void ATEN2011_bulk_in_callback(struct urb *urb)
-{
-        int status;
-        unsigned char *data;
-        struct usb_serial *serial;
-        struct usb_serial_port *port;
-        struct ATENINTL_serial *ATEN2011_serial;
-        struct ATENINTL_port *ATEN2011_port;
-        struct tty_struct *tty;
-
-        if (urb->status) {
-                dbg("nonzero read bulk status received: %d", urb->status);
-                return;
-        }
-
-        ATEN2011_port = (struct ATENINTL_port *)urb->context;
-
-        port = (struct usb_serial_port *)ATEN2011_port->port;
-        serial = port->serial;
-
-        dbg("%s", "Entering...");
-
-        data = urb->transfer_buffer;
-        ATEN2011_serial = usb_get_serial_data(serial);
-
-        if (urb->actual_length) {
-                tty = tty_port_tty_get(&ATEN2011_port->port->port);
-                if (tty) {
-                        tty_buffer_request_room(tty, urb->actual_length);
-                        tty_insert_flip_string(tty, data, urb->actual_length);
-                        tty_flip_buffer_push(tty);
-                        tty_kref_put(tty);
-                }
-
-                ATEN2011_port->icount.rx += urb->actual_length;
-                dbg("ATEN2011_port->icount.rx is %d:",
-                        ATEN2011_port->icount.rx);
-        }
-
-        if (!ATEN2011_port->read_urb) {
-                dbg("%s", "URB KILLED !!!");
-                return;
-        }
-
-        if (ATEN2011_port->read_urb->status != -EINPROGRESS) {
-                ATEN2011_port->read_urb->dev = serial->dev;
-
-                status = usb_submit_urb(ATEN2011_port->read_urb, GFP_ATOMIC);
-                if (status)
-                        dbg("usb_submit_urb(read bulk) failed, status = %d", status);
-        }
-}
-
-static void ATEN2011_bulk_out_data_callback(struct urb *urb)
-{
-        struct ATENINTL_port *ATEN2011_port;
-        struct tty_struct *tty;
-
-        if (urb->status) {
-                dbg("nonzero write bulk status received:%d", urb->status);
-                return;
-        }
-
-        ATEN2011_port = (struct ATENINTL_port *)urb->context;
-
-        dbg("%s", "Entering .........");
-
-        tty = tty_port_tty_get(&ATEN2011_port->port->port);
-
-        if (tty && ATEN2011_port->open)
-                /* tell the tty driver that something has changed */
-                tty_wakeup(tty);
-
-        /* schedule_work(&ATEN2011_port->port->work); */
-        tty_kref_put(tty);
-
-}
-
-#ifdef ATENSerialProbe
-static int ATEN2011_serial_probe(struct usb_serial *serial,
-                                 const struct usb_device_id *id)
-{
-
-        /*need to implement the mode_reg reading and updating\
-           structures usb_serial_ device_type\
-           (i.e num_ports, num_bulkin,bulkout etc) */
-        /* Also we can update the changes  attach */
-        return 1;
-}
-#endif
-
-static int ATEN2011_open(struct tty_struct *tty, struct usb_serial_port *port,
-                         struct file *filp)
-{
-        int response;
-        int j;
-        struct usb_serial *serial;
-        struct urb *urb;
-        __u16 Data;
-        int status;
-        struct ATENINTL_serial *ATEN2011_serial;
-        struct ATENINTL_port *ATEN2011_port;
-        struct ktermios tmp_termios;
-        int minor;
-
-        serial = port->serial;
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-
-        if (ATEN2011_port == NULL)
-                return -ENODEV;
-
-        ATEN2011_serial = usb_get_serial_data(serial);
-        if (ATEN2011_serial == NULL)
-                return -ENODEV;
-
-        /* increment the number of opened ports counter here */
-        ATEN2011_serial->NoOfOpenPorts++;
-
-        usb_clear_halt(serial->dev, port->write_urb->pipe);
-        usb_clear_halt(serial->dev, port->read_urb->pipe);
-
-        /* Initialising the write urb pool */
-        for (j = 0; j < NUM_URBS; ++j) {
-                urb = usb_alloc_urb(0, GFP_ATOMIC);
-                ATEN2011_port->write_urb_pool[j] = urb;
-
-                if (urb == NULL) {
-                        err("No more urbs???");
-                        continue;
-                }
-
-                urb->transfer_buffer = NULL;
-                urb->transfer_buffer =
-                    kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
-                if (!urb->transfer_buffer) {
-                        err("%s-out of memory for urb buffers.", __func__);
-                        continue;
-                }
-        }
-
-/*****************************************************************************
- * Initialize ATEN2011 -- Write Init values to corresponding Registers
- *
- * Register Index
- * 1 : IER
- * 2 : FCR
- * 3 : LCR
- * 4 : MCR
- *
- * 0x08 : SP1/2 Control Reg
- *****************************************************************************/
-
-/* NEED to check the fallowing Block */
-
-        Data = 0x0;
-        status = get_reg_sync(port, ATEN2011_port->SpRegOffset, &Data);
-        if (status < 0) {
-                dbg("Reading Spreg failed");
-                return -1;
-        }
-        Data |= 0x80;
-        status = set_reg_sync(port, ATEN2011_port->SpRegOffset, Data);
-        if (status < 0) {
-                dbg("writing Spreg failed");
-                return -1;
-        }
-
-        Data &= ~0x80;
-        status = set_reg_sync(port, ATEN2011_port->SpRegOffset, Data);
-        if (status < 0) {
-                dbg("writing Spreg failed");
-                return -1;
-        }
-
-/* End of block to be checked */
-/**************************CHECK***************************/
-
-        if (RS485mode == 0)
-                Data = 0xC0;
-        else
-                Data = 0x00;
-        status = set_uart_reg(port, SCRATCH_PAD_REGISTER, Data);
-        if (status < 0) {
-                dbg("Writing SCRATCH_PAD_REGISTER failed status-0x%x", status);
-                return -1;
-        } else
-                dbg("SCRATCH_PAD_REGISTER Writing success status%d", status);
-
-/**************************CHECK***************************/
-
-        Data = 0x0;
-        status = get_reg_sync(port, ATEN2011_port->ControlRegOffset, &Data);
-        if (status < 0) {
-                dbg("Reading Controlreg failed");
-                return -1;
-        }
-        Data |= 0x08;           /* Driver done bit */
-        Data |= 0x20;           /* rx_disable */
-        status = 0;
-        status =
-            set_reg_sync(port, ATEN2011_port->ControlRegOffset, Data);
-        if (status < 0) {
-                dbg("writing Controlreg failed");
-                return -1;
-        }
-        /*
-         * do register settings here
-         * Set all regs to the device default values.
-         * First Disable all interrupts.
-         */
-
-        Data = 0x00;
-        status = set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
-        if (status < 0) {
-                dbg("disableing interrupts failed");
-                return -1;
-        }
-        /* Set FIFO_CONTROL_REGISTER to the default value */
-        Data = 0x00;
-        status = set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
-        if (status < 0) {
-                dbg("Writing FIFO_CONTROL_REGISTER  failed");
-                return -1;
-        }
-
-        Data = 0xcf;            /* chk */
-        status = set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
-        if (status < 0) {
-                dbg("Writing FIFO_CONTROL_REGISTER  failed");
-                return -1;
-        }
-
-        Data = 0x03;            /* LCR_BITS_8 */
-        status = set_uart_reg(port, LINE_CONTROL_REGISTER, Data);
-        ATEN2011_port->shadowLCR = Data;
-
-        Data = 0x0b;            /* MCR_DTR|MCR_RTS|MCR_MASTER_IE */
-        status = set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-        ATEN2011_port->shadowMCR = Data;
-
-#ifdef Check
-        Data = 0x00;
-        status = get_uart_reg(port, LINE_CONTROL_REGISTER, &Data);
-        ATEN2011_port->shadowLCR = Data;
-
-        Data |= SERIAL_LCR_DLAB;        /* data latch enable in LCR 0x80 */
-        status = set_uart_reg(port, LINE_CONTROL_REGISTER, Data);
-
-        Data = 0x0c;
-        status = set_uart_reg(port, DIVISOR_LATCH_LSB, Data);
-
-        Data = 0x0;
-        status = set_uart_reg(port, DIVISOR_LATCH_MSB, Data);
-
-        Data = 0x00;
-        status = get_uart_reg(port, LINE_CONTROL_REGISTER, &Data);
-
-/*      Data = ATEN2011_port->shadowLCR; */     /* data latch disable */
-        Data = Data & ~SERIAL_LCR_DLAB;
-        status = set_uart_reg(port, LINE_CONTROL_REGISTER, Data);
-        ATEN2011_port->shadowLCR = Data;
-#endif
-        /* clearing Bulkin and Bulkout Fifo */
-        Data = 0x0;
-        status = get_reg_sync(port, ATEN2011_port->SpRegOffset, &Data);
-
-        Data = Data | 0x0c;
-        status = set_reg_sync(port, ATEN2011_port->SpRegOffset, Data);
-
-        Data = Data & ~0x0c;
-        status = set_reg_sync(port, ATEN2011_port->SpRegOffset, Data);
-        /* Finally enable all interrupts */
-        Data = 0x0;
-        Data = 0x0c;
-        status = set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
-
-        /* clearing rx_disable */
-        Data = 0x0;
-        status = get_reg_sync(port, ATEN2011_port->ControlRegOffset, &Data);
-        Data = Data & ~0x20;
-        status = set_reg_sync(port, ATEN2011_port->ControlRegOffset, Data);
-
-        /* rx_negate */
-        Data = 0x0;
-        status = get_reg_sync(port, ATEN2011_port->ControlRegOffset, &Data);
-        Data = Data | 0x10;
-        status = 0;
-        status = set_reg_sync(port, ATEN2011_port->ControlRegOffset, Data);
-
-        /*
-         * Check to see if we've set up our endpoint info yet
-         * (can't set it up in ATEN2011_startup as the structures
-         * were not set up at that time.)
-         */
-        if (ATEN2011_serial->NoOfOpenPorts == 1) {
-                /* start the status polling here */
-                ATEN2011_serial->status_polling_started = 1;
-                /* If not yet set, Set here */
-                ATEN2011_serial->interrupt_in_buffer =
-                    serial->port[0]->interrupt_in_buffer;
-                ATEN2011_serial->interrupt_in_endpoint =
-                    serial->port[0]->interrupt_in_endpointAddress;
-                ATEN2011_serial->interrupt_read_urb =
-                    serial->port[0]->interrupt_in_urb;
-
-                /* set up interrupt urb */
-                usb_fill_int_urb(ATEN2011_serial->interrupt_read_urb,
-                                 serial->dev,
-                                 usb_rcvintpipe(serial->dev,
-                                                ATEN2011_serial->
-                                                interrupt_in_endpoint),
-                                 ATEN2011_serial->interrupt_in_buffer,
-                                 ATEN2011_serial->interrupt_read_urb->
-                                 transfer_buffer_length,
-                                 ATEN2011_interrupt_callback, ATEN2011_serial,
-                                 ATEN2011_serial->interrupt_read_urb->interval);
-
-                /* start interrupt read for ATEN2011               *
-                 * will continue as long as ATEN2011 is connected  */
-
-                response =
-                    usb_submit_urb(ATEN2011_serial->interrupt_read_urb,
-                                   GFP_KERNEL);
-                if (response) {
-                        dbg("%s - Error %d submitting interrupt urb",
-                                __func__, response);
-                }
-
-        }
-
-        /*
-         * See if we've set up our endpoint info yet
-         * (can't set it up in ATEN2011_startup as the
-         * structures were not set up at that time.)
-         */
-
-        dbg("port number is %d", port->number);
-        dbg("serial number is %d", port->serial->minor);
-        dbg("Bulkin endpoint is %d", port->bulk_in_endpointAddress);
-        dbg("BulkOut endpoint is %d", port->bulk_out_endpointAddress);
-        dbg("Interrupt endpoint is %d",
-                port->interrupt_in_endpointAddress);
-        dbg("port's number in the device is %d", ATEN2011_port->port_num);
-        ATEN2011_port->bulk_in_buffer = port->bulk_in_buffer;
-        ATEN2011_port->bulk_in_endpoint = port->bulk_in_endpointAddress;
-        ATEN2011_port->read_urb = port->read_urb;
-        ATEN2011_port->bulk_out_endpoint = port->bulk_out_endpointAddress;
-
-        minor = port->serial->minor;
-        if (minor == SERIAL_TTY_NO_MINOR)
-                minor = 0;
-
-        /* set up our bulk in urb */
-        if ((ATEN2011_serial->ATEN2011_spectrum_2or4ports == 2)
-            && (((__u16) port->number - (__u16) (minor)) != 0)) {
-                usb_fill_bulk_urb(ATEN2011_port->read_urb, serial->dev,
-                                  usb_rcvbulkpipe(serial->dev,
-                                                  (port->
-                                                   bulk_in_endpointAddress +
-                                                   2)), port->bulk_in_buffer,
-                                  ATEN2011_port->read_urb->
-                                  transfer_buffer_length,
-                                  ATEN2011_bulk_in_callback, ATEN2011_port);
-        } else
-                usb_fill_bulk_urb(ATEN2011_port->read_urb,
-                                  serial->dev,
-                                  usb_rcvbulkpipe(serial->dev,
-                                                  port->
-                                                  bulk_in_endpointAddress),
-                                  port->bulk_in_buffer,
-                                  ATEN2011_port->read_urb->
-                                  transfer_buffer_length,
-                                  ATEN2011_bulk_in_callback, ATEN2011_port);
-
-        dbg("ATEN2011_open: bulkin endpoint is %d",
-                port->bulk_in_endpointAddress);
-        response = usb_submit_urb(ATEN2011_port->read_urb, GFP_KERNEL);
-        if (response) {
-                err("%s - Error %d submitting control urb", __func__,
-                    response);
-        }
-
-        /* initialize our wait queues */
-        init_waitqueue_head(&ATEN2011_port->wait_chase);
-        init_waitqueue_head(&ATEN2011_port->wait_command);
-
-        /* initialize our icount structure */
-        memset(&(ATEN2011_port->icount), 0x00, sizeof(ATEN2011_port->icount));
-
-        /* initialize our port settings */
-        ATEN2011_port->shadowMCR = MCR_MASTER_IE;       /* Must set to enable ints! */
-        ATEN2011_port->chaseResponsePending = 0;
-        /* send a open port command */
-        ATEN2011_port->open = 1;
-        /* ATEN2011_change_port_settings(ATEN2011_port,old_termios); */
-        /* Setup termios */
-        ATEN2011_set_termios(tty, port, &tmp_termios);
-        ATEN2011_port->icount.tx = 0;
-        ATEN2011_port->icount.rx = 0;
-
-        dbg("usb_serial serial:%x       ATEN2011_port:%x\nATEN2011_serial:%x      usb_serial_port port:%x",
-             (unsigned int)serial, (unsigned int)ATEN2011_port,
-             (unsigned int)ATEN2011_serial, (unsigned int)port);
-
-        return 0;
-
-}
-
-static int ATEN2011_chars_in_buffer(struct tty_struct *tty)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        int i;
-        int chars = 0;
-        struct ATENINTL_port *ATEN2011_port;
-
-        /* dbg("%s"," ATEN2011_chars_in_buffer:entering ..........."); */
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-        if (ATEN2011_port == NULL) {
-                dbg("%s", "ATEN2011_break:leaving ...........");
-                return -1;
-        }
-
-        for (i = 0; i < NUM_URBS; ++i)
-                if (ATEN2011_port->write_urb_pool[i]->status == -EINPROGRESS)
-                        chars += URB_TRANSFER_BUFFER_SIZE;
-
-        dbg("%s - returns %d", __func__, chars);
-        return chars;
-
-}
-
-static void ATEN2011_block_until_tx_empty(struct tty_struct *tty,
-                                          struct ATENINTL_port *ATEN2011_port)
-{
-        int timeout = HZ / 10;
-        int wait = 30;
-        int count;
-
-        while (1) {
-                count = ATEN2011_chars_in_buffer(tty);
-
-                /* Check for Buffer status */
-                if (count <= 0)
-                        return;
-
-                /* Block the thread for a while */
-                interruptible_sleep_on_timeout(&ATEN2011_port->wait_chase,
-                                               timeout);
-
-                /* No activity.. count down section */
-                wait--;
-                if (wait == 0) {
-                        dbg("%s - TIMEOUT", __func__);
-                        return;
-                } else {
-                        /* Reset timout value back to seconds */
-                        wait = 30;
-                }
-        }
-}
-
-static void ATEN2011_close(struct tty_struct *tty, struct usb_serial_port *port,
-                           struct file *filp)
-{
-        struct usb_serial *serial;
-        struct ATENINTL_serial *ATEN2011_serial;
-        struct ATENINTL_port *ATEN2011_port;
-        int no_urbs;
-        __u16 Data;
-
-        dbg("%s", "ATEN2011_close:entering...");
-        serial = port->serial;
-
-        /* take the Adpater and port's private data */
-        ATEN2011_serial = usb_get_serial_data(serial);
-        ATEN2011_port = usb_get_serial_port_data(port);
-        if ((ATEN2011_serial == NULL) || (ATEN2011_port == NULL))
-                return;
-
-        if (serial->dev) {
-                /* flush and block(wait) until tx is empty */
-                ATEN2011_block_until_tx_empty(tty, ATEN2011_port);
-        }
-        /* kill the ports URB's */
-        for (no_urbs = 0; no_urbs < NUM_URBS; no_urbs++)
-                usb_kill_urb(ATEN2011_port->write_urb_pool[no_urbs]);
-        /* Freeing Write URBs */
-        for (no_urbs = 0; no_urbs < NUM_URBS; ++no_urbs) {
-                kfree(ATEN2011_port->write_urb_pool[no_urbs]->transfer_buffer);
-                usb_free_urb(ATEN2011_port->write_urb_pool[no_urbs]);
-        }
-        /* While closing port, shutdown all bulk read, write  *
-         * and interrupt read if they exists                  */
-        if (serial->dev) {
-                if (ATEN2011_port->write_urb) {
-                        dbg("%s", "Shutdown bulk write");
-                        usb_kill_urb(ATEN2011_port->write_urb);
-                }
-                if (ATEN2011_port->read_urb) {
-                        dbg("%s", "Shutdown bulk read");
-                        usb_kill_urb(ATEN2011_port->read_urb);
-                }
-                if ((&ATEN2011_port->control_urb)) {
-                        dbg("%s", "Shutdown control read");
-                        /* usb_kill_urb (ATEN2011_port->control_urb); */
-
-                }
-        }
-        /* if(ATEN2011_port->ctrl_buf != NULL) */
-                /* kfree(ATEN2011_port->ctrl_buf); */
-        /* decrement the no.of open ports counter of an individual USB-serial adapter. */
-        ATEN2011_serial->NoOfOpenPorts--;
-        dbg("NoOfOpenPorts in close%d:in port%d",
-                ATEN2011_serial->NoOfOpenPorts, port->number);
-        if (ATEN2011_serial->NoOfOpenPorts == 0) {
-                /* stop the stus polling here */
-                ATEN2011_serial->status_polling_started = 0;
-                if (ATEN2011_serial->interrupt_read_urb) {
-                        dbg("%s", "Shutdown interrupt_read_urb");
-                        /* ATEN2011_serial->interrupt_in_buffer=NULL; */
-                        /* usb_kill_urb (ATEN2011_serial->interrupt_read_urb); */
-                }
-        }
-        if (ATEN2011_port->write_urb) {
-                /* if this urb had a transfer buffer already (old tx) free it */
-                kfree(ATEN2011_port->write_urb->transfer_buffer);
-                usb_free_urb(ATEN2011_port->write_urb);
-        }
-
-        /* clear the MCR & IER */
-        Data = 0x00;
-        set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-        Data = 0x00;
-        set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
-
-        ATEN2011_port->open = 0;
-        dbg("%s", "Leaving ............");
-
-}
-
-static void ATEN2011_block_until_chase_response(struct tty_struct *tty,
-                                                struct ATENINTL_port
-                                                *ATEN2011_port)
-{
-        int timeout = 1 * HZ;
-        int wait = 10;
-        int count;
-
-        while (1) {
-                count = ATEN2011_chars_in_buffer(tty);
-
-                /* Check for Buffer status */
-                if (count <= 0) {
-                        ATEN2011_port->chaseResponsePending = 0;
-                        return;
-                }
-
-                /* Block the thread for a while */
-                interruptible_sleep_on_timeout(&ATEN2011_port->wait_chase,
-                                               timeout);
-                /* No activity.. count down section */
-                wait--;
-                if (wait == 0) {
-                        dbg("%s - TIMEOUT", __func__);
-                        return;
-                } else {
-                        /* Reset timout value back to seconds */
-                        wait = 10;
-                }
-        }
-
-}
-
-static void ATEN2011_break(struct tty_struct *tty, int break_state)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        unsigned char data;
-        struct usb_serial *serial;
-        struct ATENINTL_serial *ATEN2011_serial;
-        struct ATENINTL_port *ATEN2011_port;
-
-        dbg("%s", "Entering ...........");
-        dbg("ATEN2011_break: Start");
-
-        serial = port->serial;
-
-        ATEN2011_serial = usb_get_serial_data(serial);
-        ATEN2011_port = usb_get_serial_port_data(port);
-
-        if ((ATEN2011_serial == NULL) || (ATEN2011_port == NULL))
-                return;
-
-        /* flush and chase */
-        ATEN2011_port->chaseResponsePending = 1;
-
-        if (serial->dev) {
-                /* flush and block until tx is empty */
-                ATEN2011_block_until_chase_response(tty, ATEN2011_port);
-        }
-
-        if (break_state == -1)
-                data = ATEN2011_port->shadowLCR | LCR_SET_BREAK;
-        else
-                data = ATEN2011_port->shadowLCR & ~LCR_SET_BREAK;
-
-        ATEN2011_port->shadowLCR = data;
-        dbg("ATEN2011_break ATEN2011_port->shadowLCR is %x",
-                ATEN2011_port->shadowLCR);
-        set_uart_reg(port, LINE_CONTROL_REGISTER, ATEN2011_port->shadowLCR);
-
-        return;
-}
-
-static int ATEN2011_write_room(struct tty_struct *tty)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        int i;
-        int room = 0;
-        struct ATENINTL_port *ATEN2011_port;
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-        if (ATEN2011_port == NULL) {
-                dbg("%s", "ATEN2011_break:leaving ...........");
-                return -1;
-        }
-
-        for (i = 0; i < NUM_URBS; ++i)
-                if (ATEN2011_port->write_urb_pool[i]->status != -EINPROGRESS)
-                        room += URB_TRANSFER_BUFFER_SIZE;
-
-        dbg("%s - returns %d", __func__, room);
-        return room;
-
-}
-
-static int ATEN2011_write(struct tty_struct *tty, struct usb_serial_port *port,
-                          const unsigned char *data, int count)
-{
-        int status;
-        int i;
-        int bytes_sent = 0;
-        int transfer_size;
-        int minor;
-
-        struct ATENINTL_port *ATEN2011_port;
-        struct usb_serial *serial;
-        struct ATENINTL_serial *ATEN2011_serial;
-        struct urb *urb;
-        const unsigned char *current_position = data;
-        unsigned char *data1;
-        dbg("%s", "entering ...........");
-
-        serial = port->serial;
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-        if (ATEN2011_port == NULL) {
-                dbg("%s", "ATEN2011_port is NULL");
-                return -1;
-        }
-
-        ATEN2011_serial = usb_get_serial_data(serial);
-        if (ATEN2011_serial == NULL) {
-                dbg("%s", "ATEN2011_serial is NULL");
-                return -1;
-        }
-
-        /* try to find a free urb in the list */
-        urb = NULL;
-
-        for (i = 0; i < NUM_URBS; ++i) {
-                if (ATEN2011_port->write_urb_pool[i]->status != -EINPROGRESS) {
-                        urb = ATEN2011_port->write_urb_pool[i];
-                        dbg("URB:%d", i);
-                        break;
-                }
-        }
-
-        if (urb == NULL) {
-                dbg("%s - no more free urbs", __func__);
-                goto exit;
-        }
-
-        if (urb->transfer_buffer == NULL) {
-                urb->transfer_buffer =
-                    kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
-
-                if (urb->transfer_buffer == NULL) {
-                        err("%s no more kernel memory...", __func__);
-                        goto exit;
-                }
-        }
-        transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
-
-        memcpy(urb->transfer_buffer, current_position, transfer_size);
-        /* usb_serial_debug_data (__FILE__, __func__, transfer_size, urb->transfer_buffer); */
-
-        /* fill urb with data and submit  */
-        minor = port->serial->minor;
-        if (minor == SERIAL_TTY_NO_MINOR)
-                minor = 0;
-        if ((ATEN2011_serial->ATEN2011_spectrum_2or4ports == 2)
-            && (((__u16) port->number - (__u16) (minor)) != 0)) {
-                usb_fill_bulk_urb(urb, ATEN2011_serial->serial->dev,
-                                  usb_sndbulkpipe(ATEN2011_serial->serial->dev,
-                                                  (port->
-                                                   bulk_out_endpointAddress) +
-                                                  2), urb->transfer_buffer,
-                                  transfer_size,
-                                  ATEN2011_bulk_out_data_callback,
-                                  ATEN2011_port);
-        } else
-
-                usb_fill_bulk_urb(urb,
-                                  ATEN2011_serial->serial->dev,
-                                  usb_sndbulkpipe(ATEN2011_serial->serial->dev,
-                                                  port->
-                                                  bulk_out_endpointAddress),
-                                  urb->transfer_buffer, transfer_size,
-                                  ATEN2011_bulk_out_data_callback,
-                                  ATEN2011_port);
-
-        data1 = urb->transfer_buffer;
-        dbg("bulkout endpoint is %d", port->bulk_out_endpointAddress);
-        /* for(i=0;i < urb->actual_length;i++) */
-                /* dbg("Data is %c ",data1[i]); */
-
-        /* send it down the pipe */
-        status = usb_submit_urb(urb, GFP_ATOMIC);
-
-        if (status) {
-                err("%s - usb_submit_urb(write bulk) failed with status = %d",
-                    __func__, status);
-                bytes_sent = status;
-                goto exit;
-        }
-        bytes_sent = transfer_size;
-        ATEN2011_port->icount.tx += transfer_size;
-        dbg("ATEN2011_port->icount.tx is %d:", ATEN2011_port->icount.tx);
-
-exit:
-        return bytes_sent;
-}
-
-static void ATEN2011_throttle(struct tty_struct *tty)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        struct ATENINTL_port *ATEN2011_port;
-        int status;
-
-        dbg("- port %d", port->number);
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-
-        if (ATEN2011_port == NULL)
-                return;
-
-        if (!ATEN2011_port->open) {
-                dbg("%s", "port not opened");
-                return;
-        }
-
-        dbg("%s", "Entering .......... ");
-
-        if (!tty) {
-                dbg("%s - no tty available", __func__);
-                return;
-        }
-
-        /* if we are implementing XON/XOFF, send the stop character */
-        if (I_IXOFF(tty)) {
-                unsigned char stop_char = STOP_CHAR(tty);
-                status = ATEN2011_write(tty, port, &stop_char, 1);
-                if (status <= 0)
-                        return;
-        }
-
-        /* if we are implementing RTS/CTS, toggle that line */
-        if (tty->termios->c_cflag & CRTSCTS) {
-                ATEN2011_port->shadowMCR &= ~MCR_RTS;
-                status = set_uart_reg(port, MODEM_CONTROL_REGISTER,
-                                      ATEN2011_port->shadowMCR);
-                if (status < 0)
-                        return;
-        }
-
-        return;
-}
-
-static void ATEN2011_unthrottle(struct tty_struct *tty)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        int status;
-        struct ATENINTL_port *ATEN2011_port = usb_get_serial_port_data(port);
-
-        if (ATEN2011_port == NULL)
-                return;
-
-        if (!ATEN2011_port->open) {
-                dbg("%s - port not opened", __func__);
-                return;
-        }
-
-        dbg("%s", "Entering .......... ");
-
-        if (!tty) {
-                dbg("%s - no tty available", __func__);
-                return;
-        }
-
-        /* if we are implementing XON/XOFF, send the start character */
-        if (I_IXOFF(tty)) {
-                unsigned char start_char = START_CHAR(tty);
-                status = ATEN2011_write(tty, port, &start_char, 1);
-                if (status <= 0)
-                        return;
-        }
-
-        /* if we are implementing RTS/CTS, toggle that line */
-        if (tty->termios->c_cflag & CRTSCTS) {
-                ATEN2011_port->shadowMCR |= MCR_RTS;
-                status = set_uart_reg(port, MODEM_CONTROL_REGISTER,
-                                      ATEN2011_port->shadowMCR);
-                if (status < 0)
-                        return;
-        }
-
-        return;
-}
-
-static int ATEN2011_tiocmget(struct tty_struct *tty, struct file *file)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        struct ATENINTL_port *ATEN2011_port;
-        unsigned int result;
-        __u16 msr;
-        __u16 mcr;
-        /* unsigned int mcr; */
-        int status = 0;
-        ATEN2011_port = usb_get_serial_port_data(port);
-
-        dbg("%s - port %d", __func__, port->number);
-
-        if (ATEN2011_port == NULL)
-                return -ENODEV;
-
-        status = get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
-        status = get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
-        /* mcr = ATEN2011_port->shadowMCR; */
-        /* COMMENT2: the Fallowing three line are commented for updating only MSR values */
-        result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
-            | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
-            | ((mcr & MCR_LOOPBACK) ? TIOCM_LOOP : 0)
-            | ((msr & ATEN2011_MSR_CTS) ? TIOCM_CTS : 0)
-            | ((msr & ATEN2011_MSR_CD) ? TIOCM_CAR : 0)
-            | ((msr & ATEN2011_MSR_RI) ? TIOCM_RI : 0)
-            | ((msr & ATEN2011_MSR_DSR) ? TIOCM_DSR : 0);
-
-        dbg("%s - 0x%04X", __func__, result);
-
-        return result;
-}
-
-static int ATEN2011_tiocmset(struct tty_struct *tty, struct file *file,
-                             unsigned int set, unsigned int clear)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        struct ATENINTL_port *ATEN2011_port;
-        unsigned int mcr;
-        unsigned int status;
-
-        dbg("%s - port %d", __func__, port->number);
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-
-        if (ATEN2011_port == NULL)
-                return -ENODEV;
-
-        mcr = ATEN2011_port->shadowMCR;
-        if (clear & TIOCM_RTS)
-                mcr &= ~MCR_RTS;
-        if (clear & TIOCM_DTR)
-                mcr &= ~MCR_DTR;
-        if (clear & TIOCM_LOOP)
-                mcr &= ~MCR_LOOPBACK;
-
-        if (set & TIOCM_RTS)
-                mcr |= MCR_RTS;
-        if (set & TIOCM_DTR)
-                mcr |= MCR_DTR;
-        if (set & TIOCM_LOOP)
-                mcr |= MCR_LOOPBACK;
-
-        ATEN2011_port->shadowMCR = mcr;
-
-        status = set_uart_reg(port, MODEM_CONTROL_REGISTER, mcr);
-        if (status < 0) {
-                dbg("setting MODEM_CONTROL_REGISTER Failed");
-                return -1;
-        }
-
-        return 0;
-}
-
-static void ATEN2011_set_termios(struct tty_struct *tty,
-                                 struct usb_serial_port *port,
-                                 struct ktermios *old_termios)
-{
-        int status;
-        unsigned int cflag;
-        struct usb_serial *serial;
-        struct ATENINTL_port *ATEN2011_port;
-
-        dbg("ATEN2011_set_termios: START");
-
-        serial = port->serial;
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-
-        if (ATEN2011_port == NULL)
-                return;
-
-        if (!ATEN2011_port->open) {
-                dbg("%s - port not opened", __func__);
-                return;
-        }
-
-        dbg("%s", "setting termios - ");
-
-        cflag = tty->termios->c_cflag;
-
-        dbg("%s - cflag %08x iflag %08x", __func__,
-            tty->termios->c_cflag, RELEVANT_IFLAG(tty->termios->c_iflag));
-
-        if (old_termios) {
-                dbg("%s - old clfag %08x old iflag %08x", __func__,
-                    old_termios->c_cflag, RELEVANT_IFLAG(old_termios->c_iflag));
-        }
-
-        dbg("%s - port %d", __func__, port->number);
-
-        /* change the port settings to the new ones specified */
-
-        ATEN2011_change_port_settings(tty, ATEN2011_port, old_termios);
-
-        if (!ATEN2011_port->read_urb) {
-                dbg("%s", "URB KILLED !!!!!");
-                return;
-        }
-
-        if (ATEN2011_port->read_urb->status != -EINPROGRESS) {
-                ATEN2011_port->read_urb->dev = serial->dev;
-                status = usb_submit_urb(ATEN2011_port->read_urb, GFP_ATOMIC);
-                if (status) {
-                        dbg
-                            (" usb_submit_urb(read bulk) failed, status = %d",
-                             status);
-                }
-        }
-        return;
-}
-
-static int get_lsr_info(struct tty_struct *tty,
-                        struct ATENINTL_port *ATEN2011_port,
-                        unsigned int __user *value)
-{
-        int count;
-        unsigned int result = 0;
-
-        count = ATEN2011_chars_in_buffer(tty);
-        if (count == 0) {
-                dbg("%s -- Empty", __func__);
-                result = TIOCSER_TEMT;
-        }
-
-        if (copy_to_user(value, &result, sizeof(int)))
-                return -EFAULT;
-        return 0;
-}
-
-static int get_number_bytes_avail(struct tty_struct *tty,
-                                  struct ATENINTL_port *ATEN2011_port,
-                                  unsigned int __user *value)
-{
-        unsigned int result = 0;
-
-        if (!tty)
-                return -ENOIOCTLCMD;
-
-        result = tty->read_cnt;
-
-        dbg("%s(%d) = %d", __func__, ATEN2011_port->port->number, result);
-        if (copy_to_user(value, &result, sizeof(int)))
-                return -EFAULT;
-
-        return -ENOIOCTLCMD;
-}
-
-static int set_modem_info(struct ATENINTL_port *ATEN2011_port, unsigned int cmd,
-                          unsigned int __user *value)
-{
-        unsigned int mcr;
-        unsigned int arg;
-        __u16 Data;
-        int status;
-        struct usb_serial_port *port;
-
-        if (ATEN2011_port == NULL)
-                return -1;
-
-        port = (struct usb_serial_port *)ATEN2011_port->port;
-
-        mcr = ATEN2011_port->shadowMCR;
-
-        if (copy_from_user(&arg, value, sizeof(int)))
-                return -EFAULT;
-
-        switch (cmd) {
-        case TIOCMBIS:
-                if (arg & TIOCM_RTS)
-                        mcr |= MCR_RTS;
-                if (arg & TIOCM_DTR)
-                        mcr |= MCR_RTS;
-                if (arg & TIOCM_LOOP)
-                        mcr |= MCR_LOOPBACK;
-                break;
-
-        case TIOCMBIC:
-                if (arg & TIOCM_RTS)
-                        mcr &= ~MCR_RTS;
-                if (arg & TIOCM_DTR)
-                        mcr &= ~MCR_RTS;
-                if (arg & TIOCM_LOOP)
-                        mcr &= ~MCR_LOOPBACK;
-                break;
-
-        case TIOCMSET:
-                /* turn off the RTS and DTR and LOOPBACK
-                 * and then only turn on what was asked to */
-                mcr &= ~(MCR_RTS | MCR_DTR | MCR_LOOPBACK);
-                mcr |= ((arg & TIOCM_RTS) ? MCR_RTS : 0);
-                mcr |= ((arg & TIOCM_DTR) ? MCR_DTR : 0);
-                mcr |= ((arg & TIOCM_LOOP) ? MCR_LOOPBACK : 0);
-                break;
-        }
-
-        ATEN2011_port->shadowMCR = mcr;
-
-        Data = ATEN2011_port->shadowMCR;
-        status = set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-        if (status < 0) {
-                dbg("setting MODEM_CONTROL_REGISTER Failed");
-                return -1;
-        }
-
-        return 0;
-}
-
-static int get_modem_info(struct ATENINTL_port *ATEN2011_port,
-                          unsigned int __user *value)
-{
-        unsigned int result = 0;
-        __u16 msr;
-        unsigned int mcr = ATEN2011_port->shadowMCR;
-        int status;
-
-        status = get_uart_reg(ATEN2011_port->port, MODEM_STATUS_REGISTER, &msr);
-        result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)      /* 0x002 */
-            |((mcr & MCR_RTS) ? TIOCM_RTS : 0)  /* 0x004 */
-            |((msr & ATEN2011_MSR_CTS) ? TIOCM_CTS : 0) /* 0x020 */
-            |((msr & ATEN2011_MSR_CD) ? TIOCM_CAR : 0)  /* 0x040 */
-            |((msr & ATEN2011_MSR_RI) ? TIOCM_RI : 0)   /* 0x080 */
-            |((msr & ATEN2011_MSR_DSR) ? TIOCM_DSR : 0);        /* 0x100 */
-
-        dbg("%s -- %x", __func__, result);
-
-        if (copy_to_user(value, &result, sizeof(int)))
-                return -EFAULT;
-        return 0;
-}
-
-static int get_serial_info(struct ATENINTL_port *ATEN2011_port,
-                           struct serial_struct __user *retinfo)
-{
-        struct serial_struct tmp;
-
-        if (ATEN2011_port == NULL)
-                return -1;
-
-        if (!retinfo)
-                return -EFAULT;
-
-        memset(&tmp, 0, sizeof(tmp));
-
-        tmp.type = PORT_16550A;
-        tmp.line = ATEN2011_port->port->serial->minor;
-        if (tmp.line == SERIAL_TTY_NO_MINOR)
-                tmp.line = 0;
-        tmp.port = ATEN2011_port->port->number;
-        tmp.irq = 0;
-        tmp.flags = ASYNC_SKIP_TEST | ASYNC_AUTO_IRQ;
-        tmp.xmit_fifo_size = NUM_URBS * URB_TRANSFER_BUFFER_SIZE;
-        tmp.baud_base = 9600;
-        tmp.close_delay = 5 * HZ;
-        tmp.closing_wait = 30 * HZ;
-
-        if (copy_to_user(retinfo, &tmp, sizeof(*retinfo)))
-                return -EFAULT;
-        return 0;
-}
-
-static int ATEN2011_ioctl(struct tty_struct *tty, struct file *file,
-                          unsigned int cmd, unsigned long arg)
-{
-        struct usb_serial_port *port = tty->driver_data;
-        struct ATENINTL_port *ATEN2011_port;
-        struct async_icount cnow;
-        struct async_icount cprev;
-        struct serial_icounter_struct icount;
-        int ATENret = 0;
-        unsigned int __user *user_arg = (unsigned int __user *)arg;
-
-        ATEN2011_port = usb_get_serial_port_data(port);
-
-        if (ATEN2011_port == NULL)
-                return -1;
-
-        dbg("%s - port %d, cmd = 0x%x", __func__, port->number, cmd);
-
-        switch (cmd) {
-                /* return number of bytes available */
-
-        case TIOCINQ:
-                dbg("%s (%d) TIOCINQ", __func__, port->number);
-                return get_number_bytes_avail(tty, ATEN2011_port, user_arg);
-                break;
-
-        case TIOCOUTQ:
-                dbg("%s (%d) TIOCOUTQ", __func__, port->number);
-                return put_user(ATEN2011_chars_in_buffer(tty), user_arg);
-                break;
-
-        case TIOCSERGETLSR:
-                dbg("%s (%d) TIOCSERGETLSR", __func__, port->number);
-                return get_lsr_info(tty, ATEN2011_port, user_arg);
-                return 0;
-
-        case TIOCMBIS:
-        case TIOCMBIC:
-        case TIOCMSET:
-                dbg("%s (%d) TIOCMSET/TIOCMBIC/TIOCMSET", __func__,
-                    port->number);
-                ATENret = set_modem_info(ATEN2011_port, cmd, user_arg);
-                return ATENret;
-
-        case TIOCMGET:
-                dbg("%s (%d) TIOCMGET", __func__, port->number);
-                return get_modem_info(ATEN2011_port, user_arg);
-
-        case TIOCGSERIAL:
-                dbg("%s (%d) TIOCGSERIAL", __func__, port->number);
-                return get_serial_info(ATEN2011_port,
-                                       (struct serial_struct __user *)arg);
-
-        case TIOCSSERIAL:
-                dbg("%s (%d) TIOCSSERIAL", __func__, port->number);
-                break;
-
-        case TIOCMIWAIT:
-                dbg("%s (%d) TIOCMIWAIT", __func__, port->number);
-                cprev = ATEN2011_port->icount;
-                while (1) {
-                        /* see if a signal did it */
-                        if (signal_pending(current))
-                                return -ERESTARTSYS;
-                        cnow = ATEN2011_port->icount;
-                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
-                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
-                                return -EIO;    /* no change => error */
-                        if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
-                            ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
-                            ((arg & TIOCM_CD) && (cnow.dcd != cprev.dcd)) ||
-                            ((arg & TIOCM_CTS) && (cnow.cts != cprev.cts))) {
-                                return 0;
-                        }
-                        cprev = cnow;
-                }
-                /* NOTREACHED */
-                break;
-
-        case TIOCGICOUNT:
-                cnow = ATEN2011_port->icount;
-                icount.cts = cnow.cts;
-                icount.dsr = cnow.dsr;
-                icount.rng = cnow.rng;
-                icount.dcd = cnow.dcd;
-                icount.rx = cnow.rx;
-                icount.tx = cnow.tx;
-                icount.frame = cnow.frame;
-                icount.overrun = cnow.overrun;
-                icount.parity = cnow.parity;
-                icount.brk = cnow.brk;
-                icount.buf_overrun = cnow.buf_overrun;
-
-                dbg("%s (%d) TIOCGICOUNT RX=%d, TX=%d", __func__,
-                    port->number, icount.rx, icount.tx);
-                if (copy_to_user((void __user *)arg, &icount, sizeof(icount)))
-                        return -EFAULT;
-                return 0;
-
-        default:
-                break;
-        }
-
-        return -ENOIOCTLCMD;
-}
-
-static int ATEN2011_calc_baud_rate_divisor(int baudRate, int *divisor,
-                                           __u16 *clk_sel_val)
-{
-        dbg("%s - %d", __func__, baudRate);
-
-        if (baudRate <= 115200) {
-                *divisor = 115200 / baudRate;
-                *clk_sel_val = 0x0;
-        }
-        if ((baudRate > 115200) && (baudRate <= 230400)) {
-                *divisor = 230400 / baudRate;
-                *clk_sel_val = 0x10;
-        } else if ((baudRate > 230400) && (baudRate <= 403200)) {
-                *divisor = 403200 / baudRate;
-                *clk_sel_val = 0x20;
-        } else if ((baudRate > 403200) && (baudRate <= 460800)) {
-                *divisor = 460800 / baudRate;
-                *clk_sel_val = 0x30;
-        } else if ((baudRate > 460800) && (baudRate <= 806400)) {
-                *divisor = 806400 / baudRate;
-                *clk_sel_val = 0x40;
-        } else if ((baudRate > 806400) && (baudRate <= 921600)) {
-                *divisor = 921600 / baudRate;
-                *clk_sel_val = 0x50;
-        } else if ((baudRate > 921600) && (baudRate <= 1572864)) {
-                *divisor = 1572864 / baudRate;
-                *clk_sel_val = 0x60;
-        } else if ((baudRate > 1572864) && (baudRate <= 3145728)) {
-                *divisor = 3145728 / baudRate;
-                *clk_sel_val = 0x70;
-        }
-        return 0;
-}
-
-static int ATEN2011_send_cmd_write_baud_rate(struct ATENINTL_port
-                                             *ATEN2011_port, int baudRate)
-{
-        int divisor = 0;
-        int status;
-        __u16 Data;
-        unsigned char number;
-        __u16 clk_sel_val;
-        struct usb_serial_port *port;
-        int minor;
-
-        if (ATEN2011_port == NULL)
-                return -1;
-
-        port = (struct usb_serial_port *)ATEN2011_port->port;
-
-        dbg("%s", "Entering .......... ");
-
-        minor = ATEN2011_port->port->serial->minor;
-        if (minor == SERIAL_TTY_NO_MINOR)
-                minor = 0;
-        number = ATEN2011_port->port->number - minor;
-
-        dbg("%s - port = %d, baud = %d", __func__,
-            ATEN2011_port->port->number, baudRate);
-        /* reset clk_uart_sel in spregOffset */
-        if (baudRate > 115200) {
-#ifdef HW_flow_control
-                /*
-                 * NOTE: need to see the pther register to modify
-                 * setting h/w flow control bit to 1;
-                 */
-                /* Data = ATEN2011_port->shadowMCR; */
-                Data = 0x2b;
-                ATEN2011_port->shadowMCR = Data;
-                status = set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-                if (status < 0) {
-                        dbg("Writing spreg failed in set_serial_baud");
-                        return -1;
-                }
-#endif
-
-        } else {
-#ifdef HW_flow_control
-                /* setting h/w flow control bit to 0; */
-                /* Data = ATEN2011_port->shadowMCR; */
-                Data = 0xb;
-                ATEN2011_port->shadowMCR = Data;
-                status = set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-                if (status < 0) {
-                        dbg("Writing spreg failed in set_serial_baud");
-                        return -1;
-                }
-#endif
-
-        }
-
-        if (1)                  /* baudRate <= 115200) */ {
-                clk_sel_val = 0x0;
-                Data = 0x0;
-                status =
-                    ATEN2011_calc_baud_rate_divisor(baudRate, &divisor,
-                                                    &clk_sel_val);
-                status = get_reg_sync(port, ATEN2011_port->SpRegOffset, &Data);
-                if (status < 0) {
-                        dbg("reading spreg failed in set_serial_baud");
-                        return -1;
-                }
-                Data = (Data & 0x8f) | clk_sel_val;
-                status = set_reg_sync(port, ATEN2011_port->SpRegOffset, Data);
-                if (status < 0) {
-                        dbg("Writing spreg failed in set_serial_baud");
-                        return -1;
-                }
-                /* Calculate the Divisor */
-
-                if (status) {
-                        err("%s - bad baud rate", __func__);
-                        dbg("%s", "bad baud rate");
-                        return status;
-                }
-                /* Enable access to divisor latch */
-                Data = ATEN2011_port->shadowLCR | SERIAL_LCR_DLAB;
-                ATEN2011_port->shadowLCR = Data;
-                set_uart_reg(port, LINE_CONTROL_REGISTER, Data);
-
-                /* Write the divisor */
-                Data = (unsigned char)(divisor & 0xff);
-                dbg("set_serial_baud Value to write DLL is %x", Data);
-                set_uart_reg(port, DIVISOR_LATCH_LSB, Data);
-
-                Data = (unsigned char)((divisor & 0xff00) >> 8);
-                dbg("set_serial_baud Value to write DLM is %x", Data);
-                set_uart_reg(port, DIVISOR_LATCH_MSB, Data);
-
-                /* Disable access to divisor latch */
-                Data = ATEN2011_port->shadowLCR & ~SERIAL_LCR_DLAB;
-                ATEN2011_port->shadowLCR = Data;
-                set_uart_reg(port, LINE_CONTROL_REGISTER, Data);
-
-        }
-
-        return status;
-}
-
-static void ATEN2011_change_port_settings(struct tty_struct *tty,
-                                          struct ATENINTL_port *ATEN2011_port,
-                                          struct ktermios *old_termios)
-{
-        int baud;
-        unsigned cflag;
-        unsigned iflag;
-        __u8 lData;
-        __u8 lParity;
-        __u8 lStop;
-        int status;
-        __u16 Data;
-        struct usb_serial_port *port;
-        struct usb_serial *serial;
-
-        if (ATEN2011_port == NULL)
-                return;
-
-        port = (struct usb_serial_port *)ATEN2011_port->port;
-
-        serial = port->serial;
-
-        dbg("%s - port %d", __func__, ATEN2011_port->port->number);
-
-        if (!ATEN2011_port->open) {
-                dbg("%s - port not opened", __func__);
-                return;
-        }
-
-        if ((!tty) || (!tty->termios)) {
-                dbg("%s - no tty structures", __func__);
-                return;
-        }
-
-        dbg("%s", "Entering .......... ");
-
-        lData = LCR_BITS_8;
-        lStop = LCR_STOP_1;
-        lParity = LCR_PAR_NONE;
-
-        cflag = tty->termios->c_cflag;
-        iflag = tty->termios->c_iflag;
-
-        /* Change the number of bits */
-
-        /* COMMENT1: the below Line"if(cflag & CSIZE)" is added for the errors we get for serial loop data test i.e serial_loopback.pl -v */
-        /* if(cflag & CSIZE) */
-        {
-                switch (cflag & CSIZE) {
-                case CS5:
-                        lData = LCR_BITS_5;
-                        break;
-
-                case CS6:
-                        lData = LCR_BITS_6;
-                        break;
-
-                case CS7:
-                        lData = LCR_BITS_7;
-                        break;
-                default:
-                case CS8:
-                        lData = LCR_BITS_8;
-                        break;
-                }
-        }
-        /* Change the Parity bit */
-        if (cflag & PARENB) {
-                if (cflag & PARODD) {
-                        lParity = LCR_PAR_ODD;
-                        dbg("%s - parity = odd", __func__);
-                } else {
-                        lParity = LCR_PAR_EVEN;
-                        dbg("%s - parity = even", __func__);
-                }
-
-        } else {
-                dbg("%s - parity = none", __func__);
-        }
-
-        if (cflag & CMSPAR)
-                lParity = lParity | 0x20;
-
-        /* Change the Stop bit */
-        if (cflag & CSTOPB) {
-                lStop = LCR_STOP_2;
-                dbg("%s - stop bits = 2", __func__);
-        } else {
-                lStop = LCR_STOP_1;
-                dbg("%s - stop bits = 1", __func__);
-        }
-
-        /* Update the LCR with the correct value */
-        ATEN2011_port->shadowLCR &=
-            ~(LCR_BITS_MASK | LCR_STOP_MASK | LCR_PAR_MASK);
-        ATEN2011_port->shadowLCR |= (lData | lParity | lStop);
-
-        dbg
-            ("ATEN2011_change_port_settings ATEN2011_port->shadowLCR is %x",
-             ATEN2011_port->shadowLCR);
-        /* Disable Interrupts */
-        Data = 0x00;
-        set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
-
-        Data = 0x00;
-        set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
-
-        Data = 0xcf;
-        set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
-
-        /* Send the updated LCR value to the ATEN2011 */
-        Data = ATEN2011_port->shadowLCR;
-
-        set_uart_reg(port, LINE_CONTROL_REGISTER, Data);
-
-        Data = 0x00b;
-        ATEN2011_port->shadowMCR = Data;
-        set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-        Data = 0x00b;
-        set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-
-        /* set up the MCR register and send it to the ATEN2011 */
-
-        ATEN2011_port->shadowMCR = MCR_MASTER_IE;
-        if (cflag & CBAUD)
-                ATEN2011_port->shadowMCR |= (MCR_DTR | MCR_RTS);
-
-        if (cflag & CRTSCTS)
-                ATEN2011_port->shadowMCR |= (MCR_XON_ANY);
-        else
-                ATEN2011_port->shadowMCR &= ~(MCR_XON_ANY);
-
-        Data = ATEN2011_port->shadowMCR;
-        set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-
-        /* Determine divisor based on baud rate */
-        baud = tty_get_baud_rate(tty);
-
-        if (!baud) {
-                /* pick a default, any default... */
-                dbg("%s", "Picked default baud...");
-                baud = 9600;
-        }
-
-        dbg("%s - baud rate = %d", __func__, baud);
-        status = ATEN2011_send_cmd_write_baud_rate(ATEN2011_port, baud);
-
-        /* Enable Interrupts */
-        Data = 0x0c;
-        set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
-
-        if (ATEN2011_port->read_urb->status != -EINPROGRESS) {
-                ATEN2011_port->read_urb->dev = serial->dev;
-
-                status = usb_submit_urb(ATEN2011_port->read_urb, GFP_ATOMIC);
-
-                if (status) {
-                        dbg
-                            (" usb_submit_urb(read bulk) failed, status = %d",
-                             status);
-                }
-        }
-        dbg
-            ("ATEN2011_change_port_settings ATEN2011_port->shadowLCR is End %x",
-             ATEN2011_port->shadowLCR);
-
-        return;
-}
-
-static int ATEN2011_calc_num_ports(struct usb_serial *serial)
-{
-
-        __u16 Data = 0x00;
-        int ret = 0;
-        int ATEN2011_2or4ports;
-        ret = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
-                              ATEN_RDREQ, ATEN_RD_RTYPE, 0, GPIO_REGISTER,
-                              &Data, VENDOR_READ_LENGTH, ATEN_WDR_TIMEOUT);
-
-/* ghostgum: here is where the problem appears to bet */
-/* Which of the following are needed? */
-/* Greg used the serial->type->num_ports=2 */
-/* But the code in the ATEN2011_open relies on serial->num_ports=2 */
-        if ((Data & 0x01) == 0) {
-                ATEN2011_2or4ports = 2;
-                serial->type->num_ports = 2;
-                serial->num_ports = 2;
-        }
-        /* else if(serial->interface->cur_altsetting->desc.bNumEndpoints == 9) */
-        else {
-                ATEN2011_2or4ports = 4;
-                serial->type->num_ports = 4;
-                serial->num_ports = 4;
-
-        }
-
-        return ATEN2011_2or4ports;
-}
-
-static int ATEN2011_startup(struct usb_serial *serial)
-{
-        struct ATENINTL_serial *ATEN2011_serial;
-        struct ATENINTL_port *ATEN2011_port;
-        struct usb_device *dev;
-        int i, status;
-        int minor;
-
-        __u16 Data;
-        dbg("%s", " ATEN2011_startup :entering..........");
-
-        if (!serial) {
-                dbg("%s", "Invalid Handler");
-                return -1;
-        }
-
-        dev = serial->dev;
-
-        dbg("%s", "Entering...");
-
-        /* create our private serial structure */
-        ATEN2011_serial = kzalloc(sizeof(struct ATENINTL_serial), GFP_KERNEL);
-        if (ATEN2011_serial == NULL) {
-                err("%s - Out of memory", __func__);
-                return -ENOMEM;
-        }
-
-        /* resetting the private structure field values to zero */
-        memset(ATEN2011_serial, 0, sizeof(struct ATENINTL_serial));
-
-        ATEN2011_serial->serial = serial;
-        /* initilize status polling flag to 0 */
-        ATEN2011_serial->status_polling_started = 0;
-
-        usb_set_serial_data(serial, ATEN2011_serial);
-        ATEN2011_serial->ATEN2011_spectrum_2or4ports =
-            ATEN2011_calc_num_ports(serial);
-        /* we set up the pointers to the endpoints in the ATEN2011_open *
-         * function, as the structures aren't created yet.             */
-
-        /* set up port private structures */
-        for (i = 0; i < serial->num_ports; ++i) {
-                ATEN2011_port =
-                    kmalloc(sizeof(struct ATENINTL_port), GFP_KERNEL);
-                if (ATEN2011_port == NULL) {
-                        err("%s - Out of memory", __func__);
-                        usb_set_serial_data(serial, NULL);
-                        kfree(ATEN2011_serial);
-                        return -ENOMEM;
-                }
-                memset(ATEN2011_port, 0, sizeof(struct ATENINTL_port));
-
-                /*
-                 * Initialize all port interrupt end point to port 0
-                 * int endpoint. Our device has only one interrupt end point
-                 * comman to all port
-                 */
-                /* serial->port[i]->interrupt_in_endpointAddress = serial->port[0]->interrupt_in_endpointAddress; */
-
-                ATEN2011_port->port = serial->port[i];
-                usb_set_serial_port_data(serial->port[i], ATEN2011_port);
-
-                minor = serial->port[i]->serial->minor;
-                if (minor == SERIAL_TTY_NO_MINOR)
-                        minor = 0;
-                ATEN2011_port->port_num =
-                    ((serial->port[i]->number - minor) + 1);
-
-                if (ATEN2011_port->port_num == 1) {
-                        ATEN2011_port->SpRegOffset = 0x0;
-                        ATEN2011_port->ControlRegOffset = 0x1;
-                        ATEN2011_port->DcrRegOffset = 0x4;
-                } else if ((ATEN2011_port->port_num == 2)
-                           && (ATEN2011_serial->ATEN2011_spectrum_2or4ports ==
-                               4)) {
-                        ATEN2011_port->SpRegOffset = 0x8;
-                        ATEN2011_port->ControlRegOffset = 0x9;
-                        ATEN2011_port->DcrRegOffset = 0x16;
-                } else if ((ATEN2011_port->port_num == 2)
-                           && (ATEN2011_serial->ATEN2011_spectrum_2or4ports ==
-                               2)) {
-                        ATEN2011_port->SpRegOffset = 0xa;
-                        ATEN2011_port->ControlRegOffset = 0xb;
-                        ATEN2011_port->DcrRegOffset = 0x19;
-                } else if ((ATEN2011_port->port_num == 3)
-                           && (ATEN2011_serial->ATEN2011_spectrum_2or4ports ==
-                               4)) {
-                        ATEN2011_port->SpRegOffset = 0xa;
-                        ATEN2011_port->ControlRegOffset = 0xb;
-                        ATEN2011_port->DcrRegOffset = 0x19;
-                } else if ((ATEN2011_port->port_num == 4)
-                           && (ATEN2011_serial->ATEN2011_spectrum_2or4ports ==
-                               4)) {
-                        ATEN2011_port->SpRegOffset = 0xc;
-                        ATEN2011_port->ControlRegOffset = 0xd;
-                        ATEN2011_port->DcrRegOffset = 0x1c;
-                }
-
-                usb_set_serial_port_data(serial->port[i], ATEN2011_port);
-
-                /* enable rx_disable bit in control register */
-
-                status = get_reg_sync(serial->port[i],
-                                      ATEN2011_port->ControlRegOffset, &Data);
-                if (status < 0) {
-                        dbg("Reading ControlReg failed status-0x%x",
-                                status);
-                        break;
-                } else
-                        dbg
-                            ("ControlReg Reading success val is %x, status%d",
-                             Data, status);
-                Data |= 0x08;   /* setting driver done bit */
-                Data |= 0x04;   /* sp1_bit to have cts change reflect in modem status reg */
-
-                /* Data |= 0x20; */     /* rx_disable bit */
-                status = set_reg_sync(serial->port[i],
-                                      ATEN2011_port->ControlRegOffset, Data);
-                if (status < 0) {
-                        dbg
-                            ("Writing ControlReg failed(rx_disable) status-0x%x",
-                             status);
-                        break;
-                } else
-                        dbg
-                            ("ControlReg Writing success(rx_disable) status%d",
-                             status);
-
-                /*
-                 * Write default values in DCR (i.e 0x01 in DCR0, 0x05 in DCR2
-                 * and 0x24 in DCR3
-                 */
-                Data = 0x01;
-                status = set_reg_sync(serial->port[i],
-                                      (__u16)(ATEN2011_port->DcrRegOffset + 0),
-                                      Data);
-                if (status < 0) {
-                        dbg("Writing DCR0 failed status-0x%x", status);
-                        break;
-                } else
-                        dbg("DCR0 Writing success status%d", status);
-
-                Data = 0x05;
-                status = set_reg_sync(serial->port[i],
-                                      (__u16)(ATEN2011_port->DcrRegOffset + 1),
-                                      Data);
-                if (status < 0) {
-                        dbg("Writing DCR1 failed status-0x%x", status);
-                        break;
-                } else
-                        dbg("DCR1 Writing success status%d", status);
-
-                Data = 0x24;
-                status = set_reg_sync(serial->port[i],
-                                      (__u16)(ATEN2011_port->DcrRegOffset + 2),
-                                      Data);
-                if (status < 0) {
-                        dbg("Writing DCR2 failed status-0x%x", status);
-                        break;
-                } else
-                        dbg("DCR2 Writing success status%d", status);
-
-                /* write values in clkstart0x0 and clkmulti 0x20 */
-                Data = 0x0;
-                status = set_reg_sync(serial->port[i], CLK_START_VALUE_REGISTER,
-                                      Data);
-                if (status < 0) {
-                        dbg
-                            ("Writing CLK_START_VALUE_REGISTER failed status-0x%x",
-                             status);
-                        break;
-                } else
-                        dbg
-                            ("CLK_START_VALUE_REGISTER Writing success status%d",
-                             status);
-
-                Data = 0x20;
-                status = set_reg_sync(serial->port[i], CLK_MULTI_REGISTER,
-                                      Data);
-                if (status < 0) {
-                        dbg
-                            ("Writing CLK_MULTI_REGISTER failed status-0x%x",
-                             status);
-                        break;
-                } else
-                        dbg("CLK_MULTI_REGISTER Writing success status%d",
-                                status);
-
-                /* Zero Length flag register */
-                if ((ATEN2011_port->port_num != 1)
-                    && (ATEN2011_serial->ATEN2011_spectrum_2or4ports == 2)) {
-
-                        Data = 0xff;
-                        status = set_reg_sync(serial->port[i],
-                                              (__u16)(ZLP_REG1 + ((__u16)ATEN2011_port->port_num)),
-                                              Data);
-                        dbg("ZLIP offset%x",
-                                (__u16) (ZLP_REG1 +
-                                         ((__u16) ATEN2011_port->port_num)));
-                        if (status < 0) {
-                                dbg
-                                    ("Writing ZLP_REG%d failed status-0x%x",
-                                     i + 2, status);
-                                break;
-                        } else
-                                dbg("ZLP_REG%d Writing success status%d",
-                                        i + 2, status);
-                } else {
-                        Data = 0xff;
-                        status = set_reg_sync(serial->port[i],
-                                              (__u16)(ZLP_REG1 + ((__u16)ATEN2011_port->port_num) - 0x1),
-                                              Data);
-                        dbg("ZLIP offset%x",
-                                (__u16) (ZLP_REG1 +
-                                         ((__u16) ATEN2011_port->port_num) -
-                                         0x1));
-                        if (status < 0) {
-                                dbg
-                                    ("Writing ZLP_REG%d failed status-0x%x",
-                                     i + 1, status);
-                                break;
-                        } else
-                                dbg("ZLP_REG%d Writing success status%d",
-                                        i + 1, status);
-
-                }
-                ATEN2011_port->control_urb = usb_alloc_urb(0, GFP_ATOMIC);
-                ATEN2011_port->ctrl_buf = kmalloc(16, GFP_KERNEL);
-
-        }
-
-        /* Zero Length flag enable */
-        Data = 0x0f;
-        status = set_reg_sync(serial->port[0], ZLP_REG5, Data);
-        if (status < 0) {
-                dbg("Writing ZLP_REG5 failed status-0x%x", status);
-                return -1;
-        } else
-                dbg("ZLP_REG5 Writing success status%d", status);
-
-        /* setting configuration feature to one */
-        usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
-                        (__u8) 0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5 * HZ);
-        return 0;
-}
-
-static void ATEN2011_release(struct usb_serial *serial)
-{
-        int i;
-        struct ATENINTL_port *ATEN2011_port;
-
-        /* check for the ports to be closed,close the ports and disconnect */
-
-        /* free private structure allocated for serial port  *
-         * stop reads and writes on all ports                */
-
-        for (i = 0; i < serial->num_ports; ++i) {
-                ATEN2011_port = usb_get_serial_port_data(serial->port[i]);
-                kfree(ATEN2011_port->ctrl_buf);
-                usb_kill_urb(ATEN2011_port->control_urb);
-                kfree(ATEN2011_port);
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
-
-        /* free private structure allocated for serial device */
-
-        kfree(usb_get_serial_data(serial));
-        usb_set_serial_data(serial, NULL);
-}
-
-static struct usb_serial_driver aten_serial_driver = {
-        .driver = {
-                .owner =        THIS_MODULE,
-                .name =         "aten2011",
-                },
-        .description =          DRIVER_DESC,
-        .id_table =             id_table,
-        .open =                 ATEN2011_open,
-        .close =                ATEN2011_close,
-        .write =                ATEN2011_write,
-        .write_room =           ATEN2011_write_room,
-        .chars_in_buffer =      ATEN2011_chars_in_buffer,
-        .throttle =             ATEN2011_throttle,
-        .unthrottle =           ATEN2011_unthrottle,
-        .calc_num_ports =       ATEN2011_calc_num_ports,
-
-        .ioctl =                ATEN2011_ioctl,
-        .set_termios =          ATEN2011_set_termios,
-        .break_ctl =            ATEN2011_break,
-        .tiocmget =             ATEN2011_tiocmget,
-        .tiocmset =             ATEN2011_tiocmset,
-        .attach =               ATEN2011_startup,
-        .release =              ATEN2011_release,
-        .read_bulk_callback =   ATEN2011_bulk_in_callback,
-        .read_int_callback =    ATEN2011_interrupt_callback,
-};
-
-static struct usb_driver aten_driver = {
-        .name =         "aten2011",
-        .probe =        usb_serial_probe,
-        .disconnect =   usb_serial_disconnect,
-        .id_table =     id_table,
-};
-
-static int __init aten_init(void)
-{
-        int retval;
-
-        /* Register with the usb serial */
-        retval = usb_serial_register(&aten_serial_driver);
-        if (retval)
-                return retval;
-
-        printk(KERN_INFO KBUILD_MODNAME ":"
-               DRIVER_DESC " " DRIVER_VERSION "\n");
-
-        /* Register with the usb */
-        retval = usb_register(&aten_driver);
-        if (retval)
-                usb_serial_deregister(&aten_serial_driver);
-
-        return retval;
-}
-
-static void __exit aten_exit(void)
-{
-        usb_deregister(&aten_driver);
-        usb_serial_deregister(&aten_serial_driver);
-}
-
-module_init(aten_init);
-module_exit(aten_exit);
-
-/* Module information */
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_LICENSE("GPL");
-
-MODULE_PARM_DESC(debug, "Debug enabled or not");
diff --git a/drivers/staging/udlfb/udlfb.c b/drivers/staging/udlfb/udlfb.c
index 0ab9d15f3439..f5416af1e902 100644
--- a/drivers/staging/udlfb/udlfb.c
+++ b/drivers/staging/udlfb/udlfb.c
@@ -21,6 +21,7 @@
 #include <linux/mm.h>
 #include <linux/fb.h>
 #include <linux/mutex.h>
+#include <linux/vmalloc.h>
 
 #include "udlfb.h"
 
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 24dfb33f90cb..a16c538d0132 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -80,38 +80,18 @@ static int usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
         int max_tx;
         int i;
 
-        /* Allocate space for the SS endpoint companion descriptor */
-        ep->ss_ep_comp = kzalloc(sizeof(struct usb_host_ss_ep_comp),
-                        GFP_KERNEL);
-        if (!ep->ss_ep_comp)
-                return -ENOMEM;
         desc = (struct usb_ss_ep_comp_descriptor *) buffer;
         if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP) {
                 dev_warn(ddev, "No SuperSpeed endpoint companion for config %d "
                                 " interface %d altsetting %d ep %d: "
                                 "using minimum values\n",
                                 cfgno, inum, asnum, ep->desc.bEndpointAddress);
-                ep->ss_ep_comp->desc.bLength = USB_DT_SS_EP_COMP_SIZE;
-                ep->ss_ep_comp->desc.bDescriptorType = USB_DT_SS_ENDPOINT_COMP;
-                ep->ss_ep_comp->desc.bMaxBurst = 0;
-                /*
-                 * Leave bmAttributes as zero, which will mean no streams for
-                 * bulk, and isoc won't support multiple bursts of packets.
-                 * With bursts of only one packet, and a Mult of 1, the max
-                 * amount of data moved per endpoint service interval is one
-                 * packet.
-                 */
-                if (usb_endpoint_xfer_isoc(&ep->desc) ||
-                                usb_endpoint_xfer_int(&ep->desc))
-                        ep->ss_ep_comp->desc.wBytesPerInterval =
-                                ep->desc.wMaxPacketSize;
                 /*
                  * The next descriptor is for an Endpoint or Interface,
                  * no extra descriptors to copy into the companion structure,
                  * and we didn't eat up any of the buffer.
                  */
-                retval = 0;
-                goto valid;
+                return 0;
         }
         memcpy(&ep->ss_ep_comp->desc, desc, USB_DT_SS_EP_COMP_SIZE);
         desc = &ep->ss_ep_comp->desc;
@@ -320,6 +300,28 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 buffer += i;
                 size -= i;
 
+                /* Allocate space for the SS endpoint companion descriptor */
+                endpoint->ss_ep_comp = kzalloc(sizeof(struct usb_host_ss_ep_comp),
+                                GFP_KERNEL);
+                if (!endpoint->ss_ep_comp)
+                        return -ENOMEM;
+
+                /* Fill in some default values (may be overwritten later) */
+                endpoint->ss_ep_comp->desc.bLength = USB_DT_SS_EP_COMP_SIZE;
+                endpoint->ss_ep_comp->desc.bDescriptorType = USB_DT_SS_ENDPOINT_COMP;
+                endpoint->ss_ep_comp->desc.bMaxBurst = 0;
+                /*
+                 * Leave bmAttributes as zero, which will mean no streams for
+                 * bulk, and isoc won't support multiple bursts of packets.
+                 * With bursts of only one packet, and a Mult of 1, the max
+                 * amount of data moved per endpoint service interval is one
+                 * packet.
+                 */
+                if (usb_endpoint_xfer_isoc(&endpoint->desc) ||
+                                usb_endpoint_xfer_int(&endpoint->desc))
+                        endpoint->ss_ep_comp->desc.wBytesPerInterval =
+                                endpoint->desc.wMaxPacketSize;
+
                 if (size > 0) {
                         retval = usb_parse_ss_endpoint_companion(ddev, cfgno,
                                         inum, asnum, endpoint, num_ep, buffer,
@@ -329,6 +331,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                                 retval = buffer - buffer0;
                         }
                 } else {
+                        dev_warn(ddev, "config %d interface %d altsetting %d "
+                                "endpoint 0x%X has no "
+                                "SuperSpeed companion descriptor\n",
+                                cfgno, inum, asnum, d->bEndpointAddress);
                         retval = buffer - buffer0;
                 }
         } else {
diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
index dc2ac613a9d1..1d283e1b2b8d 100644
--- a/drivers/usb/host/ehci-orion.c
+++ b/drivers/usb/host/ehci-orion.c
@@ -105,6 +105,7 @@ static int ehci_orion_setup(struct usb_hcd *hcd)
         struct ehci_hcd *ehci = hcd_to_ehci(hcd);
         int retval;
 
+        ehci_reset(ehci);
         retval = ehci_halt(ehci);
         if (retval)
                 return retval;
@@ -118,7 +119,6 @@ static int ehci_orion_setup(struct usb_hcd *hcd)
 
         hcd->has_tt = 1;
 
-        ehci_reset(ehci);
         ehci_port_power(ehci, 0);
 
         return retval;
diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
index f3aaba35e912..83cbecd2a1ed 100644
--- a/drivers/usb/host/ohci-omap.c
+++ b/drivers/usb/host/ohci-omap.c
@@ -282,6 +282,7 @@ static int ohci_omap_init(struct usb_hcd *hcd)
 static void ohci_omap_stop(struct usb_hcd *hcd)
 {
         dev_dbg(hcd->self.controller, "stopping USB Controller\n");
+        ohci_stop(hcd);
         omap_ohci_clock_power(0);
 }
 
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index 2501c571f855..705e34324156 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -173,6 +173,7 @@ void xhci_print_ir_set(struct xhci_hcd *xhci, struct xhci_intr_reg *ir_set, int
 {
         void *addr;
         u32 temp;
+        u64 temp_64;
 
         addr = &ir_set->irq_pending;
         temp = xhci_readl(xhci, addr);
@@ -200,25 +201,15 @@ void xhci_print_ir_set(struct xhci_hcd *xhci, struct xhci_intr_reg *ir_set, int
                 xhci_dbg(xhci, "  WARN: %p: ir_set.rsvd = 0x%x\n",
                                 addr, (unsigned int)temp);
 
-        addr = &ir_set->erst_base[0];
-        temp = xhci_readl(xhci, addr);
-        xhci_dbg(xhci, "  %p: ir_set.erst_base[0] = 0x%x\n",
-                        addr, (unsigned int) temp);
-
-        addr = &ir_set->erst_base[1];
-        temp = xhci_readl(xhci, addr);
-        xhci_dbg(xhci, "  %p: ir_set.erst_base[1] = 0x%x\n",
-                        addr, (unsigned int) temp);
+        addr = &ir_set->erst_base;
+        temp_64 = xhci_read_64(xhci, addr);
+        xhci_dbg(xhci, "  %p: ir_set.erst_base = @%08llx\n",
+                        addr, temp_64);
 
-        addr = &ir_set->erst_dequeue[0];
-        temp = xhci_readl(xhci, addr);
-        xhci_dbg(xhci, "  %p: ir_set.erst_dequeue[0] = 0x%x\n",
-                        addr, (unsigned int) temp);
-
-        addr = &ir_set->erst_dequeue[1];
-        temp = xhci_readl(xhci, addr);
-        xhci_dbg(xhci, "  %p: ir_set.erst_dequeue[1] = 0x%x\n",
-                        addr, (unsigned int) temp);
+        addr = &ir_set->erst_dequeue;
+        temp_64 = xhci_read_64(xhci, addr);
+        xhci_dbg(xhci, "  %p: ir_set.erst_dequeue = @%08llx\n",
+                        addr, temp_64);
 }
 
 void xhci_print_run_regs(struct xhci_hcd *xhci)
@@ -268,8 +259,7 @@ void xhci_debug_trb(struct xhci_hcd *xhci, union xhci_trb *trb)
                 xhci_dbg(xhci, "Link TRB:\n");
                 xhci_print_trb_offsets(xhci, trb);
 
-                address = trb->link.segment_ptr[0] +
-                        (((u64) trb->link.segment_ptr[1]) << 32);
+                address = trb->link.segment_ptr;
                 xhci_dbg(xhci, "Next ring segment DMA address = 0x%llx\n", address);
 
                 xhci_dbg(xhci, "Interrupter target = 0x%x\n",
@@ -282,8 +272,7 @@ void xhci_debug_trb(struct xhci_hcd *xhci, union xhci_trb *trb)
                                 (unsigned int) (trb->link.control & TRB_NO_SNOOP));
                 break;
         case TRB_TYPE(TRB_TRANSFER):
-                address = trb->trans_event.buffer[0] +
-                        (((u64) trb->trans_event.buffer[1]) << 32);
+                address = trb->trans_event.buffer;
                 /*
                  * FIXME: look at flags to figure out if it's an address or if
                  * the data is directly in the buffer field.
@@ -291,8 +280,7 @@ void xhci_debug_trb(struct xhci_hcd *xhci, union xhci_trb *trb)
                 xhci_dbg(xhci, "DMA address or buffer contents= %llu\n", address);
                 break;
         case TRB_TYPE(TRB_COMPLETION):
-                address = trb->event_cmd.cmd_trb[0] +
-                        (((u64) trb->event_cmd.cmd_trb[1]) << 32);
+                address = trb->event_cmd.cmd_trb;
                 xhci_dbg(xhci, "Command TRB pointer = %llu\n", address);
                 xhci_dbg(xhci, "Completion status = %u\n",
                                 (unsigned int) GET_COMP_CODE(trb->event_cmd.status));
@@ -328,8 +316,8 @@ void xhci_debug_segment(struct xhci_hcd *xhci, struct xhci_segment *seg)
         for (i = 0; i < TRBS_PER_SEGMENT; ++i) {
                 trb = &seg->trbs[i];
                 xhci_dbg(xhci, "@%08x %08x %08x %08x %08x\n", addr,
-                                (unsigned int) trb->link.segment_ptr[0],
-                                (unsigned int) trb->link.segment_ptr[1],
+                                lower_32_bits(trb->link.segment_ptr),
+                                upper_32_bits(trb->link.segment_ptr),
                                 (unsigned int) trb->link.intr_target,
                                 (unsigned int) trb->link.control);
                 addr += sizeof(*trb);
@@ -386,8 +374,8 @@ void xhci_dbg_erst(struct xhci_hcd *xhci, struct xhci_erst *erst)
                 entry = &erst->entries[i];
                 xhci_dbg(xhci, "@%08x %08x %08x %08x %08x\n",
                                 (unsigned int) addr,
-                                (unsigned int) entry->seg_addr[0],
-                                (unsigned int) entry->seg_addr[1],
+                                lower_32_bits(entry->seg_addr),
+                                upper_32_bits(entry->seg_addr),
                                 (unsigned int) entry->seg_size,
                                 (unsigned int) entry->rsvd);
                 addr += sizeof(*entry);
@@ -396,90 +384,147 @@ void xhci_dbg_erst(struct xhci_hcd *xhci, struct xhci_erst *erst)
 
 void xhci_dbg_cmd_ptrs(struct xhci_hcd *xhci)
 {
-        u32 val;
+        u64 val;
 
-        val = xhci_readl(xhci, &xhci->op_regs->cmd_ring[0]);
-        xhci_dbg(xhci, "// xHC command ring deq ptr low bits + flags = 0x%x\n", val);
-        val = xhci_readl(xhci, &xhci->op_regs->cmd_ring[1]);
-        xhci_dbg(xhci, "// xHC command ring deq ptr high bits = 0x%x\n", val);
+        val = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
+        xhci_dbg(xhci, "// xHC command ring deq ptr low bits + flags = @%08x\n",
+                        lower_32_bits(val));
+        xhci_dbg(xhci, "// xHC command ring deq ptr high bits = @%08x\n",
+                        upper_32_bits(val));
 }
 
-void xhci_dbg_ctx(struct xhci_hcd *xhci, struct xhci_device_control *ctx, dma_addr_t dma, unsigned int last_ep)
+/* Print the last 32 bytes for 64-byte contexts */
+static void dbg_rsvd64(struct xhci_hcd *xhci, u64 *ctx, dma_addr_t dma)
+{
+        int i;
+        for (i = 0; i < 4; ++i) {
+                xhci_dbg(xhci, "@%p (virt) @%08llx "
+                         "(dma) %#08llx - rsvd64[%d]\n",
+                         &ctx[4 + i], (unsigned long long)dma,
+                         ctx[4 + i], i);
+                dma += 8;
+        }
+}
+
+void xhci_dbg_slot_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx)
 {
-        int i, j;
-        int last_ep_ctx = 31;
         /* Fields are 32 bits wide, DMA addresses are in bytes */
         int field_size = 32 / 8;
+        int i;
 
-        xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - drop flags\n",
-                        &ctx->drop_flags, (unsigned long long)dma,
-                        ctx->drop_flags);
-        dma += field_size;
-        xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - add flags\n",
-                        &ctx->add_flags, (unsigned long long)dma,
-                        ctx->add_flags);
-        dma += field_size;
-        for (i = 0; i > 6; ++i) {
-                xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - rsvd[%d]\n",
-                                &ctx->rsvd[i], (unsigned long long)dma,
-                                ctx->rsvd[i], i);
-                dma += field_size;
-        }
+        struct xhci_slot_ctx *slot_ctx = xhci_get_slot_ctx(xhci, ctx);
+        dma_addr_t dma = ctx->dma + ((unsigned long)slot_ctx - (unsigned long)ctx);
+        int csz = HCC_64BYTE_CONTEXT(xhci->hcc_params);
 
         xhci_dbg(xhci, "Slot Context:\n");
         xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - dev_info\n",
-                        &ctx->slot.dev_info,
-                        (unsigned long long)dma, ctx->slot.dev_info);
+                        &slot_ctx->dev_info,
+                        (unsigned long long)dma, slot_ctx->dev_info);
         dma += field_size;
         xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - dev_info2\n",
-                        &ctx->slot.dev_info2,
-                        (unsigned long long)dma, ctx->slot.dev_info2);
+                        &slot_ctx->dev_info2,
+                        (unsigned long long)dma, slot_ctx->dev_info2);
         dma += field_size;
         xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - tt_info\n",
-                        &ctx->slot.tt_info,
-                        (unsigned long long)dma, ctx->slot.tt_info);
+                        &slot_ctx->tt_info,
+                        (unsigned long long)dma, slot_ctx->tt_info);
         dma += field_size;
         xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - dev_state\n",
-                        &ctx->slot.dev_state,
-                        (unsigned long long)dma, ctx->slot.dev_state);
+                        &slot_ctx->dev_state,
+                        (unsigned long long)dma, slot_ctx->dev_state);
         dma += field_size;
-        for (i = 0; i > 4; ++i) {
+        for (i = 0; i < 4; ++i) {
                 xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - rsvd[%d]\n",
-                                &ctx->slot.reserved[i], (unsigned long long)dma,
-                                ctx->slot.reserved[i], i);
+                                &slot_ctx->reserved[i], (unsigned long long)dma,
+                                slot_ctx->reserved[i], i);
                 dma += field_size;
         }
 
+        if (csz)
+                dbg_rsvd64(xhci, (u64 *)slot_ctx, dma);
+}
+
+void xhci_dbg_ep_ctx(struct xhci_hcd *xhci,
+                     struct xhci_container_ctx *ctx,
+                     unsigned int last_ep)
+{
+        int i, j;
+        int last_ep_ctx = 31;
+        /* Fields are 32 bits wide, DMA addresses are in bytes */
+        int field_size = 32 / 8;
+        int csz = HCC_64BYTE_CONTEXT(xhci->hcc_params);
+
         if (last_ep < 31)
                 last_ep_ctx = last_ep + 1;
         for (i = 0; i < last_ep_ctx; ++i) {
+                struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci, ctx, i);
+                dma_addr_t dma = ctx->dma +
+                        ((unsigned long)ep_ctx - (unsigned long)ctx);
+
                 xhci_dbg(xhci, "Endpoint %02d Context:\n", i);
                 xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - ep_info\n",
-                                &ctx->ep[i].ep_info,
-                                (unsigned long long)dma, ctx->ep[i].ep_info);
+                                &ep_ctx->ep_info,
+                                (unsigned long long)dma, ep_ctx->ep_info);
                 dma += field_size;
                 xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - ep_info2\n",
-                                &ctx->ep[i].ep_info2,
-                                (unsigned long long)dma, ctx->ep[i].ep_info2);
-                dma += field_size;
-                xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - deq[0]\n",
-                                &ctx->ep[i].deq[0],
-                                (unsigned long long)dma, ctx->ep[i].deq[0]);
-                dma += field_size;
-                xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - deq[1]\n",
-                                &ctx->ep[i].deq[1],
-                                (unsigned long long)dma, ctx->ep[i].deq[1]);
+                                &ep_ctx->ep_info2,
+                                (unsigned long long)dma, ep_ctx->ep_info2);
                 dma += field_size;
+                xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08llx - deq\n",
+                                &ep_ctx->deq,
+                                (unsigned long long)dma, ep_ctx->deq);
+                dma += 2*field_size;
                 xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - tx_info\n",
-                                &ctx->ep[i].tx_info,
-                                (unsigned long long)dma, ctx->ep[i].tx_info);
+                                &ep_ctx->tx_info,
+                                (unsigned long long)dma, ep_ctx->tx_info);
                 dma += field_size;
                 for (j = 0; j < 3; ++j) {
                         xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - rsvd[%d]\n",
-                                        &ctx->ep[i].reserved[j],
+                                        &ep_ctx->reserved[j],
                                         (unsigned long long)dma,
-                                        ctx->ep[i].reserved[j], j);
+                                        ep_ctx->reserved[j], j);
+                        dma += field_size;
+                }
+
+                if (csz)
+                        dbg_rsvd64(xhci, (u64 *)ep_ctx, dma);
+        }
+}
+
+void xhci_dbg_ctx(struct xhci_hcd *xhci,
+                  struct xhci_container_ctx *ctx,
+                  unsigned int last_ep)
+{
+        int i;
+        /* Fields are 32 bits wide, DMA addresses are in bytes */
+        int field_size = 32 / 8;
+        struct xhci_slot_ctx *slot_ctx;
+        dma_addr_t dma = ctx->dma;
+        int csz = HCC_64BYTE_CONTEXT(xhci->hcc_params);
+
+        if (ctx->type == XHCI_CTX_TYPE_INPUT) {
+                struct xhci_input_control_ctx *ctrl_ctx =
+                        xhci_get_input_control_ctx(xhci, ctx);
+                xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - drop flags\n",
+                         &ctrl_ctx->drop_flags, (unsigned long long)dma,
+                         ctrl_ctx->drop_flags);
+                dma += field_size;
+                xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - add flags\n",
+                         &ctrl_ctx->add_flags, (unsigned long long)dma,
+                         ctrl_ctx->add_flags);
+                dma += field_size;
+                for (i = 0; i < 6; ++i) {
+                        xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - rsvd2[%d]\n",
+                                 &ctrl_ctx->rsvd2[i], (unsigned long long)dma,
+                                 ctrl_ctx->rsvd2[i], i);
                         dma += field_size;
                 }
+
+                if (csz)
+                        dbg_rsvd64(xhci, (u64 *)ctrl_ctx, dma);
         }
+
+        slot_ctx = xhci_get_slot_ctx(xhci, ctx);
+        xhci_dbg_slot_ctx(xhci, ctx);
+        xhci_dbg_ep_ctx(xhci, ctx, last_ep);
 }
diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
index dba3e07ccd09..816c39caca1c 100644
--- a/drivers/usb/host/xhci-hcd.c
+++ b/drivers/usb/host/xhci-hcd.c
@@ -103,7 +103,10 @@ int xhci_reset(struct xhci_hcd *xhci)
         u32 state;
 
         state = xhci_readl(xhci, &xhci->op_regs->status);
-        BUG_ON((state & STS_HALT) == 0);
+        if ((state & STS_HALT) == 0) {
+                xhci_warn(xhci, "Host controller not halted, aborting reset.\n");
+                return 0;
+        }
 
         xhci_dbg(xhci, "// Reset the HC\n");
         command = xhci_readl(xhci, &xhci->op_regs->command);
@@ -226,6 +229,7 @@ int xhci_init(struct usb_hcd *hcd)
 static void xhci_work(struct xhci_hcd *xhci)
 {
         u32 temp;
+        u64 temp_64;
 
         /*
          * Clear the op reg interrupt status first,
@@ -248,9 +252,9 @@ static void xhci_work(struct xhci_hcd *xhci)
         /* FIXME this should be a delayed service routine that clears the EHB */
         xhci_handle_event(xhci);
 
-        /* Clear the event handler busy flag; the event ring should be empty. */
-        temp = xhci_readl(xhci, &xhci->ir_set->erst_dequeue[0]);
-        xhci_writel(xhci, temp & ~ERST_EHB, &xhci->ir_set->erst_dequeue[0]);
+        /* Clear the event handler busy flag (RW1C); the event ring should be empty. */
+        temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+        xhci_write_64(xhci, temp_64 | ERST_EHB, &xhci->ir_set->erst_dequeue);
         /* Flush posted writes -- FIXME is this necessary? */
         xhci_readl(xhci, &xhci->ir_set->irq_pending);
 }
@@ -266,19 +270,34 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
 {
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         u32 temp, temp2;
+        union xhci_trb *trb;
 
         spin_lock(&xhci->lock);
+        trb = xhci->event_ring->dequeue;
         /* Check if the xHC generated the interrupt, or the irq is shared */
         temp = xhci_readl(xhci, &xhci->op_regs->status);
         temp2 = xhci_readl(xhci, &xhci->ir_set->irq_pending);
+        if (temp == 0xffffffff && temp2 == 0xffffffff)
+                goto hw_died;
+
         if (!(temp & STS_EINT) && !ER_IRQ_PENDING(temp2)) {
                 spin_unlock(&xhci->lock);
                 return IRQ_NONE;
         }
+        xhci_dbg(xhci, "op reg status = %08x\n", temp);
+        xhci_dbg(xhci, "ir set irq_pending = %08x\n", temp2);
+        xhci_dbg(xhci, "Event ring dequeue ptr:\n");
+        xhci_dbg(xhci, "@%llx %08x %08x %08x %08x\n",
+                        (unsigned long long)xhci_trb_virt_to_dma(xhci->event_ring->deq_seg, trb),
+                        lower_32_bits(trb->link.segment_ptr),
+                        upper_32_bits(trb->link.segment_ptr),
+                        (unsigned int) trb->link.intr_target,
+                        (unsigned int) trb->link.control);
 
         if (temp & STS_FATAL) {
                 xhci_warn(xhci, "WARNING: Host System Error\n");
                 xhci_halt(xhci);
+hw_died:
                 xhci_to_hcd(xhci)->state = HC_STATE_HALT;
                 spin_unlock(&xhci->lock);
                 return -ESHUTDOWN;
@@ -295,6 +314,7 @@ void xhci_event_ring_work(unsigned long arg)
 {
         unsigned long flags;
         int temp;
+        u64 temp_64;
         struct xhci_hcd *xhci = (struct xhci_hcd *) arg;
         int i, j;
 
@@ -311,9 +331,9 @@ void xhci_event_ring_work(unsigned long arg)
         xhci_dbg(xhci, "Event ring:\n");
         xhci_debug_segment(xhci, xhci->event_ring->deq_seg);
         xhci_dbg_ring_ptrs(xhci, xhci->event_ring);
-        temp = xhci_readl(xhci, &xhci->ir_set->erst_dequeue[0]);
-        temp &= ERST_PTR_MASK;
-        xhci_dbg(xhci, "ERST deq = 0x%x\n", temp);
+        temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+        temp_64 &= ~ERST_PTR_MASK;
+        xhci_dbg(xhci, "ERST deq = 64'h%0lx\n", (long unsigned int) temp_64);
         xhci_dbg(xhci, "Command ring:\n");
         xhci_debug_segment(xhci, xhci->cmd_ring->deq_seg);
         xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
@@ -356,6 +376,7 @@ void xhci_event_ring_work(unsigned long arg)
 int xhci_run(struct usb_hcd *hcd)
 {
         u32 temp;
+        u64 temp_64;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         void (*doorbell)(struct xhci_hcd *) = NULL;
 
@@ -382,6 +403,20 @@ int xhci_run(struct usb_hcd *hcd)
         add_timer(&xhci->event_ring_timer);
 #endif
 
+        xhci_dbg(xhci, "Command ring memory map follows:\n");
+        xhci_debug_ring(xhci, xhci->cmd_ring);
+        xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
+        xhci_dbg_cmd_ptrs(xhci);
+
+        xhci_dbg(xhci, "ERST memory map follows:\n");
+        xhci_dbg_erst(xhci, &xhci->erst);
+        xhci_dbg(xhci, "Event ring:\n");
+        xhci_debug_ring(xhci, xhci->event_ring);
+        xhci_dbg_ring_ptrs(xhci, xhci->event_ring);
+        temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+        temp_64 &= ~ERST_PTR_MASK;
+        xhci_dbg(xhci, "ERST deq = 64'h%0lx\n", (long unsigned int) temp_64);
+
         xhci_dbg(xhci, "// Set the interrupt modulation register\n");
         temp = xhci_readl(xhci, &xhci->ir_set->irq_control);
         temp &= ~ER_IRQ_INTERVAL_MASK;
@@ -406,22 +441,6 @@ int xhci_run(struct usb_hcd *hcd)
         if (NUM_TEST_NOOPS > 0)
                 doorbell = xhci_setup_one_noop(xhci);
 
-        xhci_dbg(xhci, "Command ring memory map follows:\n");
-        xhci_debug_ring(xhci, xhci->cmd_ring);
-        xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
-        xhci_dbg_cmd_ptrs(xhci);
-
-        xhci_dbg(xhci, "ERST memory map follows:\n");
-        xhci_dbg_erst(xhci, &xhci->erst);
-        xhci_dbg(xhci, "Event ring:\n");
-        xhci_debug_ring(xhci, xhci->event_ring);
-        xhci_dbg_ring_ptrs(xhci, xhci->event_ring);
-        temp = xhci_readl(xhci, &xhci->ir_set->erst_dequeue[0]);
-        temp &= ERST_PTR_MASK;
-        xhci_dbg(xhci, "ERST deq = 0x%x\n", temp);
-        temp = xhci_readl(xhci, &xhci->ir_set->erst_dequeue[1]);
-        xhci_dbg(xhci, "ERST deq upper = 0x%x\n", temp);
-
         temp = xhci_readl(xhci, &xhci->op_regs->command);
         temp |= (CMD_RUN);
         xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n",
@@ -601,10 +620,13 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                 goto exit;
         }
         if (usb_endpoint_xfer_control(&urb->ep->desc))
-                ret = xhci_queue_ctrl_tx(xhci, mem_flags, urb,
+                /* We have a spinlock and interrupts disabled, so we must pass
+                 * atomic context to this function, which may allocate memory.
+                 */
+                ret = xhci_queue_ctrl_tx(xhci, GFP_ATOMIC, urb,
                                 slot_id, ep_index);
         else if (usb_endpoint_xfer_bulk(&urb->ep->desc))
-                ret = xhci_queue_bulk_tx(xhci, mem_flags, urb,
+                ret = xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb,
                                 slot_id, ep_index);
         else
                 ret = -EINVAL;
@@ -661,8 +683,12 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 goto done;
 
         xhci_dbg(xhci, "Cancel URB %p\n", urb);
+        xhci_dbg(xhci, "Event ring:\n");
+        xhci_debug_ring(xhci, xhci->event_ring);
         ep_index = xhci_get_endpoint_index(&urb->ep->desc);
         ep_ring = xhci->devs[urb->dev->slot_id]->ep_rings[ep_index];
+        xhci_dbg(xhci, "Endpoint ring:\n");
+        xhci_debug_ring(xhci, ep_ring);
         td = (struct xhci_td *) urb->hcpriv;
 
         ep_ring->cancels_pending++;
@@ -696,7 +722,9 @@ int xhci_drop_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
         struct xhci_hcd *xhci;
-        struct xhci_device_control *in_ctx;
+        struct xhci_container_ctx *in_ctx, *out_ctx;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        struct xhci_slot_ctx *slot_ctx;
         unsigned int last_ctx;
         unsigned int ep_index;
         struct xhci_ep_ctx *ep_ctx;
@@ -724,31 +752,34 @@ int xhci_drop_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         }
 
         in_ctx = xhci->devs[udev->slot_id]->in_ctx;
+        out_ctx = xhci->devs[udev->slot_id]->out_ctx;
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
         ep_index = xhci_get_endpoint_index(&ep->desc);
-        ep_ctx = &xhci->devs[udev->slot_id]->out_ctx->ep[ep_index];
+        ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
         /* If the HC already knows the endpoint is disabled,
          * or the HCD has noted it is disabled, ignore this request
          */
         if ((ep_ctx->ep_info & EP_STATE_MASK) == EP_STATE_DISABLED ||
-                        in_ctx->drop_flags & xhci_get_endpoint_flag(&ep->desc)) {
+                        ctrl_ctx->drop_flags & xhci_get_endpoint_flag(&ep->desc)) {
                 xhci_warn(xhci, "xHCI %s called with disabled ep %p\n",
                                 __func__, ep);
                 return 0;
         }
 
-        in_ctx->drop_flags |= drop_flag;
-        new_drop_flags = in_ctx->drop_flags;
+        ctrl_ctx->drop_flags |= drop_flag;
+        new_drop_flags = ctrl_ctx->drop_flags;
 
-        in_ctx->add_flags = ~drop_flag;
-        new_add_flags = in_ctx->add_flags;
+        ctrl_ctx->add_flags = ~drop_flag;
+        new_add_flags = ctrl_ctx->add_flags;
 
-        last_ctx = xhci_last_valid_endpoint(in_ctx->add_flags);
+        last_ctx = xhci_last_valid_endpoint(ctrl_ctx->add_flags);
+        slot_ctx = xhci_get_slot_ctx(xhci, in_ctx);
         /* Update the last valid endpoint context, if we deleted the last one */
-        if ((in_ctx->slot.dev_info & LAST_CTX_MASK) > LAST_CTX(last_ctx)) {
-                in_ctx->slot.dev_info &= ~LAST_CTX_MASK;
-                in_ctx->slot.dev_info |= LAST_CTX(last_ctx);
+        if ((slot_ctx->dev_info & LAST_CTX_MASK) > LAST_CTX(last_ctx)) {
+                slot_ctx->dev_info &= ~LAST_CTX_MASK;
+                slot_ctx->dev_info |= LAST_CTX(last_ctx);
         }
-        new_slot_info = in_ctx->slot.dev_info;
+        new_slot_info = slot_ctx->dev_info;
 
         xhci_endpoint_zero(xhci, xhci->devs[udev->slot_id], ep);
 
@@ -778,17 +809,22 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
         struct xhci_hcd *xhci;
-        struct xhci_device_control *in_ctx;
+        struct xhci_container_ctx *in_ctx, *out_ctx;
         unsigned int ep_index;
         struct xhci_ep_ctx *ep_ctx;
+        struct xhci_slot_ctx *slot_ctx;
+        struct xhci_input_control_ctx *ctrl_ctx;
         u32 added_ctxs;
         unsigned int last_ctx;
         u32 new_add_flags, new_drop_flags, new_slot_info;
         int ret = 0;
 
         ret = xhci_check_args(hcd, udev, ep, 1, __func__);
-        if (ret <= 0)
+        if (ret <= 0) {
+                /* So we won't queue a reset ep command for a root hub */
+                ep->hcpriv = NULL;
                 return ret;
+        }
         xhci = hcd_to_xhci(hcd);
 
         added_ctxs = xhci_get_endpoint_flag(&ep->desc);
@@ -810,12 +846,14 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         }
 
         in_ctx = xhci->devs[udev->slot_id]->in_ctx;
+        out_ctx = xhci->devs[udev->slot_id]->out_ctx;
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
         ep_index = xhci_get_endpoint_index(&ep->desc);
-        ep_ctx = &xhci->devs[udev->slot_id]->out_ctx->ep[ep_index];
+        ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
         /* If the HCD has already noted the endpoint is enabled,
          * ignore this request.
          */
-        if (in_ctx->add_flags & xhci_get_endpoint_flag(&ep->desc)) {
+        if (ctrl_ctx->add_flags & xhci_get_endpoint_flag(&ep->desc)) {
                 xhci_warn(xhci, "xHCI %s called with enabled ep %p\n",
                                 __func__, ep);
                 return 0;
@@ -833,8 +871,8 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
                 return -ENOMEM;
         }
 
-        in_ctx->add_flags |= added_ctxs;
-        new_add_flags = in_ctx->add_flags;
+        ctrl_ctx->add_flags |= added_ctxs;
+        new_add_flags = ctrl_ctx->add_flags;
 
         /* If xhci_endpoint_disable() was called for this endpoint, but the
          * xHC hasn't been notified yet through the check_bandwidth() call,
@@ -842,14 +880,18 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
          * descriptors.  We must drop and re-add this endpoint, so we leave the
          * drop flags alone.
          */
-        new_drop_flags = in_ctx->drop_flags;
+        new_drop_flags = ctrl_ctx->drop_flags;
 
+        slot_ctx = xhci_get_slot_ctx(xhci, in_ctx);
         /* Update the last valid endpoint context, if we just added one past */
-        if ((in_ctx->slot.dev_info & LAST_CTX_MASK) < LAST_CTX(last_ctx)) {
-                in_ctx->slot.dev_info &= ~LAST_CTX_MASK;
-                in_ctx->slot.dev_info |= LAST_CTX(last_ctx);
+        if ((slot_ctx->dev_info & LAST_CTX_MASK) < LAST_CTX(last_ctx)) {
+                slot_ctx->dev_info &= ~LAST_CTX_MASK;
+                slot_ctx->dev_info |= LAST_CTX(last_ctx);
         }
-        new_slot_info = in_ctx->slot.dev_info;
+        new_slot_info = slot_ctx->dev_info;
+
+        /* Store the usb_device pointer for later use */
+        ep->hcpriv = udev;
 
         xhci_dbg(xhci, "add ep 0x%x, slot id %d, new drop flags = %#x, new add flags = %#x, new slot info = %#x\n",
                         (unsigned int) ep->desc.bEndpointAddress,
@@ -860,9 +902,11 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         return 0;
 }
 
-static void xhci_zero_in_ctx(struct xhci_virt_device *virt_dev)
+static void xhci_zero_in_ctx(struct xhci_hcd *xhci, struct xhci_virt_device *virt_dev)
 {
+        struct xhci_input_control_ctx *ctrl_ctx;
         struct xhci_ep_ctx *ep_ctx;
+        struct xhci_slot_ctx *slot_ctx;
         int i;
 
         /* When a device's add flag and drop flag are zero, any subsequent
@@ -870,17 +914,18 @@ static void xhci_zero_in_ctx(struct xhci_virt_device *virt_dev)
          * untouched.  Make sure we don't leave any old state in the input
          * endpoint contexts.
          */
-        virt_dev->in_ctx->drop_flags = 0;
-        virt_dev->in_ctx->add_flags = 0;
-        virt_dev->in_ctx->slot.dev_info &= ~LAST_CTX_MASK;
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, virt_dev->in_ctx);
+        ctrl_ctx->drop_flags = 0;
+        ctrl_ctx->add_flags = 0;
+        slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->in_ctx);
+        slot_ctx->dev_info &= ~LAST_CTX_MASK;
         /* Endpoint 0 is always valid */
-        virt_dev->in_ctx->slot.dev_info |= LAST_CTX(1);
+        slot_ctx->dev_info |= LAST_CTX(1);
         for (i = 1; i < 31; ++i) {
-                ep_ctx = &virt_dev->in_ctx->ep[i];
+                ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, i);
                 ep_ctx->ep_info = 0;
                 ep_ctx->ep_info2 = 0;
-                ep_ctx->deq[0] = 0;
-                ep_ctx->deq[1] = 0;
+                ep_ctx->deq = 0;
                 ep_ctx->tx_info = 0;
         }
 }
@@ -903,6 +948,8 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
         unsigned long flags;
         struct xhci_hcd *xhci;
         struct xhci_virt_device *virt_dev;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        struct xhci_slot_ctx *slot_ctx;
 
         ret = xhci_check_args(hcd, udev, NULL, 0, __func__);
         if (ret <= 0)
@@ -918,16 +965,18 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
         virt_dev = xhci->devs[udev->slot_id];
 
         /* See section 4.6.6 - A0 = 1; A1 = D0 = D1 = 0 */
-        virt_dev->in_ctx->add_flags |= SLOT_FLAG;
-        virt_dev->in_ctx->add_flags &= ~EP0_FLAG;
-        virt_dev->in_ctx->drop_flags &= ~SLOT_FLAG;
-        virt_dev->in_ctx->drop_flags &= ~EP0_FLAG;
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, virt_dev->in_ctx);
+        ctrl_ctx->add_flags |= SLOT_FLAG;
+        ctrl_ctx->add_flags &= ~EP0_FLAG;
+        ctrl_ctx->drop_flags &= ~SLOT_FLAG;
+        ctrl_ctx->drop_flags &= ~EP0_FLAG;
         xhci_dbg(xhci, "New Input Control Context:\n");
-        xhci_dbg_ctx(xhci, virt_dev->in_ctx, virt_dev->in_ctx_dma,
-                        LAST_CTX_TO_EP_NUM(virt_dev->in_ctx->slot.dev_info));
+        slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->in_ctx);
+        xhci_dbg_ctx(xhci, virt_dev->in_ctx,
+                        LAST_CTX_TO_EP_NUM(slot_ctx->dev_info));
 
         spin_lock_irqsave(&xhci->lock, flags);
-        ret = xhci_queue_configure_endpoint(xhci, virt_dev->in_ctx_dma,
+        ret = xhci_queue_configure_endpoint(xhci, virt_dev->in_ctx->dma,
                         udev->slot_id);
         if (ret < 0) {
                 spin_unlock_irqrestore(&xhci->lock, flags);
@@ -982,10 +1031,10 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
         }
 
         xhci_dbg(xhci, "Output context after successful config ep cmd:\n");
-        xhci_dbg_ctx(xhci, virt_dev->out_ctx, virt_dev->out_ctx_dma,
-                        LAST_CTX_TO_EP_NUM(virt_dev->in_ctx->slot.dev_info));
+        xhci_dbg_ctx(xhci, virt_dev->out_ctx,
+                        LAST_CTX_TO_EP_NUM(slot_ctx->dev_info));
 
-        xhci_zero_in_ctx(virt_dev);
+        xhci_zero_in_ctx(xhci, virt_dev);
         /* Free any old rings */
         for (i = 1; i < 31; ++i) {
                 if (virt_dev->new_ep_rings[i]) {
@@ -1023,7 +1072,67 @@ void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
                         virt_dev->new_ep_rings[i] = NULL;
                 }
         }
-        xhci_zero_in_ctx(virt_dev);
+        xhci_zero_in_ctx(xhci, virt_dev);
+}
+
+/* Deal with stalled endpoints.  The core should have sent the control message
+ * to clear the halt condition.  However, we need to make the xHCI hardware
+ * reset its sequence number, since a device will expect a sequence number of
+ * zero after the halt condition is cleared.
+ * Context: in_interrupt
+ */
+void xhci_endpoint_reset(struct usb_hcd *hcd,
+                struct usb_host_endpoint *ep)
+{
+        struct xhci_hcd *xhci;
+        struct usb_device *udev;
+        unsigned int ep_index;
+        unsigned long flags;
+        int ret;
+        struct xhci_dequeue_state deq_state;
+        struct xhci_ring *ep_ring;
+
+        xhci = hcd_to_xhci(hcd);
+        udev = (struct usb_device *) ep->hcpriv;
+        /* Called with a root hub endpoint (or an endpoint that wasn't added
+         * with xhci_add_endpoint()
+         */
+        if (!ep->hcpriv)
+                return;
+        ep_index = xhci_get_endpoint_index(&ep->desc);
+        ep_ring = xhci->devs[udev->slot_id]->ep_rings[ep_index];
+        if (!ep_ring->stopped_td) {
+                xhci_dbg(xhci, "Endpoint 0x%x not halted, refusing to reset.\n",
+                                ep->desc.bEndpointAddress);
+                return;
+        }
+
+        xhci_dbg(xhci, "Queueing reset endpoint command\n");
+        spin_lock_irqsave(&xhci->lock, flags);
+        ret = xhci_queue_reset_ep(xhci, udev->slot_id, ep_index);
+        /*
+         * Can't change the ring dequeue pointer until it's transitioned to the
+         * stopped state, which is only upon a successful reset endpoint
+         * command.  Better hope that last command worked!
+         */
+        if (!ret) {
+                xhci_dbg(xhci, "Cleaning up stalled endpoint ring\n");
+                /* We need to move the HW's dequeue pointer past this TD,
+                 * or it will attempt to resend it on the next doorbell ring.
+                 */
+                xhci_find_new_dequeue_state(xhci, udev->slot_id,
+                                ep_index, ep_ring->stopped_td, &deq_state);
+                xhci_dbg(xhci, "Queueing new dequeue state\n");
+                xhci_queue_new_dequeue_state(xhci, ep_ring,
+                                udev->slot_id,
+                                ep_index, &deq_state);
+                kfree(ep_ring->stopped_td);
+                xhci_ring_cmd_db(xhci);
+        }
+        spin_unlock_irqrestore(&xhci->lock, flags);
+
+        if (ret)
+                xhci_warn(xhci, "FIXME allocate a new ring segment\n");
 }
 
 /*
@@ -1120,7 +1229,9 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
         struct xhci_virt_device *virt_dev;
         int ret = 0;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        u32 temp;
+        struct xhci_slot_ctx *slot_ctx;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        u64 temp_64;
 
         if (!udev->slot_id) {
                 xhci_dbg(xhci, "Bad Slot ID %d\n", udev->slot_id);
@@ -1133,10 +1244,12 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
         if (!udev->config)
                 xhci_setup_addressable_virt_dev(xhci, udev);
         /* Otherwise, assume the core has the device configured how it wants */
+        xhci_dbg(xhci, "Slot ID %d Input Context:\n", udev->slot_id);
+        xhci_dbg_ctx(xhci, virt_dev->in_ctx, 2);
 
         spin_lock_irqsave(&xhci->lock, flags);
-        ret = xhci_queue_address_device(xhci, virt_dev->in_ctx_dma,
-                        udev->slot_id);
+        ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,
+                                        udev->slot_id);
         if (ret) {
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 xhci_dbg(xhci, "FIXME: allocate a command ring segment\n");
@@ -1176,41 +1289,37 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
         default:
                 xhci_err(xhci, "ERROR: unexpected command completion "
                                 "code 0x%x.\n", virt_dev->cmd_status);
+                xhci_dbg(xhci, "Slot ID %d Output Context:\n", udev->slot_id);
+                xhci_dbg_ctx(xhci, virt_dev->out_ctx, 2);
                 ret = -EINVAL;
                 break;
         }
         if (ret) {
                 return ret;
         }
-        temp = xhci_readl(xhci, &xhci->op_regs->dcbaa_ptr[0]);
-        xhci_dbg(xhci, "Op regs DCBAA ptr[0] = %#08x\n", temp);
-        temp = xhci_readl(xhci, &xhci->op_regs->dcbaa_ptr[1]);
-        xhci_dbg(xhci, "Op regs DCBAA ptr[1] = %#08x\n", temp);
-        xhci_dbg(xhci, "Slot ID %d dcbaa entry[0] @%p = %#08x\n",
-                        udev->slot_id,
-                        &xhci->dcbaa->dev_context_ptrs[2*udev->slot_id],
-                        xhci->dcbaa->dev_context_ptrs[2*udev->slot_id]);
-        xhci_dbg(xhci, "Slot ID %d dcbaa entry[1] @%p = %#08x\n",
+        temp_64 = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr);
+        xhci_dbg(xhci, "Op regs DCBAA ptr = %#016llx\n", temp_64);
+        xhci_dbg(xhci, "Slot ID %d dcbaa entry @%p = %#016llx\n",
                         udev->slot_id,
-                        &xhci->dcbaa->dev_context_ptrs[2*udev->slot_id+1],
-                        xhci->dcbaa->dev_context_ptrs[2*udev->slot_id+1]);
+                        &xhci->dcbaa->dev_context_ptrs[udev->slot_id],
+                        (unsigned long long)
+                                xhci->dcbaa->dev_context_ptrs[udev->slot_id]);
         xhci_dbg(xhci, "Output Context DMA address = %#08llx\n",
-                        (unsigned long long)virt_dev->out_ctx_dma);
+                        (unsigned long long)virt_dev->out_ctx->dma);
         xhci_dbg(xhci, "Slot ID %d Input Context:\n", udev->slot_id);
-        xhci_dbg_ctx(xhci, virt_dev->in_ctx, virt_dev->in_ctx_dma, 2);
+        xhci_dbg_ctx(xhci, virt_dev->in_ctx, 2);
         xhci_dbg(xhci, "Slot ID %d Output Context:\n", udev->slot_id);
-        xhci_dbg_ctx(xhci, virt_dev->out_ctx, virt_dev->out_ctx_dma, 2);
+        xhci_dbg_ctx(xhci, virt_dev->out_ctx, 2);
         /*
          * USB core uses address 1 for the roothubs, so we add one to the
          * address given back to us by the HC.
          */
-        udev->devnum = (virt_dev->out_ctx->slot.dev_state & DEV_ADDR_MASK) + 1;
+        slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx);
+        udev->devnum = (slot_ctx->dev_state & DEV_ADDR_MASK) + 1;
         /* Zero the input context control for later use */
-        virt_dev->in_ctx->add_flags = 0;
-        virt_dev->in_ctx->drop_flags = 0;
-        /* Mirror flags in the output context for future ep enable/disable */
-        virt_dev->out_ctx->add_flags = SLOT_FLAG | EP0_FLAG;
-        virt_dev->out_ctx->drop_flags = 0;
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, virt_dev->in_ctx);
+        ctrl_ctx->add_flags = 0;
+        ctrl_ctx->drop_flags = 0;
 
         xhci_dbg(xhci, "Device address = %d\n", udev->devnum);
         /* XXX Meh, not sure if anyone else but choose_address uses this. */
@@ -1252,7 +1361,6 @@ static int __init xhci_hcd_init(void)
         /* xhci_device_control has eight fields, and also
          * embeds one xhci_slot_ctx and 31 xhci_ep_ctx
          */
-        BUILD_BUG_ON(sizeof(struct xhci_device_control) != (8+8+8*31)*32/8);
         BUILD_BUG_ON(sizeof(struct xhci_stream_ctx) != 4*32/8);
         BUILD_BUG_ON(sizeof(union xhci_trb) != 4*32/8);
         BUILD_BUG_ON(sizeof(struct xhci_erst_entry) != 4*32/8);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index c8a72de1c508..e6b9a1c6002d 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -88,7 +88,7 @@ static void xhci_link_segments(struct xhci_hcd *xhci, struct xhci_segment *prev,
                 return;
         prev->next = next;
         if (link_trbs) {
-                prev->trbs[TRBS_PER_SEGMENT-1].link.segment_ptr[0] = next->dma;
+                prev->trbs[TRBS_PER_SEGMENT-1].link.segment_ptr = next->dma;
 
                 /* Set the last TRB in the segment to have a TRB type ID of Link TRB */
                 val = prev->trbs[TRBS_PER_SEGMENT-1].link.control;
@@ -189,6 +189,63 @@ fail:
         return 0;
 }
 
+#define CTX_SIZE(_hcc) (HCC_64BYTE_CONTEXT(_hcc) ? 64 : 32)
+
+struct xhci_container_ctx *xhci_alloc_container_ctx(struct xhci_hcd *xhci,
+                                                    int type, gfp_t flags)
+{
+        struct xhci_container_ctx *ctx = kzalloc(sizeof(*ctx), flags);
+        if (!ctx)
+                return NULL;
+
+        BUG_ON((type != XHCI_CTX_TYPE_DEVICE) && (type != XHCI_CTX_TYPE_INPUT));
+        ctx->type = type;
+        ctx->size = HCC_64BYTE_CONTEXT(xhci->hcc_params) ? 2048 : 1024;
+        if (type == XHCI_CTX_TYPE_INPUT)
+                ctx->size += CTX_SIZE(xhci->hcc_params);
+
+        ctx->bytes = dma_pool_alloc(xhci->device_pool, flags, &ctx->dma);
+        memset(ctx->bytes, 0, ctx->size);
+        return ctx;
+}
+
+void xhci_free_container_ctx(struct xhci_hcd *xhci,
+                             struct xhci_container_ctx *ctx)
+{
+        dma_pool_free(xhci->device_pool, ctx->bytes, ctx->dma);
+        kfree(ctx);
+}
+
+struct xhci_input_control_ctx *xhci_get_input_control_ctx(struct xhci_hcd *xhci,
+                                              struct xhci_container_ctx *ctx)
+{
+        BUG_ON(ctx->type != XHCI_CTX_TYPE_INPUT);
+        return (struct xhci_input_control_ctx *)ctx->bytes;
+}
+
+struct xhci_slot_ctx *xhci_get_slot_ctx(struct xhci_hcd *xhci,
+                                        struct xhci_container_ctx *ctx)
+{
+        if (ctx->type == XHCI_CTX_TYPE_DEVICE)
+                return (struct xhci_slot_ctx *)ctx->bytes;
+
+        return (struct xhci_slot_ctx *)
+                (ctx->bytes + CTX_SIZE(xhci->hcc_params));
+}
+
+struct xhci_ep_ctx *xhci_get_ep_ctx(struct xhci_hcd *xhci,
+                                    struct xhci_container_ctx *ctx,
+                                    unsigned int ep_index)
+{
+        /* increment ep index by offset of start of ep ctx array */
+        ep_index++;
+        if (ctx->type == XHCI_CTX_TYPE_INPUT)
+                ep_index++;
+
+        return (struct xhci_ep_ctx *)
+                (ctx->bytes + (ep_index * CTX_SIZE(xhci->hcc_params)));
+}
+
 /* All the xhci_tds in the ring's TD list should be freed at this point */
 void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
 {
@@ -200,8 +257,7 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
                 return;
 
         dev = xhci->devs[slot_id];
-        xhci->dcbaa->dev_context_ptrs[2*slot_id] = 0;
-        xhci->dcbaa->dev_context_ptrs[2*slot_id + 1] = 0;
+        xhci->dcbaa->dev_context_ptrs[slot_id] = 0;
         if (!dev)
                 return;
 
@@ -210,11 +266,10 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
                         xhci_ring_free(xhci, dev->ep_rings[i]);
 
         if (dev->in_ctx)
-                dma_pool_free(xhci->device_pool,
-                                dev->in_ctx, dev->in_ctx_dma);
+                xhci_free_container_ctx(xhci, dev->in_ctx);
         if (dev->out_ctx)
-                dma_pool_free(xhci->device_pool,
-                                dev->out_ctx, dev->out_ctx_dma);
+                xhci_free_container_ctx(xhci, dev->out_ctx);
+
         kfree(xhci->devs[slot_id]);
         xhci->devs[slot_id] = 0;
 }
@@ -222,7 +277,6 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
 int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
                 struct usb_device *udev, gfp_t flags)
 {
-        dma_addr_t      dma;
         struct xhci_virt_device *dev;
 
         /* Slot ID 0 is reserved */
@@ -236,23 +290,21 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
                 return 0;
         dev = xhci->devs[slot_id];
 
-        /* Allocate the (output) device context that will be used in the HC */
-        dev->out_ctx = dma_pool_alloc(xhci->device_pool, flags, &dma);
+        /* Allocate the (output) device context that will be used in the HC. */
+        dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
         if (!dev->out_ctx)
                 goto fail;
-        dev->out_ctx_dma = dma;
+
         xhci_dbg(xhci, "Slot %d output ctx = 0x%llx (dma)\n", slot_id,
-                        (unsigned long long)dma);
-        memset(dev->out_ctx, 0, sizeof(*dev->out_ctx));
+                        (unsigned long long)dev->out_ctx->dma);
 
         /* Allocate the (input) device context for address device command */
-        dev->in_ctx = dma_pool_alloc(xhci->device_pool, flags, &dma);
+        dev->in_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_INPUT, flags);
         if (!dev->in_ctx)
                 goto fail;
-        dev->in_ctx_dma = dma;
+
         xhci_dbg(xhci, "Slot %d input ctx = 0x%llx (dma)\n", slot_id,
-                        (unsigned long long)dma);
-        memset(dev->in_ctx, 0, sizeof(*dev->in_ctx));
+                        (unsigned long long)dev->in_ctx->dma);
 
         /* Allocate endpoint 0 ring */
         dev->ep_rings[0] = xhci_ring_alloc(xhci, 1, true, flags);
@@ -261,17 +313,12 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
 
         init_completion(&dev->cmd_completion);
 
-        /*
-         * Point to output device context in dcbaa; skip the output control
-         * context, which is eight 32 bit fields (or 32 bytes long)
-         */
-        xhci->dcbaa->dev_context_ptrs[2*slot_id] =
-                (u32) dev->out_ctx_dma + (32);
+        /* Point to output device context in dcbaa. */
+        xhci->dcbaa->dev_context_ptrs[slot_id] = dev->out_ctx->dma;
         xhci_dbg(xhci, "Set slot id %d dcbaa entry %p to 0x%llx\n",
                         slot_id,
-                        &xhci->dcbaa->dev_context_ptrs[2*slot_id],
-                        (unsigned long long)dev->out_ctx_dma);
-        xhci->dcbaa->dev_context_ptrs[2*slot_id + 1] = 0;
+                        &xhci->dcbaa->dev_context_ptrs[slot_id],
+                        (unsigned long long) xhci->dcbaa->dev_context_ptrs[slot_id]);
 
         return 1;
 fail:
@@ -285,6 +332,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
         struct xhci_virt_device *dev;
         struct xhci_ep_ctx      *ep0_ctx;
         struct usb_device       *top_dev;
+        struct xhci_slot_ctx    *slot_ctx;
+        struct xhci_input_control_ctx *ctrl_ctx;
 
         dev = xhci->devs[udev->slot_id];
         /* Slot ID 0 is reserved */
@@ -293,27 +342,29 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
                                 udev->slot_id);
                 return -EINVAL;
         }
-        ep0_ctx = &dev->in_ctx->ep[0];
+        ep0_ctx = xhci_get_ep_ctx(xhci, dev->in_ctx, 0);
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, dev->in_ctx);
+        slot_ctx = xhci_get_slot_ctx(xhci, dev->in_ctx);
 
         /* 2) New slot context and endpoint 0 context are valid*/
-        dev->in_ctx->add_flags = SLOT_FLAG | EP0_FLAG;
+        ctrl_ctx->add_flags = SLOT_FLAG | EP0_FLAG;
 
         /* 3) Only the control endpoint is valid - one endpoint context */
-        dev->in_ctx->slot.dev_info |= LAST_CTX(1);
+        slot_ctx->dev_info |= LAST_CTX(1);
 
         switch (udev->speed) {
         case USB_SPEED_SUPER:
-                dev->in_ctx->slot.dev_info |= (u32) udev->route;
-                dev->in_ctx->slot.dev_info |= (u32) SLOT_SPEED_SS;
+                slot_ctx->dev_info |= (u32) udev->route;
+                slot_ctx->dev_info |= (u32) SLOT_SPEED_SS;
                 break;
         case USB_SPEED_HIGH:
-                dev->in_ctx->slot.dev_info |= (u32) SLOT_SPEED_HS;
+                slot_ctx->dev_info |= (u32) SLOT_SPEED_HS;
                 break;
         case USB_SPEED_FULL:
-                dev->in_ctx->slot.dev_info |= (u32) SLOT_SPEED_FS;
+                slot_ctx->dev_info |= (u32) SLOT_SPEED_FS;
                 break;
         case USB_SPEED_LOW:
-                dev->in_ctx->slot.dev_info |= (u32) SLOT_SPEED_LS;
+                slot_ctx->dev_info |= (u32) SLOT_SPEED_LS;
                 break;
         case USB_SPEED_VARIABLE:
                 xhci_dbg(xhci, "FIXME xHCI doesn't support wireless speeds\n");
@@ -327,7 +378,7 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
         for (top_dev = udev; top_dev->parent && top_dev->parent->parent;
                         top_dev = top_dev->parent)
                 /* Found device below root hub */;
-        dev->in_ctx->slot.dev_info2 |= (u32) ROOT_HUB_PORT(top_dev->portnum);
+        slot_ctx->dev_info2 |= (u32) ROOT_HUB_PORT(top_dev->portnum);
         xhci_dbg(xhci, "Set root hub portnum to %d\n", top_dev->portnum);
 
         /* Is this a LS/FS device under a HS hub? */
@@ -337,8 +388,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
          */
         if ((udev->speed == USB_SPEED_LOW || udev->speed == USB_SPEED_FULL) &&
                         udev->tt) {
-                dev->in_ctx->slot.tt_info = udev->tt->hub->slot_id;
-                dev->in_ctx->slot.tt_info |= udev->ttport << 8;
+                slot_ctx->tt_info = udev->tt->hub->slot_id;
+                slot_ctx->tt_info |= udev->ttport << 8;
         }
         xhci_dbg(xhci, "udev->tt = %p\n", udev->tt);
         xhci_dbg(xhci, "udev->ttport = 0x%x\n", udev->ttport);
@@ -360,10 +411,9 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
         ep0_ctx->ep_info2 |= MAX_BURST(0);
         ep0_ctx->ep_info2 |= ERROR_COUNT(3);
 
-        ep0_ctx->deq[0] =
+        ep0_ctx->deq =
                 dev->ep_rings[0]->first_seg->dma;
-        ep0_ctx->deq[0] |= dev->ep_rings[0]->cycle_state;
-        ep0_ctx->deq[1] = 0;
+        ep0_ctx->deq |= dev->ep_rings[0]->cycle_state;
 
         /* Steps 7 and 8 were done in xhci_alloc_virt_device() */
 
@@ -470,25 +520,26 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         unsigned int max_burst;
 
         ep_index = xhci_get_endpoint_index(&ep->desc);
-        ep_ctx = &virt_dev->in_ctx->ep[ep_index];
+        ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
 
         /* Set up the endpoint ring */
         virt_dev->new_ep_rings[ep_index] = xhci_ring_alloc(xhci, 1, true, mem_flags);
         if (!virt_dev->new_ep_rings[ep_index])
                 return -ENOMEM;
         ep_ring = virt_dev->new_ep_rings[ep_index];
-        ep_ctx->deq[0] = ep_ring->first_seg->dma | ep_ring->cycle_state;
-        ep_ctx->deq[1] = 0;
+        ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
 
         ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep);
 
         /* FIXME dig Mult and streams info out of ep companion desc */
 
-        /* Allow 3 retries for everything but isoc */
+        /* Allow 3 retries for everything but isoc;
+         * error count = 0 means infinite retries.
+         */
         if (!usb_endpoint_xfer_isoc(&ep->desc))
                 ep_ctx->ep_info2 = ERROR_COUNT(3);
         else
-                ep_ctx->ep_info2 = ERROR_COUNT(0);
+                ep_ctx->ep_info2 = ERROR_COUNT(1);
 
         ep_ctx->ep_info2 |= xhci_get_endpoint_type(udev, ep);
 
@@ -498,7 +549,12 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
                 max_packet = ep->desc.wMaxPacketSize;
                 ep_ctx->ep_info2 |= MAX_PACKET(max_packet);
                 /* dig out max burst from ep companion desc */
-                max_packet = ep->ss_ep_comp->desc.bMaxBurst;
+                if (!ep->ss_ep_comp) {
+                        xhci_warn(xhci, "WARN no SS endpoint companion descriptor.\n");
+                        max_packet = 0;
+                } else {
+                        max_packet = ep->ss_ep_comp->desc.bMaxBurst;
+                }
                 ep_ctx->ep_info2 |= MAX_BURST(max_packet);
                 break;
         case USB_SPEED_HIGH:
@@ -531,18 +587,114 @@ void xhci_endpoint_zero(struct xhci_hcd *xhci,
         struct xhci_ep_ctx *ep_ctx;
 
         ep_index = xhci_get_endpoint_index(&ep->desc);
-        ep_ctx = &virt_dev->in_ctx->ep[ep_index];
+        ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
 
         ep_ctx->ep_info = 0;
         ep_ctx->ep_info2 = 0;
-        ep_ctx->deq[0] = 0;
-        ep_ctx->deq[1] = 0;
+        ep_ctx->deq = 0;
         ep_ctx->tx_info = 0;
         /* Don't free the endpoint ring until the set interface or configuration
          * request succeeds.
          */
 }
 
+/* Set up the scratchpad buffer array and scratchpad buffers, if needed. */
+static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
+{
+        int i;
+        struct device *dev = xhci_to_hcd(xhci)->self.controller;
+        int num_sp = HCS_MAX_SCRATCHPAD(xhci->hcs_params2);
+
+        xhci_dbg(xhci, "Allocating %d scratchpad buffers\n", num_sp);
+
+        if (!num_sp)
+                return 0;
+
+        xhci->scratchpad = kzalloc(sizeof(*xhci->scratchpad), flags);
+        if (!xhci->scratchpad)
+                goto fail_sp;
+
+        xhci->scratchpad->sp_array =
+                pci_alloc_consistent(to_pci_dev(dev),
+                                     num_sp * sizeof(u64),
+                                     &xhci->scratchpad->sp_dma);
+        if (!xhci->scratchpad->sp_array)
+                goto fail_sp2;
+
+        xhci->scratchpad->sp_buffers = kzalloc(sizeof(void *) * num_sp, flags);
+        if (!xhci->scratchpad->sp_buffers)
+                goto fail_sp3;
+
+        xhci->scratchpad->sp_dma_buffers =
+                kzalloc(sizeof(dma_addr_t) * num_sp, flags);
+
+        if (!xhci->scratchpad->sp_dma_buffers)
+                goto fail_sp4;
+
+        xhci->dcbaa->dev_context_ptrs[0] = xhci->scratchpad->sp_dma;
+        for (i = 0; i < num_sp; i++) {
+                dma_addr_t dma;
+                void *buf = pci_alloc_consistent(to_pci_dev(dev),
+                                                 xhci->page_size, &dma);
+                if (!buf)
+                        goto fail_sp5;
+
+                xhci->scratchpad->sp_array[i] = dma;
+                xhci->scratchpad->sp_buffers[i] = buf;
+                xhci->scratchpad->sp_dma_buffers[i] = dma;
+        }
+
+        return 0;
+
+ fail_sp5:
+        for (i = i - 1; i >= 0; i--) {
+                pci_free_consistent(to_pci_dev(dev), xhci->page_size,
+                                    xhci->scratchpad->sp_buffers[i],
+                                    xhci->scratchpad->sp_dma_buffers[i]);
+        }
+        kfree(xhci->scratchpad->sp_dma_buffers);
+
+ fail_sp4:
+        kfree(xhci->scratchpad->sp_buffers);
+
+ fail_sp3:
+        pci_free_consistent(to_pci_dev(dev), num_sp * sizeof(u64),
+                            xhci->scratchpad->sp_array,
+                            xhci->scratchpad->sp_dma);
+
+ fail_sp2:
+        kfree(xhci->scratchpad);
+        xhci->scratchpad = NULL;
+
+ fail_sp:
+        return -ENOMEM;
+}
+
+static void scratchpad_free(struct xhci_hcd *xhci)
+{
+        int num_sp;
+        int i;
+        struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+
+        if (!xhci->scratchpad)
+                return;
+
+        num_sp = HCS_MAX_SCRATCHPAD(xhci->hcs_params2);
+
+        for (i = 0; i < num_sp; i++) {
+                pci_free_consistent(pdev, xhci->page_size,
+                                    xhci->scratchpad->sp_buffers[i],
+                                    xhci->scratchpad->sp_dma_buffers[i]);
+        }
+        kfree(xhci->scratchpad->sp_dma_buffers);
+        kfree(xhci->scratchpad->sp_buffers);
+        pci_free_consistent(pdev, num_sp * sizeof(u64),
+                            xhci->scratchpad->sp_array,
+                            xhci->scratchpad->sp_dma);
+        kfree(xhci->scratchpad);
+        xhci->scratchpad = NULL;
+}
+
 void xhci_mem_cleanup(struct xhci_hcd *xhci)
 {
         struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
@@ -551,10 +703,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
 
         /* Free the Event Ring Segment Table and the actual Event Ring */
         xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
-        xhci_writel(xhci, 0, &xhci->ir_set->erst_base[0]);
-        xhci_writel(xhci, 0, &xhci->ir_set->erst_base[1]);
-        xhci_writel(xhci, 0, &xhci->ir_set->erst_dequeue[0]);
-        xhci_writel(xhci, 0, &xhci->ir_set->erst_dequeue[1]);
+        xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
+        xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
         size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
         if (xhci->erst.entries)
                 pci_free_consistent(pdev, size,
@@ -566,8 +716,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         xhci->event_ring = NULL;
         xhci_dbg(xhci, "Freed event ring\n");
 
-        xhci_writel(xhci, 0, &xhci->op_regs->cmd_ring[0]);
-        xhci_writel(xhci, 0, &xhci->op_regs->cmd_ring[1]);
+        xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring);
         if (xhci->cmd_ring)
                 xhci_ring_free(xhci, xhci->cmd_ring);
         xhci->cmd_ring = NULL;
@@ -586,8 +735,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         xhci->device_pool = NULL;
         xhci_dbg(xhci, "Freed device context pool\n");
 
-        xhci_writel(xhci, 0, &xhci->op_regs->dcbaa_ptr[0]);
-        xhci_writel(xhci, 0, &xhci->op_regs->dcbaa_ptr[1]);
+        xhci_write_64(xhci, 0, &xhci->op_regs->dcbaa_ptr);
         if (xhci->dcbaa)
                 pci_free_consistent(pdev, sizeof(*xhci->dcbaa),
                                 xhci->dcbaa, xhci->dcbaa->dma);
@@ -595,6 +743,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
 
         xhci->page_size = 0;
         xhci->page_shift = 0;
+        scratchpad_free(xhci);
 }
 
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
@@ -602,6 +751,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         dma_addr_t      dma;
         struct device   *dev = xhci_to_hcd(xhci)->self.controller;
         unsigned int    val, val2;
+        u64             val_64;
         struct xhci_segment     *seg;
         u32 page_size;
         int i;
@@ -647,8 +797,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         xhci->dcbaa->dma = dma;
         xhci_dbg(xhci, "// Device context base array address = 0x%llx (DMA), %p (virt)\n",
                         (unsigned long long)xhci->dcbaa->dma, xhci->dcbaa);
-        xhci_writel(xhci, dma, &xhci->op_regs->dcbaa_ptr[0]);
-        xhci_writel(xhci, (u32) 0, &xhci->op_regs->dcbaa_ptr[1]);
+        xhci_write_64(xhci, dma, &xhci->op_regs->dcbaa_ptr);
 
         /*
          * Initialize the ring segment pool.  The ring must be a contiguous
@@ -658,11 +807,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
          */
         xhci->segment_pool = dma_pool_create("xHCI ring segments", dev,
                         SEGMENT_SIZE, 64, xhci->page_size);
+
         /* See Table 46 and Note on Figure 55 */
-        /* FIXME support 64-byte contexts */
         xhci->device_pool = dma_pool_create("xHCI input/output contexts", dev,
-                        sizeof(struct xhci_device_control),
-                        64, xhci->page_size);
+                        2112, 64, xhci->page_size);
         if (!xhci->segment_pool || !xhci->device_pool)
                 goto fail;
 
@@ -675,14 +823,12 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
                         (unsigned long long)xhci->cmd_ring->first_seg->dma);
 
         /* Set the address in the Command Ring Control register */
-        val = xhci_readl(xhci, &xhci->op_regs->cmd_ring[0]);
-        val = (val & ~CMD_RING_ADDR_MASK) |
-                (xhci->cmd_ring->first_seg->dma & CMD_RING_ADDR_MASK) |
+        val_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
+        val_64 = (val_64 & (u64) CMD_RING_RSVD_BITS) |
+                (xhci->cmd_ring->first_seg->dma & (u64) ~CMD_RING_RSVD_BITS) |
                 xhci->cmd_ring->cycle_state;
-        xhci_dbg(xhci, "// Setting command ring address low bits to 0x%x\n", val);
-        xhci_writel(xhci, val, &xhci->op_regs->cmd_ring[0]);
-        xhci_dbg(xhci, "// Setting command ring address high bits to 0x0\n");
-        xhci_writel(xhci, (u32) 0, &xhci->op_regs->cmd_ring[1]);
+        xhci_dbg(xhci, "// Setting command ring address to 0x%x\n", val);
+        xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring);
         xhci_dbg_cmd_ptrs(xhci);
 
         val = xhci_readl(xhci, &xhci->cap_regs->db_off);
@@ -722,8 +868,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         /* set ring base address and size for each segment table entry */
         for (val = 0, seg = xhci->event_ring->first_seg; val < ERST_NUM_SEGS; val++) {
                 struct xhci_erst_entry *entry = &xhci->erst.entries[val];
-                entry->seg_addr[0] = seg->dma;
-                entry->seg_addr[1] = 0;
+                entry->seg_addr = seg->dma;
                 entry->seg_size = TRBS_PER_SEGMENT;
                 entry->rsvd = 0;
                 seg = seg->next;
@@ -741,11 +886,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         /* set the segment table base address */
         xhci_dbg(xhci, "// Set ERST base address for ir_set 0 = 0x%llx\n",
                         (unsigned long long)xhci->erst.erst_dma_addr);
-        val = xhci_readl(xhci, &xhci->ir_set->erst_base[0]);
-        val &= ERST_PTR_MASK;
-        val |= (xhci->erst.erst_dma_addr & ~ERST_PTR_MASK);
-        xhci_writel(xhci, val, &xhci->ir_set->erst_base[0]);
-        xhci_writel(xhci, 0, &xhci->ir_set->erst_base[1]);
+        val_64 = xhci_read_64(xhci, &xhci->ir_set->erst_base);
+        val_64 &= ERST_PTR_MASK;
+        val_64 |= (xhci->erst.erst_dma_addr & (u64) ~ERST_PTR_MASK);
+        xhci_write_64(xhci, val_64, &xhci->ir_set->erst_base);
 
         /* Set the event ring dequeue address */
         xhci_set_hc_event_deq(xhci);
@@ -761,7 +905,11 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         for (i = 0; i < MAX_HC_SLOTS; ++i)
                 xhci->devs[i] = 0;
 
+        if (scratchpad_alloc(xhci, flags))
+                goto fail;
+
         return 0;
+
 fail:
         xhci_warn(xhci, "Couldn't initialize memory\n");
         xhci_mem_cleanup(xhci);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 1462709e26c0..592fe7e623f7 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -117,6 +117,7 @@ static const struct hc_driver xhci_pci_hc_driver = {
         .free_dev =             xhci_free_dev,
         .add_endpoint =         xhci_add_endpoint,
         .drop_endpoint =        xhci_drop_endpoint,
+        .endpoint_reset =       xhci_endpoint_reset,
         .check_bandwidth =      xhci_check_bandwidth,
         .reset_bandwidth =      xhci_reset_bandwidth,
         .address_device =       xhci_address_device,
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 02d81985c454..aa88a067148b 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -135,6 +135,7 @@ static void next_trb(struct xhci_hcd *xhci,
 static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
 {
         union xhci_trb *next = ++(ring->dequeue);
+        unsigned long long addr;
 
         ring->deq_updates++;
         /* Update the dequeue pointer further if that was a link TRB or we're at
@@ -152,6 +153,13 @@ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
                 ring->dequeue = ring->deq_seg->trbs;
                 next = ring->dequeue;
         }
+        addr = (unsigned long long) xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);
+        if (ring == xhci->event_ring)
+                xhci_dbg(xhci, "Event ring deq = 0x%llx (DMA)\n", addr);
+        else if (ring == xhci->cmd_ring)
+                xhci_dbg(xhci, "Command ring deq = 0x%llx (DMA)\n", addr);
+        else
+                xhci_dbg(xhci, "Ring deq = 0x%llx (DMA)\n", addr);
 }
 
 /*
@@ -171,6 +179,7 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
 {
         u32 chain;
         union xhci_trb *next;
+        unsigned long long addr;
 
         chain = ring->enqueue->generic.field[3] & TRB_CHAIN;
         next = ++(ring->enqueue);
@@ -204,6 +213,13 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
                 ring->enqueue = ring->enq_seg->trbs;
                 next = ring->enqueue;
         }
+        addr = (unsigned long long) xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue);
+        if (ring == xhci->event_ring)
+                xhci_dbg(xhci, "Event ring enq = 0x%llx (DMA)\n", addr);
+        else if (ring == xhci->cmd_ring)
+                xhci_dbg(xhci, "Command ring enq = 0x%llx (DMA)\n", addr);
+        else
+                xhci_dbg(xhci, "Ring enq = 0x%llx (DMA)\n", addr);
 }
 
 /*
@@ -237,7 +253,7 @@ static int room_on_ring(struct xhci_hcd *xhci, struct xhci_ring *ring,
 
 void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
 {
-        u32 temp;
+        u64 temp;
         dma_addr_t deq;
 
         deq = xhci_trb_virt_to_dma(xhci->event_ring->deq_seg,
@@ -246,13 +262,15 @@ void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
                 xhci_warn(xhci, "WARN something wrong with SW event ring "
                                 "dequeue ptr.\n");
         /* Update HC event ring dequeue pointer */
-        temp = xhci_readl(xhci, &xhci->ir_set->erst_dequeue[0]);
+        temp = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
         temp &= ERST_PTR_MASK;
-        if (!in_interrupt())
-                xhci_dbg(xhci, "// Write event ring dequeue pointer\n");
-        xhci_writel(xhci, 0, &xhci->ir_set->erst_dequeue[1]);
-        xhci_writel(xhci, (deq & ~ERST_PTR_MASK) | temp,
-                        &xhci->ir_set->erst_dequeue[0]);
+        /* Don't clear the EHB bit (which is RW1C) because
+         * there might be more events to service.
+         */
+        temp &= ~ERST_EHB;
+        xhci_dbg(xhci, "// Write event ring dequeue pointer, preserving EHB bit\n");
+        xhci_write_64(xhci, ((u64) deq & (u64) ~ERST_PTR_MASK) | temp,
+                        &xhci->ir_set->erst_dequeue);
 }
 
 /* Ring the host controller doorbell after placing a command on the ring */
@@ -279,7 +297,8 @@ static void ring_ep_doorbell(struct xhci_hcd *xhci,
         /* Don't ring the doorbell for this endpoint if there are pending
          * cancellations because the we don't want to interrupt processing.
          */
-        if (!ep_ring->cancels_pending && !(ep_ring->state & SET_DEQ_PENDING)) {
+        if (!ep_ring->cancels_pending && !(ep_ring->state & SET_DEQ_PENDING)
+                        && !(ep_ring->state & EP_HALTED)) {
                 field = xhci_readl(xhci, db_addr) & DB_MASK;
                 xhci_writel(xhci, field | EPI_TO_DB(ep_index), db_addr);
                 /* Flush PCI posted writes - FIXME Matthew Wilcox says this
@@ -316,12 +335,6 @@ static struct xhci_segment *find_trb_seg(
         return cur_seg;
 }
 
-struct dequeue_state {
-        struct xhci_segment *new_deq_seg;
-        union xhci_trb *new_deq_ptr;
-        int new_cycle_state;
-};
-
 /*
  * Move the xHC's endpoint ring dequeue pointer past cur_td.
  * Record the new state of the xHC's endpoint ring dequeue segment,
@@ -336,24 +349,30 @@ struct dequeue_state {
  *  - Finally we move the dequeue state one TRB further, toggling the cycle bit
  *    if we've moved it past a link TRB with the toggle cycle bit set.
  */
-static void find_new_dequeue_state(struct xhci_hcd *xhci,
+void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                 unsigned int slot_id, unsigned int ep_index,
-                struct xhci_td *cur_td, struct dequeue_state *state)
+                struct xhci_td *cur_td, struct xhci_dequeue_state *state)
 {
         struct xhci_virt_device *dev = xhci->devs[slot_id];
         struct xhci_ring *ep_ring = dev->ep_rings[ep_index];
         struct xhci_generic_trb *trb;
+        struct xhci_ep_ctx *ep_ctx;
+        dma_addr_t addr;
 
         state->new_cycle_state = 0;
+        xhci_dbg(xhci, "Finding segment containing stopped TRB.\n");
         state->new_deq_seg = find_trb_seg(cur_td->start_seg,
                         ep_ring->stopped_trb,
                         &state->new_cycle_state);
         if (!state->new_deq_seg)
                 BUG();
         /* Dig out the cycle state saved by the xHC during the stop ep cmd */
-        state->new_cycle_state = 0x1 & dev->out_ctx->ep[ep_index].deq[0];
+        xhci_dbg(xhci, "Finding endpoint context\n");
+        ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
+        state->new_cycle_state = 0x1 & ep_ctx->deq;
 
         state->new_deq_ptr = cur_td->last_trb;
+        xhci_dbg(xhci, "Finding segment containing last TRB in TD.\n");
         state->new_deq_seg = find_trb_seg(state->new_deq_seg,
                         state->new_deq_ptr,
                         &state->new_cycle_state);
@@ -367,6 +386,12 @@ static void find_new_dequeue_state(struct xhci_hcd *xhci,
         next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
 
         /* Don't update the ring cycle state for the producer (us). */
+        xhci_dbg(xhci, "New dequeue segment = %p (virtual)\n",
+                        state->new_deq_seg);
+        addr = xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr);
+        xhci_dbg(xhci, "New dequeue pointer = 0x%llx (DMA)\n",
+                        (unsigned long long) addr);
+        xhci_dbg(xhci, "Setting dequeue pointer in internal ring state.\n");
         ep_ring->dequeue = state->new_deq_ptr;
         ep_ring->deq_seg = state->new_deq_seg;
 }
@@ -416,6 +441,30 @@ static int queue_set_tr_deq(struct xhci_hcd *xhci, int slot_id,
                 unsigned int ep_index, struct xhci_segment *deq_seg,
                 union xhci_trb *deq_ptr, u32 cycle_state);
 
+void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
+                struct xhci_ring *ep_ring, unsigned int slot_id,
+                unsigned int ep_index, struct xhci_dequeue_state *deq_state)
+{
+        xhci_dbg(xhci, "Set TR Deq Ptr cmd, new deq seg = %p (0x%llx dma), "
+                        "new deq ptr = %p (0x%llx dma), new cycle = %u\n",
+                        deq_state->new_deq_seg,
+                        (unsigned long long)deq_state->new_deq_seg->dma,
+                        deq_state->new_deq_ptr,
+                        (unsigned long long)xhci_trb_virt_to_dma(deq_state->new_deq_seg, deq_state->new_deq_ptr),
+                        deq_state->new_cycle_state);
+        queue_set_tr_deq(xhci, slot_id, ep_index,
+                        deq_state->new_deq_seg,
+                        deq_state->new_deq_ptr,
+                        (u32) deq_state->new_cycle_state);
+        /* Stop the TD queueing code from ringing the doorbell until
+         * this command completes.  The HC won't set the dequeue pointer
+         * if the ring is running, and ringing the doorbell starts the
+         * ring running.
+         */
+        ep_ring->state |= SET_DEQ_PENDING;
+        xhci_ring_cmd_db(xhci);
+}
+
 /*
  * When we get a command completion for a Stop Endpoint Command, we need to
  * unlink any cancelled TDs from the ring.  There are two ways to do that:
@@ -436,7 +485,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
         struct xhci_td *cur_td = 0;
         struct xhci_td *last_unlinked_td;
 
-        struct dequeue_state deq_state;
+        struct xhci_dequeue_state deq_state;
 #ifdef CONFIG_USB_HCD_STAT
         ktime_t stop_time = ktime_get();
 #endif
@@ -464,7 +513,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
                  * move the xHC endpoint ring dequeue pointer past this TD.
                  */
                 if (cur_td == ep_ring->stopped_td)
-                        find_new_dequeue_state(xhci, slot_id, ep_index, cur_td,
+                        xhci_find_new_dequeue_state(xhci, slot_id, ep_index, cur_td,
                                         &deq_state);
                 else
                         td_to_noop(xhci, ep_ring, cur_td);
@@ -480,24 +529,8 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
 
         /* If necessary, queue a Set Transfer Ring Dequeue Pointer command */
         if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
-                xhci_dbg(xhci, "Set TR Deq Ptr cmd, new deq seg = %p (0x%llx dma), "
-                                "new deq ptr = %p (0x%llx dma), new cycle = %u\n",
-                                deq_state.new_deq_seg,
-                                (unsigned long long)deq_state.new_deq_seg->dma,
-                                deq_state.new_deq_ptr,
-                                (unsigned long long)xhci_trb_virt_to_dma(deq_state.new_deq_seg, deq_state.new_deq_ptr),
-                                deq_state.new_cycle_state);
-                queue_set_tr_deq(xhci, slot_id, ep_index,
-                                deq_state.new_deq_seg,
-                                deq_state.new_deq_ptr,
-                                (u32) deq_state.new_cycle_state);
-                /* Stop the TD queueing code from ringing the doorbell until
-                 * this command completes.  The HC won't set the dequeue pointer
-                 * if the ring is running, and ringing the doorbell starts the
-                 * ring running.
-                 */
-                ep_ring->state |= SET_DEQ_PENDING;
-                xhci_ring_cmd_db(xhci);
+                xhci_queue_new_dequeue_state(xhci, ep_ring,
+                                slot_id, ep_index, &deq_state);
         } else {
                 /* Otherwise just ring the doorbell to restart the ring */
                 ring_ep_doorbell(xhci, slot_id, ep_index);
@@ -551,11 +584,15 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
         unsigned int ep_index;
         struct xhci_ring *ep_ring;
         struct xhci_virt_device *dev;
+        struct xhci_ep_ctx *ep_ctx;
+        struct xhci_slot_ctx *slot_ctx;
 
         slot_id = TRB_TO_SLOT_ID(trb->generic.field[3]);
         ep_index = TRB_TO_EP_INDEX(trb->generic.field[3]);
         dev = xhci->devs[slot_id];
         ep_ring = dev->ep_rings[ep_index];
+        ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
+        slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx);
 
         if (GET_COMP_CODE(event->status) != COMP_SUCCESS) {
                 unsigned int ep_state;
@@ -569,9 +606,9 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
                 case COMP_CTX_STATE:
                         xhci_warn(xhci, "WARN Set TR Deq Ptr cmd failed due "
                                         "to incorrect slot or ep state.\n");
-                        ep_state = dev->out_ctx->ep[ep_index].ep_info;
+                        ep_state = ep_ctx->ep_info;
                         ep_state &= EP_STATE_MASK;
-                        slot_state = dev->out_ctx->slot.dev_state;
+                        slot_state = slot_ctx->dev_state;
                         slot_state = GET_SLOT_STATE(slot_state);
                         xhci_dbg(xhci, "Slot state = %u, EP state = %u\n",
                                         slot_state, ep_state);
@@ -593,16 +630,33 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
                  * cancelling URBs, which might not be an error...
                  */
         } else {
-                xhci_dbg(xhci, "Successful Set TR Deq Ptr cmd, deq[0] = 0x%x, "
-                                "deq[1] = 0x%x.\n",
-                                dev->out_ctx->ep[ep_index].deq[0],
-                                dev->out_ctx->ep[ep_index].deq[1]);
+                xhci_dbg(xhci, "Successful Set TR Deq Ptr cmd, deq = @%08llx\n",
+                                ep_ctx->deq);
         }
 
         ep_ring->state &= ~SET_DEQ_PENDING;
         ring_ep_doorbell(xhci, slot_id, ep_index);
 }
 
+static void handle_reset_ep_completion(struct xhci_hcd *xhci,
+                struct xhci_event_cmd *event,
+                union xhci_trb *trb)
+{
+        int slot_id;
+        unsigned int ep_index;
+
+        slot_id = TRB_TO_SLOT_ID(trb->generic.field[3]);
+        ep_index = TRB_TO_EP_INDEX(trb->generic.field[3]);
+        /* This command will only fail if the endpoint wasn't halted,
+         * but we don't care.
+         */
+        xhci_dbg(xhci, "Ignoring reset ep completion code of %u\n",
+                        (unsigned int) GET_COMP_CODE(event->status));
+
+        /* Clear our internal halted state and restart the ring */
+        xhci->devs[slot_id]->ep_rings[ep_index]->state &= ~EP_HALTED;
+        ring_ep_doorbell(xhci, slot_id, ep_index);
+}
 
 static void handle_cmd_completion(struct xhci_hcd *xhci,
                 struct xhci_event_cmd *event)
@@ -611,7 +665,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
         u64 cmd_dma;
         dma_addr_t cmd_dequeue_dma;
 
-        cmd_dma = (((u64) event->cmd_trb[1]) << 32) + event->cmd_trb[0];
+        cmd_dma = event->cmd_trb;
         cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
                         xhci->cmd_ring->dequeue);
         /* Is the command ring deq ptr out of sync with the deq seg ptr? */
@@ -653,6 +707,9 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
         case TRB_TYPE(TRB_CMD_NOOP):
                 ++xhci->noops_handled;
                 break;
+        case TRB_TYPE(TRB_RESET_EP):
+                handle_reset_ep_completion(xhci, event, xhci->cmd_ring->dequeue);
+                break;
         default:
                 /* Skip over unknown commands on the event ring */
                 xhci->error_bitmask |= 1 << 6;
@@ -756,7 +813,9 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         union xhci_trb *event_trb;
         struct urb *urb = 0;
         int status = -EINPROGRESS;
+        struct xhci_ep_ctx *ep_ctx;
 
+        xhci_dbg(xhci, "In %s\n", __func__);
         xdev = xhci->devs[TRB_TO_SLOT_ID(event->flags)];
         if (!xdev) {
                 xhci_err(xhci, "ERROR Transfer event pointed to bad slot\n");
@@ -765,17 +824,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 
         /* Endpoint ID is 1 based, our index is zero based */
         ep_index = TRB_TO_EP_ID(event->flags) - 1;
+        xhci_dbg(xhci, "%s - ep index = %d\n", __func__, ep_index);
         ep_ring = xdev->ep_rings[ep_index];
-        if (!ep_ring || (xdev->out_ctx->ep[ep_index].ep_info & EP_STATE_MASK) == EP_STATE_DISABLED) {
+        ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
+        if (!ep_ring || (ep_ctx->ep_info & EP_STATE_MASK) == EP_STATE_DISABLED) {
                 xhci_err(xhci, "ERROR Transfer event pointed to disabled endpoint\n");
                 return -ENODEV;
         }
 
-        event_dma = event->buffer[0];
-        if (event->buffer[1] != 0)
-                xhci_warn(xhci, "WARN ignoring upper 32-bits of 64-bit TRB dma address\n");
-
+        event_dma = event->buffer;
         /* This TRB should be in the TD at the head of this ring's TD list */
+        xhci_dbg(xhci, "%s - checking for list empty\n", __func__);
         if (list_empty(&ep_ring->td_list)) {
                 xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
                                 TRB_TO_SLOT_ID(event->flags), ep_index);
@@ -785,11 +844,14 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 urb = NULL;
                 goto cleanup;
         }
+        xhci_dbg(xhci, "%s - getting list entry\n", __func__);
         td = list_entry(ep_ring->td_list.next, struct xhci_td, td_list);
 
         /* Is this a TRB in the currently executing TD? */
+        xhci_dbg(xhci, "%s - looking for TD\n", __func__);
         event_seg = trb_in_td(ep_ring->deq_seg, ep_ring->dequeue,
                         td->last_trb, event_dma);
+        xhci_dbg(xhci, "%s - found event_seg = %p\n", __func__, event_seg);
         if (!event_seg) {
                 /* HC is busted, give up! */
                 xhci_err(xhci, "ERROR Transfer event TRB DMA ptr not part of current TD\n");
@@ -798,10 +860,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         event_trb = &event_seg->trbs[(event_dma - event_seg->dma) / sizeof(*event_trb)];
         xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
                         (unsigned int) (event->flags & TRB_TYPE_BITMASK)>>10);
-        xhci_dbg(xhci, "Offset 0x00 (buffer[0]) = 0x%x\n",
-                        (unsigned int) event->buffer[0]);
-        xhci_dbg(xhci, "Offset 0x04 (buffer[0]) = 0x%x\n",
-                        (unsigned int) event->buffer[1]);
+        xhci_dbg(xhci, "Offset 0x00 (buffer lo) = 0x%x\n",
+                        lower_32_bits(event->buffer));
+        xhci_dbg(xhci, "Offset 0x04 (buffer hi) = 0x%x\n",
+                        upper_32_bits(event->buffer));
         xhci_dbg(xhci, "Offset 0x08 (transfer length) = 0x%x\n",
                         (unsigned int) event->transfer_len);
         xhci_dbg(xhci, "Offset 0x0C (flags) = 0x%x\n",
@@ -823,6 +885,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 break;
         case COMP_STALL:
                 xhci_warn(xhci, "WARN: Stalled endpoint\n");
+                ep_ring->state |= EP_HALTED;
                 status = -EPIPE;
                 break;
         case COMP_TRB_ERR:
@@ -833,6 +896,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 xhci_warn(xhci, "WARN: transfer error on endpoint\n");
                 status = -EPROTO;
                 break;
+        case COMP_BABBLE:
+                xhci_warn(xhci, "WARN: babble error on endpoint\n");
+                status = -EOVERFLOW;
+                break;
         case COMP_DB_ERR:
                 xhci_warn(xhci, "WARN: HC couldn't access mem fast enough\n");
                 status = -ENOSR;
@@ -874,15 +941,26 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 if (event_trb != ep_ring->dequeue) {
                         /* The event was for the status stage */
                         if (event_trb == td->last_trb) {
-                                td->urb->actual_length =
-                                        td->urb->transfer_buffer_length;
+                                if (td->urb->actual_length != 0) {
+                                        /* Don't overwrite a previously set error code */
+                                        if (status == -EINPROGRESS || status == 0)
+                                                /* Did we already see a short data stage? */
+                                                status = -EREMOTEIO;
+                                } else {
+                                        td->urb->actual_length =
+                                                td->urb->transfer_buffer_length;
+                                }
                         } else {
                         /* Maybe the event was for the data stage? */
-                                if (GET_COMP_CODE(event->transfer_len) != COMP_STOP_INVAL)
+                                if (GET_COMP_CODE(event->transfer_len) != COMP_STOP_INVAL) {
                                         /* We didn't stop on a link TRB in the middle */
                                         td->urb->actual_length =
                                                 td->urb->transfer_buffer_length -
                                                 TRB_LEN(event->transfer_len);
+                                        xhci_dbg(xhci, "Waiting for status stage event\n");
+                                        urb = NULL;
+                                        goto cleanup;
+                                }
                         }
                 }
         } else {
@@ -929,16 +1007,20 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                                         TRB_LEN(event->transfer_len));
                                         td->urb->actual_length = 0;
                                 }
-                                if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-                                        status = -EREMOTEIO;
-                                else
-                                        status = 0;
+                                /* Don't overwrite a previously set error code */
+                                if (status == -EINPROGRESS) {
+                                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                                status = -EREMOTEIO;
+                                        else
+                                                status = 0;
+                                }
                         } else {
                                 td->urb->actual_length = td->urb->transfer_buffer_length;
                                 /* Ignore a short packet completion if the
                                  * untransferred length was zero.
                                  */
-                                status = 0;
+                                if (status == -EREMOTEIO)
+                                        status = 0;
                         }
                 } else {
                         /* Slow path - walk the list, starting from the dequeue
@@ -965,19 +1047,30 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                         TRB_LEN(event->transfer_len);
                 }
         }
-        /* The Endpoint Stop Command completion will take care of
-         * any stopped TDs.  A stopped TD may be restarted, so don't update the
-         * ring dequeue pointer or take this TD off any lists yet.
-         */
         if (GET_COMP_CODE(event->transfer_len) == COMP_STOP_INVAL ||
                         GET_COMP_CODE(event->transfer_len) == COMP_STOP) {
+                /* The Endpoint Stop Command completion will take care of any
+                 * stopped TDs.  A stopped TD may be restarted, so don't update
+                 * the ring dequeue pointer or take this TD off any lists yet.
+                 */
                 ep_ring->stopped_td = td;
                 ep_ring->stopped_trb = event_trb;
         } else {
-                /* Update ring dequeue pointer */
-                while (ep_ring->dequeue != td->last_trb)
+                if (GET_COMP_CODE(event->transfer_len) == COMP_STALL) {
+                        /* The transfer is completed from the driver's
+                         * perspective, but we need to issue a set dequeue
+                         * command for this stalled endpoint to move the dequeue
+                         * pointer past the TD.  We can't do that here because
+                         * the halt condition must be cleared first.
+                         */
+                        ep_ring->stopped_td = td;
+                        ep_ring->stopped_trb = event_trb;
+                } else {
+                        /* Update ring dequeue pointer */
+                        while (ep_ring->dequeue != td->last_trb)
+                                inc_deq(xhci, ep_ring, false);
                         inc_deq(xhci, ep_ring, false);
-                inc_deq(xhci, ep_ring, false);
+                }
 
                 /* Clean up the endpoint's TD list */
                 urb = td->urb;
@@ -987,7 +1080,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         list_del(&td->cancelled_td_list);
                         ep_ring->cancels_pending--;
                 }
-                kfree(td);
+                /* Leave the TD around for the reset endpoint function to use */
+                if (GET_COMP_CODE(event->transfer_len) != COMP_STALL) {
+                        kfree(td);
+                }
                 urb->hcpriv = NULL;
         }
 cleanup:
@@ -997,6 +1093,8 @@ cleanup:
         /* FIXME for multi-TD URBs (who have buffers bigger than 64MB) */
         if (urb) {
                 usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb);
+                xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n",
+                                urb, td->urb->actual_length, status);
                 spin_unlock(&xhci->lock);
                 usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status);
                 spin_lock(&xhci->lock);
@@ -1014,6 +1112,7 @@ void xhci_handle_event(struct xhci_hcd *xhci)
         int update_ptrs = 1;
         int ret;
 
+        xhci_dbg(xhci, "In %s\n", __func__);
         if (!xhci->event_ring || !xhci->event_ring->dequeue) {
                 xhci->error_bitmask |= 1 << 1;
                 return;
@@ -1026,18 +1125,25 @@ void xhci_handle_event(struct xhci_hcd *xhci)
                 xhci->error_bitmask |= 1 << 2;
                 return;
         }
+        xhci_dbg(xhci, "%s - OS owns TRB\n", __func__);
 
         /* FIXME: Handle more event types. */
         switch ((event->event_cmd.flags & TRB_TYPE_BITMASK)) {
         case TRB_TYPE(TRB_COMPLETION):
+                xhci_dbg(xhci, "%s - calling handle_cmd_completion\n", __func__);
                 handle_cmd_completion(xhci, &event->event_cmd);
+                xhci_dbg(xhci, "%s - returned from handle_cmd_completion\n", __func__);
                 break;
         case TRB_TYPE(TRB_PORT_STATUS):
+                xhci_dbg(xhci, "%s - calling handle_port_status\n", __func__);
                 handle_port_status(xhci, event);
+                xhci_dbg(xhci, "%s - returned from handle_port_status\n", __func__);
                 update_ptrs = 0;
                 break;
         case TRB_TYPE(TRB_TRANSFER):
+                xhci_dbg(xhci, "%s - calling handle_tx_event\n", __func__);
                 ret = handle_tx_event(xhci, &event->trans_event);
+                xhci_dbg(xhci, "%s - returned from handle_tx_event\n", __func__);
                 if (ret < 0)
                         xhci->error_bitmask |= 1 << 9;
                 else
@@ -1093,13 +1199,13 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
                  */
                 xhci_warn(xhci, "WARN urb submitted to disabled ep\n");
                 return -ENOENT;
-        case EP_STATE_HALTED:
         case EP_STATE_ERROR:
-                xhci_warn(xhci, "WARN waiting for halt or error on ep "
-                                "to be cleared\n");
+                xhci_warn(xhci, "WARN waiting for error on ep to be cleared\n");
                 /* FIXME event handling code for error needs to clear it */
                 /* XXX not sure if this should be -ENOENT or not */
                 return -EINVAL;
+        case EP_STATE_HALTED:
+                xhci_dbg(xhci, "WARN halted endpoint, queueing URB anyway.\n");
         case EP_STATE_STOPPED:
         case EP_STATE_RUNNING:
                 break;
@@ -1128,9 +1234,9 @@ static int prepare_transfer(struct xhci_hcd *xhci,
                 gfp_t mem_flags)
 {
         int ret;
-
+        struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
         ret = prepare_ring(xhci, xdev->ep_rings[ep_index],
-                        xdev->out_ctx->ep[ep_index].ep_info & EP_STATE_MASK,
+                        ep_ctx->ep_info & EP_STATE_MASK,
                         num_trbs, mem_flags);
         if (ret)
                 return ret;
@@ -1285,6 +1391,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* Queue the first TRB, even if it's zero-length */
         do {
                 u32 field = 0;
+                u32 length_field = 0;
 
                 /* Don't change the cycle bit of the first TRB until later */
                 if (first_trb)
@@ -1314,10 +1421,13 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                                         (unsigned int) (addr + TRB_MAX_BUFF_SIZE) & ~(TRB_MAX_BUFF_SIZE - 1),
                                         (unsigned int) addr + trb_buff_len);
                 }
+                length_field = TRB_LEN(trb_buff_len) |
+                        TD_REMAINDER(urb->transfer_buffer_length - running_total) |
+                        TRB_INTR_TARGET(0);
                 queue_trb(xhci, ep_ring, false,
-                                (u32) addr,
-                                (u32) ((u64) addr >> 32),
-                                TRB_LEN(trb_buff_len) | TRB_INTR_TARGET(0),
+                                lower_32_bits(addr),
+                                upper_32_bits(addr),
+                                length_field,
                                 /* We always want to know if the TRB was short,
                                  * or we won't get an event when it completes.
                                  * (Unless we use event data TRBs, which are a
@@ -1365,7 +1475,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         struct xhci_generic_trb *start_trb;
         bool first_trb;
         int start_cycle;
-        u32 field;
+        u32 field, length_field;
 
         int running_total, trb_buff_len, ret;
         u64 addr;
@@ -1443,10 +1553,13 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                         td->last_trb = ep_ring->enqueue;
                         field |= TRB_IOC;
                 }
+                length_field = TRB_LEN(trb_buff_len) |
+                        TD_REMAINDER(urb->transfer_buffer_length - running_total) |
+                        TRB_INTR_TARGET(0);
                 queue_trb(xhci, ep_ring, false,
-                                (u32) addr,
-                                (u32) ((u64) addr >> 32),
-                                TRB_LEN(trb_buff_len) | TRB_INTR_TARGET(0),
+                                lower_32_bits(addr),
+                                upper_32_bits(addr),
+                                length_field,
                                 /* We always want to know if the TRB was short,
                                  * or we won't get an event when it completes.
                                  * (Unless we use event data TRBs, which are a
@@ -1478,7 +1591,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         struct usb_ctrlrequest *setup;
         struct xhci_generic_trb *start_trb;
         int start_cycle;
-        u32 field;
+        u32 field, length_field;
         struct xhci_td *td;
 
         ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
@@ -1528,13 +1641,16 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
         /* If there's data, queue data TRBs */
         field = 0;
+        length_field = TRB_LEN(urb->transfer_buffer_length) |
+                TD_REMAINDER(urb->transfer_buffer_length) |
+                TRB_INTR_TARGET(0);
         if (urb->transfer_buffer_length > 0) {
                 if (setup->bRequestType & USB_DIR_IN)
                         field |= TRB_DIR_IN;
                 queue_trb(xhci, ep_ring, false,
                                 lower_32_bits(urb->transfer_dma),
                                 upper_32_bits(urb->transfer_dma),
-                                TRB_LEN(urb->transfer_buffer_length) | TRB_INTR_TARGET(0),
+                                length_field,
                                 /* Event on short tx */
                                 field | TRB_ISP | TRB_TYPE(TRB_DATA) | ep_ring->cycle_state);
         }
@@ -1603,7 +1719,8 @@ int xhci_queue_slot_control(struct xhci_hcd *xhci, u32 trb_type, u32 slot_id)
 int xhci_queue_address_device(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id)
 {
-        return queue_command(xhci, in_ctx_ptr, 0, 0,
+        return queue_command(xhci, lower_32_bits(in_ctx_ptr),
+                        upper_32_bits(in_ctx_ptr), 0,
                         TRB_TYPE(TRB_ADDR_DEV) | SLOT_ID_FOR_TRB(slot_id));
 }
 
@@ -1611,7 +1728,8 @@ int xhci_queue_address_device(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
 int xhci_queue_configure_endpoint(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id)
 {
-        return queue_command(xhci, in_ctx_ptr, 0, 0,
+        return queue_command(xhci, lower_32_bits(in_ctx_ptr),
+                        upper_32_bits(in_ctx_ptr), 0,
                         TRB_TYPE(TRB_CONFIG_EP) | SLOT_ID_FOR_TRB(slot_id));
 }
 
@@ -1639,10 +1757,23 @@ static int queue_set_tr_deq(struct xhci_hcd *xhci, int slot_id,
         u32 type = TRB_TYPE(TRB_SET_DEQ);
 
         addr = xhci_trb_virt_to_dma(deq_seg, deq_ptr);
-        if (addr == 0)
+        if (addr == 0) {
                 xhci_warn(xhci, "WARN Cannot submit Set TR Deq Ptr\n");
                 xhci_warn(xhci, "WARN deq seg = %p, deq pt = %p\n",
                                 deq_seg, deq_ptr);
-        return queue_command(xhci, (u32) addr | cycle_state, 0, 0,
+                return 0;
+        }
+        return queue_command(xhci, lower_32_bits(addr) | cycle_state,
+                        upper_32_bits(addr), 0,
                         trb_slot_id | trb_ep_index | type);
 }
+
+int xhci_queue_reset_ep(struct xhci_hcd *xhci, int slot_id,
+                unsigned int ep_index)
+{
+        u32 trb_slot_id = SLOT_ID_FOR_TRB(slot_id);
+        u32 trb_ep_index = EP_ID_FOR_TRB(ep_index);
+        u32 type = TRB_TYPE(TRB_RESET_EP);
+
+        return queue_command(xhci, 0, 0, 0, trb_slot_id | trb_ep_index | type);
+}
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 8936eeb5588b..d31d32206ba3 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -25,6 +25,7 @@
 
 #include <linux/usb.h>
 #include <linux/timer.h>
+#include <linux/kernel.h>
 
 #include "../core/hcd.h"
 /* Code sharing between pci-quirks and xhci hcd */
@@ -42,14 +43,6 @@
  * xHCI register interface.
  * This corresponds to the eXtensible Host Controller Interface (xHCI)
  * Revision 0.95 specification
- *
- * Registers should always be accessed with double word or quad word accesses.
- *
- * Some xHCI implementations may support 64-bit address pointers.  Registers
- * with 64-bit address pointers should be written to with dword accesses by
- * writing the low dword first (ptr[0]), then the high dword (ptr[1]) second.
- * xHCI implementations that do not support 64-bit address pointers will ignore
- * the high dword, and write order is irrelevant.
  */
 
 /**
@@ -96,6 +89,7 @@ struct xhci_cap_regs {
 #define HCS_ERST_MAX(p)         (((p) >> 4) & 0xf)
 /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
 /* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
+#define HCS_MAX_SCRATCHPAD(p)   (((p) >> 27) & 0x1f)
 
 /* HCSPARAMS3 - hcs_params3 - bitmasks */
 /* bits 0:7, Max U1 to U0 latency for the roothub ports */
@@ -166,10 +160,10 @@ struct xhci_op_regs {
         u32     reserved1;
         u32     reserved2;
         u32     dev_notification;
-        u32     cmd_ring[2];
+        u64     cmd_ring;
         /* rsvd: offset 0x20-2F */
         u32     reserved3[4];
-        u32     dcbaa_ptr[2];
+        u64     dcbaa_ptr;
         u32     config_reg;
         /* rsvd: offset 0x3C-3FF */
         u32     reserved4[241];
@@ -254,7 +248,7 @@ struct xhci_op_regs {
 #define CMD_RING_RUNNING        (1 << 3)
 /* bits 4:5 reserved and should be preserved */
 /* Command Ring pointer - bit mask for the lower 32 bits. */
-#define CMD_RING_ADDR_MASK      (0xffffffc0)
+#define CMD_RING_RSVD_BITS      (0x3f)
 
 /* CONFIG - Configure Register - config_reg bitmasks */
 /* bits 0:7 - maximum number of device slots enabled (NumSlotsEn) */
@@ -382,8 +376,8 @@ struct xhci_intr_reg {
         u32     irq_control;
         u32     erst_size;
         u32     rsvd;
-        u32     erst_base[2];
-        u32     erst_dequeue[2];
+        u64     erst_base;
+        u64     erst_dequeue;
 };
 
 /* irq_pending bitmasks */
@@ -453,6 +447,27 @@ struct xhci_doorbell_array {
 
 
 /**
+ * struct xhci_container_ctx
+ * @type: Type of context.  Used to calculated offsets to contained contexts.
+ * @size: Size of the context data
+ * @bytes: The raw context data given to HW
+ * @dma: dma address of the bytes
+ *
+ * Represents either a Device or Input context.  Holds a pointer to the raw
+ * memory used for the context (bytes) and dma address of it (dma).
+ */
+struct xhci_container_ctx {
+        unsigned type;
+#define XHCI_CTX_TYPE_DEVICE  0x1
+#define XHCI_CTX_TYPE_INPUT   0x2
+
+        int size;
+
+        u8 *bytes;
+        dma_addr_t dma;
+};
+
+/**
  * struct xhci_slot_ctx
  * @dev_info:   Route string, device speed, hub info, and last valid endpoint
  * @dev_info2:  Max exit latency for device number, root hub port number
@@ -538,7 +553,7 @@ struct xhci_slot_ctx {
 struct xhci_ep_ctx {
         u32     ep_info;
         u32     ep_info2;
-        u32     deq[2];
+        u64     deq;
         u32     tx_info;
         /* offset 0x14 - 0x1f reserved for HC internal use */
         u32     reserved[3];
@@ -589,18 +604,16 @@ struct xhci_ep_ctx {
 
 
 /**
- * struct xhci_device_control
- * Input/Output context; see section 6.2.5.
+ * struct xhci_input_control_context
+ * Input control context; see section 6.2.5.
  *
  * @drop_context:       set the bit of the endpoint context you want to disable
  * @add_context:        set the bit of the endpoint context you want to enable
  */
-struct xhci_device_control {
+struct xhci_input_control_ctx {
         u32     drop_flags;
         u32     add_flags;
-        u32     rsvd[6];
-        struct xhci_slot_ctx    slot;
-        struct xhci_ep_ctx      ep[31];
+        u32     rsvd2[6];
 };
 
 /* drop context bitmasks */
@@ -608,7 +621,6 @@ struct xhci_device_control {
 /* add context bitmasks */
 #define ADD_EP(x)       (0x1 << x)
 
-
 struct xhci_virt_device {
         /*
          * Commands to the hardware are passed an "input context" that
@@ -618,11 +630,10 @@ struct xhci_virt_device {
          * track of input and output contexts separately because
          * these commands might fail and we don't trust the hardware.
          */
-        struct xhci_device_control      *out_ctx;
-        dma_addr_t                      out_ctx_dma;
+        struct xhci_container_ctx       *out_ctx;
         /* Used for addressing devices and configuration changes */
-        struct xhci_device_control      *in_ctx;
-        dma_addr_t                      in_ctx_dma;
+        struct xhci_container_ctx       *in_ctx;
+
         /* FIXME when stream support is added */
         struct xhci_ring                *ep_rings[31];
         /* Temporary storage in case the configure endpoint command fails and we
@@ -641,7 +652,7 @@ struct xhci_virt_device {
  */
 struct xhci_device_context_array {
         /* 64-bit device addresses; we only write 32-bit addresses */
-        u32                     dev_context_ptrs[2*MAX_HC_SLOTS];
+        u64                     dev_context_ptrs[MAX_HC_SLOTS];
         /* private xHCD pointers */
         dma_addr_t      dma;
 };
@@ -654,7 +665,7 @@ struct xhci_device_context_array {
 
 struct xhci_stream_ctx {
         /* 64-bit stream ring address, cycle state, and stream type */
-        u32     stream_ring[2];
+        u64     stream_ring;
         /* offset 0x14 - 0x1f reserved for HC internal use */
         u32     reserved[2];
 };
@@ -662,7 +673,7 @@ struct xhci_stream_ctx {
 
 struct xhci_transfer_event {
         /* 64-bit buffer address, or immediate data */
-        u32     buffer[2];
+        u64     buffer;
         u32     transfer_len;
         /* This field is interpreted differently based on the type of TRB */
         u32     flags;
@@ -744,7 +755,7 @@ struct xhci_transfer_event {
 
 struct xhci_link_trb {
         /* 64-bit segment pointer*/
-        u32 segment_ptr[2];
+        u64 segment_ptr;
         u32 intr_target;
         u32 control;
 };
@@ -755,7 +766,7 @@ struct xhci_link_trb {
 /* Command completion event TRB */
 struct xhci_event_cmd {
         /* Pointer to command TRB, or the value passed by the event data trb */
-        u32 cmd_trb[2];
+        u64 cmd_trb;
         u32 status;
         u32 flags;
 };
@@ -848,8 +859,8 @@ union xhci_trb {
 #define TRB_CONFIG_EP           12
 /* Evaluate Context Command */
 #define TRB_EVAL_CONTEXT        13
-/* Reset Transfer Ring Command */
-#define TRB_RESET_RING          14
+/* Reset Endpoint Command */
+#define TRB_RESET_EP            14
 /* Stop Transfer Ring Command */
 #define TRB_STOP_RING           15
 /* Set Transfer Ring Dequeue Pointer Command */
@@ -929,6 +940,7 @@ struct xhci_ring {
         unsigned int            cancels_pending;
         unsigned int            state;
 #define SET_DEQ_PENDING         (1 << 0)
+#define EP_HALTED               (1 << 1)
         /* The TRB that was last reported in a stopped endpoint ring */
         union xhci_trb          *stopped_trb;
         struct xhci_td          *stopped_td;
@@ -940,9 +952,15 @@ struct xhci_ring {
         u32                     cycle_state;
 };
 
+struct xhci_dequeue_state {
+        struct xhci_segment *new_deq_seg;
+        union xhci_trb *new_deq_ptr;
+        int new_cycle_state;
+};
+
 struct xhci_erst_entry {
         /* 64-bit event ring segment address */
-        u32     seg_addr[2];
+        u64     seg_addr;
         u32     seg_size;
         /* Set to zero */
         u32     rsvd;
@@ -957,6 +975,13 @@ struct xhci_erst {
         unsigned int            erst_size;
 };
 
+struct xhci_scratchpad {
+        u64 *sp_array;
+        dma_addr_t sp_dma;
+        void **sp_buffers;
+        dma_addr_t *sp_dma_buffers;
+};
+
 /*
  * Each segment table entry is 4*32bits long.  1K seems like an ok size:
  * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
@@ -1011,6 +1036,9 @@ struct xhci_hcd {
         struct xhci_ring        *cmd_ring;
         struct xhci_ring        *event_ring;
         struct xhci_erst        erst;
+        /* Scratchpad */
+        struct xhci_scratchpad  *scratchpad;
+
         /* slot enabling and address device helpers */
         struct completion       addr_dev;
         int slot_id;
@@ -1071,13 +1099,43 @@ static inline unsigned int xhci_readl(const struct xhci_hcd *xhci,
 static inline void xhci_writel(struct xhci_hcd *xhci,
                 const unsigned int val, __u32 __iomem *regs)
 {
-        if (!in_interrupt())
-                xhci_dbg(xhci,
-                         "`MEM_WRITE_DWORD(3'b000, 32'h%p, 32'h%0x, 4'hf);\n",
-                         regs, val);
+        xhci_dbg(xhci,
+                        "`MEM_WRITE_DWORD(3'b000, 32'h%p, 32'h%0x, 4'hf);\n",
+                        regs, val);
         writel(val, regs);
 }
 
+/*
+ * Registers should always be accessed with double word or quad word accesses.
+ *
+ * Some xHCI implementations may support 64-bit address pointers.  Registers
+ * with 64-bit address pointers should be written to with dword accesses by
+ * writing the low dword first (ptr[0]), then the high dword (ptr[1]) second.
+ * xHCI implementations that do not support 64-bit address pointers will ignore
+ * the high dword, and write order is irrelevant.
+ */
+static inline u64 xhci_read_64(const struct xhci_hcd *xhci,
+                __u64 __iomem *regs)
+{
+        __u32 __iomem *ptr = (__u32 __iomem *) regs;
+        u64 val_lo = readl(ptr);
+        u64 val_hi = readl(ptr + 1);
+        return val_lo + (val_hi << 32);
+}
+static inline void xhci_write_64(struct xhci_hcd *xhci,
+                const u64 val, __u64 __iomem *regs)
+{
+        __u32 __iomem *ptr = (__u32 __iomem *) regs;
+        u32 val_lo = lower_32_bits(val);
+        u32 val_hi = upper_32_bits(val);
+
+        xhci_dbg(xhci,
+                        "`MEM_WRITE_DWORD(3'b000, 64'h%p, 64'h%0lx, 4'hf);\n",
+                        regs, (long unsigned int) val);
+        writel(val_lo, ptr);
+        writel(val_hi, ptr + 1);
+}
+
 /* xHCI debugging */
 void xhci_print_ir_set(struct xhci_hcd *xhci, struct xhci_intr_reg *ir_set, int set_num);
 void xhci_print_registers(struct xhci_hcd *xhci);
@@ -1090,7 +1148,7 @@ void xhci_debug_ring(struct xhci_hcd *xhci, struct xhci_ring *ring);
 void xhci_dbg_erst(struct xhci_hcd *xhci, struct xhci_erst *erst);
 void xhci_dbg_cmd_ptrs(struct xhci_hcd *xhci);
 void xhci_dbg_ring_ptrs(struct xhci_hcd *xhci, struct xhci_ring *ring);
-void xhci_dbg_ctx(struct xhci_hcd *xhci, struct xhci_device_control *ctx, dma_addr_t dma, unsigned int last_ep);
+void xhci_dbg_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx, unsigned int last_ep);
 
 /* xHCI memory managment */
 void xhci_mem_cleanup(struct xhci_hcd *xhci);
@@ -1128,6 +1186,7 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags);
 int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status);
 int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev, struct usb_host_endpoint *ep);
 int xhci_drop_endpoint(struct usb_hcd *hcd, struct usb_device *udev, struct usb_host_endpoint *ep);
+void xhci_endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
 int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev);
 void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev);
 
@@ -1148,10 +1207,23 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
                 int slot_id, unsigned int ep_index);
 int xhci_queue_configure_endpoint(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id);
+int xhci_queue_reset_ep(struct xhci_hcd *xhci, int slot_id,
+                unsigned int ep_index);
+void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+                unsigned int slot_id, unsigned int ep_index,
+                struct xhci_td *cur_td, struct xhci_dequeue_state *state);
+void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
+                struct xhci_ring *ep_ring, unsigned int slot_id,
+                unsigned int ep_index, struct xhci_dequeue_state *deq_state);
 
 /* xHCI roothub code */
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
                 char *buf, u16 wLength);
 int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
 
+/* xHCI contexts */
+struct xhci_input_control_ctx *xhci_get_input_control_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx);
+struct xhci_slot_ctx *xhci_get_slot_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx);
+struct xhci_ep_ctx *xhci_get_ep_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx, unsigned int ep_index);
+
 #endif /* __LINUX_XHCI_HCD_H */
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index a68d91a11bee..abe3aa67ed00 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -220,7 +220,7 @@ config USB_IOWARRIOR
 
 config USB_TEST
         tristate "USB testing driver"
-        depends on USB && USB_DEVICEFS
+        depends on USB
         help
           This driver is for testing host controller software.  It is used
           with specialized device firmware for regression and stress testing,
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 554a414f65d1..c7c1ca0494cd 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1326,7 +1326,6 @@ static int __init musb_core_init(u16 musb_type, struct musb *musb)
         int             i;
 
         /* log core options (read using indexed model) */
-        musb_ep_select(mbase, 0);
         reg = musb_read_configdata(mbase);
 
         strcpy(aInfo, (reg & MUSB_CONFIGDATA_UTMIDW) ? "UTMI-16" : "UTMI-8");
@@ -1990,7 +1989,7 @@ bad_config:
         if (status < 0)
                 goto fail2;
 
-#ifdef CONFIG_USB_OTG
+#ifdef CONFIG_USB_MUSB_OTG
         setup_timer(&musb->otg_timer, musb_otg_timer_func, (unsigned long) musb);
 #endif
 
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 40ed50ecedff..7a6778675ad3 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -407,7 +407,7 @@ stall:
                                         csr |= MUSB_RXCSR_P_SENDSTALL
                                                 | MUSB_RXCSR_FLUSHFIFO
                                                 | MUSB_RXCSR_CLRDATATOG
-                                                | MUSB_TXCSR_P_WZC_BITS;
+                                                | MUSB_RXCSR_P_WZC_BITS;
                                         musb_writew(regs, MUSB_RXCSR,
                                                         csr);
                                 }
diff --git a/drivers/usb/musb/musb_regs.h b/drivers/usb/musb/musb_regs.h
index de3b2f18db44..fbfd3fd9ce1f 100644
--- a/drivers/usb/musb/musb_regs.h
+++ b/drivers/usb/musb/musb_regs.h
@@ -323,6 +323,7 @@ static inline void  musb_write_rxfifoadd(void __iomem *mbase, u16 c_off)
 
 static inline u8 musb_read_configdata(void __iomem *mbase)
 {
+        musb_writeb(mbase, MUSB_INDEX, 0);
         return musb_readb(mbase, 0x10 + MUSB_CONFIGDATA);
 }
 
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index e9a40b820fd4..985cbcf48bda 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -80,6 +80,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10C4, 0x80F6) }, /* Suunto sports instrument */
         { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
         { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
+        { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
         { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
         { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
         { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
@@ -96,7 +97,9 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10c4, 0x8293) }, /* Telegesys ETRX2USB */
         { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
         { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+        { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
         { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
+        { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
         { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 60c64cc5be2a..b574878c78b2 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -698,6 +698,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+        { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index c9fbd7415092..24dbd99e87d7 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -947,6 +947,13 @@
 #define FTDI_TURTELIZER_PID     0xBDC8 /* JTAG/RS-232 adapter by egnite GmBH */
 
 /*
+ * GN Otometrics (http://www.otometrics.com)
+ * Submitted by Ville Sundberg.
+ */
+#define GN_OTOMETRICS_VID       0x0c33  /* Vendor ID */
+#define AURICAL_USB_PID         0x0010  /* Aurical USB Audiometer */
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index c31940a307f8..270009afdf77 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -124,10 +124,13 @@
 #define BANDB_DEVICE_ID_USOPTL4_4       0xAC44
 #define BANDB_DEVICE_ID_USOPTL4_2       0xAC42
 
-/* This driver also supports the ATEN UC2324 device since it is mos7840 based
- *  - if I knew the device id it would also support the ATEN UC2322 */
+/* This driver also supports
+ * ATEN UC2324 device using Moschip MCS7840
+ * ATEN UC2322 device using Moschip MCS7820
+ */
 #define USB_VENDOR_ID_ATENINTL          0x0557
 #define ATENINTL_DEVICE_ID_UC2324       0x2011
+#define ATENINTL_DEVICE_ID_UC2322       0x7820
 
 /* Interrupt Routine Defines    */
 
@@ -177,6 +180,7 @@ static struct usb_device_id moschip_port_id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
         {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
+        {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
         {}                      /* terminating entry */
 };
 
@@ -186,6 +190,7 @@ static __devinitdata struct usb_device_id moschip_id_table_combined[] = {
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
         {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
+        {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
         {}                      /* terminating entry */
 };
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 98262dd552bb..c784ddbe7b61 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -66,8 +66,10 @@ static int  option_tiocmget(struct tty_struct *tty, struct file *file);
 static int  option_tiocmset(struct tty_struct *tty, struct file *file,
                                 unsigned int set, unsigned int clear);
 static int  option_send_setup(struct usb_serial_port *port);
+#ifdef CONFIG_PM
 static int  option_suspend(struct usb_serial *serial, pm_message_t message);
 static int  option_resume(struct usb_serial *serial);
+#endif
 
 /* Vendor and product IDs */
 #define OPTION_VENDOR_ID                        0x0AF0
@@ -205,6 +207,7 @@ static int  option_resume(struct usb_serial *serial);
 #define NOVATELWIRELESS_PRODUCT_MC727           0x4100
 #define NOVATELWIRELESS_PRODUCT_MC950D          0x4400
 #define NOVATELWIRELESS_PRODUCT_U727            0x5010
+#define NOVATELWIRELESS_PRODUCT_MC727_NEW       0x5100
 #define NOVATELWIRELESS_PRODUCT_MC760           0x6000
 #define NOVATELWIRELESS_PRODUCT_OVMC760         0x6002
 
@@ -259,11 +262,6 @@ static int  option_resume(struct usb_serial *serial);
 #define AXESSTEL_VENDOR_ID                      0x1726
 #define AXESSTEL_PRODUCT_MV110H                 0x1000
 
-#define ONDA_VENDOR_ID                          0x19d2
-#define ONDA_PRODUCT_MSA501HS                   0x0001
-#define ONDA_PRODUCT_ET502HS                    0x0002
-#define ONDA_PRODUCT_MT503HS                    0x2000
-
 #define BANDRICH_VENDOR_ID                      0x1A8D
 #define BANDRICH_PRODUCT_C100_1                 0x1002
 #define BANDRICH_PRODUCT_C100_2                 0x1003
@@ -301,6 +299,7 @@ static int  option_resume(struct usb_serial *serial);
 #define ZTE_PRODUCT_MF628                       0x0015
 #define ZTE_PRODUCT_MF626                       0x0031
 #define ZTE_PRODUCT_CDMA_TECH                   0xfffe
+#define ZTE_PRODUCT_AC8710                      0xfff1
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -322,6 +321,11 @@ static int  option_resume(struct usb_serial *serial);
 #define ALINK_VENDOR_ID                         0x1e0e
 #define ALINK_PRODUCT_3GU                       0x9200
 
+/* ALCATEL PRODUCTS */
+#define ALCATEL_VENDOR_ID                       0x1bbb
+#define ALCATEL_PRODUCT_X060S                   0x0000
+
+
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -438,6 +442,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU870D) }, /* Novatel EU850D/EU860D/EU870D */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC950D) }, /* Novatel MC930D/MC950D */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727) }, /* Novatel MC727/U727/USB727 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727_NEW) }, /* Novatel MC727/U727/USB727 refresh */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U727) }, /* Novatel MC727/U727/USB727 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC760) }, /* Novatel MC760/U760/USB760 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_OVMC760) }, /* Novatel Ovation MC760 */
@@ -474,42 +479,6 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
         { USB_DEVICE(AXESSTEL_VENDOR_ID, AXESSTEL_PRODUCT_MV110H) },
-        { USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_MSA501HS) },
-        { USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_ET502HS) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0003) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0004) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0005) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0006) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0007) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0008) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0009) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x000a) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x000b) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x000c) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x000d) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x000e) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x000f) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0010) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0011) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0012) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0013) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0014) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0015) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0016) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0017) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0018) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0019) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0020) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0021) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0022) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0023) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0024) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0025) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0026) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0027) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0028) },
-        { USB_DEVICE(ONDA_VENDOR_ID, 0x0029) },
-        { USB_DEVICE(ONDA_VENDOR_ID, ONDA_PRODUCT_MT503HS) },
         { USB_DEVICE(YISO_VENDOR_ID, YISO_PRODUCT_U893) },
         { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_1) },
         { USB_DEVICE(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_C100_2) },
@@ -534,10 +503,75 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
-        { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622) },
-        { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626) },
-        { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
-        { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0003, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0004, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0005, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0006, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0007, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0008, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0009, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x000a, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x000b, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x000c, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x000d, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x000e, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x000f, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0010, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0011, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0022, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0023, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0043, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0048, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0064, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0082, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
         { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
@@ -547,6 +581,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
         { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
         { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
@@ -555,8 +590,10 @@ static struct usb_driver option_driver = {
         .name       = "option",
         .probe      = usb_serial_probe,
         .disconnect = usb_serial_disconnect,
+#ifdef CONFIG_PM
         .suspend    = usb_serial_suspend,
         .resume     = usb_serial_resume,
+#endif
         .id_table   = option_ids,
         .no_dynamic_id =        1,
 };
@@ -588,8 +625,10 @@ static struct usb_serial_driver option_1port_device = {
         .disconnect        = option_disconnect,
         .release           = option_release,
         .read_int_callback = option_instat_callback,
+#ifdef CONFIG_PM
         .suspend           = option_suspend,
         .resume            = option_resume,
+#endif
 };
 
 static int debug;
@@ -831,7 +870,6 @@ static void option_instat_callback(struct urb *urb)
         int status = urb->status;
         struct usb_serial_port *port =  urb->context;
         struct option_port_private *portdata = usb_get_serial_port_data(port);
-        struct usb_serial *serial = port->serial;
 
         dbg("%s", __func__);
         dbg("%s: urb %p port %p has data %p", __func__, urb, port, portdata);
@@ -927,7 +965,6 @@ static int option_open(struct tty_struct *tty,
                         struct usb_serial_port *port, struct file *filp)
 {
         struct option_port_private *portdata;
-        struct usb_serial *serial = port->serial;
         int i, err;
         struct urb *urb;
 
@@ -1187,6 +1224,7 @@ static void option_release(struct usb_serial *serial)
         }
 }
 
+#ifdef CONFIG_PM
 static int option_suspend(struct usb_serial *serial, pm_message_t message)
 {
         dbg("%s entered", __func__);
@@ -1245,6 +1283,7 @@ static int option_resume(struct usb_serial *serial)
         }
         return 0;
 }
+#endif
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index bd7581b3a48a..99188c92068b 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -32,6 +32,7 @@
 #include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/uaccess.h>
+#include <linux/serial.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 #include "pl2303.h"
@@ -184,6 +185,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
         struct usb_serial_port *port;
         unsigned int portNumber;
         int retval = 0;
+        int first = 0;
 
         dbg("%s", __func__);
 
@@ -223,7 +225,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
 
         /* If the console is attached, the device is already open */
         if (port->port.count == 1 && !port->console) {
-
+                first = 1;
                 /* lock this module before we call it
                  * this may fail, which means we must bail out,
                  * safe because we are called with BKL held */
@@ -246,13 +248,21 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
                 if (retval)
                         goto bailout_interface_put;
                 mutex_unlock(&serial->disc_mutex);
+                set_bit(ASYNCB_INITIALIZED, &port->port.flags);
         }
         mutex_unlock(&port->mutex);
         /* Now do the correct tty layer semantics */
         retval = tty_port_block_til_ready(&port->port, tty, filp);
-        if (retval == 0)
+        if (retval == 0) {
+                if (!first)
+                        usb_serial_put(serial);
                 return 0;
-
+        }
+        mutex_lock(&port->mutex);
+        if (first == 0)
+                goto bailout_mutex_unlock;
+        /* Undo the initial port actions */
+        mutex_lock(&serial->disc_mutex);
 bailout_interface_put:
         usb_autopm_put_interface(serial->interface);
 bailout_module_put:
@@ -340,6 +350,22 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
 
         dbg("%s - port %d", __func__, port->number);
 
+        /* FIXME:
+           This leaves a very narrow race. Really we should do the
+           serial_do_free() on tty->shutdown(), but tty->shutdown can
+           be called from IRQ context and serial_do_free can sleep.
+
+           The right fix is probably to make the tty free (which is rare)
+           and thus tty->shutdown() occur via a work queue and simplify all
+           the drivers that use it.
+        */
+        if (tty_hung_up_p(filp)) {
+                /* serial_hangup already called serial_down at this point.
+                   Another user may have already reopened the port but
+                   serial_do_free is refcounted */
+                serial_do_free(port);
+                return;
+        }
 
         if (tty_port_close_start(&port->port, tty, filp) == 0)
                 return;
@@ -355,7 +381,8 @@ static void serial_hangup(struct tty_struct *tty)
         struct usb_serial_port *port = tty->driver_data;
         serial_do_down(port);
         tty_port_hangup(&port->port);
-        serial_do_free(port);
+        /* We must not free port yet - the USB serial layer depends on it's
+           continued existence */
 }
 
 static int serial_write(struct tty_struct *tty, const unsigned char *buf,
@@ -394,7 +421,6 @@ static int serial_chars_in_buffer(struct tty_struct *tty)
         struct usb_serial_port *port = tty->driver_data;
         dbg("%s = port %d", __func__, port->number);
 
-        WARN_ON(!port->port.count);
         /* if the device was unplugged then any remaining characters
            fell out of the connector ;) */
         if (port->serial->disconnected)
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index fcb320217218..e20dc525d177 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -961,7 +961,7 @@ int usb_stor_Bulk_max_lun(struct us_data *us)
                                  US_BULK_GET_MAX_LUN, 
                                  USB_DIR_IN | USB_TYPE_CLASS | 
                                  USB_RECIP_INTERFACE,
-                                 0, us->ifnum, us->iobuf, 1, HZ);
+                                 0, us->ifnum, us->iobuf, 1, 10*HZ);
 
         US_DEBUGP("GetMaxLUN command result is %d, data is %d\n", 
                   result, us->iobuf[0]);
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 6e4f6c50a120..019e8af449ab 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -424,11 +424,11 @@ int btrfs_requeue_work(struct btrfs_work *work)
          * list
          */
         if (worker->idle) {
-                spin_lock_irqsave(&worker->workers->lock, flags);
+                spin_lock(&worker->workers->lock);
                 worker->idle = 0;
                 list_move_tail(&worker->worker_list,
                                &worker->workers->worker_list);
-                spin_unlock_irqrestore(&worker->workers->lock, flags);
+                spin_unlock(&worker->workers->lock);
         }
         if (!worker->working) {
                 wake = 1;
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 60a45f3a4e91..3fdcc0512d3a 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -557,19 +557,7 @@ static int comp_keys(struct btrfs_disk_key *disk, struct btrfs_key *k2)
 
         btrfs_disk_key_to_cpu(&k1, disk);
 
-        if (k1.objectid > k2->objectid)
-                return 1;
-        if (k1.objectid < k2->objectid)
-                return -1;
-        if (k1.type > k2->type)
-                return 1;
-        if (k1.type < k2->type)
-                return -1;
-        if (k1.offset > k2->offset)
-                return 1;
-        if (k1.offset < k2->offset)
-                return -1;
-        return 0;
+        return btrfs_comp_cpu_keys(&k1, k2);
 }
 
 /*
@@ -1052,9 +1040,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
             BTRFS_NODEPTRS_PER_BLOCK(root) / 4)
                 return 0;
 
-        if (btrfs_header_nritems(mid) > 2)
-                return 0;
-
         if (btrfs_header_nritems(mid) < 2)
                 err_on_enospc = 1;
 
@@ -1701,6 +1686,7 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root
         struct extent_buffer *b;
         int slot;
         int ret;
+        int err;
         int level;
         int lowest_unlock = 1;
         u8 lowest_level = 0;
@@ -1737,8 +1723,6 @@ again:
                         p->locks[level] = 1;
 
                 if (cow) {
-                        int wret;
-
                         /*
                          * if we don't really need to cow this block
                          * then we don't want to set the path blocking,
@@ -1749,12 +1733,12 @@ again:
 
                         btrfs_set_path_blocking(p);
 
-                        wret = btrfs_cow_block(trans, root, b,
-                                               p->nodes[level + 1],
-                                               p->slots[level + 1], &b);
-                        if (wret) {
+                        err = btrfs_cow_block(trans, root, b,
+                                              p->nodes[level + 1],
+                                              p->slots[level + 1], &b);
+                        if (err) {
                                 free_extent_buffer(b);
-                                ret = wret;
+                                ret = err;
                                 goto done;
                         }
                 }
@@ -1793,41 +1777,45 @@ cow_done:
                 ret = bin_search(b, key, level, &slot);
 
                 if (level != 0) {
-                        if (ret && slot > 0)
+                        int dec = 0;
+                        if (ret && slot > 0) {
+                                dec = 1;
                                 slot -= 1;
+                        }
                         p->slots[level] = slot;
-                        ret = setup_nodes_for_search(trans, root, p, b, level,
+                        err = setup_nodes_for_search(trans, root, p, b, level,
                                                      ins_len);
-                        if (ret == -EAGAIN)
+                        if (err == -EAGAIN)
                                 goto again;
-                        else if (ret)
+                        if (err) {
+                                ret = err;
                                 goto done;
+                        }
                         b = p->nodes[level];
                         slot = p->slots[level];
 
                         unlock_up(p, level, lowest_unlock);
 
-                        /* this is only true while dropping a snapshot */
                         if (level == lowest_level) {
-                                ret = 0;
+                                if (dec)
+                                        p->slots[level]++;
                                 goto done;
                         }
 
-                        ret = read_block_for_search(trans, root, p,
+                        err = read_block_for_search(trans, root, p,
                                                     &b, level, slot, key);
-                        if (ret == -EAGAIN)
+                        if (err == -EAGAIN)
                                 goto again;
-
-                        if (ret == -EIO)
+                        if (err) {
+                                ret = err;
                                 goto done;
+                        }
 
                         if (!p->skip_locking) {
-                                int lret;
-
                                 btrfs_clear_path_blocking(p, NULL);
-                                lret = btrfs_try_spin_lock(b);
+                                err = btrfs_try_spin_lock(b);
 
-                                if (!lret) {
+                                if (!err) {
                                         btrfs_set_path_blocking(p);
                                         btrfs_tree_lock(b);
                                         btrfs_clear_path_blocking(p, b);
@@ -1837,16 +1825,14 @@ cow_done:
                         p->slots[level] = slot;
                         if (ins_len > 0 &&
                             btrfs_leaf_free_space(root, b) < ins_len) {
-                                int sret;
-
                                 btrfs_set_path_blocking(p);
-                                sret = split_leaf(trans, root, key,
-                                                      p, ins_len, ret == 0);
+                                err = split_leaf(trans, root, key,
+                                                 p, ins_len, ret == 0);
                                 btrfs_clear_path_blocking(p, NULL);
 
-                                BUG_ON(sret > 0);
-                                if (sret) {
-                                        ret = sret;
+                                BUG_ON(err > 0);
+                                if (err) {
+                                        ret = err;
                                         goto done;
                                 }
                         }
@@ -3807,7 +3793,7 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                 }
 
                 /* delete the leaf if it is mostly empty */
-                if (used < BTRFS_LEAF_DATA_SIZE(root) / 2) {
+                if (used < BTRFS_LEAF_DATA_SIZE(root) / 3) {
                         /* push_leaf_left fixes the path.
                          * make sure the path still points to our leaf
                          * for possible call to del_ptr below
@@ -4042,10 +4028,9 @@ out:
  * calling this function.
  */
 int btrfs_find_next_key(struct btrfs_root *root, struct btrfs_path *path,
-                        struct btrfs_key *key, int lowest_level,
+                        struct btrfs_key *key, int level,
                         int cache_only, u64 min_trans)
 {
-        int level = lowest_level;
         int slot;
         struct extent_buffer *c;
 
@@ -4058,11 +4043,40 @@ int btrfs_find_next_key(struct btrfs_root *root, struct btrfs_path *path,
                 c = path->nodes[level];
 next:
                 if (slot >= btrfs_header_nritems(c)) {
-                        level++;
-                        if (level == BTRFS_MAX_LEVEL)
+                        int ret;
+                        int orig_lowest;
+                        struct btrfs_key cur_key;
+                        if (level + 1 >= BTRFS_MAX_LEVEL ||
+                            !path->nodes[level + 1])
                                 return 1;
-                        continue;
+
+                        if (path->locks[level + 1]) {
+                                level++;
+                                continue;
+                        }
+
+                        slot = btrfs_header_nritems(c) - 1;
+                        if (level == 0)
+                                btrfs_item_key_to_cpu(c, &cur_key, slot);
+                        else
+                                btrfs_node_key_to_cpu(c, &cur_key, slot);
+
+                        orig_lowest = path->lowest_level;
+                        btrfs_release_path(root, path);
+                        path->lowest_level = level;
+                        ret = btrfs_search_slot(NULL, root, &cur_key, path,
+                                                0, 0);
+                        path->lowest_level = orig_lowest;
+                        if (ret < 0)
+                                return ret;
+
+                        c = path->nodes[level];
+                        slot = path->slots[level];
+                        if (ret == 0)
+                                slot++;
+                        goto next;
                 }
+
                 if (level == 0)
                         btrfs_item_key_to_cpu(c, key, slot);
                 else {
@@ -4146,7 +4160,8 @@ again:
          * advance the path if there are now more items available.
          */
         if (nritems > 0 && path->slots[0] < nritems - 1) {
-                path->slots[0]++;
+                if (ret == 0)
+                        path->slots[0]++;
                 ret = 0;
                 goto done;
         }
@@ -4278,10 +4293,10 @@ int btrfs_previous_item(struct btrfs_root *root,
                         path->slots[0]--;
 
                 btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]);
-                if (found_key.type == type)
-                        return 0;
                 if (found_key.objectid < min_objectid)
                         break;
+                if (found_key.type == type)
+                        return 0;
                 if (found_key.objectid == min_objectid &&
                     found_key.type < type)
                         break;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 98a873838717..215ef8cae823 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -481,7 +481,7 @@ struct btrfs_shared_data_ref {
 
 struct btrfs_extent_inline_ref {
         u8 type;
-        u64 offset;
+        __le64 offset;
 } __attribute__ ((__packed__));
 
 /* old style backrefs item */
@@ -689,6 +689,7 @@ struct btrfs_space_info {
         struct list_head block_groups;
         spinlock_t lock;
         struct rw_semaphore groups_sem;
+        atomic_t caching_threads;
 };
 
 /*
@@ -707,6 +708,9 @@ struct btrfs_free_cluster {
         /* first extent starting offset */
         u64 window_start;
 
+        /* if this cluster simply points at a bitmap in the block group */
+        bool points_to_bitmap;
+
         struct btrfs_block_group_cache *block_group;
         /*
          * when a cluster is allocated from a block group, we put the
@@ -716,24 +720,37 @@ struct btrfs_free_cluster {
         struct list_head block_group_list;
 };
 
+enum btrfs_caching_type {
+        BTRFS_CACHE_NO          = 0,
+        BTRFS_CACHE_STARTED     = 1,
+        BTRFS_CACHE_FINISHED    = 2,
+};
+
 struct btrfs_block_group_cache {
         struct btrfs_key key;
         struct btrfs_block_group_item item;
+        struct btrfs_fs_info *fs_info;
         spinlock_t lock;
-        struct mutex cache_mutex;
         u64 pinned;
         u64 reserved;
         u64 flags;
-        int cached;
+        u64 sectorsize;
+        int extents_thresh;
+        int free_extents;
+        int total_bitmaps;
         int ro;
         int dirty;
 
+        /* cache tracking stuff */
+        wait_queue_head_t caching_q;
+        int cached;
+
         struct btrfs_space_info *space_info;
 
         /* free space cache stuff */
         spinlock_t tree_lock;
-        struct rb_root free_space_bytes;
         struct rb_root free_space_offset;
+        u64 free_space;
 
         /* block group cache stuff */
         struct rb_node cache_node;
@@ -942,6 +959,9 @@ struct btrfs_root {
         /* the node lock is held while changing the node pointer */
         spinlock_t node_lock;
 
+        /* taken when updating the commit root */
+        struct rw_semaphore commit_root_sem;
+
         struct extent_buffer *commit_root;
         struct btrfs_root *log_root;
         struct btrfs_root *reloc_root;
@@ -1988,6 +2008,7 @@ void btrfs_delalloc_reserve_space(struct btrfs_root *root, struct inode *inode,
                                  u64 bytes);
 void btrfs_delalloc_free_space(struct btrfs_root *root, struct inode *inode,
                               u64 bytes);
+void btrfs_free_pinned_extents(struct btrfs_fs_info *info);
 /* ctree.c */
 int btrfs_bin_search(struct extent_buffer *eb, struct btrfs_key *key,
                      int level, int *slot);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index d28d29c95f7c..7dcaa8138864 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -909,6 +909,7 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         spin_lock_init(&root->inode_lock);
         mutex_init(&root->objectid_mutex);
         mutex_init(&root->log_mutex);
+        init_rwsem(&root->commit_root_sem);
         init_waitqueue_head(&root->log_writer_wait);
         init_waitqueue_head(&root->log_commit_wait[0]);
         init_waitqueue_head(&root->log_commit_wait[1]);
@@ -1799,6 +1800,11 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                                            btrfs_super_chunk_root(disk_super),
                                            blocksize, generation);
         BUG_ON(!chunk_root->node);
+        if (!test_bit(EXTENT_BUFFER_UPTODATE, &chunk_root->node->bflags)) {
+                printk(KERN_WARNING "btrfs: failed to read chunk root on %s\n",
+                       sb->s_id);
+                goto fail_chunk_root;
+        }
         btrfs_set_root_node(&chunk_root->root_item, chunk_root->node);
         chunk_root->commit_root = btrfs_root_node(chunk_root);
 
@@ -1826,6 +1832,11 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                                           blocksize, generation);
         if (!tree_root->node)
                 goto fail_chunk_root;
+        if (!test_bit(EXTENT_BUFFER_UPTODATE, &tree_root->node->bflags)) {
+                printk(KERN_WARNING "btrfs: failed to read tree root on %s\n",
+                       sb->s_id);
+                goto fail_tree_root;
+        }
         btrfs_set_root_node(&tree_root->root_item, tree_root->node);
         tree_root->commit_root = btrfs_root_node(tree_root);
 
@@ -2322,6 +2333,9 @@ int close_ctree(struct btrfs_root *root)
                         printk(KERN_ERR "btrfs: commit super ret %d\n", ret);
         }
 
+        fs_info->closing = 2;
+        smp_mb();
+
         if (fs_info->delalloc_bytes) {
                 printk(KERN_INFO "btrfs: at unmount delalloc count %llu\n",
                        (unsigned long long)fs_info->delalloc_bytes);
@@ -2343,6 +2357,7 @@ int close_ctree(struct btrfs_root *root)
         free_extent_buffer(root->fs_info->csum_root->commit_root);
 
         btrfs_free_block_groups(root->fs_info);
+        btrfs_free_pinned_extents(root->fs_info);
 
         del_fs_roots(fs_info);
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a5aca3997d42..fadf69a2764b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -21,6 +21,7 @@
 #include <linux/blkdev.h>
 #include <linux/sort.h>
 #include <linux/rcupdate.h>
+#include <linux/kthread.h>
 #include "compat.h"
 #include "hash.h"
 #include "ctree.h"
@@ -61,6 +62,13 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
                           struct btrfs_root *extent_root, u64 alloc_bytes,
                           u64 flags, int force);
 
+static noinline int
+block_group_cache_done(struct btrfs_block_group_cache *cache)
+{
+        smp_mb();
+        return cache->cached == BTRFS_CACHE_FINISHED;
+}
+
 static int block_group_bits(struct btrfs_block_group_cache *cache, u64 bits)
 {
         return (cache->flags & bits) == bits;
@@ -146,20 +154,70 @@ block_group_cache_tree_search(struct btrfs_fs_info *info, u64 bytenr,
 }
 
 /*
+ * We always set EXTENT_LOCKED for the super mirror extents so we don't
+ * overwrite them, so those bits need to be unset.  Also, if we are unmounting
+ * with pinned extents still sitting there because we had a block group caching,
+ * we need to clear those now, since we are done.
+ */
+void btrfs_free_pinned_extents(struct btrfs_fs_info *info)
+{
+        u64 start, end, last = 0;
+        int ret;
+
+        while (1) {
+                ret = find_first_extent_bit(&info->pinned_extents, last,
+                                            &start, &end,
+                                            EXTENT_LOCKED|EXTENT_DIRTY);
+                if (ret)
+                        break;
+
+                clear_extent_bits(&info->pinned_extents, start, end,
+                                  EXTENT_LOCKED|EXTENT_DIRTY, GFP_NOFS);
+                last = end+1;
+        }
+}
+
+static int remove_sb_from_cache(struct btrfs_root *root,
+                                struct btrfs_block_group_cache *cache)
+{
+        struct btrfs_fs_info *fs_info = root->fs_info;
+        u64 bytenr;
+        u64 *logical;
+        int stripe_len;
+        int i, nr, ret;
+
+        for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
+                bytenr = btrfs_sb_offset(i);
+                ret = btrfs_rmap_block(&root->fs_info->mapping_tree,
+                                       cache->key.objectid, bytenr,
+                                       0, &logical, &nr, &stripe_len);
+                BUG_ON(ret);
+                while (nr--) {
+                        try_lock_extent(&fs_info->pinned_extents,
+                                        logical[nr],
+                                        logical[nr] + stripe_len - 1, GFP_NOFS);
+                }
+                kfree(logical);
+        }
+
+        return 0;
+}
+
+/*
  * this is only called by cache_block_group, since we could have freed extents
  * we need to check the pinned_extents for any extents that can't be used yet
  * since their free space will be released as soon as the transaction commits.
  */
-static int add_new_free_space(struct btrfs_block_group_cache *block_group,
+static u64 add_new_free_space(struct btrfs_block_group_cache *block_group,
                               struct btrfs_fs_info *info, u64 start, u64 end)
 {
-        u64 extent_start, extent_end, size;
+        u64 extent_start, extent_end, size, total_added = 0;
         int ret;
 
         while (start < end) {
                 ret = find_first_extent_bit(&info->pinned_extents, start,
                                             &extent_start, &extent_end,
-                                            EXTENT_DIRTY);
+                                            EXTENT_DIRTY|EXTENT_LOCKED);
                 if (ret)
                         break;
 
@@ -167,6 +225,7 @@ static int add_new_free_space(struct btrfs_block_group_cache *block_group,
                         start = extent_end + 1;
                 } else if (extent_start > start && extent_start < end) {
                         size = extent_start - start;
+                        total_added += size;
                         ret = btrfs_add_free_space(block_group, start,
                                                    size);
                         BUG_ON(ret);
@@ -178,84 +237,79 @@ static int add_new_free_space(struct btrfs_block_group_cache *block_group,
 
         if (start < end) {
                 size = end - start;
+                total_added += size;
                 ret = btrfs_add_free_space(block_group, start, size);
                 BUG_ON(ret);
         }
 
-        return 0;
+        return total_added;
 }
 
-static int remove_sb_from_cache(struct btrfs_root *root,
-                                struct btrfs_block_group_cache *cache)
-{
-        u64 bytenr;
-        u64 *logical;
-        int stripe_len;
-        int i, nr, ret;
-
-        for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
-                bytenr = btrfs_sb_offset(i);
-                ret = btrfs_rmap_block(&root->fs_info->mapping_tree,
-                                       cache->key.objectid, bytenr, 0,
-                                       &logical, &nr, &stripe_len);
-                BUG_ON(ret);
-                while (nr--) {
-                        btrfs_remove_free_space(cache, logical[nr],
-                                                stripe_len);
-                }
-                kfree(logical);
-        }
-        return 0;
-}
-
-static int cache_block_group(struct btrfs_root *root,
-                             struct btrfs_block_group_cache *block_group)
+static int caching_kthread(void *data)
 {
+        struct btrfs_block_group_cache *block_group = data;
+        struct btrfs_fs_info *fs_info = block_group->fs_info;
+        u64 last = 0;
         struct btrfs_path *path;
         int ret = 0;
         struct btrfs_key key;
         struct extent_buffer *leaf;
         int slot;
-        u64 last;
-
-        if (!block_group)
-                return 0;
+        u64 total_found = 0;
 
-        root = root->fs_info->extent_root;
-
-        if (block_group->cached)
-                return 0;
+        BUG_ON(!fs_info);
 
         path = btrfs_alloc_path();
         if (!path)
                 return -ENOMEM;
 
-        path->reada = 2;
+        atomic_inc(&block_group->space_info->caching_threads);
+        last = max_t(u64, block_group->key.objectid, BTRFS_SUPER_INFO_OFFSET);
+again:
+        /* need to make sure the commit_root doesn't disappear */
+        down_read(&fs_info->extent_root->commit_root_sem);
+
         /*
-         * we get into deadlocks with paths held by callers of this function.
-         * since the alloc_mutex is protecting things right now, just
-         * skip the locking here
+         * We don't want to deadlock with somebody trying to allocate a new
+         * extent for the extent root while also trying to search the extent
+         * root to add free space.  So we skip locking and search the commit
+         * root, since its read-only
          */
         path->skip_locking = 1;
-        last = max_t(u64, block_group->key.objectid, BTRFS_SUPER_INFO_OFFSET);
+        path->search_commit_root = 1;
+        path->reada = 2;
+
         key.objectid = last;
         key.offset = 0;
         btrfs_set_key_type(&key, BTRFS_EXTENT_ITEM_KEY);
-        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        ret = btrfs_search_slot(NULL, fs_info->extent_root, &key, path, 0, 0);
         if (ret < 0)
                 goto err;
 
         while (1) {
+                smp_mb();
+                if (block_group->fs_info->closing > 1) {
+                        last = (u64)-1;
+                        break;
+                }
+
                 leaf = path->nodes[0];
                 slot = path->slots[0];
                 if (slot >= btrfs_header_nritems(leaf)) {
-                        ret = btrfs_next_leaf(root, path);
+                        ret = btrfs_next_leaf(fs_info->extent_root, path);
                         if (ret < 0)
                                 goto err;
-                        if (ret == 0)
-                                continue;
-                        else
+                        else if (ret)
                                 break;
+
+                        if (need_resched()) {
+                                btrfs_release_path(fs_info->extent_root, path);
+                                up_read(&fs_info->extent_root->commit_root_sem);
+                                cond_resched();
+                                goto again;
+                        }
+
+                        continue;
                 }
                 btrfs_item_key_to_cpu(leaf, &key, slot);
                 if (key.objectid < block_group->key.objectid)
@@ -266,24 +320,59 @@ static int cache_block_group(struct btrfs_root *root,
                         break;
 
                 if (btrfs_key_type(&key) == BTRFS_EXTENT_ITEM_KEY) {
-                        add_new_free_space(block_group, root->fs_info, last,
-                                           key.objectid);
-
+                        total_found += add_new_free_space(block_group,
+                                                          fs_info, last,
+                                                          key.objectid);
                         last = key.objectid + key.offset;
                 }
+
+                if (total_found > (1024 * 1024 * 2)) {
+                        total_found = 0;
+                        wake_up(&block_group->caching_q);
+                }
 next:
                 path->slots[0]++;
         }
+        ret = 0;
 
-        add_new_free_space(block_group, root->fs_info, last,
-                           block_group->key.objectid +
-                           block_group->key.offset);
+        total_found += add_new_free_space(block_group, fs_info, last,
+                                          block_group->key.objectid +
+                                          block_group->key.offset);
+
+        spin_lock(&block_group->lock);
+        block_group->cached = BTRFS_CACHE_FINISHED;
+        spin_unlock(&block_group->lock);
 
-        block_group->cached = 1;
-        remove_sb_from_cache(root, block_group);
-        ret = 0;
 err:
         btrfs_free_path(path);
+        up_read(&fs_info->extent_root->commit_root_sem);
+        atomic_dec(&block_group->space_info->caching_threads);
+        wake_up(&block_group->caching_q);
+
+        return 0;
+}
+
+static int cache_block_group(struct btrfs_block_group_cache *cache)
+{
+        struct task_struct *tsk;
+        int ret = 0;
+
+        spin_lock(&cache->lock);
+        if (cache->cached != BTRFS_CACHE_NO) {
+                spin_unlock(&cache->lock);
+                return ret;
+        }
+        cache->cached = BTRFS_CACHE_STARTED;
+        spin_unlock(&cache->lock);
+
+        tsk = kthread_run(caching_kthread, cache, "btrfs-cache-%llu\n",
+                          cache->key.objectid);
+        if (IS_ERR(tsk)) {
+                ret = PTR_ERR(tsk);
+                printk(KERN_ERR "error running thread %d\n", ret);
+                BUG();
+        }
+
         return ret;
 }
 
@@ -2387,13 +2476,29 @@ fail:
 
 }
 
+static struct btrfs_block_group_cache *
+next_block_group(struct btrfs_root *root,
+                 struct btrfs_block_group_cache *cache)
+{
+        struct rb_node *node;
+        spin_lock(&root->fs_info->block_group_cache_lock);
+        node = rb_next(&cache->cache_node);
+        btrfs_put_block_group(cache);
+        if (node) {
+                cache = rb_entry(node, struct btrfs_block_group_cache,
+                                 cache_node);
+                atomic_inc(&cache->count);
+        } else
+                cache = NULL;
+        spin_unlock(&root->fs_info->block_group_cache_lock);
+        return cache;
+}
+
 int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root)
 {
-        struct btrfs_block_group_cache *cache, *entry;
-        struct rb_node *n;
+        struct btrfs_block_group_cache *cache;
         int err = 0;
-        int werr = 0;
         struct btrfs_path *path;
         u64 last = 0;
 
@@ -2402,39 +2507,35 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                 return -ENOMEM;
 
         while (1) {
-                cache = NULL;
-                spin_lock(&root->fs_info->block_group_cache_lock);
-                for (n = rb_first(&root->fs_info->block_group_cache_tree);
-                     n; n = rb_next(n)) {
-                        entry = rb_entry(n, struct btrfs_block_group_cache,
-                                         cache_node);
-                        if (entry->dirty) {
-                                cache = entry;
-                                break;
-                        }
+                if (last == 0) {
+                        err = btrfs_run_delayed_refs(trans, root,
+                                                     (unsigned long)-1);
+                        BUG_ON(err);
                 }
-                spin_unlock(&root->fs_info->block_group_cache_lock);
 
-                if (!cache)
-                        break;
+                cache = btrfs_lookup_first_block_group(root->fs_info, last);
+                while (cache) {
+                        if (cache->dirty)
+                                break;
+                        cache = next_block_group(root, cache);
+                }
+                if (!cache) {
+                        if (last == 0)
+                                break;
+                        last = 0;
+                        continue;
+                }
 
                 cache->dirty = 0;
-                last += cache->key.offset;
+                last = cache->key.objectid + cache->key.offset;
 
-                err = write_one_cache_group(trans, root,
-                                            path, cache);
-                /*
-                 * if we fail to write the cache group, we want
-                 * to keep it marked dirty in hopes that a later
-                 * write will work
-                 */
-                if (err) {
-                        werr = err;
-                        continue;
-                }
+                err = write_one_cache_group(trans, root, path, cache);
+                BUG_ON(err);
+                btrfs_put_block_group(cache);
         }
+
         btrfs_free_path(path);
-        return werr;
+        return 0;
 }
 
 int btrfs_extent_readonly(struct btrfs_root *root, u64 bytenr)
@@ -2484,6 +2585,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
         found->force_alloc = 0;
         *space_info = found;
         list_add_rcu(&found->list, &info->space_info);
+        atomic_set(&found->caching_threads, 0);
         return 0;
 }
 
@@ -2947,13 +3049,9 @@ int btrfs_update_pinned_extents(struct btrfs_root *root,
         struct btrfs_block_group_cache *cache;
         struct btrfs_fs_info *fs_info = root->fs_info;
 
-        if (pin) {
+        if (pin)
                 set_extent_dirty(&fs_info->pinned_extents,
                                 bytenr, bytenr + num - 1, GFP_NOFS);
-        } else {
-                clear_extent_dirty(&fs_info->pinned_extents,
-                                bytenr, bytenr + num - 1, GFP_NOFS);
-        }
 
         while (num > 0) {
                 cache = btrfs_lookup_block_group(fs_info, bytenr);
@@ -2969,14 +3067,34 @@ int btrfs_update_pinned_extents(struct btrfs_root *root,
                         spin_unlock(&cache->space_info->lock);
                         fs_info->total_pinned += len;
                 } else {
+                        int unpin = 0;
+
+                        /*
+                         * in order to not race with the block group caching, we
+                         * only want to unpin the extent if we are cached.  If
+                         * we aren't cached, we want to start async caching this
+                         * block group so we can free the extent the next time
+                         * around.
+                         */
                         spin_lock(&cache->space_info->lock);
                         spin_lock(&cache->lock);
-                        cache->pinned -= len;
-                        cache->space_info->bytes_pinned -= len;
+                        unpin = (cache->cached == BTRFS_CACHE_FINISHED);
+                        if (likely(unpin)) {
+                                cache->pinned -= len;
+                                cache->space_info->bytes_pinned -= len;
+                                fs_info->total_pinned -= len;
+                        }
                         spin_unlock(&cache->lock);
                         spin_unlock(&cache->space_info->lock);
-                        fs_info->total_pinned -= len;
-                        if (cache->cached)
+
+                        if (likely(unpin))
+                                clear_extent_dirty(&fs_info->pinned_extents,
+                                                   bytenr, bytenr + len -1,
+                                                   GFP_NOFS);
+                        else
+                                cache_block_group(cache);
+
+                        if (unpin)
                                 btrfs_add_free_space(cache, bytenr, len);
                 }
                 btrfs_put_block_group(cache);
@@ -3030,6 +3148,7 @@ int btrfs_copy_pinned(struct btrfs_root *root, struct extent_io_tree *copy)
                                             &start, &end, EXTENT_DIRTY);
                 if (ret)
                         break;
+
                 set_extent_dirty(copy, start, end, GFP_NOFS);
                 last = end + 1;
         }
@@ -3058,6 +3177,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans,
 
                 cond_resched();
         }
+
         return ret;
 }
 
@@ -3436,6 +3556,45 @@ static u64 stripe_align(struct btrfs_root *root, u64 val)
 }
 
 /*
+ * when we wait for progress in the block group caching, its because
+ * our allocation attempt failed at least once.  So, we must sleep
+ * and let some progress happen before we try again.
+ *
+ * This function will sleep at least once waiting for new free space to
+ * show up, and then it will check the block group free space numbers
+ * for our min num_bytes.  Another option is to have it go ahead
+ * and look in the rbtree for a free extent of a given size, but this
+ * is a good start.
+ */
+static noinline int
+wait_block_group_cache_progress(struct btrfs_block_group_cache *cache,
+                                u64 num_bytes)
+{
+        DEFINE_WAIT(wait);
+
+        prepare_to_wait(&cache->caching_q, &wait, TASK_UNINTERRUPTIBLE);
+
+        if (block_group_cache_done(cache)) {
+                finish_wait(&cache->caching_q, &wait);
+                return 0;
+        }
+        schedule();
+        finish_wait(&cache->caching_q, &wait);
+
+        wait_event(cache->caching_q, block_group_cache_done(cache) ||
+                   (cache->free_space >= num_bytes));
+        return 0;
+}
+
+enum btrfs_loop_type {
+        LOOP_CACHED_ONLY = 0,
+        LOOP_CACHING_NOWAIT = 1,
+        LOOP_CACHING_WAIT = 2,
+        LOOP_ALLOC_CHUNK = 3,
+        LOOP_NO_EMPTY_SIZE = 4,
+};
+
+/*
  * walks the btree of allocated extents and find a hole of a given size.
  * The key ins is changed to record the hole:
  * ins->objectid == block start
@@ -3460,6 +3619,7 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         struct btrfs_space_info *space_info;
         int last_ptr_loop = 0;
         int loop = 0;
+        bool found_uncached_bg = false;
 
         WARN_ON(num_bytes < root->sectorsize);
         btrfs_set_key_type(ins, BTRFS_EXTENT_ITEM_KEY);
@@ -3491,15 +3651,18 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         search_start = max(search_start, first_logical_byte(root, 0));
         search_start = max(search_start, hint_byte);
 
-        if (!last_ptr) {
+        if (!last_ptr)
                 empty_cluster = 0;
-                loop = 1;
-        }
 
         if (search_start == hint_byte) {
                 block_group = btrfs_lookup_block_group(root->fs_info,
                                                        search_start);
-                if (block_group && block_group_bits(block_group, data)) {
+                /*
+                 * we don't want to use the block group if it doesn't match our
+                 * allocation bits, or if its not cached.
+                 */
+                if (block_group && block_group_bits(block_group, data) &&
+                    block_group_cache_done(block_group)) {
                         down_read(&space_info->groups_sem);
                         if (list_empty(&block_group->list) ||
                             block_group->ro) {
@@ -3522,21 +3685,35 @@ search:
         down_read(&space_info->groups_sem);
         list_for_each_entry(block_group, &space_info->block_groups, list) {
                 u64 offset;
+                int cached;
 
                 atomic_inc(&block_group->count);
                 search_start = block_group->key.objectid;
 
 have_block_group:
-                if (unlikely(!block_group->cached)) {
-                        mutex_lock(&block_group->cache_mutex);
-                        ret = cache_block_group(root, block_group);
-                        mutex_unlock(&block_group->cache_mutex);
-                        if (ret) {
-                                btrfs_put_block_group(block_group);
-                                break;
+                if (unlikely(block_group->cached == BTRFS_CACHE_NO)) {
+                        /*
+                         * we want to start caching kthreads, but not too many
+                         * right off the bat so we don't overwhelm the system,
+                         * so only start them if there are less than 2 and we're
+                         * in the initial allocation phase.
+                         */
+                        if (loop > LOOP_CACHING_NOWAIT ||
+                            atomic_read(&space_info->caching_threads) < 2) {
+                                ret = cache_block_group(block_group);
+                                BUG_ON(ret);
                         }
                 }
 
+                cached = block_group_cache_done(block_group);
+                if (unlikely(!cached)) {
+                        found_uncached_bg = true;
+
+                        /* if we only want cached bgs, loop */
+                        if (loop == LOOP_CACHED_ONLY)
+                                goto loop;
+                }
+
                 if (unlikely(block_group->ro))
                         goto loop;
 
@@ -3615,14 +3792,21 @@ refill_cluster:
                                         spin_unlock(&last_ptr->refill_lock);
                                         goto checks;
                                 }
+                        } else if (!cached && loop > LOOP_CACHING_NOWAIT) {
+                                spin_unlock(&last_ptr->refill_lock);
+
+                                wait_block_group_cache_progress(block_group,
+                                       num_bytes + empty_cluster + empty_size);
+                                goto have_block_group;
                         }
+
                         /*
                          * at this point we either didn't find a cluster
                          * or we weren't able to allocate a block from our
                          * cluster.  Free the cluster we've been trying
                          * to use, and go to the next block group
                          */
-                        if (loop < 2) {
+                        if (loop < LOOP_NO_EMPTY_SIZE) {
                                 btrfs_return_cluster_to_free_space(NULL,
                                                                    last_ptr);
                                 spin_unlock(&last_ptr->refill_lock);
@@ -3633,11 +3817,17 @@ refill_cluster:
 
                 offset = btrfs_find_space_for_alloc(block_group, search_start,
                                                     num_bytes, empty_size);
-                if (!offset)
+                if (!offset && (cached || (!cached &&
+                                           loop == LOOP_CACHING_NOWAIT))) {
                         goto loop;
+                } else if (!offset && (!cached &&
+                                       loop > LOOP_CACHING_NOWAIT)) {
+                        wait_block_group_cache_progress(block_group,
+                                        num_bytes + empty_size);
+                        goto have_block_group;
+                }
 checks:
                 search_start = stripe_align(root, offset);
-
                 /* move on to the next group */
                 if (search_start + num_bytes >= search_end) {
                         btrfs_add_free_space(block_group, offset, num_bytes);
@@ -3683,13 +3873,26 @@ loop:
         }
         up_read(&space_info->groups_sem);
 
-        /* loop == 0, try to find a clustered alloc in every block group
-         * loop == 1, try again after forcing a chunk allocation
-         * loop == 2, set empty_size and empty_cluster to 0 and try again
+        /* LOOP_CACHED_ONLY, only search fully cached block groups
+         * LOOP_CACHING_NOWAIT, search partially cached block groups, but
+         *                      dont wait foR them to finish caching
+         * LOOP_CACHING_WAIT, search everything, and wait if our bg is caching
+         * LOOP_ALLOC_CHUNK, force a chunk allocation and try again
+         * LOOP_NO_EMPTY_SIZE, set empty_size and empty_cluster to 0 and try
+         *                      again
          */
-        if (!ins->objectid && loop < 3 &&
-            (empty_size || empty_cluster || allowed_chunk_alloc)) {
-                if (loop >= 2) {
+        if (!ins->objectid && loop < LOOP_NO_EMPTY_SIZE &&
+            (found_uncached_bg || empty_size || empty_cluster ||
+             allowed_chunk_alloc)) {
+                if (found_uncached_bg) {
+                        found_uncached_bg = false;
+                        if (loop < LOOP_CACHING_WAIT) {
+                                loop++;
+                                goto search;
+                        }
+                }
+
+                if (loop == LOOP_ALLOC_CHUNK) {
                         empty_size = 0;
                         empty_cluster = 0;
                 }
@@ -3702,7 +3905,7 @@ loop:
                         space_info->force_alloc = 1;
                 }
 
-                if (loop < 3) {
+                if (loop < LOOP_NO_EMPTY_SIZE) {
                         loop++;
                         goto search;
                 }
@@ -3798,7 +4001,7 @@ again:
                                num_bytes, data, 1);
                 goto again;
         }
-        if (ret) {
+        if (ret == -ENOSPC) {
                 struct btrfs_space_info *sinfo;
 
                 sinfo = __find_space_info(root->fs_info, data);
@@ -3806,7 +4009,6 @@ again:
                        "wanted %llu\n", (unsigned long long)data,
                        (unsigned long long)num_bytes);
                 dump_space_info(sinfo, num_bytes);
-                BUG();
         }
 
         return ret;
@@ -3844,7 +4046,9 @@ int btrfs_reserve_extent(struct btrfs_trans_handle *trans,
         ret = __btrfs_reserve_extent(trans, root, num_bytes, min_alloc_size,
                                      empty_size, hint_byte, search_end, ins,
                                      data);
-        update_reserved_extents(root, ins->objectid, ins->offset, 1);
+        if (!ret)
+                update_reserved_extents(root, ins->objectid, ins->offset, 1);
+
         return ret;
 }
 
@@ -4006,9 +4210,9 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
         struct btrfs_block_group_cache *block_group;
 
         block_group = btrfs_lookup_block_group(root->fs_info, ins->objectid);
-        mutex_lock(&block_group->cache_mutex);
-        cache_block_group(root, block_group);
-        mutex_unlock(&block_group->cache_mutex);
+        cache_block_group(block_group);
+        wait_event(block_group->caching_q,
+                   block_group_cache_done(block_group));
 
         ret = btrfs_remove_free_space(block_group, ins->objectid,
                                       ins->offset);
@@ -4039,7 +4243,8 @@ static int alloc_tree_block(struct btrfs_trans_handle *trans,
         ret = __btrfs_reserve_extent(trans, root, num_bytes, num_bytes,
                                      empty_size, hint_byte, search_end,
                                      ins, 0);
-        BUG_ON(ret);
+        if (ret)
+                return ret;
 
         if (root_objectid == BTRFS_TREE_RELOC_OBJECTID) {
                 if (parent == 0)
@@ -6955,11 +7160,16 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                          &info->block_group_cache_tree);
                 spin_unlock(&info->block_group_cache_lock);
 
-                btrfs_remove_free_space_cache(block_group);
                 down_write(&block_group->space_info->groups_sem);
                 list_del(&block_group->list);
                 up_write(&block_group->space_info->groups_sem);
 
+                if (block_group->cached == BTRFS_CACHE_STARTED)
+                        wait_event(block_group->caching_q,
+                                   block_group_cache_done(block_group));
+
+                btrfs_remove_free_space_cache(block_group);
+
                 WARN_ON(atomic_read(&block_group->count) != 1);
                 kfree(block_group);
 
@@ -7025,9 +7235,19 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                 atomic_set(&cache->count, 1);
                 spin_lock_init(&cache->lock);
                 spin_lock_init(&cache->tree_lock);
-                mutex_init(&cache->cache_mutex);
+                cache->fs_info = info;
+                init_waitqueue_head(&cache->caching_q);
                 INIT_LIST_HEAD(&cache->list);
                 INIT_LIST_HEAD(&cache->cluster_list);
+
+                /*
+                 * we only want to have 32k of ram per block group for keeping
+                 * track of free space, and if we pass 1/2 of that we want to
+                 * start converting things over to using bitmaps
+                 */
+                cache->extents_thresh = ((1024 * 32) / 2) /
+                        sizeof(struct btrfs_free_space);
+
                 read_extent_buffer(leaf, &cache->item,
                                    btrfs_item_ptr_offset(leaf, path->slots[0]),
                                    sizeof(cache->item));
@@ -7036,6 +7256,26 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                 key.objectid = found_key.objectid + found_key.offset;
                 btrfs_release_path(root, path);
                 cache->flags = btrfs_block_group_flags(&cache->item);
+                cache->sectorsize = root->sectorsize;
+
+                remove_sb_from_cache(root, cache);
+
+                /*
+                 * check for two cases, either we are full, and therefore
+                 * don't need to bother with the caching work since we won't
+                 * find any space, or we are empty, and we can just add all
+                 * the space in and be done with it.  This saves us _alot_ of
+                 * time, particularly in the full case.
+                 */
+                if (found_key.offset == btrfs_block_group_used(&cache->item)) {
+                        cache->cached = BTRFS_CACHE_FINISHED;
+                } else if (btrfs_block_group_used(&cache->item) == 0) {
+                        cache->cached = BTRFS_CACHE_FINISHED;
+                        add_new_free_space(cache, root->fs_info,
+                                           found_key.objectid,
+                                           found_key.objectid +
+                                           found_key.offset);
+                }
 
                 ret = update_space_info(info, cache->flags, found_key.offset,
                                         btrfs_block_group_used(&cache->item),
@@ -7079,10 +7319,19 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
         cache->key.objectid = chunk_offset;
         cache->key.offset = size;
         cache->key.type = BTRFS_BLOCK_GROUP_ITEM_KEY;
+        cache->sectorsize = root->sectorsize;
+
+        /*
+         * we only want to have 32k of ram per block group for keeping track
+         * of free space, and if we pass 1/2 of that we want to start
+         * converting things over to using bitmaps
+         */
+        cache->extents_thresh = ((1024 * 32) / 2) /
+                sizeof(struct btrfs_free_space);
         atomic_set(&cache->count, 1);
         spin_lock_init(&cache->lock);
         spin_lock_init(&cache->tree_lock);
-        mutex_init(&cache->cache_mutex);
+        init_waitqueue_head(&cache->caching_q);
         INIT_LIST_HEAD(&cache->list);
         INIT_LIST_HEAD(&cache->cluster_list);
 
@@ -7091,6 +7340,12 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
         cache->flags = type;
         btrfs_set_block_group_flags(&cache->item, type);
 
+        cache->cached = BTRFS_CACHE_FINISHED;
+        remove_sb_from_cache(root, cache);
+
+        add_new_free_space(cache, root->fs_info, chunk_offset,
+                           chunk_offset + size);
+
         ret = update_space_info(root->fs_info, cache->flags, size, bytes_used,
                                 &cache->space_info);
         BUG_ON(ret);
@@ -7149,7 +7404,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         rb_erase(&block_group->cache_node,
                  &root->fs_info->block_group_cache_tree);
         spin_unlock(&root->fs_info->block_group_cache_lock);
-        btrfs_remove_free_space_cache(block_group);
+
         down_write(&block_group->space_info->groups_sem);
         /*
          * we must use list_del_init so people can check to see if they
@@ -7158,11 +7413,18 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         list_del_init(&block_group->list);
         up_write(&block_group->space_info->groups_sem);
 
+        if (block_group->cached == BTRFS_CACHE_STARTED)
+                wait_event(block_group->caching_q,
+                           block_group_cache_done(block_group));
+
+        btrfs_remove_free_space_cache(block_group);
+
         spin_lock(&block_group->space_info->lock);
         block_group->space_info->total_bytes -= block_group->key.offset;
         block_group->space_info->bytes_readonly -= block_group->key.offset;
         spin_unlock(&block_group->space_info->lock);
-        block_group->space_info->full = 0;
+
+        btrfs_clear_space_info_full(root->fs_info);
 
         btrfs_put_block_group(block_group);
         btrfs_put_block_group(block_group);
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 4538e48581a5..af99b78b288e 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -16,45 +16,46 @@
  * Boston, MA 021110-1307, USA.
  */
 
+#include <linux/pagemap.h>
 #include <linux/sched.h>
+#include <linux/math64.h>
 #include "ctree.h"
 #include "free-space-cache.h"
 #include "transaction.h"
 
-struct btrfs_free_space {
-        struct rb_node bytes_index;
-        struct rb_node offset_index;
-        u64 offset;
-        u64 bytes;
-};
+#define BITS_PER_BITMAP         (PAGE_CACHE_SIZE * 8)
+#define MAX_CACHE_BYTES_PER_GIG (32 * 1024)
 
-static int tree_insert_offset(struct rb_root *root, u64 offset,
-                              struct rb_node *node)
+static inline unsigned long offset_to_bit(u64 bitmap_start, u64 sectorsize,
+                                          u64 offset)
 {
-        struct rb_node **p = &root->rb_node;
-        struct rb_node *parent = NULL;
-        struct btrfs_free_space *info;
+        BUG_ON(offset < bitmap_start);
+        offset -= bitmap_start;
+        return (unsigned long)(div64_u64(offset, sectorsize));
+}
 
-        while (*p) {
-                parent = *p;
-                info = rb_entry(parent, struct btrfs_free_space, offset_index);
+static inline unsigned long bytes_to_bits(u64 bytes, u64 sectorsize)
+{
+        return (unsigned long)(div64_u64(bytes, sectorsize));
+}
 
-                if (offset < info->offset)
-                        p = &(*p)->rb_left;
-                else if (offset > info->offset)
-                        p = &(*p)->rb_right;
-                else
-                        return -EEXIST;
-        }
+static inline u64 offset_to_bitmap(struct btrfs_block_group_cache *block_group,
+                                   u64 offset)
+{
+        u64 bitmap_start;
+        u64 bytes_per_bitmap;
 
-        rb_link_node(node, parent, p);
-        rb_insert_color(node, root);
+        bytes_per_bitmap = BITS_PER_BITMAP * block_group->sectorsize;
+        bitmap_start = offset - block_group->key.objectid;
+        bitmap_start = div64_u64(bitmap_start, bytes_per_bitmap);
+        bitmap_start *= bytes_per_bitmap;
+        bitmap_start += block_group->key.objectid;
 
-        return 0;
+        return bitmap_start;
 }
 
-static int tree_insert_bytes(struct rb_root *root, u64 bytes,
-                             struct rb_node *node)
+static int tree_insert_offset(struct rb_root *root, u64 offset,
+                              struct rb_node *node, int bitmap)
 {
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
@@ -62,12 +63,34 @@ static int tree_insert_bytes(struct rb_root *root, u64 bytes,
 
         while (*p) {
                 parent = *p;
-                info = rb_entry(parent, struct btrfs_free_space, bytes_index);
+                info = rb_entry(parent, struct btrfs_free_space, offset_index);
 
-                if (bytes < info->bytes)
+                if (offset < info->offset) {
                         p = &(*p)->rb_left;
-                else
+                } else if (offset > info->offset) {
                         p = &(*p)->rb_right;
+                } else {
+                        /*
+                         * we could have a bitmap entry and an extent entry
+                         * share the same offset.  If this is the case, we want
+                         * the extent entry to always be found first if we do a
+                         * linear search through the tree, since we want to have
+                         * the quickest allocation time, and allocating from an
+                         * extent is faster than allocating from a bitmap.  So
+                         * if we're inserting a bitmap and we find an entry at
+                         * this offset, we want to go right, or after this entry
+                         * logically.  If we are inserting an extent and we've
+                         * found a bitmap, we want to go left, or before
+                         * logically.
+                         */
+                        if (bitmap) {
+                                WARN_ON(info->bitmap);
+                                p = &(*p)->rb_right;
+                        } else {
+                                WARN_ON(!info->bitmap);
+                                p = &(*p)->rb_left;
+                        }
+                }
         }
 
         rb_link_node(node, parent, p);
@@ -79,110 +102,143 @@ static int tree_insert_bytes(struct rb_root *root, u64 bytes,
 /*
  * searches the tree for the given offset.
  *
- * fuzzy == 1: this is used for allocations where we are given a hint of where
- * to look for free space.  Because the hint may not be completely on an offset
- * mark, or the hint may no longer point to free space we need to fudge our
- * results a bit.  So we look for free space starting at or after offset with at
- * least bytes size.  We prefer to find as close to the given offset as we can.
- * Also if the offset is within a free space range, then we will return the free
- * space that contains the given offset, which means we can return a free space
- * chunk with an offset before the provided offset.
- *
- * fuzzy == 0: this is just a normal tree search.  Give us the free space that
- * starts at the given offset which is at least bytes size, and if its not there
- * return NULL.
+ * fuzzy - If this is set, then we are trying to make an allocation, and we just
+ * want a section that has at least bytes size and comes at or after the given
+ * offset.
  */
-static struct btrfs_free_space *tree_search_offset(struct rb_root *root,
-                                                   u64 offset, u64 bytes,
-                                                   int fuzzy)
+static struct btrfs_free_space *
+tree_search_offset(struct btrfs_block_group_cache *block_group,
+                   u64 offset, int bitmap_only, int fuzzy)
 {
-        struct rb_node *n = root->rb_node;
-        struct btrfs_free_space *entry, *ret = NULL;
+        struct rb_node *n = block_group->free_space_offset.rb_node;
+        struct btrfs_free_space *entry, *prev = NULL;
+
+        /* find entry that is closest to the 'offset' */
+        while (1) {
+                if (!n) {
+                        entry = NULL;
+                        break;
+                }
 
-        while (n) {
                 entry = rb_entry(n, struct btrfs_free_space, offset_index);
+                prev = entry;
 
-                if (offset < entry->offset) {
-                        if (fuzzy &&
-                            (!ret || entry->offset < ret->offset) &&
-                            (bytes <= entry->bytes))
-                                ret = entry;
+                if (offset < entry->offset)
                         n = n->rb_left;
-                } else if (offset > entry->offset) {
-                        if (fuzzy &&
-                            (entry->offset + entry->bytes - 1) >= offset &&
-                            bytes <= entry->bytes) {
-                                ret = entry;
-                                break;
-                        }
+                else if (offset > entry->offset)
                         n = n->rb_right;
-                } else {
-                        if (bytes > entry->bytes) {
-                                n = n->rb_right;
-                                continue;
-                        }
-                        ret = entry;
+                else
                         break;
-                }
         }
 
-        return ret;
-}
-
-/*
- * return a chunk at least bytes size, as close to offset that we can get.
- */
-static struct btrfs_free_space *tree_search_bytes(struct rb_root *root,
-                                                  u64 offset, u64 bytes)
-{
-        struct rb_node *n = root->rb_node;
-        struct btrfs_free_space *entry, *ret = NULL;
+        if (bitmap_only) {
+                if (!entry)
+                        return NULL;
+                if (entry->bitmap)
+                        return entry;
 
-        while (n) {
-                entry = rb_entry(n, struct btrfs_free_space, bytes_index);
+                /*
+                 * bitmap entry and extent entry may share same offset,
+                 * in that case, bitmap entry comes after extent entry.
+                 */
+                n = rb_next(n);
+                if (!n)
+                        return NULL;
+                entry = rb_entry(n, struct btrfs_free_space, offset_index);
+                if (entry->offset != offset)
+                        return NULL;
 
-                if (bytes < entry->bytes) {
+                WARN_ON(!entry->bitmap);
+                return entry;
+        } else if (entry) {
+                if (entry->bitmap) {
                         /*
-                         * We prefer to get a hole size as close to the size we
-                         * are asking for so we don't take small slivers out of
-                         * huge holes, but we also want to get as close to the
-                         * offset as possible so we don't have a whole lot of
-                         * fragmentation.
+                         * if previous extent entry covers the offset,
+                         * we should return it instead of the bitmap entry
                          */
-                        if (offset <= entry->offset) {
-                                if (!ret)
-                                        ret = entry;
-                                else if (entry->bytes < ret->bytes)
-                                        ret = entry;
-                                else if (entry->offset < ret->offset)
-                                        ret = entry;
+                        n = &entry->offset_index;
+                        while (1) {
+                                n = rb_prev(n);
+                                if (!n)
+                                        break;
+                                prev = rb_entry(n, struct btrfs_free_space,
+                                                offset_index);
+                                if (!prev->bitmap) {
+                                        if (prev->offset + prev->bytes > offset)
+                                                entry = prev;
+                                        break;
+                                }
                         }
-                        n = n->rb_left;
-                } else if (bytes > entry->bytes) {
-                        n = n->rb_right;
+                }
+                return entry;
+        }
+
+        if (!prev)
+                return NULL;
+
+        /* find last entry before the 'offset' */
+        entry = prev;
+        if (entry->offset > offset) {
+                n = rb_prev(&entry->offset_index);
+                if (n) {
+                        entry = rb_entry(n, struct btrfs_free_space,
+                                        offset_index);
+                        BUG_ON(entry->offset > offset);
                 } else {
-                        /*
-                         * Ok we may have multiple chunks of the wanted size,
-                         * so we don't want to take the first one we find, we
-                         * want to take the one closest to our given offset, so
-                         * keep searching just in case theres a better match.
-                         */
-                        n = n->rb_right;
-                        if (offset > entry->offset)
-                                continue;
-                        else if (!ret || entry->offset < ret->offset)
-                                ret = entry;
+                        if (fuzzy)
+                                return entry;
+                        else
+                                return NULL;
                 }
         }
 
-        return ret;
+        if (entry->bitmap) {
+                n = &entry->offset_index;
+                while (1) {
+                        n = rb_prev(n);
+                        if (!n)
+                                break;
+                        prev = rb_entry(n, struct btrfs_free_space,
+                                        offset_index);
+                        if (!prev->bitmap) {
+                                if (prev->offset + prev->bytes > offset)
+                                        return prev;
+                                break;
+                        }
+                }
+                if (entry->offset + BITS_PER_BITMAP *
+                    block_group->sectorsize > offset)
+                        return entry;
+        } else if (entry->offset + entry->bytes > offset)
+                return entry;
+
+        if (!fuzzy)
+                return NULL;
+
+        while (1) {
+                if (entry->bitmap) {
+                        if (entry->offset + BITS_PER_BITMAP *
+                            block_group->sectorsize > offset)
+                                break;
+                } else {
+                        if (entry->offset + entry->bytes > offset)
+                                break;
+                }
+
+                n = rb_next(&entry->offset_index);
+                if (!n)
+                        return NULL;
+                entry = rb_entry(n, struct btrfs_free_space, offset_index);
+        }
+        return entry;
 }
 
 static void unlink_free_space(struct btrfs_block_group_cache *block_group,
                               struct btrfs_free_space *info)
 {
         rb_erase(&info->offset_index, &block_group->free_space_offset);
-        rb_erase(&info->bytes_index, &block_group->free_space_bytes);
+        block_group->free_extents--;
+        block_group->free_space -= info->bytes;
 }
 
 static int link_free_space(struct btrfs_block_group_cache *block_group,
@@ -190,17 +246,314 @@ static int link_free_space(struct btrfs_block_group_cache *block_group,
 {
         int ret = 0;
 
-
-        BUG_ON(!info->bytes);
+        BUG_ON(!info->bitmap && !info->bytes);
         ret = tree_insert_offset(&block_group->free_space_offset, info->offset,
-                                 &info->offset_index);
+                                 &info->offset_index, (info->bitmap != NULL));
         if (ret)
                 return ret;
 
-        ret = tree_insert_bytes(&block_group->free_space_bytes, info->bytes,
-                                &info->bytes_index);
-        if (ret)
-                return ret;
+        block_group->free_space += info->bytes;
+        block_group->free_extents++;
+        return ret;
+}
+
+static void recalculate_thresholds(struct btrfs_block_group_cache *block_group)
+{
+        u64 max_bytes, possible_bytes;
+
+        /*
+         * The goal is to keep the total amount of memory used per 1gb of space
+         * at or below 32k, so we need to adjust how much memory we allow to be
+         * used by extent based free space tracking
+         */
+        max_bytes = MAX_CACHE_BYTES_PER_GIG *
+                (div64_u64(block_group->key.offset, 1024 * 1024 * 1024));
+
+        possible_bytes = (block_group->total_bitmaps * PAGE_CACHE_SIZE) +
+                (sizeof(struct btrfs_free_space) *
+                 block_group->extents_thresh);
+
+        if (possible_bytes > max_bytes) {
+                int extent_bytes = max_bytes -
+                        (block_group->total_bitmaps * PAGE_CACHE_SIZE);
+
+                if (extent_bytes <= 0) {
+                        block_group->extents_thresh = 0;
+                        return;
+                }
+
+                block_group->extents_thresh = extent_bytes /
+                        (sizeof(struct btrfs_free_space));
+        }
+}
+
+static void bitmap_clear_bits(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *info, u64 offset,
+                              u64 bytes)
+{
+        unsigned long start, end;
+        unsigned long i;
+
+        start = offset_to_bit(info->offset, block_group->sectorsize, offset);
+        end = start + bytes_to_bits(bytes, block_group->sectorsize);
+        BUG_ON(end > BITS_PER_BITMAP);
+
+        for (i = start; i < end; i++)
+                clear_bit(i, info->bitmap);
+
+        info->bytes -= bytes;
+        block_group->free_space -= bytes;
+}
+
+static void bitmap_set_bits(struct btrfs_block_group_cache *block_group,
+                            struct btrfs_free_space *info, u64 offset,
+                            u64 bytes)
+{
+        unsigned long start, end;
+        unsigned long i;
+
+        start = offset_to_bit(info->offset, block_group->sectorsize, offset);
+        end = start + bytes_to_bits(bytes, block_group->sectorsize);
+        BUG_ON(end > BITS_PER_BITMAP);
+
+        for (i = start; i < end; i++)
+                set_bit(i, info->bitmap);
+
+        info->bytes += bytes;
+        block_group->free_space += bytes;
+}
+
+static int search_bitmap(struct btrfs_block_group_cache *block_group,
+                         struct btrfs_free_space *bitmap_info, u64 *offset,
+                         u64 *bytes)
+{
+        unsigned long found_bits = 0;
+        unsigned long bits, i;
+        unsigned long next_zero;
+
+        i = offset_to_bit(bitmap_info->offset, block_group->sectorsize,
+                          max_t(u64, *offset, bitmap_info->offset));
+        bits = bytes_to_bits(*bytes, block_group->sectorsize);
+
+        for (i = find_next_bit(bitmap_info->bitmap, BITS_PER_BITMAP, i);
+             i < BITS_PER_BITMAP;
+             i = find_next_bit(bitmap_info->bitmap, BITS_PER_BITMAP, i + 1)) {
+                next_zero = find_next_zero_bit(bitmap_info->bitmap,
+                                               BITS_PER_BITMAP, i);
+                if ((next_zero - i) >= bits) {
+                        found_bits = next_zero - i;
+                        break;
+                }
+                i = next_zero;
+        }
+
+        if (found_bits) {
+                *offset = (u64)(i * block_group->sectorsize) +
+                        bitmap_info->offset;
+                *bytes = (u64)(found_bits) * block_group->sectorsize;
+                return 0;
+        }
+
+        return -1;
+}
+
+static struct btrfs_free_space *find_free_space(struct btrfs_block_group_cache
+                                                *block_group, u64 *offset,
+                                                u64 *bytes, int debug)
+{
+        struct btrfs_free_space *entry;
+        struct rb_node *node;
+        int ret;
+
+        if (!block_group->free_space_offset.rb_node)
+                return NULL;
+
+        entry = tree_search_offset(block_group,
+                                   offset_to_bitmap(block_group, *offset),
+                                   0, 1);
+        if (!entry)
+                return NULL;
+
+        for (node = &entry->offset_index; node; node = rb_next(node)) {
+                entry = rb_entry(node, struct btrfs_free_space, offset_index);
+                if (entry->bytes < *bytes)
+                        continue;
+
+                if (entry->bitmap) {
+                        ret = search_bitmap(block_group, entry, offset, bytes);
+                        if (!ret)
+                                return entry;
+                        continue;
+                }
+
+                *offset = entry->offset;
+                *bytes = entry->bytes;
+                return entry;
+        }
+
+        return NULL;
+}
+
+static void add_new_bitmap(struct btrfs_block_group_cache *block_group,
+                           struct btrfs_free_space *info, u64 offset)
+{
+        u64 bytes_per_bg = BITS_PER_BITMAP * block_group->sectorsize;
+        int max_bitmaps = (int)div64_u64(block_group->key.offset +
+                                         bytes_per_bg - 1, bytes_per_bg);
+        BUG_ON(block_group->total_bitmaps >= max_bitmaps);
+
+        info->offset = offset_to_bitmap(block_group, offset);
+        link_free_space(block_group, info);
+        block_group->total_bitmaps++;
+
+        recalculate_thresholds(block_group);
+}
+
+static noinline int remove_from_bitmap(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *bitmap_info,
+                              u64 *offset, u64 *bytes)
+{
+        u64 end;
+
+again:
+        end = bitmap_info->offset +
+                (u64)(BITS_PER_BITMAP * block_group->sectorsize) - 1;
+
+        if (*offset > bitmap_info->offset && *offset + *bytes > end) {
+                bitmap_clear_bits(block_group, bitmap_info, *offset,
+                                  end - *offset + 1);
+                *bytes -= end - *offset + 1;
+                *offset = end + 1;
+        } else if (*offset >= bitmap_info->offset && *offset + *bytes <= end) {
+                bitmap_clear_bits(block_group, bitmap_info, *offset, *bytes);
+                *bytes = 0;
+        }
+
+        if (*bytes) {
+                if (!bitmap_info->bytes) {
+                        unlink_free_space(block_group, bitmap_info);
+                        kfree(bitmap_info->bitmap);
+                        kfree(bitmap_info);
+                        block_group->total_bitmaps--;
+                        recalculate_thresholds(block_group);
+                }
+
+                bitmap_info = tree_search_offset(block_group,
+                                                 offset_to_bitmap(block_group,
+                                                                  *offset),
+                                                 1, 0);
+                if (!bitmap_info)
+                        return -EINVAL;
+
+                if (!bitmap_info->bitmap)
+                        return -EAGAIN;
+
+                goto again;
+        } else if (!bitmap_info->bytes) {
+                unlink_free_space(block_group, bitmap_info);
+                kfree(bitmap_info->bitmap);
+                kfree(bitmap_info);
+                block_group->total_bitmaps--;
+                recalculate_thresholds(block_group);
+        }
+
+        return 0;
+}
+
+static int insert_into_bitmap(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *info)
+{
+        struct btrfs_free_space *bitmap_info;
+        int added = 0;
+        u64 bytes, offset, end;
+        int ret;
+
+        /*
+         * If we are below the extents threshold then we can add this as an
+         * extent, and don't have to deal with the bitmap
+         */
+        if (block_group->free_extents < block_group->extents_thresh &&
+            info->bytes > block_group->sectorsize * 4)
+                return 0;
+
+        /*
+         * some block groups are so tiny they can't be enveloped by a bitmap, so
+         * don't even bother to create a bitmap for this
+         */
+        if (BITS_PER_BITMAP * block_group->sectorsize >
+            block_group->key.offset)
+                return 0;
+
+        bytes = info->bytes;
+        offset = info->offset;
+
+again:
+        bitmap_info = tree_search_offset(block_group,
+                                         offset_to_bitmap(block_group, offset),
+                                         1, 0);
+        if (!bitmap_info) {
+                BUG_ON(added);
+                goto new_bitmap;
+        }
+
+        end = bitmap_info->offset +
+                (u64)(BITS_PER_BITMAP * block_group->sectorsize);
+
+        if (offset >= bitmap_info->offset && offset + bytes > end) {
+                bitmap_set_bits(block_group, bitmap_info, offset,
+                                end - offset);
+                bytes -= end - offset;
+                offset = end;
+                added = 0;
+        } else if (offset >= bitmap_info->offset && offset + bytes <= end) {
+                bitmap_set_bits(block_group, bitmap_info, offset, bytes);
+                bytes = 0;
+        } else {
+                BUG();
+        }
+
+        if (!bytes) {
+                ret = 1;
+                goto out;
+        } else
+                goto again;
+
+new_bitmap:
+        if (info && info->bitmap) {
+                add_new_bitmap(block_group, info, offset);
+                added = 1;
+                info = NULL;
+                goto again;
+        } else {
+                spin_unlock(&block_group->tree_lock);
+
+                /* no pre-allocated info, allocate a new one */
+                if (!info) {
+                        info = kzalloc(sizeof(struct btrfs_free_space),
+                                       GFP_NOFS);
+                        if (!info) {
+                                spin_lock(&block_group->tree_lock);
+                                ret = -ENOMEM;
+                                goto out;
+                        }
+                }
+
+                /* allocate the bitmap */
+                info->bitmap = kzalloc(PAGE_CACHE_SIZE, GFP_NOFS);
+                spin_lock(&block_group->tree_lock);
+                if (!info->bitmap) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+                goto again;
+        }
+
+out:
+        if (info) {
+                if (info->bitmap)
+                        kfree(info->bitmap);
+                kfree(info);
+        }
 
         return ret;
 }
@@ -208,8 +561,8 @@ static int link_free_space(struct btrfs_block_group_cache *block_group,
 int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
                          u64 offset, u64 bytes)
 {
-        struct btrfs_free_space *right_info;
-        struct btrfs_free_space *left_info;
+        struct btrfs_free_space *right_info = NULL;
+        struct btrfs_free_space *left_info = NULL;
         struct btrfs_free_space *info = NULL;
         int ret = 0;
 
@@ -227,18 +580,38 @@ int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
          * are adding, if there is remove that struct and add a new one to
          * cover the entire range
          */
-        right_info = tree_search_offset(&block_group->free_space_offset,
-                                        offset+bytes, 0, 0);
-        left_info = tree_search_offset(&block_group->free_space_offset,
-                                       offset-1, 0, 1);
+        right_info = tree_search_offset(block_group, offset + bytes, 0, 0);
+        if (right_info && rb_prev(&right_info->offset_index))
+                left_info = rb_entry(rb_prev(&right_info->offset_index),
+                                     struct btrfs_free_space, offset_index);
+        else
+                left_info = tree_search_offset(block_group, offset - 1, 0, 0);
 
-        if (right_info) {
+        /*
+         * If there was no extent directly to the left or right of this new
+         * extent then we know we're going to have to allocate a new extent, so
+         * before we do that see if we need to drop this into a bitmap
+         */
+        if ((!left_info || left_info->bitmap) &&
+            (!right_info || right_info->bitmap)) {
+                ret = insert_into_bitmap(block_group, info);
+
+                if (ret < 0) {
+                        goto out;
+                } else if (ret) {
+                        ret = 0;
+                        goto out;
+                }
+        }
+
+        if (right_info && !right_info->bitmap) {
                 unlink_free_space(block_group, right_info);
                 info->bytes += right_info->bytes;
                 kfree(right_info);
         }
 
-        if (left_info && left_info->offset + left_info->bytes == offset) {
+        if (left_info && !left_info->bitmap &&
+            left_info->offset + left_info->bytes == offset) {
                 unlink_free_space(block_group, left_info);
                 info->offset = left_info->offset;
                 info->bytes += left_info->bytes;
@@ -248,11 +621,11 @@ int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
         ret = link_free_space(block_group, info);
         if (ret)
                 kfree(info);
-
+out:
         spin_unlock(&block_group->tree_lock);
 
         if (ret) {
-                printk(KERN_ERR "btrfs: unable to add free space :%d\n", ret);
+                printk(KERN_CRIT "btrfs: unable to add free space :%d\n", ret);
                 BUG_ON(ret == -EEXIST);
         }
 
@@ -263,40 +636,65 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
                             u64 offset, u64 bytes)
 {
         struct btrfs_free_space *info;
+        struct btrfs_free_space *next_info = NULL;
         int ret = 0;
 
         spin_lock(&block_group->tree_lock);
 
-        info = tree_search_offset(&block_group->free_space_offset, offset, 0,
-                                  1);
-        if (info && info->offset == offset) {
-                if (info->bytes < bytes) {
-                        printk(KERN_ERR "Found free space at %llu, size %llu,"
-                               "trying to use %llu\n",
-                               (unsigned long long)info->offset,
-                               (unsigned long long)info->bytes,
-                               (unsigned long long)bytes);
+again:
+        info = tree_search_offset(block_group, offset, 0, 0);
+        if (!info) {
+                WARN_ON(1);
+                goto out_lock;
+        }
+
+        if (info->bytes < bytes && rb_next(&info->offset_index)) {
+                u64 end;
+                next_info = rb_entry(rb_next(&info->offset_index),
+                                             struct btrfs_free_space,
+                                             offset_index);
+
+                if (next_info->bitmap)
+                        end = next_info->offset + BITS_PER_BITMAP *
+                                block_group->sectorsize - 1;
+                else
+                        end = next_info->offset + next_info->bytes;
+
+                if (next_info->bytes < bytes ||
+                    next_info->offset > offset || offset > end) {
+                        printk(KERN_CRIT "Found free space at %llu, size %llu,"
+                              " trying to use %llu\n",
+                              (unsigned long long)info->offset,
+                              (unsigned long long)info->bytes,
+                              (unsigned long long)bytes);
                         WARN_ON(1);
                         ret = -EINVAL;
-                        spin_unlock(&block_group->tree_lock);
-                        goto out;
+                        goto out_lock;
                 }
-                unlink_free_space(block_group, info);
 
-                if (info->bytes == bytes) {
-                        kfree(info);
-                        spin_unlock(&block_group->tree_lock);
-                        goto out;
+                info = next_info;
+        }
+
+        if (info->bytes == bytes) {
+                unlink_free_space(block_group, info);
+                if (info->bitmap) {
+                        kfree(info->bitmap);
+                        block_group->total_bitmaps--;
                 }
+                kfree(info);
+                goto out_lock;
+        }
 
+        if (!info->bitmap && info->offset == offset) {
+                unlink_free_space(block_group, info);
                 info->offset += bytes;
                 info->bytes -= bytes;
+                link_free_space(block_group, info);
+                goto out_lock;
+        }
 
-                ret = link_free_space(block_group, info);
-                spin_unlock(&block_group->tree_lock);
-                BUG_ON(ret);
-        } else if (info && info->offset < offset &&
-                   info->offset + info->bytes >= offset + bytes) {
+        if (!info->bitmap && info->offset <= offset &&
+            info->offset + info->bytes >= offset + bytes) {
                 u64 old_start = info->offset;
                 /*
                  * we're freeing space in the middle of the info,
@@ -312,7 +710,9 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
                         info->offset = offset + bytes;
                         info->bytes = old_end - info->offset;
                         ret = link_free_space(block_group, info);
-                        BUG_ON(ret);
+                        WARN_ON(ret);
+                        if (ret)
+                                goto out_lock;
                 } else {
                         /* the hole we're creating ends at the end
                          * of the info struct, just free the info
@@ -320,32 +720,22 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
                         kfree(info);
                 }
                 spin_unlock(&block_group->tree_lock);
-                /* step two, insert a new info struct to cover anything
-                 * before the hole
+
+                /* step two, insert a new info struct to cover
+                 * anything before the hole
                  */
                 ret = btrfs_add_free_space(block_group, old_start,
                                            offset - old_start);
-                BUG_ON(ret);
-        } else {
-                spin_unlock(&block_group->tree_lock);
-                if (!info) {
-                        printk(KERN_ERR "couldn't find space %llu to free\n",
-                               (unsigned long long)offset);
-                        printk(KERN_ERR "cached is %d, offset %llu bytes %llu\n",
-                               block_group->cached,
-                               (unsigned long long)block_group->key.objectid,
-                               (unsigned long long)block_group->key.offset);
-                        btrfs_dump_free_space(block_group, bytes);
-                } else if (info) {
-                        printk(KERN_ERR "hmm, found offset=%llu bytes=%llu, "
-                               "but wanted offset=%llu bytes=%llu\n",
-                               (unsigned long long)info->offset,
-                               (unsigned long long)info->bytes,
-                               (unsigned long long)offset,
-                               (unsigned long long)bytes);
-                }
-                WARN_ON(1);
+                WARN_ON(ret);
+                goto out;
         }
+
+        ret = remove_from_bitmap(block_group, info, &offset, &bytes);
+        if (ret == -EAGAIN)
+                goto again;
+        BUG_ON(ret);
+out_lock:
+        spin_unlock(&block_group->tree_lock);
 out:
         return ret;
 }
@@ -361,10 +751,13 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
                 info = rb_entry(n, struct btrfs_free_space, offset_index);
                 if (info->bytes >= bytes)
                         count++;
-                printk(KERN_ERR "entry offset %llu, bytes %llu\n",
+                printk(KERN_CRIT "entry offset %llu, bytes %llu, bitmap %s\n",
                        (unsigned long long)info->offset,
-                       (unsigned long long)info->bytes);
+                       (unsigned long long)info->bytes,
+                       (info->bitmap) ? "yes" : "no");
         }
+        printk(KERN_INFO "block group has cluster?: %s\n",
+               list_empty(&block_group->cluster_list) ? "no" : "yes");
         printk(KERN_INFO "%d blocks of free space at or bigger than bytes is"
                "\n", count);
 }
@@ -397,26 +790,35 @@ __btrfs_return_cluster_to_free_space(
 {
         struct btrfs_free_space *entry;
         struct rb_node *node;
+        bool bitmap;
 
         spin_lock(&cluster->lock);
         if (cluster->block_group != block_group)
                 goto out;
 
+        bitmap = cluster->points_to_bitmap;
+        cluster->block_group = NULL;
         cluster->window_start = 0;
+        list_del_init(&cluster->block_group_list);
+        cluster->points_to_bitmap = false;
+
+        if (bitmap)
+                goto out;
+
         node = rb_first(&cluster->root);
-        while(node) {
+        while (node) {
                 entry = rb_entry(node, struct btrfs_free_space, offset_index);
                 node = rb_next(&entry->offset_index);
                 rb_erase(&entry->offset_index, &cluster->root);
-                link_free_space(block_group, entry);
+                BUG_ON(entry->bitmap);
+                tree_insert_offset(&block_group->free_space_offset,
+                                   entry->offset, &entry->offset_index, 0);
         }
-        list_del_init(&cluster->block_group_list);
-
-        btrfs_put_block_group(cluster->block_group);
-        cluster->block_group = NULL;
         cluster->root.rb_node = NULL;
+
 out:
         spin_unlock(&cluster->lock);
+        btrfs_put_block_group(block_group);
         return 0;
 }
 
@@ -425,20 +827,28 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
         struct btrfs_free_space *info;
         struct rb_node *node;
         struct btrfs_free_cluster *cluster;
-        struct btrfs_free_cluster *safe;
+        struct list_head *head;
 
         spin_lock(&block_group->tree_lock);
-
-        list_for_each_entry_safe(cluster, safe, &block_group->cluster_list,
-                                 block_group_list) {
+        while ((head = block_group->cluster_list.next) !=
+               &block_group->cluster_list) {
+                cluster = list_entry(head, struct btrfs_free_cluster,
+                                     block_group_list);
 
                 WARN_ON(cluster->block_group != block_group);
                 __btrfs_return_cluster_to_free_space(block_group, cluster);
+                if (need_resched()) {
+                        spin_unlock(&block_group->tree_lock);
+                        cond_resched();
+                        spin_lock(&block_group->tree_lock);
+                }
         }
 
-        while ((node = rb_last(&block_group->free_space_bytes)) != NULL) {
-                info = rb_entry(node, struct btrfs_free_space, bytes_index);
+        while ((node = rb_last(&block_group->free_space_offset)) != NULL) {
+                info = rb_entry(node, struct btrfs_free_space, offset_index);
                 unlink_free_space(block_group, info);
+                if (info->bitmap)
+                        kfree(info->bitmap);
                 kfree(info);
                 if (need_resched()) {
                         spin_unlock(&block_group->tree_lock);
@@ -446,6 +856,7 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
                         spin_lock(&block_group->tree_lock);
                 }
         }
+
         spin_unlock(&block_group->tree_lock);
 }
 
@@ -453,25 +864,35 @@ u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
                                u64 offset, u64 bytes, u64 empty_size)
 {
         struct btrfs_free_space *entry = NULL;
+        u64 bytes_search = bytes + empty_size;
         u64 ret = 0;
 
         spin_lock(&block_group->tree_lock);
-        entry = tree_search_offset(&block_group->free_space_offset, offset,
-                                   bytes + empty_size, 1);
+        entry = find_free_space(block_group, &offset, &bytes_search, 0);
         if (!entry)
-                entry = tree_search_bytes(&block_group->free_space_bytes,
-                                          offset, bytes + empty_size);
-        if (entry) {
+                goto out;
+
+        ret = offset;
+        if (entry->bitmap) {
+                bitmap_clear_bits(block_group, entry, offset, bytes);
+                if (!entry->bytes) {
+                        unlink_free_space(block_group, entry);
+                        kfree(entry->bitmap);
+                        kfree(entry);
+                        block_group->total_bitmaps--;
+                        recalculate_thresholds(block_group);
+                }
+        } else {
                 unlink_free_space(block_group, entry);
-                ret = entry->offset;
                 entry->offset += bytes;
                 entry->bytes -= bytes;
-
                 if (!entry->bytes)
                         kfree(entry);
                 else
                         link_free_space(block_group, entry);
         }
+
+out:
         spin_unlock(&block_group->tree_lock);
 
         return ret;
@@ -517,6 +938,47 @@ int btrfs_return_cluster_to_free_space(
         return ret;
 }
 
+static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
+                                   struct btrfs_free_cluster *cluster,
+                                   u64 bytes, u64 min_start)
+{
+        struct btrfs_free_space *entry;
+        int err;
+        u64 search_start = cluster->window_start;
+        u64 search_bytes = bytes;
+        u64 ret = 0;
+
+        spin_lock(&block_group->tree_lock);
+        spin_lock(&cluster->lock);
+
+        if (!cluster->points_to_bitmap)
+                goto out;
+
+        if (cluster->block_group != block_group)
+                goto out;
+
+        entry = tree_search_offset(block_group, search_start, 0, 0);
+
+        if (!entry || !entry->bitmap)
+                goto out;
+
+        search_start = min_start;
+        search_bytes = bytes;
+
+        err = search_bitmap(block_group, entry, &search_start,
+                            &search_bytes);
+        if (err)
+                goto out;
+
+        ret = search_start;
+        bitmap_clear_bits(block_group, entry, ret, bytes);
+out:
+        spin_unlock(&cluster->lock);
+        spin_unlock(&block_group->tree_lock);
+
+        return ret;
+}
+
 /*
  * given a cluster, try to allocate 'bytes' from it, returns 0
  * if it couldn't find anything suitably large, or a logical disk offset
@@ -530,6 +992,10 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
         struct rb_node *node;
         u64 ret = 0;
 
+        if (cluster->points_to_bitmap)
+                return btrfs_alloc_from_bitmap(block_group, cluster, bytes,
+                                               min_start);
+
         spin_lock(&cluster->lock);
         if (bytes > cluster->max_size)
                 goto out;
@@ -567,9 +1033,73 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
         }
 out:
         spin_unlock(&cluster->lock);
+
         return ret;
 }
 
+static int btrfs_bitmap_cluster(struct btrfs_block_group_cache *block_group,
+                                struct btrfs_free_space *entry,
+                                struct btrfs_free_cluster *cluster,
+                                u64 offset, u64 bytes, u64 min_bytes)
+{
+        unsigned long next_zero;
+        unsigned long i;
+        unsigned long search_bits;
+        unsigned long total_bits;
+        unsigned long found_bits;
+        unsigned long start = 0;
+        unsigned long total_found = 0;
+        bool found = false;
+
+        i = offset_to_bit(entry->offset, block_group->sectorsize,
+                          max_t(u64, offset, entry->offset));
+        search_bits = bytes_to_bits(min_bytes, block_group->sectorsize);
+        total_bits = bytes_to_bits(bytes, block_group->sectorsize);
+
+again:
+        found_bits = 0;
+        for (i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, i);
+             i < BITS_PER_BITMAP;
+             i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, i + 1)) {
+                next_zero = find_next_zero_bit(entry->bitmap,
+                                               BITS_PER_BITMAP, i);
+                if (next_zero - i >= search_bits) {
+                        found_bits = next_zero - i;
+                        break;
+                }
+                i = next_zero;
+        }
+
+        if (!found_bits)
+                return -1;
+
+        if (!found) {
+                start = i;
+                found = true;
+        }
+
+        total_found += found_bits;
+
+        if (cluster->max_size < found_bits * block_group->sectorsize)
+                cluster->max_size = found_bits * block_group->sectorsize;
+
+        if (total_found < total_bits) {
+                i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, next_zero);
+                if (i - start > total_bits * 2) {
+                        total_found = 0;
+                        cluster->max_size = 0;
+                        found = false;
+                }
+                goto again;
+        }
+
+        cluster->window_start = start * block_group->sectorsize +
+                entry->offset;
+        cluster->points_to_bitmap = true;
+
+        return 0;
+}
+
 /*
  * here we try to find a cluster of blocks in a block group.  The goal
  * is to find at least bytes free and up to empty_size + bytes free.
@@ -587,12 +1117,12 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
         struct btrfs_free_space *entry = NULL;
         struct rb_node *node;
         struct btrfs_free_space *next;
-        struct btrfs_free_space *last;
+        struct btrfs_free_space *last = NULL;
         u64 min_bytes;
         u64 window_start;
         u64 window_free;
         u64 max_extent = 0;
-        int total_retries = 0;
+        bool found_bitmap = false;
         int ret;
 
         /* for metadata, allow allocates with more holes */
@@ -620,31 +1150,80 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
                 goto out;
         }
 again:
-        min_bytes = min(min_bytes, bytes + empty_size);
-        entry = tree_search_bytes(&block_group->free_space_bytes,
-                                  offset, min_bytes);
+        entry = tree_search_offset(block_group, offset, found_bitmap, 1);
         if (!entry) {
                 ret = -ENOSPC;
                 goto out;
         }
+
+        /*
+         * If found_bitmap is true, we exhausted our search for extent entries,
+         * and we just want to search all of the bitmaps that we can find, and
+         * ignore any extent entries we find.
+         */
+        while (entry->bitmap || found_bitmap ||
+               (!entry->bitmap && entry->bytes < min_bytes)) {
+                struct rb_node *node = rb_next(&entry->offset_index);
+
+                if (entry->bitmap && entry->bytes > bytes + empty_size) {
+                        ret = btrfs_bitmap_cluster(block_group, entry, cluster,
+                                                   offset, bytes + empty_size,
+                                                   min_bytes);
+                        if (!ret)
+                                goto got_it;
+                }
+
+                if (!node) {
+                        ret = -ENOSPC;
+                        goto out;
+                }
+                entry = rb_entry(node, struct btrfs_free_space, offset_index);
+        }
+
+        /*
+         * We already searched all the extent entries from the passed in offset
+         * to the end and didn't find enough space for the cluster, and we also
+         * didn't find any bitmaps that met our criteria, just go ahead and exit
+         */
+        if (found_bitmap) {
+                ret = -ENOSPC;
+                goto out;
+        }
+
+        cluster->points_to_bitmap = false;
         window_start = entry->offset;
         window_free = entry->bytes;
         last = entry;
         max_extent = entry->bytes;
 
-        while(1) {
+        while (1) {
                 /* out window is just right, lets fill it */
                 if (window_free >= bytes + empty_size)
                         break;
 
                 node = rb_next(&last->offset_index);
                 if (!node) {
+                        if (found_bitmap)
+                                goto again;
                         ret = -ENOSPC;
                         goto out;
                 }
                 next = rb_entry(node, struct btrfs_free_space, offset_index);
 
                 /*
+                 * we found a bitmap, so if this search doesn't result in a
+                 * cluster, we know to go and search again for the bitmaps and
+                 * start looking for space there
+                 */
+                if (next->bitmap) {
+                        if (!found_bitmap)
+                                offset = next->offset;
+                        found_bitmap = true;
+                        last = next;
+                        continue;
+                }
+
+                /*
                  * we haven't filled the empty size and the window is
                  * very large.  reset and try again
                  */
@@ -655,19 +1234,6 @@ again:
                         window_free = entry->bytes;
                         last = entry;
                         max_extent = 0;
-                        total_retries++;
-                        if (total_retries % 64 == 0) {
-                                if (min_bytes >= (bytes + empty_size)) {
-                                        ret = -ENOSPC;
-                                        goto out;
-                                }
-                                /*
-                                 * grow our allocation a bit, we're not having
-                                 * much luck
-                                 */
-                                min_bytes *= 2;
-                                goto again;
-                        }
                 } else {
                         last = next;
                         window_free += next->bytes;
@@ -685,11 +1251,19 @@ again:
          * The cluster includes an rbtree, but only uses the offset index
          * of each free space cache entry.
          */
-        while(1) {
+        while (1) {
                 node = rb_next(&entry->offset_index);
-                unlink_free_space(block_group, entry);
+                if (entry->bitmap && node) {
+                        entry = rb_entry(node, struct btrfs_free_space,
+                                         offset_index);
+                        continue;
+                } else if (entry->bitmap && !node) {
+                        break;
+                }
+
+                rb_erase(&entry->offset_index, &block_group->free_space_offset);
                 ret = tree_insert_offset(&cluster->root, entry->offset,
-                                         &entry->offset_index);
+                                         &entry->offset_index, 0);
                 BUG_ON(ret);
 
                 if (!node || entry == last)
@@ -697,8 +1271,10 @@ again:
 
                 entry = rb_entry(node, struct btrfs_free_space, offset_index);
         }
-        ret = 0;
+
         cluster->max_size = max_extent;
+got_it:
+        ret = 0;
         atomic_inc(&block_group->count);
         list_add_tail(&cluster->block_group_list, &block_group->cluster_list);
         cluster->block_group = block_group;
@@ -718,6 +1294,7 @@ void btrfs_init_free_cluster(struct btrfs_free_cluster *cluster)
         spin_lock_init(&cluster->refill_lock);
         cluster->root.rb_node = NULL;
         cluster->max_size = 0;
+        cluster->points_to_bitmap = false;
         INIT_LIST_HEAD(&cluster->block_group_list);
         cluster->block_group = NULL;
 }
diff --git a/fs/btrfs/free-space-cache.h b/fs/btrfs/free-space-cache.h
index 266fb8764054..890a8e79011b 100644
--- a/fs/btrfs/free-space-cache.h
+++ b/fs/btrfs/free-space-cache.h
@@ -19,6 +19,14 @@
 #ifndef __BTRFS_FREE_SPACE_CACHE
 #define __BTRFS_FREE_SPACE_CACHE
 
+struct btrfs_free_space {
+        struct rb_node offset_index;
+        u64 offset;
+        u64 bytes;
+        unsigned long *bitmap;
+        struct list_head list;
+};
+
 int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
                          u64 bytenr, u64 size);
 int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 791eab19e330..56fe83fa60c4 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2603,8 +2603,8 @@ noinline int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
         if (root->ref_cows)
                 btrfs_drop_extent_cache(inode, new_size & (~mask), (u64)-1, 0);
         path = btrfs_alloc_path();
-        path->reada = -1;
         BUG_ON(!path);
+        path->reada = -1;
 
         /* FIXME, add redo link to tree so we don't leak on crash */
         key.objectid = inode->i_ino;
diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
index 6d6523da0a30..0d126be22b63 100644
--- a/fs/btrfs/print-tree.c
+++ b/fs/btrfs/print-tree.c
@@ -309,7 +309,7 @@ void btrfs_print_tree(struct btrfs_root *root, struct extent_buffer *c)
         }
         printk(KERN_INFO "node %llu level %d total ptrs %d free spc %u\n",
                (unsigned long long)btrfs_header_bytenr(c),
-               btrfs_header_level(c), nr,
+              level, nr,
                (u32)BTRFS_NODEPTRS_PER_BLOCK(root) - nr);
         for (i = 0; i < nr; i++) {
                 btrfs_node_key_to_cpu(c, &key, i);
@@ -326,10 +326,10 @@ void btrfs_print_tree(struct btrfs_root *root, struct extent_buffer *c)
                                         btrfs_level_size(root, level - 1),
                                         btrfs_node_ptr_generation(c, i));
                 if (btrfs_is_leaf(next) &&
-                    btrfs_header_level(c) != 1)
+                   level != 1)
                         BUG();
                 if (btrfs_header_level(next) !=
-                        btrfs_header_level(c) - 1)
+                       level - 1)
                         BUG();
                 btrfs_print_tree(root, next);
                 free_extent_buffer(next);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 008397934778..e71264d1c2c9 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -670,6 +670,8 @@ again:
                         err = ret;
                         goto out;
                 }
+                if (ret > 0 && path2->slots[level] > 0)
+                        path2->slots[level]--;
 
                 eb = path2->nodes[level];
                 WARN_ON(btrfs_node_blockptr(eb, path2->slots[level]) !=
@@ -1609,6 +1611,7 @@ static noinline_for_stack int merge_reloc_root(struct reloc_control *rc,
                 BUG_ON(level == 0);
                 path->lowest_level = level;
                 ret = btrfs_search_slot(NULL, reloc_root, &key, path, 0, 0);
+                path->lowest_level = 0;
                 if (ret < 0) {
                         btrfs_free_path(path);
                         return ret;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 2dbf1c1f56ee..e51d2bc532f8 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -40,6 +40,14 @@ static noinline void put_transaction(struct btrfs_transaction *transaction)
         }
 }
 
+static noinline void switch_commit_root(struct btrfs_root *root)
+{
+        down_write(&root->commit_root_sem);
+        free_extent_buffer(root->commit_root);
+        root->commit_root = btrfs_root_node(root);
+        up_write(&root->commit_root_sem);
+}
+
 /*
  * either allocate a new transaction or hop into the existing one
  */
@@ -444,9 +452,6 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
 
         btrfs_write_dirty_block_groups(trans, root);
 
-        ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-        BUG_ON(ret);
-
         while (1) {
                 old_root_bytenr = btrfs_root_bytenr(&root->root_item);
                 if (old_root_bytenr == root->node->start)
@@ -457,13 +462,11 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
                                         &root->root_key,
                                         &root->root_item);
                 BUG_ON(ret);
-                btrfs_write_dirty_block_groups(trans, root);
 
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
+                ret = btrfs_write_dirty_block_groups(trans, root);
                 BUG_ON(ret);
         }
-        free_extent_buffer(root->commit_root);
-        root->commit_root = btrfs_root_node(root);
+        switch_commit_root(root);
         return 0;
 }
 
@@ -495,9 +498,6 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
                 root = list_entry(next, struct btrfs_root, dirty_list);
 
                 update_cowonly_root(trans, root);
-
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-                BUG_ON(ret);
         }
         return 0;
 }
@@ -544,8 +544,7 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans,
                         btrfs_update_reloc_root(trans, root);
 
                         if (root->commit_root != root->node) {
-                                free_extent_buffer(root->commit_root);
-                                root->commit_root = btrfs_root_node(root);
+                                switch_commit_root(root);
                                 btrfs_set_root_node(&root->root_item,
                                                     root->node);
                         }
@@ -943,9 +942,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
                 mutex_unlock(&root->fs_info->trans_mutex);
 
-                if (flush_on_commit || snap_pending) {
-                        if (flush_on_commit)
-                                btrfs_start_delalloc_inodes(root);
+                if (flush_on_commit) {
+                        btrfs_start_delalloc_inodes(root);
+                        ret = btrfs_wait_ordered_extents(root, 0);
+                        BUG_ON(ret);
+                } else if (snap_pending) {
                         ret = btrfs_wait_ordered_extents(root, 1);
                         BUG_ON(ret);
                 }
@@ -1009,15 +1010,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         btrfs_set_root_node(&root->fs_info->tree_root->root_item,
                             root->fs_info->tree_root->node);
-        free_extent_buffer(root->fs_info->tree_root->commit_root);
-        root->fs_info->tree_root->commit_root =
-                                btrfs_root_node(root->fs_info->tree_root);
+        switch_commit_root(root->fs_info->tree_root);
 
         btrfs_set_root_node(&root->fs_info->chunk_root->root_item,
                             root->fs_info->chunk_root->node);
-        free_extent_buffer(root->fs_info->chunk_root->commit_root);
-        root->fs_info->chunk_root->commit_root =
-                                btrfs_root_node(root->fs_info->chunk_root);
+        switch_commit_root(root->fs_info->chunk_root);
 
         update_super_roots(root);
 
@@ -1057,6 +1054,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         cur_trans->commit_done = 1;
 
         root->fs_info->last_trans_committed = cur_trans->transid;
+
         wake_up(&cur_trans->commit_wait);
 
         put_transaction(cur_trans);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c13922206d1b..d91b0de7c502 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -797,7 +797,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
                 return -ENOENT;
 
         inode = read_one_inode(root, key->objectid);
-        BUG_ON(!dir);
+        BUG_ON(!inode);
 
         ref_ptr = btrfs_item_ptr_offset(eb, slot);
         ref_end = ref_ptr + btrfs_item_size_nr(eb, slot);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 3ab80e9cd767..5dbefd11b4af 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -721,7 +721,8 @@ error:
  */
 static noinline int find_free_dev_extent(struct btrfs_trans_handle *trans,
                                          struct btrfs_device *device,
-                                         u64 num_bytes, u64 *start)
+                                         u64 num_bytes, u64 *start,
+                                         u64 *max_avail)
 {
         struct btrfs_key key;
         struct btrfs_root *root = device->dev_root;
@@ -758,9 +759,13 @@ static noinline int find_free_dev_extent(struct btrfs_trans_handle *trans,
         ret = btrfs_search_slot(trans, root, &key, path, 0, 0);
         if (ret < 0)
                 goto error;
-        ret = btrfs_previous_item(root, path, 0, key.type);
-        if (ret < 0)
-                goto error;
+        if (ret > 0) {
+                ret = btrfs_previous_item(root, path, key.objectid, key.type);
+                if (ret < 0)
+                        goto error;
+                if (ret > 0)
+                        start_found = 1;
+        }
         l = path->nodes[0];
         btrfs_item_key_to_cpu(l, &key, path->slots[0]);
         while (1) {
@@ -803,6 +808,10 @@ no_more_items:
                         if (last_byte < search_start)
                                 last_byte = search_start;
                         hole_size = key.offset - last_byte;
+
+                        if (hole_size > *max_avail)
+                                *max_avail = hole_size;
+
                         if (key.offset > last_byte &&
                             hole_size >= num_bytes) {
                                 *start = last_byte;
@@ -1621,6 +1630,7 @@ static int __btrfs_grow_device(struct btrfs_trans_handle *trans,
         device->fs_devices->total_rw_bytes += diff;
 
         device->total_bytes = new_size;
+        device->disk_total_bytes = new_size;
         btrfs_clear_space_info_full(device->dev_root->fs_info);
 
         return btrfs_update_device(trans, device);
@@ -2007,7 +2017,7 @@ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size)
                         goto done;
                 if (ret) {
                         ret = 0;
-                        goto done;
+                        break;
                 }
 
                 l = path->nodes[0];
@@ -2015,7 +2025,7 @@ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size)
                 btrfs_item_key_to_cpu(l, &key, path->slots[0]);
 
                 if (key.objectid != device->devid)
-                        goto done;
+                        break;
 
                 dev_extent = btrfs_item_ptr(l, slot, struct btrfs_dev_extent);
                 length = btrfs_dev_extent_length(l, dev_extent);
@@ -2171,6 +2181,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                              max_chunk_size);
 
 again:
+        max_avail = 0;
         if (!map || map->num_stripes != num_stripes) {
                 kfree(map);
                 map = kmalloc(map_lookup_size(num_stripes), GFP_NOFS);
@@ -2219,7 +2230,8 @@ again:
 
                 if (device->in_fs_metadata && avail >= min_free) {
                         ret = find_free_dev_extent(trans, device,
-                                                   min_free, &dev_offset);
+                                                   min_free, &dev_offset,
+                                                   &max_avail);
                         if (ret == 0) {
                                 list_move_tail(&device->dev_alloc_list,
                                                &private_devs);
@@ -2795,26 +2807,6 @@ int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree,
                 }
         }
 
-        for (i = 0; i > nr; i++) {
-                struct btrfs_multi_bio *multi;
-                struct btrfs_bio_stripe *stripe;
-                int ret;
-
-                length = 1;
-                ret = btrfs_map_block(map_tree, WRITE, buf[i],
-                                      &length, &multi, 0);
-                BUG_ON(ret);
-
-                stripe = multi->stripes;
-                for (j = 0; j < multi->num_stripes; j++) {
-                        if (stripe->physical >= physical &&
-                            physical < stripe->physical + length)
-                                break;
-                }
-                BUG_ON(j >= multi->num_stripes);
-                kfree(multi);
-        }
-
         *logical = buf;
         *naddrs = nr;
         *stripe_len = map->stripe_len;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 9bb5c8750736..fc44d316d0bb 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2452,10 +2452,10 @@ try_mount_again:
                 tcon->local_lease = volume_info->local_lease;
         }
         if (pSesInfo) {
-                if (pSesInfo->capabilities & CAP_LARGE_FILES) {
-                        sb->s_maxbytes = (u64) 1 << 63;
-                } else
-                        sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
+                if (pSesInfo->capabilities & CAP_LARGE_FILES)
+                        sb->s_maxbytes = MAX_LFS_FILESIZE;
+                else
+                        sb->s_maxbytes = MAX_NON_LFS;
         }
 
         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 18afe57b2461..82d83839655e 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -212,7 +212,7 @@ cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info,
  * junction to the new submount (ie to setup the fake directory
  * which represents a DFS referral).
  */
-void
+static void
 cifs_create_dfs_fattr(struct cifs_fattr *fattr, struct super_block *sb)
 {
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
@@ -388,7 +388,7 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
 }
 
 /* Fill a cifs_fattr struct with info from FILE_ALL_INFO */
-void
+static void
 cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                        struct cifs_sb_info *cifs_sb, bool adjust_tz)
 {
@@ -513,9 +513,12 @@ int cifs_get_inode_info(struct inode **pinode,
                                         cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                         if (rc1) {
-                                /* BB EOPNOSUPP disable SERVER_INUM? */
                                 cFYI(1, ("GetSrvInodeNum rc %d", rc1));
                                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
+                                /* disable serverino if call not supported */
+                                if (rc1 == -EINVAL)
+                                        cifs_sb->mnt_cifs_flags &=
+                                                        ~CIFS_MOUNT_SERVER_INUM;
                         }
                 } else {
                         fattr.cf_uniqueid = iunique(sb, ROOT_I);
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index af737bb56cb7..259525c9abb8 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1303,6 +1303,13 @@ parse_tag_3_packet(struct ecryptfs_crypt_stat *crypt_stat,
         }
         (*new_auth_tok)->session_key.encrypted_key_size =
                 (body_size - (ECRYPTFS_SALT_SIZE + 5));
+        if ((*new_auth_tok)->session_key.encrypted_key_size
+            > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) {
+                printk(KERN_WARNING "Tag 3 packet contains key larger "
+                       "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
+                rc = -EINVAL;
+                goto out_free;
+        }
         if (unlikely(data[(*packet_size)++] != 0x04)) {
                 printk(KERN_WARNING "Unknown version number [%d]\n",
                        data[(*packet_size) - 1]);
@@ -1449,6 +1456,12 @@ parse_tag_11_packet(unsigned char *data, unsigned char *contents,
                 rc = -EINVAL;
                 goto out;
         }
+        if (unlikely((*tag_11_contents_size) > max_contents_bytes)) {
+                printk(KERN_ERR "Literal data section in tag 11 packet exceeds "
+                       "expected size\n");
+                rc = -EINVAL;
+                goto out;
+        }
         if (data[(*packet_size)++] != 0x62) {
                 printk(KERN_WARNING "Unrecognizable packet\n");
                 rc = -EINVAL;
diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
index 3d724a95882f..373fa90c796a 100644
--- a/fs/ext3/dir.c
+++ b/fs/ext3/dir.c
@@ -130,8 +130,7 @@ static int ext3_readdir(struct file * filp,
                 struct buffer_head *bh = NULL;
 
                 map_bh.b_state = 0;
-                err = ext3_get_blocks_handle(NULL, inode, blk, 1,
-                                                &map_bh, 0, 0);
+                err = ext3_get_blocks_handle(NULL, inode, blk, 1, &map_bh, 0);
                 if (err > 0) {
                         pgoff_t index = map_bh.b_blocknr >>
                                         (PAGE_CACHE_SHIFT - inode->i_blkbits);
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 5f51fed5c750..b49908a167ae 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -788,7 +788,7 @@ err_out:
 int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
                 sector_t iblock, unsigned long maxblocks,
                 struct buffer_head *bh_result,
-                int create, int extend_disksize)
+                int create)
 {
         int err = -EIO;
         int offsets[4];
@@ -911,13 +911,6 @@ int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
         if (!err)
                 err = ext3_splice_branch(handle, inode, iblock,
                                         partial, indirect_blks, count);
-        /*
-         * i_disksize growing is protected by truncate_mutex.  Don't forget to
-         * protect it if you're about to implement concurrent
-         * ext3_get_block() -bzzz
-        */
-        if (!err && extend_disksize && inode->i_size > ei->i_disksize)
-                ei->i_disksize = inode->i_size;
         mutex_unlock(&ei->truncate_mutex);
         if (err)
                 goto cleanup;
@@ -972,7 +965,7 @@ static int ext3_get_block(struct inode *inode, sector_t iblock,
         }
 
         ret = ext3_get_blocks_handle(handle, inode, iblock,
-                                        max_blocks, bh_result, create, 0);
+                                        max_blocks, bh_result, create);
         if (ret > 0) {
                 bh_result->b_size = (ret << inode->i_blkbits);
                 ret = 0;
@@ -1005,7 +998,7 @@ struct buffer_head *ext3_getblk(handle_t *handle, struct inode *inode,
         dummy.b_blocknr = -1000;
         buffer_trace_init(&dummy.b_history);
         err = ext3_get_blocks_handle(handle, inode, block, 1,
-                                        &dummy, create, 1);
+                                        &dummy, create);
         /*
          * ext3_get_blocks_handle() returns number of blocks
          * mapped. 0 in case of a HOLE.
@@ -1193,15 +1186,16 @@ write_begin_failed:
                  * i_size_read because we hold i_mutex.
                  *
                  * Add inode to orphan list in case we crash before truncate
-                 * finishes.
+                 * finishes. Do this only if ext3_can_truncate() agrees so
+                 * that orphan processing code is happy.
                  */
-                if (pos + len > inode->i_size)
+                if (pos + len > inode->i_size && ext3_can_truncate(inode))
                         ext3_orphan_add(handle, inode);
                 ext3_journal_stop(handle);
                 unlock_page(page);
                 page_cache_release(page);
                 if (pos + len > inode->i_size)
-                        vmtruncate(inode, inode->i_size);
+                        ext3_truncate(inode);
         }
         if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
                 goto retry;
@@ -1287,7 +1281,7 @@ static int ext3_ordered_write_end(struct file *file,
          * There may be allocated blocks outside of i_size because
          * we failed to copy some data. Prepare for truncate.
          */
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext3_can_truncate(inode))
                 ext3_orphan_add(handle, inode);
         ret2 = ext3_journal_stop(handle);
         if (!ret)
@@ -1296,7 +1290,7 @@ static int ext3_ordered_write_end(struct file *file,
         page_cache_release(page);
 
         if (pos + len > inode->i_size)
-                vmtruncate(inode, inode->i_size);
+                ext3_truncate(inode);
         return ret ? ret : copied;
 }
 
@@ -1315,14 +1309,14 @@ static int ext3_writeback_write_end(struct file *file,
          * There may be allocated blocks outside of i_size because
          * we failed to copy some data. Prepare for truncate.
          */
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext3_can_truncate(inode))
                 ext3_orphan_add(handle, inode);
         ret = ext3_journal_stop(handle);
         unlock_page(page);
         page_cache_release(page);
 
         if (pos + len > inode->i_size)
-                vmtruncate(inode, inode->i_size);
+                ext3_truncate(inode);
         return ret ? ret : copied;
 }
 
@@ -1358,7 +1352,7 @@ static int ext3_journalled_write_end(struct file *file,
          * There may be allocated blocks outside of i_size because
          * we failed to copy some data. Prepare for truncate.
          */
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext3_can_truncate(inode))
                 ext3_orphan_add(handle, inode);
         EXT3_I(inode)->i_state |= EXT3_STATE_JDATA;
         if (inode->i_size > EXT3_I(inode)->i_disksize) {
@@ -1375,7 +1369,7 @@ static int ext3_journalled_write_end(struct file *file,
         page_cache_release(page);
 
         if (pos + len > inode->i_size)
-                vmtruncate(inode, inode->i_size);
+                ext3_truncate(inode);
         return ret ? ret : copied;
 }
 
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 737f7246a4b5..f96f85092d1c 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -287,6 +287,7 @@ int journal_write_metadata_buffer(transaction_t *transaction,
         struct page *new_page;
         unsigned int new_offset;
         struct buffer_head *bh_in = jh2bh(jh_in);
+        journal_t *journal = transaction->t_journal;
 
         /*
          * The buffer really shouldn't be locked: only the current committing
@@ -300,6 +301,11 @@ int journal_write_metadata_buffer(transaction_t *transaction,
         J_ASSERT_BH(bh_in, buffer_jbddirty(bh_in));
 
         new_bh = alloc_buffer_head(GFP_NOFS|__GFP_NOFAIL);
+        /* keep subsequent assertions sane */
+        new_bh->b_state = 0;
+        init_buffer(new_bh, NULL, NULL);
+        atomic_set(&new_bh->b_count, 1);
+        new_jh = journal_add_journal_head(new_bh);      /* This sleeps */
 
         /*
          * If a new transaction has already done a buffer copy-out, then
@@ -361,14 +367,6 @@ repeat:
                 kunmap_atomic(mapped_data, KM_USER0);
         }
 
-        /* keep subsequent assertions sane */
-        new_bh->b_state = 0;
-        init_buffer(new_bh, NULL, NULL);
-        atomic_set(&new_bh->b_count, 1);
-        jbd_unlock_bh_state(bh_in);
-
-        new_jh = journal_add_journal_head(new_bh);      /* This sleeps */
-
         set_bh_page(new_bh, new_page, new_offset);
         new_jh->b_transaction = NULL;
         new_bh->b_size = jh2bh(jh_in)->b_size;
@@ -385,7 +383,11 @@ repeat:
          * copying is moved to the transaction's shadow queue.
          */
         JBUFFER_TRACE(jh_in, "file as BJ_Shadow");
-        journal_file_buffer(jh_in, transaction, BJ_Shadow);
+        spin_lock(&journal->j_list_lock);
+        __journal_file_buffer(jh_in, transaction, BJ_Shadow);
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(bh_in);
+
         JBUFFER_TRACE(new_jh, "file as BJ_IO");
         journal_file_buffer(new_jh, transaction, BJ_IO);
 
@@ -848,6 +850,12 @@ static int journal_reset(journal_t *journal)
 
         first = be32_to_cpu(sb->s_first);
         last = be32_to_cpu(sb->s_maxlen);
+        if (first + JFS_MIN_JOURNAL_BLOCKS > last + 1) {
+                printk(KERN_ERR "JBD: Journal too short (blocks %lu-%lu).\n",
+                       first, last);
+                journal_fail_superblock(journal);
+                return -EINVAL;
+        }
 
         journal->j_first = first;
         journal->j_last = last;
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 73242ba7c7b1..c03ac11f74be 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -489,34 +489,15 @@ void journal_unlock_updates (journal_t *journal)
         wake_up(&journal->j_wait_transaction_locked);
 }
 
-/*
- * Report any unexpected dirty buffers which turn up.  Normally those
- * indicate an error, but they can occur if the user is running (say)
- * tune2fs to modify the live filesystem, so we need the option of
- * continuing as gracefully as possible.  #
- *
- * The caller should already hold the journal lock and
- * j_list_lock spinlock: most callers will need those anyway
- * in order to probe the buffer's journaling state safely.
- */
-static void jbd_unexpected_dirty_buffer(struct journal_head *jh)
+static void warn_dirty_buffer(struct buffer_head *bh)
 {
-        int jlist;
-
-        /* If this buffer is one which might reasonably be dirty
-         * --- ie. data, or not part of this journal --- then
-         * we're OK to leave it alone, but otherwise we need to
-         * move the dirty bit to the journal's own internal
-         * JBDDirty bit. */
-        jlist = jh->b_jlist;
+        char b[BDEVNAME_SIZE];
 
-        if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
-            jlist == BJ_Shadow || jlist == BJ_Forget) {
-                struct buffer_head *bh = jh2bh(jh);
-
-                if (test_clear_buffer_dirty(bh))
-                        set_buffer_jbddirty(bh);
-        }
+        printk(KERN_WARNING
+               "JBD: Spotted dirty metadata buffer (dev = %s, blocknr = %llu). "
+               "There's a risk of filesystem corruption in case of system "
+               "crash.\n",
+               bdevname(bh->b_bdev, b), (unsigned long long)bh->b_blocknr);
 }
 
 /*
@@ -583,14 +564,16 @@ repeat:
                         if (jh->b_next_transaction)
                                 J_ASSERT_JH(jh, jh->b_next_transaction ==
                                                         transaction);
+                        warn_dirty_buffer(bh);
                 }
                 /*
                  * In any case we need to clean the dirty flag and we must
                  * do it under the buffer lock to be sure we don't race
                  * with running write-out.
                  */
-                JBUFFER_TRACE(jh, "Unexpected dirty buffer");
-                jbd_unexpected_dirty_buffer(jh);
+                JBUFFER_TRACE(jh, "Journalling dirty buffer");
+                clear_buffer_dirty(bh);
+                set_buffer_jbddirty(bh);
         }
 
         unlock_buffer(bh);
@@ -826,6 +809,15 @@ int journal_get_create_access(handle_t *handle, struct buffer_head *bh)
         J_ASSERT_JH(jh, buffer_locked(jh2bh(jh)));
 
         if (jh->b_transaction == NULL) {
+                /*
+                 * Previous journal_forget() could have left the buffer
+                 * with jbddirty bit set because it was being committed. When
+                 * the commit finished, we've filed the buffer for
+                 * checkpointing and marked it dirty. Now we are reallocating
+                 * the buffer so the transaction freeing it must have
+                 * committed and so it's safe to clear the dirty bit.
+                 */
+                clear_buffer_dirty(jh2bh(jh));
                 jh->b_transaction = transaction;
 
                 /* first access by this transaction */
@@ -1782,8 +1774,13 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
 
         if (jh->b_cp_transaction) {
                 JBUFFER_TRACE(jh, "on running+cp transaction");
+                /*
+                 * We don't want to write the buffer anymore, clear the
+                 * bit so that we don't confuse checks in
+                 * __journal_file_buffer
+                 */
+                clear_buffer_dirty(bh);
                 __journal_file_buffer(jh, transaction, BJ_Forget);
-                clear_buffer_jbddirty(bh);
                 may_free = 0;
         } else {
                 JBUFFER_TRACE(jh, "on running transaction");
@@ -2041,12 +2038,17 @@ void __journal_file_buffer(struct journal_head *jh,
         if (jh->b_transaction && jh->b_jlist == jlist)
                 return;
 
-        /* The following list of buffer states needs to be consistent
-         * with __jbd_unexpected_dirty_buffer()'s handling of dirty
-         * state. */
-
         if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
             jlist == BJ_Shadow || jlist == BJ_Forget) {
+                /*
+                 * For metadata buffers, we track dirty bit in buffer_jbddirty
+                 * instead of buffer_dirty. We should not see a dirty bit set
+                 * here because we clear it in do_get_write_access but e.g.
+                 * tune2fs can modify the sb and set the dirty bit at any time
+                 * so we try to gracefully handle that.
+                 */
+                if (buffer_dirty(bh))
+                        warn_dirty_buffer(bh);
                 if (test_clear_buffer_dirty(bh) ||
                     test_clear_buffer_jbddirty(bh))
                         was_dirty = 1;
diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
index 91fa3ad6e8c2..a29c7c3e3fb8 100644
--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -67,10 +67,8 @@ static struct posix_acl *jfs_get_acl(struct inode *inode, int type)
                 acl = posix_acl_from_xattr(value, size);
         }
         kfree(value);
-        if (!IS_ERR(acl)) {
+        if (!IS_ERR(acl))
                 set_cached_acl(inode, type, acl);
-                posix_acl_release(acl);
-        }
         return acl;
 }
 
diff --git a/fs/notify/Kconfig b/fs/notify/Kconfig
index 31dac7e3b0f1..dffbb0911d02 100644
--- a/fs/notify/Kconfig
+++ b/fs/notify/Kconfig
@@ -1,15 +1,5 @@
 config FSNOTIFY
-        bool "Filesystem notification backend"
-        default y
-        ---help---
-           fsnotify is a backend for filesystem notification.  fsnotify does
-           not provide any userspace interface but does provide the basis
-           needed for other notification schemes such as dnotify, inotify,
-           and fanotify.
-
-           Say Y here to enable fsnotify suport.
-
-           If unsure, say Y.
+        def_bool n
 
 source "fs/notify/dnotify/Kconfig"
 source "fs/notify/inotify/Kconfig"
diff --git a/fs/notify/dnotify/Kconfig b/fs/notify/dnotify/Kconfig
index 904ff8d5405a..f9c1ca139d8f 100644
--- a/fs/notify/dnotify/Kconfig
+++ b/fs/notify/dnotify/Kconfig
@@ -1,6 +1,6 @@
 config DNOTIFY
         bool "Dnotify support"
-        depends on FSNOTIFY
+        select FSNOTIFY
         default y
         help
           Dnotify is a directory-based per-fd file change notification system
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index ec2f7bd76818..037e878e03fc 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -159,7 +159,9 @@ void fsnotify(struct inode *to_tell, __u32 mask, void *data, int data_is, const
                         if (!group->ops->should_send_event(group, to_tell, mask))
                                 continue;
                         if (!event) {
-                                event = fsnotify_create_event(to_tell, mask, data, data_is, file_name, cookie);
+                                event = fsnotify_create_event(to_tell, mask, data,
+                                                              data_is, file_name, cookie,
+                                                              GFP_KERNEL);
                                 /* shit, we OOM'd and now we can't tell, maybe
                                  * someday someone else will want to do something
                                  * here */
diff --git a/fs/notify/inotify/Kconfig b/fs/notify/inotify/Kconfig
index 5356884289a1..3e56dbffe729 100644
--- a/fs/notify/inotify/Kconfig
+++ b/fs/notify/inotify/Kconfig
@@ -15,7 +15,7 @@ config INOTIFY
 
 config INOTIFY_USER
         bool "Inotify support for userspace"
-        depends on FSNOTIFY
+        select FSNOTIFY
         default y
         ---help---
           Say Y here to enable inotify support for userspace, including the
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index ff27a2965844..f30d9bbc2e1b 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -57,7 +57,6 @@ int inotify_max_user_watches __read_mostly;
 
 static struct kmem_cache *inotify_inode_mark_cachep __read_mostly;
 struct kmem_cache *event_priv_cachep __read_mostly;
-static struct fsnotify_event *inotify_ignored_event;
 
 /*
  * When inotify registers a new group it increments this and uses that
@@ -365,6 +364,17 @@ static int inotify_find_inode(const char __user *dirname, struct path *path, uns
         return error;
 }
 
+static void inotify_remove_from_idr(struct fsnotify_group *group,
+                                    struct inotify_inode_mark_entry *ientry)
+{
+        struct idr *idr;
+
+        spin_lock(&group->inotify_data.idr_lock);
+        idr = &group->inotify_data.idr;
+        idr_remove(idr, ientry->wd);
+        spin_unlock(&group->inotify_data.idr_lock);
+        ientry->wd = -1;
+}
 /*
  * Send IN_IGNORED for this wd, remove this wd from the idr, and drop the
  * internal reference help on the mark because it is in the idr.
@@ -373,13 +383,19 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
                                     struct fsnotify_group *group)
 {
         struct inotify_inode_mark_entry *ientry;
+        struct fsnotify_event *ignored_event;
         struct inotify_event_private_data *event_priv;
         struct fsnotify_event_private_data *fsn_event_priv;
-        struct idr *idr;
+
+        ignored_event = fsnotify_create_event(NULL, FS_IN_IGNORED, NULL,
+                                              FSNOTIFY_EVENT_NONE, NULL, 0,
+                                              GFP_NOFS);
+        if (!ignored_event)
+                return;
 
         ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry);
 
-        event_priv = kmem_cache_alloc(event_priv_cachep, GFP_KERNEL);
+        event_priv = kmem_cache_alloc(event_priv_cachep, GFP_NOFS);
         if (unlikely(!event_priv))
                 goto skip_send_ignore;
 
@@ -388,7 +404,7 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
         fsn_event_priv->group = group;
         event_priv->wd = ientry->wd;
 
-        fsnotify_add_notify_event(group, inotify_ignored_event, fsn_event_priv);
+        fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
 
         /* did the private data get added? */
         if (list_empty(&fsn_event_priv->event_list))
@@ -396,14 +412,16 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
 
 skip_send_ignore:
 
+        /* matches the reference taken when the event was created */
+        fsnotify_put_event(ignored_event);
+
         /* remove this entry from the idr */
-        spin_lock(&group->inotify_data.idr_lock);
-        idr = &group->inotify_data.idr;
-        idr_remove(idr, ientry->wd);
-        spin_unlock(&group->inotify_data.idr_lock);
+        inotify_remove_from_idr(group, ientry);
 
         /* removed from idr, drop that reference */
         fsnotify_put_mark(entry);
+
+        atomic_dec(&group->inotify_data.user->inotify_watches);
 }
 
 /* ding dong the mark is dead */
@@ -418,6 +436,7 @@ static int inotify_update_watch(struct fsnotify_group *group, struct inode *inod
 {
         struct fsnotify_mark_entry *entry = NULL;
         struct inotify_inode_mark_entry *ientry;
+        struct inotify_inode_mark_entry *tmp_ientry;
         int ret = 0;
         int add = (arg & IN_MASK_ADD);
         __u32 mask;
@@ -428,54 +447,66 @@ static int inotify_update_watch(struct fsnotify_group *group, struct inode *inod
         if (unlikely(!mask))
                 return -EINVAL;
 
-        ientry = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
-        if (unlikely(!ientry))
+        tmp_ientry = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
+        if (unlikely(!tmp_ientry))
                 return -ENOMEM;
         /* we set the mask at the end after attaching it */
-        fsnotify_init_mark(&ientry->fsn_entry, inotify_free_mark);
-        ientry->wd = 0;
+        fsnotify_init_mark(&tmp_ientry->fsn_entry, inotify_free_mark);
+        tmp_ientry->wd = -1;
 
 find_entry:
         spin_lock(&inode->i_lock);
         entry = fsnotify_find_mark_entry(group, inode);
         spin_unlock(&inode->i_lock);
         if (entry) {
-                kmem_cache_free(inotify_inode_mark_cachep, ientry);
                 ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry);
         } else {
-                if (atomic_read(&group->inotify_data.user->inotify_watches) >= inotify_max_user_watches) {
-                        ret = -ENOSPC;
-                        goto out_err;
-                }
-
-                ret = fsnotify_add_mark(&ientry->fsn_entry, group, inode);
-                if (ret == -EEXIST)
-                        goto find_entry;
-                else if (ret)
+                ret = -ENOSPC;
+                if (atomic_read(&group->inotify_data.user->inotify_watches) >= inotify_max_user_watches)
                         goto out_err;
-
-                entry = &ientry->fsn_entry;
 retry:
                 ret = -ENOMEM;
                 if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))
                         goto out_err;
 
                 spin_lock(&group->inotify_data.idr_lock);
-                /* if entry is added to the idr we keep the reference obtained
-                 * through fsnotify_mark_add.  remember to drop this reference
-                 * when entry is removed from idr */
-                ret = idr_get_new_above(&group->inotify_data.idr, entry,
-                                        ++group->inotify_data.last_wd,
-                                        &ientry->wd);
+                ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
+                                        group->inotify_data.last_wd,
+                                        &tmp_ientry->wd);
                 spin_unlock(&group->inotify_data.idr_lock);
                 if (ret) {
                         if (ret == -EAGAIN)
                                 goto retry;
                         goto out_err;
                 }
+
+                ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);
+                if (ret) {
+                        inotify_remove_from_idr(group, tmp_ientry);
+                        if (ret == -EEXIST)
+                                goto find_entry;
+                        goto out_err;
+                }
+
+                /* tmp_ientry has been added to the inode, so we are all set up.
+                 * now we just need to make sure tmp_ientry doesn't get freed and
+                 * we need to set up entry and ientry so the generic code can
+                 * do its thing. */
+                ientry = tmp_ientry;
+                entry = &ientry->fsn_entry;
+                tmp_ientry = NULL;
+
                 atomic_inc(&group->inotify_data.user->inotify_watches);
+
+                /* update the idr hint */
+                group->inotify_data.last_wd = ientry->wd;
+
+                /* we put the mark on the idr, take a reference */
+                fsnotify_get_mark(entry);
         }
 
+        ret = ientry->wd;
+
         spin_lock(&entry->lock);
 
         old_mask = entry->mask;
@@ -506,14 +537,19 @@ retry:
                         fsnotify_recalc_group_mask(group);
         }
 
-        return ientry->wd;
+        /* this either matches fsnotify_find_mark_entry, or init_mark_entry
+         * depending on which path we took... */
+        fsnotify_put_mark(entry);
 
 out_err:
-        /* see this isn't supposed to happen, just kill the watch */
-        if (entry) {
-                fsnotify_destroy_mark_by_entry(entry);
-                fsnotify_put_mark(entry);
+        /* could be an error, could be that we found an existing mark */
+        if (tmp_ientry) {
+                /* on the idr but didn't make it on the inode */
+                if (tmp_ientry->wd != -1)
+                        inotify_remove_from_idr(group, tmp_ientry);
+                kmem_cache_free(inotify_inode_mark_cachep, tmp_ientry);
         }
+
         return ret;
 }
 
@@ -721,9 +757,6 @@ static int __init inotify_user_setup(void)
 
         inotify_inode_mark_cachep = KMEM_CACHE(inotify_inode_mark_entry, SLAB_PANIC);
         event_priv_cachep = KMEM_CACHE(inotify_event_private_data, SLAB_PANIC);
-        inotify_ignored_event = fsnotify_create_event(NULL, FS_IN_IGNORED, NULL, FSNOTIFY_EVENT_NONE, NULL, 0);
-        if (!inotify_ignored_event)
-                panic("unable to allocate the inotify ignored event\n");
 
         inotify_max_queued_events = 16384;
         inotify_max_user_instances = 128;
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 959b73e756fd..521368574e97 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -136,18 +136,24 @@ static bool event_compare(struct fsnotify_event *old, struct fsnotify_event *new
 {
         if ((old->mask == new->mask) &&
             (old->to_tell == new->to_tell) &&
-            (old->data_type == new->data_type)) {
+            (old->data_type == new->data_type) &&
+            (old->name_len == new->name_len)) {
                 switch (old->data_type) {
                 case (FSNOTIFY_EVENT_INODE):
-                        if (old->inode == new->inode)
+                        /* remember, after old was put on the wait_q we aren't
+                         * allowed to look at the inode any more, only thing
+                         * left to check was if the file_name is the same */
+                        if (old->name_len &&
+                            !strcmp(old->file_name, new->file_name))
                                 return true;
                         break;
                 case (FSNOTIFY_EVENT_PATH):
                         if ((old->path.mnt == new->path.mnt) &&
                             (old->path.dentry == new->path.dentry))
                                 return true;
+                        break;
                 case (FSNOTIFY_EVENT_NONE):
-                        return true;
+                        return false;
                 };
         }
         return false;
@@ -339,18 +345,19 @@ static void initialize_event(struct fsnotify_event *event)
  * @name the filename, if available
  */
 struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask, void *data,
-                                             int data_type, const char *name, u32 cookie)
+                                             int data_type, const char *name, u32 cookie,
+                                             gfp_t gfp)
 {
         struct fsnotify_event *event;
 
-        event = kmem_cache_alloc(fsnotify_event_cachep, GFP_KERNEL);
+        event = kmem_cache_alloc(fsnotify_event_cachep, gfp);
         if (!event)
                 return NULL;
 
         initialize_event(event);
 
         if (name) {
-                event->file_name = kstrdup(name, GFP_KERNEL);
+                event->file_name = kstrdup(name, gfp);
                 if (!event->file_name) {
                         kmem_cache_free(fsnotify_event_cachep, event);
                         return NULL;
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index d88d0fac9fa5..14f2d71ea3ce 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -939,8 +939,10 @@ again:
         /* Remove from old parent's list and insert into new parent's list. */
         sysfs_unlink_sibling(sd);
         sysfs_get(new_parent_sd);
+        drop_nlink(old_parent->d_inode);
         sysfs_put(sd->s_parent);
         sd->s_parent = new_parent_sd;
+        inc_nlink(new_parent->d_inode);
         sysfs_link_sibling(sd);
 
  out_unlock:
diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
index 9d40e879f99e..77ff547730af 100644
--- a/include/asm-generic/4level-fixup.h
+++ b/include/asm-generic/4level-fixup.h
@@ -27,9 +27,9 @@
 #define pud_page_vaddr(pud)             pgd_page_vaddr(pud)
 
 #undef pud_free_tlb
-#define pud_free_tlb(tlb, x)            do { } while (0)
+#define pud_free_tlb(tlb, x, addr)      do { } while (0)
 #define pud_free(mm, x)                 do { } while (0)
-#define __pud_free_tlb(tlb, x)          do { } while (0)
+#define __pud_free_tlb(tlb, x, addr)    do { } while (0)
 
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)         (end)
diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
index a7cdc48e8b78..725612b793ce 100644
--- a/include/asm-generic/pgtable-nopmd.h
+++ b/include/asm-generic/pgtable-nopmd.h
@@ -59,7 +59,7 @@ static inline pmd_t * pmd_offset(pud_t * pud, unsigned long address)
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
 }
-#define __pmd_free_tlb(tlb, x)                  do { } while (0)
+#define __pmd_free_tlb(tlb, x, a)               do { } while (0)
 
 #undef  pmd_addr_end
 #define pmd_addr_end(addr, end)                 (end)
diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
index 87cf449a6df3..810431d8351b 100644
--- a/include/asm-generic/pgtable-nopud.h
+++ b/include/asm-generic/pgtable-nopud.h
@@ -52,7 +52,7 @@ static inline pud_t * pud_offset(pgd_t * pgd, unsigned long address)
  */
 #define pud_alloc_one(mm, address)              NULL
 #define pud_free(mm, x)                         do { } while (0)
-#define __pud_free_tlb(tlb, x)                  do { } while (0)
+#define __pud_free_tlb(tlb, x, a)               do { } while (0)
 
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)                 (end)
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index f490e43a90b9..e43f9766259f 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -123,24 +123,24 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
                 __tlb_remove_tlb_entry(tlb, ptep, address);     \
         } while (0)
 
-#define pte_free_tlb(tlb, ptep)                                 \
+#define pte_free_tlb(tlb, ptep, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pte_free_tlb(tlb, ptep);                      \
+                __pte_free_tlb(tlb, ptep, address);             \
         } while (0)
 
 #ifndef __ARCH_HAS_4LEVEL_HACK
-#define pud_free_tlb(tlb, pudp)                                 \
+#define pud_free_tlb(tlb, pudp, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pud_free_tlb(tlb, pudp);                      \
+                __pud_free_tlb(tlb, pudp, address);             \
         } while (0)
 #endif
 
-#define pmd_free_tlb(tlb, pmdp)                                 \
+#define pmd_free_tlb(tlb, pmdp, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pmd_free_tlb(tlb, pmdp);                      \
+                __pmd_free_tlb(tlb, pmdp, address);             \
         } while (0)
 
 #define tlb_migrate_finish(mm) do {} while (0)
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index 41862e9a4c20..af4b4826997e 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -506,6 +506,8 @@ typedef struct {
 #define DRM_RADEON_GEM_WAIT_IDLE        0x24
 #define DRM_RADEON_CS                   0x26
 #define DRM_RADEON_INFO                 0x27
+#define DRM_RADEON_GEM_SET_TILING       0x28
+#define DRM_RADEON_GEM_GET_TILING       0x29
 
 #define DRM_IOCTL_RADEON_CP_INIT    DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_CP_INIT, drm_radeon_init_t)
 #define DRM_IOCTL_RADEON_CP_START   DRM_IO(  DRM_COMMAND_BASE + DRM_RADEON_CP_START)
@@ -544,7 +546,8 @@ typedef struct {
 #define DRM_IOCTL_RADEON_GEM_WAIT_IDLE  DRM_IOW(DRM_COMMAND_BASE + DRM_RADEON_GEM_WAIT_IDLE, struct drm_radeon_gem_wait_idle)
 #define DRM_IOCTL_RADEON_CS             DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_CS, struct drm_radeon_cs)
 #define DRM_IOCTL_RADEON_INFO           DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_INFO, struct drm_radeon_info)
-
+#define DRM_IOCTL_RADEON_SET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_SET_TILING, struct drm_radeon_gem_set_tiling)
+#define DRM_IOCTL_RADEON_GET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_GET_TILING, struct drm_radeon_gem_get_tiling)
 
 typedef struct drm_radeon_init {
         enum {
@@ -796,6 +799,24 @@ struct drm_radeon_gem_create {
         uint32_t        flags;
 };
 
+#define RADEON_TILING_MACRO 0x1
+#define RADEON_TILING_MICRO 0x2
+#define RADEON_TILING_SWAP  0x4
+#define RADEON_TILING_SURFACE  0x8 /* this object requires a surface
+                                    * when mapped - i.e. front buffer */
+
+struct drm_radeon_gem_set_tiling {
+        uint32_t        handle;
+        uint32_t        tiling_flags;
+        uint32_t        pitch;
+};
+
+struct drm_radeon_gem_get_tiling {
+        uint32_t        handle;
+        uint32_t        tiling_flags;
+        uint32_t        pitch;
+};
+
 struct drm_radeon_gem_mmap {
         uint32_t        handle;
         uint32_t        pad;
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 62ed733c52a2..a68829db381a 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -121,6 +121,7 @@ struct ttm_backend {
 #define TTM_PAGE_FLAG_SWAPPED         (1 << 4)
 #define TTM_PAGE_FLAG_PERSISTANT_SWAP (1 << 5)
 #define TTM_PAGE_FLAG_ZERO_ALLOC      (1 << 6)
+#define TTM_PAGE_FLAG_DMA32           (1 << 7)
 
 enum ttm_caching_state {
         tt_uncached,
@@ -353,6 +354,14 @@ struct ttm_bo_driver {
         int (*sync_obj_flush) (void *sync_obj, void *sync_arg);
         void (*sync_obj_unref) (void **sync_obj);
         void *(*sync_obj_ref) (void *sync_obj);
+
+        /* hook to notify driver about a driver move so it
+         * can do tiling things */
+        void (*move_notify)(struct ttm_buffer_object *bo,
+                            struct ttm_mem_reg *new_mem);
+        /* notify the driver we are taking a fault on this BO
+         * and have reserved it */
+        void (*fault_reserve_notify)(struct ttm_buffer_object *bo);
 };
 
 #define TTM_NUM_MEM_TYPES 8
@@ -429,6 +438,8 @@ struct ttm_bo_device {
          */
 
         struct delayed_work wq;
+
+        bool need_dma32;
 };
 
 /**
@@ -648,7 +659,14 @@ extern int ttm_bo_device_release(struct ttm_bo_device *bdev);
 extern int ttm_bo_device_init(struct ttm_bo_device *bdev,
                               struct ttm_mem_global *mem_glob,
                               struct ttm_bo_driver *driver,
-                              uint64_t file_page_offset);
+                              uint64_t file_page_offset, bool need_dma32);
+
+/**
+ * ttm_bo_unmap_virtual
+ *
+ * @bo: tear down the virtual mappings for this BO
+ */
+extern void ttm_bo_unmap_virtual(struct ttm_buffer_object *bo);
 
 /**
  * ttm_bo_reserve:
diff --git a/include/drm/ttm/ttm_module.h b/include/drm/ttm/ttm_module.h
index 889a4c7958ae..d1d433834e4f 100644
--- a/include/drm/ttm/ttm_module.h
+++ b/include/drm/ttm/ttm_module.h
@@ -33,7 +33,7 @@
 
 #include <linux/kernel.h>
 
-#define TTM_PFX "[TTM]"
+#define TTM_PFX "[TTM] "
 
 enum ttm_global_types {
         TTM_GLOBAL_TTM_MEM = 0,
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 0d6310657f32..655e7721580a 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -84,7 +84,7 @@ typedef int (*dm_merge_fn) (struct dm_target *ti, struct bvec_merge_data *bvm,
 
 typedef int (*iterate_devices_callout_fn) (struct dm_target *ti,
                                            struct dm_dev *dev,
-                                           sector_t physical_start,
+                                           sector_t start, sector_t len,
                                            void *data);
 
 typedef int (*dm_iterate_devices_fn) (struct dm_target *ti,
@@ -104,7 +104,7 @@ void dm_error(const char *message);
  * Combine device limits.
  */
 int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
-                         sector_t start, void *data);
+                         sector_t start, sector_t len, void *data);
 
 struct dm_dev {
         struct block_device *bdev;
diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h
index 634a5e5aba3e..7499b3667798 100644
--- a/include/linux/ext3_fs.h
+++ b/include/linux/ext3_fs.h
@@ -874,7 +874,7 @@ struct buffer_head * ext3_getblk (handle_t *, struct inode *, long, int, int *);
 struct buffer_head * ext3_bread (handle_t *, struct inode *, int, int, int *);
 int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
         sector_t iblock, unsigned long maxblocks, struct buffer_head *bh_result,
-        int create, int extend_disksize);
+        int create);
 
 extern struct inode *ext3_iget(struct super_block *, unsigned long);
 extern int  ext3_write_inode (struct inode *, int);
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 6c3de999fb34..4d6f47b51189 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -352,7 +352,7 @@ extern void fsnotify_unmount_inodes(struct list_head *list);
 /* put here because inotify does some weird stuff when destroying watches */
 extern struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask,
                                                     void *data, int data_is, const char *name,
-                                                    u32 cookie);
+                                                    u32 cookie, gfp_t gfp);
 
 #else
 
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 79b6d7fd4ac2..e5b6e33c6571 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -589,6 +589,7 @@ struct ata_device {
 #endif
         /* n_sector is CLEAR_BEGIN, read comment above CLEAR_BEGIN */
         u64                     n_sectors;      /* size of device, if ATA */
+        u64                     n_native_sectors; /* native size, if ATA */
         unsigned int            class;          /* ATA_DEV_xxx */
         unsigned long           unpark_deadline;
 
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index c9663c690303..53b94e025c7c 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -18,5 +18,8 @@ extern struct phy_device *of_phy_connect(struct net_device *dev,
                                          struct device_node *phy_np,
                                          void (*hndlr)(struct net_device *),
                                          u32 flags, phy_interface_t iface);
+extern struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                         void (*hndlr)(struct net_device *),
+                                         phy_interface_t iface);
 
 #endif /* __LINUX_OF_MDIO_H */
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 2ce29831feb6..278777fa8a3a 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -224,7 +224,7 @@ void rfkill_destroy(struct rfkill *rfkill);
  * should be blocked) so that drivers need not keep track of the soft
  * block state -- which they might not be able to.
  */
-bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
 
 /**
  * rfkill_set_sw_state - Set the internal rfkill software block state
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 1488d8c81aac..e8c6c9136c97 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -394,6 +394,7 @@ extern void __do_SAK(struct tty_struct *tty);
 extern void disassociate_ctty(int priv);
 extern void no_tty(void);
 extern void tty_flip_buffer_push(struct tty_struct *tty);
+extern void tty_flush_to_ldisc(struct tty_struct *tty);
 extern void tty_buffer_free_all(struct tty_struct *tty);
 extern void tty_buffer_flush(struct tty_struct *tty);
 extern void tty_buffer_init(struct tty_struct *tty);
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index 95846d988011..74f16876f38d 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -338,6 +338,7 @@ struct v4l2_pix_format {
 /*  Vendor-specific formats   */
 #define V4L2_PIX_FMT_WNVA     v4l2_fourcc('W', 'N', 'V', 'A') /* Winnov hw compress */
 #define V4L2_PIX_FMT_SN9C10X  v4l2_fourcc('S', '9', '1', '0') /* SN9C10x compression */
+#define V4L2_PIX_FMT_SN9C20X_I420 v4l2_fourcc('S', '9', '2', '0') /* SN9C20x YUV 4:2:0 */
 #define V4L2_PIX_FMT_PWC1     v4l2_fourcc('P', 'W', 'C', '1') /* pwc older webcam */
 #define V4L2_PIX_FMT_PWC2     v4l2_fourcc('P', 'W', 'C', '2') /* pwc newer webcam */
 #define V4L2_PIX_FMT_ET61X251 v4l2_fourcc('E', '6', '2', '5') /* ET61X251 compression */
diff --git a/include/media/v4l2-chip-ident.h b/include/media/v4l2-chip-ident.h
index 11a4a2d3e364..94e908c0d7a0 100644
--- a/include/media/v4l2-chip-ident.h
+++ b/include/media/v4l2-chip-ident.h
@@ -60,6 +60,10 @@ enum {
         V4L2_IDENT_OV7670 = 250,
         V4L2_IDENT_OV7720 = 251,
         V4L2_IDENT_OV7725 = 252,
+        V4L2_IDENT_OV7660 = 253,
+        V4L2_IDENT_OV9650 = 254,
+        V4L2_IDENT_OV9655 = 255,
+        V4L2_IDENT_SOI968 = 256,
 
         /* module saa7146: reserved range 300-309 */
         V4L2_IDENT_SAA7146 = 300,
@@ -161,6 +165,9 @@ enum {
         /* module tw9910: just ident 9910 */
         V4L2_IDENT_TW9910 = 9910,
 
+        /* module sn9c20x: just ident 10000 */
+        V4L2_IDENT_SN9C20X = 10000,
+
         /* module msp3400: reserved range 34000-34999 and 44000-44999 */
         V4L2_IDENT_MSPX4XX  = 34000, /* generic MSPX4XX identifier, only
                                         use internally (tveeprom.c). */
@@ -237,6 +244,11 @@ enum {
         V4L2_IDENT_MT9V022IX7ATC        = 45010, /* No way to detect "normal" I77ATx */
         V4L2_IDENT_MT9V022IX7ATM        = 45015, /* and "lead free" IA7ATx chips */
         V4L2_IDENT_MT9T031              = 45020,
+        V4L2_IDENT_MT9V111              = 45031,
+        V4L2_IDENT_MT9V112              = 45032,
+
+        /* HV7131R CMOS sensor: just ident 46000 */
+        V4L2_IDENT_HV7131R              = 46000,
 
         /* module cs53132a: just ident 53132 */
         V4L2_IDENT_CS53l32A = 53132,
diff --git a/include/net/rose.h b/include/net/rose.h
index cbd5364b2c8a..5ba9f02731eb 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -156,7 +156,7 @@ extern int  sysctl_rose_maximum_vcs;
 extern int  sysctl_rose_window_size;
 extern int  rosecmp(rose_address *, rose_address *);
 extern int  rosecmpm(rose_address *, rose_address *, unsigned short);
-extern const char *rose2asc(const rose_address *);
+extern char *rose2asc(char *buf, const rose_address *);
 extern struct sock *rose_find_socket(unsigned int, struct rose_neigh *);
 extern void rose_kill_by_neigh(struct rose_neigh *);
 extern unsigned int rose_new_lci(struct rose_neigh *);
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 9b1a7de26979..eb8751aa0418 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -180,10 +180,12 @@ EXPORT_SYMBOL(kthread_bind);
  * @k: thread created by kthread_create().
  *
  * Sets kthread_should_stop() for @k to return true, wakes it, and
- * waits for it to exit.  Your threadfn() must not call do_exit()
- * itself if you use this function!  This can also be called after
- * kthread_create() instead of calling wake_up_process(): the thread
- * will exit without calling threadfn().
+ * waits for it to exit. This can also be called after kthread_create()
+ * instead of calling wake_up_process(): the thread will exit without
+ * calling threadfn().
+ *
+ * If threadfn() may call do_exit() itself, the caller must ensure
+ * task_struct can't go away.
  *
  * Returns the result of threadfn(), or %-EINTR if wake_up_process()
  * was never called.
diff --git a/kernel/module.c b/kernel/module.c
index 0a049837008e..fd1411403558 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1068,7 +1068,8 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,
 {
         const unsigned long *crc;
 
-        if (!find_symbol("module_layout", NULL, &crc, true, false))
+        if (!find_symbol(MODULE_SYMBOL_PREFIX "module_layout", NULL,
+                         &crc, true, false))
                 BUG();
         return check_version(sechdrs, versindex, "module_layout", mod, crc);
 }
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index 833139ce1e22..e22c148e4b7f 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -164,7 +164,7 @@ static void ddebug_change(const struct ddebug_query *query,
 
                         if (!newflags)
                                 dt->num_enabled--;
-                        else if (!dp-flags)
+                        else if (!dp->flags)
                                 dt->num_enabled++;
                         dp->flags = newflags;
                         if (newflags) {
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 5aabd41ffb8f..487267310a84 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1217,7 +1217,6 @@ static void *kmemleak_seq_start(struct seq_file *seq, loff_t *pos)
         }
         object = NULL;
 out:
-        rcu_read_unlock();
         return object;
 }
 
@@ -1233,13 +1232,11 @@ static void *kmemleak_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
         ++(*pos);
 
-        rcu_read_lock();
         list_for_each_continue_rcu(n, &object_list) {
                 next_obj = list_entry(n, struct kmemleak_object, object_list);
                 if (get_object(next_obj))
                         break;
         }
-        rcu_read_unlock();
 
         put_object(prev_obj);
         return next_obj;
@@ -1255,6 +1252,7 @@ static void kmemleak_seq_stop(struct seq_file *seq, void *v)
                  * kmemleak_seq_start may return ERR_PTR if the scan_mutex
                  * waiting was interrupted, so only release it if !IS_ERR.
                  */
+                rcu_read_unlock();
                 mutex_unlock(&scan_mutex);
                 if (v)
                         put_object(v);
diff --git a/mm/memory.c b/mm/memory.c
index 65216194eb8d..aede2ce3aba4 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -135,11 +135,12 @@ void pmd_clear_bad(pmd_t *pmd)
  * Note: this doesn't free the actual pages themselves. That
  * has been handled earlier when unmapping all the memory regions.
  */
-static void free_pte_range(struct mmu_gather *tlb, pmd_t *pmd)
+static void free_pte_range(struct mmu_gather *tlb, pmd_t *pmd,
+                           unsigned long addr)
 {
         pgtable_t token = pmd_pgtable(*pmd);
         pmd_clear(pmd);
-        pte_free_tlb(tlb, token);
+        pte_free_tlb(tlb, token, addr);
         tlb->mm->nr_ptes--;
 }
 
@@ -157,7 +158,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
                 next = pmd_addr_end(addr, end);
                 if (pmd_none_or_clear_bad(pmd))
                         continue;
-                free_pte_range(tlb, pmd);
+                free_pte_range(tlb, pmd, addr);
         } while (pmd++, addr = next, addr != end);
 
         start &= PUD_MASK;
@@ -173,7 +174,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
 
         pmd = pmd_offset(pud, start);
         pud_clear(pud);
-        pmd_free_tlb(tlb, pmd);
+        pmd_free_tlb(tlb, pmd, start);
 }
 
 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
@@ -206,7 +207,7 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
 
         pud = pud_offset(pgd, start);
         pgd_clear(pgd);
-        pud_free_tlb(tlb, pud);
+        pud_free_tlb(tlb, pud, start);
 }
 
 /*
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8a96672e2c5c..eb404dc3ed6e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -424,7 +424,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 err2:
         br_fdb_delete_by_port(br, p, 1);
 err1:
-        kobject_del(&p->kobj);
+        kobject_put(&p->kobj);
 err0:
         dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ecf4eb2717cb..9cb79f95bf63 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1453,6 +1453,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
         }
         /* Dup */
         memcpy(new, orig, sizeof(struct tsap_cb));
+        spin_lock_init(&new->lock);
 
         /* We don't need the old instance any more */
         spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags);
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ba2643a43c73..7836ee928983 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -83,6 +83,7 @@ endmenu
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
+        depends on BROKEN
         ---help---
          This options enables support of Draft 802.11s mesh networking.
          The implementation is based on Draft 1.08 of the Mesh Networking
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c72557df45a..479597e88583 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -175,6 +175,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
+
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -265,6 +267,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
 
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
@@ -491,8 +494,10 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
  * @skb: frame to discard
  * @sdata: network subif the frame was to be sent through
  *
- * If the frame was beign forwarded from another MP, a PERR frame will be sent
- * to the precursor.
+ * If the frame was being forwarded from another MP, a PERR frame will be sent
+ * to the precursor.  The precursor's address (i.e. the previous hop) was saved
+ * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
+ * the destination is successfully resolved.
  *
  * Locking: the function must me called within a rcu_read_lock region
  */
@@ -507,7 +512,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 u8 *ra, *da;
 
                 da = hdr->addr3;
-                ra = hdr->addr2;
+                ra = hdr->addr1;
                 mpath = mesh_path_lookup(da, sdata);
                 if (mpath)
                         dsn = ++mpath->dsn;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d238a8939a09..3a8922cd1038 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1455,7 +1455,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 monitor_iface = UNKNOWN_ADDRESS;
 
                 len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
+                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
                 /* check the header is complete in the frame */
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 79693fe2001e..2fc4a1724eb8 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -549,6 +549,10 @@ void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
         swprev = !!(rfkill->state & RFKILL_BLOCK_SW);
         hwprev = !!(rfkill->state & RFKILL_BLOCK_HW);
         __rfkill_set_sw_state(rfkill, sw);
+        if (hw)
+                rfkill->state |= RFKILL_BLOCK_HW;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_HW;
 
         spin_unlock_irqrestore(&rfkill->lock, flags);
 
@@ -648,15 +652,26 @@ static ssize_t rfkill_state_store(struct device *dev,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        /*
-         * The intention was that userspace can only take control over
-         * a given device when/if rfkill-input doesn't control it due
-         * to user_claim. Since user_claim is currently unsupported,
-         * we never support changing the state from userspace -- this
-         * can be implemented again later.
-         */
+        struct rfkill *rfkill = to_rfkill(dev);
+        unsigned long state;
+        int err;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        err = strict_strtoul(buf, 0, &state);
+        if (err)
+                return err;
+
+        if (state != RFKILL_USER_STATE_SOFT_BLOCKED &&
+            state != RFKILL_USER_STATE_UNBLOCKED)
+                return -EINVAL;
+
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_set_block(rfkill, state == RFKILL_USER_STATE_SOFT_BLOCKED);
+        mutex_unlock(&rfkill_global_mutex);
 
-        return -EPERM;
+        return err ?: count;
 }
 
 static ssize_t rfkill_claim_show(struct device *dev,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6bd8e93869ed..f0a76f6bca71 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -92,23 +92,21 @@ static void rose_set_lockdep_key(struct net_device *dev)
 /*
  *      Convert a ROSE address into text.
  */
-const char *rose2asc(const rose_address *addr)
+char *rose2asc(char *buf, const rose_address *addr)
 {
-        static char buffer[11];
-
         if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
             addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
             addr->rose_addr[4] == 0x00) {
-                strcpy(buffer, "*");
+                strcpy(buf, "*");
         } else {
-                sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
+                sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
                                                 addr->rose_addr[1] & 0xFF,
                                                 addr->rose_addr[2] & 0xFF,
                                                 addr->rose_addr[3] & 0xFF,
                                                 addr->rose_addr[4] & 0xFF);
         }
 
-        return buffer;
+        return buf;
 }
 
 /*
@@ -1437,7 +1435,7 @@ static void rose_info_stop(struct seq_file *seq, void *v)
 
 static int rose_info_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1455,8 +1453,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
                         devname = dev->name;
 
                 seq_printf(seq, "%-10s %-9s ",
-                        rose2asc(&rose->dest_addr),
-                        ax2asc(buf, &rose->dest_call));
+                           rose2asc(rsbuf, &rose->dest_addr),
+                           ax2asc(buf, &rose->dest_call));
 
                 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
                         callsign = "??????-?";
@@ -1465,7 +1463,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
 
                 seq_printf(seq,
                            "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
-                        rose2asc(&rose->source_addr),
+                        rose2asc(rsbuf, &rose->source_addr),
                         callsign,
                         devname,
                         rose->lci & 0x0FFF,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a81066a1010a..9478d9b3d977 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -1104,6 +1104,7 @@ static void rose_node_stop(struct seq_file *seq, void *v)
 
 static int rose_node_show(struct seq_file *seq, void *v)
 {
+        char rsbuf[11];
         int i;
 
         if (v == SEQ_START_TOKEN)
@@ -1112,13 +1113,13 @@ static int rose_node_show(struct seq_file *seq, void *v)
                 const struct rose_node *rose_node = v;
                 /* if (rose_node->loopback) {
                         seq_printf(seq, "%-10s %04d 1 loopback\n",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask);
                 } else { */
                         seq_printf(seq, "%-10s %04d %d",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask,
-                                rose_node->count);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask,
+                                   rose_node->count);
 
                         for (i = 0; i < rose_node->count; i++)
                                 seq_printf(seq, " %05d",
@@ -1267,7 +1268,7 @@ static void rose_route_stop(struct seq_file *seq, void *v)
 
 static int rose_route_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1279,7 +1280,7 @@ static int rose_route_show(struct seq_file *seq, void *v)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d      ",
                                    rose_route->lci1,
-                                   rose2asc(&rose_route->src_addr),
+                                   rose2asc(rsbuf, &rose_route->src_addr),
                                    ax2asc(buf, &rose_route->src_call),
                                    rose_route->neigh1->number);
                 else
@@ -1289,10 +1290,10 @@ static int rose_route_show(struct seq_file *seq, void *v)
                 if (rose_route->neigh2)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d\n",
-                                rose_route->lci2,
-                                rose2asc(&rose_route->dest_addr),
-                                ax2asc(buf, &rose_route->dest_call),
-                                rose_route->neigh2->number);
+                                   rose_route->lci2,
+                                   rose2asc(rsbuf, &rose_route->dest_addr),
+                                   ax2asc(buf, &rose_route->dest_call),
+                                   rose_route->neigh2->number);
                  else
                          seq_puts(seq,
                                   "000  *           *          00000\n");
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 43bdb1372cae..634496b3ed77 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -997,7 +997,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
         if (IS_ERR(hdr)) {
                 err = PTR_ERR(hdr);
-                goto out;
+                goto free_msg;
         }
 
         cookie.msg = msg;
@@ -1011,7 +1011,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                                 &cookie, get_key_callback);
 
         if (err)
-                goto out;
+                goto free_msg;
 
         if (cookie.error)
                 goto nla_put_failure;
@@ -1022,6 +1022,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
  nla_put_failure:
         err = -ENOBUFS;
+ free_msg:
         nlmsg_free(msg);
  out:
         cfg80211_put_dev(drv);
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index f8e71b300001..9271118e1fc4 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -35,8 +35,6 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         else
                 nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
 
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
-
 #ifdef CONFIG_WIRELESS_EXT
         if (!aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
@@ -48,6 +46,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         dev_put(dev);
 
  out:
+        wiphy_to_dev(request->wiphy)->scan_req = NULL;
         kfree(request);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 333e4dd29450..72cfd47af6b8 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -233,6 +233,18 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                 xrun(substream);
                 return -EPIPE;
         }
+        if (xrun_debug(substream, 8)) {
+                char name[16];
+                pcm_debug_name(substream, name, sizeof(name));
+                snd_printd("period_update: %s: pos=0x%x/0x%x/0x%x, "
+                           "hwptr=0x%lx, hw_base=0x%lx, hw_intr=0x%lx\n",
+                           name, (unsigned int)pos,
+                           (unsigned int)runtime->period_size,
+                           (unsigned int)runtime->buffer_size,
+                           (unsigned long)old_hw_ptr,
+                           (unsigned long)runtime->hw_ptr_base,
+                           (unsigned long)runtime->hw_ptr_interrupt);
+        }
         hw_base = runtime->hw_ptr_base;
         new_hw_ptr = hw_base + pos;
         hw_ptr_interrupt = runtime->hw_ptr_interrupt + runtime->period_size;
@@ -244,18 +256,27 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                         delta = new_hw_ptr - hw_ptr_interrupt;
         }
         if (delta < 0) {
-                delta += runtime->buffer_size;
+                if (runtime->periods == 1 || new_hw_ptr < old_hw_ptr)
+                        delta += runtime->buffer_size;
                 if (delta < 0) {
                         hw_ptr_error(substream, 
                                      "Unexpected hw_pointer value "
                                      "(stream=%i, pos=%ld, intr_ptr=%ld)\n",
                                      substream->stream, (long)pos,
                                      (long)hw_ptr_interrupt);
+#if 1
+                        /* simply skipping the hwptr update seems more
+                         * robust in some cases, e.g. on VMware with
+                         * inaccurate timer source
+                         */
+                        return 0; /* skip this update */
+#else
                         /* rebase to interrupt position */
                         hw_base = new_hw_ptr = hw_ptr_interrupt;
                         /* align hw_base to buffer_size */
                         hw_base -= hw_base % runtime->buffer_size;
                         delta = 0;
+#endif
                 } else {
                         hw_base += runtime->buffer_size;
                         if (hw_base >= runtime->boundary)
@@ -344,6 +365,19 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
                 xrun(substream);
                 return -EPIPE;
         }
+        if (xrun_debug(substream, 16)) {
+                char name[16];
+                pcm_debug_name(substream, name, sizeof(name));
+                snd_printd("hw_update: %s: pos=0x%x/0x%x/0x%x, "
+                           "hwptr=0x%lx, hw_base=0x%lx, hw_intr=0x%lx\n",
+                           name, (unsigned int)pos,
+                           (unsigned int)runtime->period_size,
+                           (unsigned int)runtime->buffer_size,
+                           (unsigned long)old_hw_ptr,
+                           (unsigned long)runtime->hw_ptr_base,
+                           (unsigned long)runtime->hw_ptr_interrupt);
+        }
+
         hw_base = runtime->hw_ptr_base;
         new_hw_ptr = hw_base + pos;
 
diff --git a/sound/pci/ctxfi/ctamixer.c b/sound/pci/ctxfi/ctamixer.c
index a1db51b3ead8..a7f4a671f7b7 100644
--- a/sound/pci/ctxfi/ctamixer.c
+++ b/sound/pci/ctxfi/ctamixer.c
@@ -242,13 +242,12 @@ static int get_amixer_rsc(struct amixer_mgr *mgr,
 
         /* Allocate mem for amixer resource */
         amixer = kzalloc(sizeof(*amixer), GFP_KERNEL);
-        if (NULL == amixer) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (!amixer)
+                return -ENOMEM;
 
         /* Check whether there are sufficient
          * amixer resources to meet request. */
+        err = 0;
         spin_lock_irqsave(&mgr->mgr_lock, flags);
         for (i = 0; i < desc->msr; i++) {
                 err = mgr_get_resource(&mgr->mgr, 1, &idx);
@@ -397,12 +396,11 @@ static int get_sum_rsc(struct sum_mgr *mgr,
 
         /* Allocate mem for sum resource */
         sum = kzalloc(sizeof(*sum), GFP_KERNEL);
-        if (NULL == sum) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (!sum)
+                return -ENOMEM;
 
         /* Check whether there are sufficient sum resources to meet request. */
+        err = 0;
         spin_lock_irqsave(&mgr->mgr_lock, flags);
         for (i = 0; i < desc->msr; i++) {
                 err = mgr_get_resource(&mgr->mgr, 1, &idx);
diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c
index e1c145d8b702..df43a5cd3938 100644
--- a/sound/pci/ctxfi/ctsrc.c
+++ b/sound/pci/ctxfi/ctsrc.c
@@ -724,12 +724,11 @@ static int get_srcimp_rsc(struct srcimp_mgr *mgr,
 
         /* Allocate mem for SRCIMP resource */
         srcimp = kzalloc(sizeof(*srcimp), GFP_KERNEL);
-        if (NULL == srcimp) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (!srcimp)
+                return -ENOMEM;
 
         /* Check whether there are sufficient SRCIMP resources. */
+        err = 0;
         spin_lock_irqsave(&mgr->mgr_lock, flags);
         for (i = 0; i < desc->msr; i++) {
                 err = mgr_get_resource(&mgr->mgr, 1, &idx);
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index be7d25fa7f35..3da85caf8af1 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3754,7 +3754,7 @@ static int ad1884a_mobile_master_sw_put(struct snd_kcontrol *kcontrol,
         int mute = (!ucontrol->value.integer.value[0] &&
                     !ucontrol->value.integer.value[1]);
         /* toggle GPIO1 according to the mute state */
-        snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+        snd_hda_codec_write_cache(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
                             mute ? 0x02 : 0x0);
         return ret;
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7e99763ca527..8c8b273116fb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10631,6 +10631,18 @@ static void alc262_lenovo_3000_unsol_event(struct hda_codec *codec,
         alc262_lenovo_3000_automute(codec, 1);
 }
 
+static int amp_stereo_mute_update(struct hda_codec *codec, hda_nid_t nid,
+                                  int dir, int idx, long *valp)
+{
+        int i, change = 0;
+
+        for (i = 0; i < 2; i++, valp++)
+                change |= snd_hda_codec_amp_update(codec, nid, i, dir, idx,
+                                                   HDA_AMP_MUTE,
+                                                   *valp ? 0 : HDA_AMP_MUTE);
+        return change;
+}
+
 /* bind hp and internal speaker mute (with plug check) */
 static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
                                          struct snd_ctl_elem_value *ucontrol)
@@ -10639,13 +10651,8 @@ static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
         long *valp = ucontrol->value.integer.value;
         int change;
 
-        change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0,
-                                                 HDA_AMP_MUTE,
-                                                 valp ? 0 : HDA_AMP_MUTE);
-        change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
-                                                 HDA_AMP_MUTE,
-                                                 valp ? 0 : HDA_AMP_MUTE);
-
+        change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
+        change |= amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
         if (change)
                 alc262_fujitsu_automute(codec, 0);
         return change;
@@ -10680,10 +10687,7 @@ static int alc262_lenovo_3000_master_sw_put(struct snd_kcontrol *kcontrol,
         long *valp = ucontrol->value.integer.value;
         int change;
 
-        change = snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
-                                                 HDA_AMP_MUTE,
-                                                 valp ? 0 : HDA_AMP_MUTE);
-
+        change = amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
         if (change)
                 alc262_lenovo_3000_automute(codec, 0);
         return change;
@@ -11854,12 +11858,7 @@ static int alc268_acer_master_sw_put(struct snd_kcontrol *kcontrol,
         long *valp = ucontrol->value.integer.value;
         int change;
 
-        change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0,
-                                          HDA_AMP_MUTE,
-                                          valp[0] ? 0 : HDA_AMP_MUTE);
-        change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0,
-                                           HDA_AMP_MUTE,
-                                           valp[1] ? 0 : HDA_AMP_MUTE);
+        change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
         if (change)
                 alc268_acer_automute(codec, 0);
         return change;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index da7f9f65c047..512f3b9b9a45 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4066,7 +4066,7 @@ static int stac92xx_add_jack(struct hda_codec *codec,
         jack->nid = nid;
         jack->type = type;
 
-        sprintf(name, "%s at %s %s Jack",
+        snprintf(name, sizeof(name), "%s at %s %s Jack",
                 snd_hda_get_jack_type(def_conf),
                 snd_hda_get_jack_connectivity(def_conf),
                 snd_hda_get_jack_location(def_conf));
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index ab099f482487..cb0d1bf34b57 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -767,6 +767,7 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
         int codec_clk = 0, bypass_pll = 0, fsref, last_clk = 0;
         u8 data, r, p, pll_q, pll_p = 1, pll_r = 1, pll_j = 1;
         u16 pll_d = 1;
+        u8 reg;
 
         /* select data word length */
         data =
@@ -801,8 +802,16 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
                 pll_q &= 0xf;
                 aic3x_write(codec, AIC3X_PLL_PROGA_REG, pll_q << PLLQ_SHIFT);
                 aic3x_write(codec, AIC3X_GPIOB_REG, CODEC_CLKIN_CLKDIV);
-        } else
+                /* disable PLL if it is bypassed */
+                reg = aic3x_read_reg_cache(codec, AIC3X_PLL_PROGA_REG);
+                aic3x_write(codec, AIC3X_PLL_PROGA_REG, reg & ~PLL_ENABLE);
+
+        } else {
                 aic3x_write(codec, AIC3X_GPIOB_REG, CODEC_CLKIN_PLLDIV);
+                /* enable PLL when it is used */
+                reg = aic3x_read_reg_cache(codec, AIC3X_PLL_PROGA_REG);
+                aic3x_write(codec, AIC3X_PLL_PROGA_REG, reg | PLL_ENABLE);
+        }
 
         /* Route Left DAC to left channel input and
          * right DAC to right channel input */
diff --git a/sound/usb/Kconfig b/sound/usb/Kconfig
index 523aec188ccf..73525c048e7f 100644
--- a/sound/usb/Kconfig
+++ b/sound/usb/Kconfig
@@ -48,6 +48,7 @@ config SND_USB_CAIAQ
             * Native Instruments Kore Controller
             * Native Instruments Kore Controller 2
             * Native Instruments Audio Kontrol 1
+            * Native Instruments Audio 2 DJ
             * Native Instruments Audio 4 DJ
             * Native Instruments Audio 8 DJ
             * Native Instruments Guitar Rig Session I/O
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index 8f9b60c5d74c..121af0644fd9 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -646,6 +646,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *dev)
         case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_GUITARRIGMOBILE):
                 dev->samplerates |= SNDRV_PCM_RATE_192000;
                 /* fall thru */
+        case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO2DJ):
         case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO4DJ):
         case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO8DJ):
                 dev->samplerates |= SNDRV_PCM_RATE_88200;
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index de38108f0b28..83e6c1312d47 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -35,13 +35,14 @@
 #include "input.h"
 
 MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
-MODULE_DESCRIPTION("caiaq USB audio, version 1.3.18");
+MODULE_DESCRIPTION("caiaq USB audio, version 1.3.19");
 MODULE_LICENSE("GPL");
 MODULE_SUPPORTED_DEVICE("{{Native Instruments, RigKontrol2},"
                          "{Native Instruments, RigKontrol3},"
                          "{Native Instruments, Kore Controller},"
                          "{Native Instruments, Kore Controller 2},"
                          "{Native Instruments, Audio Kontrol 1},"
+                         "{Native Instruments, Audio 2 DJ},"
                          "{Native Instruments, Audio 4 DJ},"
                          "{Native Instruments, Audio 8 DJ},"
                          "{Native Instruments, Session I/O},"
@@ -121,6 +122,11 @@ static struct usb_device_id snd_usb_id_table[] = {
                 .idVendor =     USB_VID_NATIVEINSTRUMENTS,
                 .idProduct =    USB_PID_AUDIO4DJ
         },
+        {
+                .match_flags =  USB_DEVICE_ID_MATCH_DEVICE,
+                .idVendor =     USB_VID_NATIVEINSTRUMENTS,
+                .idProduct =    USB_PID_AUDIO2DJ
+        },
         { /* terminator */ }
 };
 
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index ece73514854e..44e3edf88bef 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -10,6 +10,7 @@
 #define USB_PID_KORECONTROLLER  0x4711
 #define USB_PID_KORECONTROLLER2 0x4712
 #define USB_PID_AK1             0x0815
+#define USB_PID_AUDIO2DJ        0x041c
 #define USB_PID_AUDIO4DJ        0x0839
 #define USB_PID_AUDIO8DJ        0x1978
 #define USB_PID_SESSIONIO       0x1915
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index 4bd3a7a0edc1..ec9cdf986928 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -990,20 +990,35 @@ static void build_feature_ctl(struct mixer_build *state, unsigned char *desc,
                 break;
         }
 
-        /* quirk for UDA1321/N101 */
-        /* note that detection between firmware 2.1.1.7 (N101) and later 2.1.1.21 */
-        /* is not very clear from datasheets */
-        /* I hope that the min value is -15360 for newer firmware --jk */
+        /* volume control quirks */
         switch (state->chip->usb_id) {
         case USB_ID(0x0471, 0x0101):
         case USB_ID(0x0471, 0x0104):
         case USB_ID(0x0471, 0x0105):
         case USB_ID(0x0672, 0x1041):
+        /* quirk for UDA1321/N101.
+         * note that detection between firmware 2.1.1.7 (N101)
+         * and later 2.1.1.21 is not very clear from datasheets.
+         * I hope that the min value is -15360 for newer firmware --jk
+         */
                 if (!strcmp(kctl->id.name, "PCM Playback Volume") &&
                     cval->min == -15616) {
-                        snd_printk(KERN_INFO "using volume control quirk for the UDA1321/N101 chip\n");
+                        snd_printk(KERN_INFO
+                                 "set volume quirk for UDA1321/N101 chip\n");
                         cval->max = -256;
                 }
+                break;
+
+        case USB_ID(0x046d, 0x09a4):
+                if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+                        snd_printk(KERN_INFO
+                                "set volume quirk for QuickCam E3500\n");
+                        cval->min = 6080;
+                        cval->max = 8768;
+                        cval->res = 192;
+                }
+                break;
+
         }
 
         snd_printdd(KERN_INFO "[%d] FU [%s] ch = %d, val = %d/%d/%d\n",