102 files changed, 864 insertions, 518 deletions
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index b8bea100a160..b34390347c16 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -2868,6 +2868,21 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
                        },
                        .driver_data = "F.23",  /* cutoff BIOS version */
                },
+                /*
+                 * Acer eMachines G725 has the same problem.  BIOS
+                 * V1.03 is known to be broken.  V3.04 is known to
+                 * work.  Inbetween, there are V1.06, V2.06 and V3.03
+                 * that we don't have much idea about.  For now,
+                 * blacklist anything older than V3.04.
+                 */
+                {
+                        .ident = "G725",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "eMachines"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "eMachines G725"),
+                        },
+                        .driver_data = "V3.04", /* cutoff BIOS version */
+                },
                { }     /* terminate list */
        };
        const struct dmi_system_id *dmi = dmi_first_match(sysids);
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index f4ea5a8c325b..d096fbcbc771 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2875,7 +2875,7 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
         * write indication (used for PIO/DMA setup), result TF is
         * copied back and we don't whine too much about its failure.
         */
-        tf->flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+        tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
        if (scmd->sc_data_direction == DMA_TO_DEVICE)
                tf->flags |= ATA_TFLAG_WRITE;
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 741065c9da67..730ef3c384ca 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -893,6 +893,9 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
                                       do_write);
        }
+        if (!do_write)
+                flush_dcache_page(page);
        qc->curbytes += qc->sect_size;
        qc->cursg_ofs += qc->sect_size;
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index f36defa37764..57d965b7f521 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -808,6 +808,7 @@ static int btmrvl_sdio_host_to_card(struct btmrvl_private *priv,
 exit:
        sdio_release_host(card->func);
+        kfree(tmpbuf);
        return ret;
 }
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 34cf04e21795..fd50ead59c79 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -767,16 +767,19 @@ int __init agp_amd64_init(void)
 static int __init agp_amd64_mod_init(void)
 {
+#ifndef MODULE
        if (gart_iommu_aperture)
                return agp_bridges_found ? 0 : -ENODEV;
+#endif
        return agp_amd64_init();
 }
 static void __exit agp_amd64_cleanup(void)
 {
+#ifndef MODULE
        if (gart_iommu_aperture)
                return;
+#endif
        if (aperture_resource)
                release_resource(aperture_resource);
        pci_unregister_driver(&agp_amd64_pci_driver);
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index ecba4942fc8e..f58440791e65 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -39,12 +39,12 @@
 struct tpm_inf_dev {
        int iotype;
-        void __iomem *mem_base;         /* MMIO ioremap'd addr */
+        void __iomem *mem_base; /* MMIO ioremap'd addr */
-        unsigned long map_base;         /* phys MMIO base */
+        unsigned long map_base; /* phys MMIO base */
-        unsigned long map_size;         /* MMIO region size */
+        unsigned long map_size; /* MMIO region size */
-        unsigned int index_off;         /* index register offset */
+        unsigned int index_off; /* index register offset */
-        unsigned int data_regs;         /* Data registers */
+        unsigned int data_regs; /* Data registers */
        unsigned int data_size;
        unsigned int config_port;       /* IO Port config index reg */
@@ -406,14 +406,14 @@ static const struct tpm_vendor_specific tpm_inf = {
        .miscdev = {.fops = &inf_ops,},
 };
-static const struct pnp_device_id tpm_pnp_tbl[] = {
+static const struct pnp_device_id tpm_inf_pnp_tbl[] = {
        /* Infineon TPMs */
        {"IFX0101", 0},
        {"IFX0102", 0},
        {"", 0}
 };
-MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
+MODULE_DEVICE_TABLE(pnp, tpm_inf_pnp_tbl);
 static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                                       const struct pnp_device_id *dev_id)
@@ -430,7 +430,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
        if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
            !(pnp_port_flags(dev, 0) & IORESOURCE_DISABLED)) {
-                tpm_dev.iotype = TPM_INF_IO_PORT;
+                tpm_dev.iotype = TPM_INF_IO_PORT;
                tpm_dev.config_port = pnp_port_start(dev, 0);
                tpm_dev.config_size = pnp_port_len(dev, 0);
@@ -459,9 +459,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                        goto err_last;
                }
        } else if (pnp_mem_valid(dev, 0) &&
-                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
+                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
-                tpm_dev.iotype = TPM_INF_IO_MEM;
+                tpm_dev.iotype = TPM_INF_IO_MEM;
                tpm_dev.map_base = pnp_mem_start(dev, 0);
                tpm_dev.map_size = pnp_mem_len(dev, 0);
@@ -563,11 +563,11 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         "product id 0x%02x%02x"
                         "%s\n",
                         tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.config_port :
+                         tpm_dev.config_port :
-                                tpm_dev.map_base + tpm_dev.index_off,
+                         tpm_dev.map_base + tpm_dev.index_off,
                         tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.data_regs :
+                         tpm_dev.data_regs :
-                                tpm_dev.map_base + tpm_dev.data_regs,
+                         tpm_dev.map_base + tpm_dev.data_regs,
                         version[0], version[1],
                         vendorid[0], vendorid[1],
                         productid[0], productid[1], chipname);
@@ -607,20 +607,55 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
                        iounmap(tpm_dev.mem_base);
                        release_mem_region(tpm_dev.map_base, tpm_dev.map_size);
                }
+                tpm_dev_vendor_release(chip);
                tpm_remove_hardware(chip->dev);
        }
 }
+static int tpm_inf_pnp_suspend(struct pnp_dev *dev, pm_message_t pm_state)
+{
+        struct tpm_chip *chip = pnp_get_drvdata(dev);
+        int rc;
+        if (chip) {
+                u8 savestate[] = {
+                        0, 193, /* TPM_TAG_RQU_COMMAND */
+                        0, 0, 0, 10,    /* blob length (in bytes) */
+                        0, 0, 0, 152    /* TPM_ORD_SaveState */
+                };
+                dev_info(&dev->dev, "saving TPM state\n");
+                rc = tpm_inf_send(chip, savestate, sizeof(savestate));
+                if (rc < 0) {
+                        dev_err(&dev->dev, "error while saving TPM state\n");
+                        return rc;
+                }
+        }
+        return 0;
+}
+static int tpm_inf_pnp_resume(struct pnp_dev *dev)
+{
+        /* Re-configure TPM after suspending */
+        tpm_config_out(ENABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        tpm_config_out(IOLIMH, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs >> 8) & 0xff, TPM_INF_DATA);
+        tpm_config_out(IOLIML, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs & 0xff), TPM_INF_DATA);
+        /* activate register */
+        tpm_config_out(TPM_DAR, TPM_INF_ADDR);
+        tpm_config_out(0x01, TPM_INF_DATA);
+        tpm_config_out(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        /* disable RESET, LP and IRQC */
+        tpm_data_out(RESET_LP_IRQC_DISABLE, CMD);
+        return tpm_pm_resume(&dev->dev);
+}
 static struct pnp_driver tpm_inf_pnp_driver = {
        .name = "tpm_inf_pnp",
-        .driver = {
+        .id_table = tpm_inf_pnp_tbl,
-                .owner = THIS_MODULE,
-                .suspend = tpm_pm_suspend,
-                .resume = tpm_pm_resume,
-        },
-        .id_table = tpm_pnp_tbl,
        .probe = tpm_inf_pnp_probe,
-        .remove = __devexit_p(tpm_inf_pnp_remove),
+        .suspend = tpm_inf_pnp_suspend,
+        .resume = tpm_inf_pnp_resume,
+        .remove = __devexit_p(tpm_inf_pnp_remove)
 };
 static int __init init_inf(void)
@@ -638,5 +673,5 @@ module_exit(cleanup_inf);
 MODULE_AUTHOR("Marcel Selhorst <m.selhorst@sirrix.com>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.9");
+MODULE_VERSION("1.9.2");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index c6f3b48be9dd..dcb9083ecde0 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1951,8 +1951,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
                        pid = task_pid(current);
                        type = PIDTYPE_PID;
                }
-                retval = __f_setown(filp, pid, type, 0);
+                get_pid(pid);
                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+                retval = __f_setown(filp, pid, type, 0);
+                put_pid(pid);
                if (retval)
                        goto out;
        } else {
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 4b34ade2332b..bd444dc93cf2 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -554,6 +554,9 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                                (dbs_tuners_ins.up_threshold -
                                 dbs_tuners_ins.down_differential);
+                if (freq_next < policy->min)
+                        freq_next = policy->min;
                if (!dbs_tuners_ins.powersave_bias) {
                        __cpufreq_driver_target(policy, freq_next,
                                        CPUFREQ_RELATION_L);
diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
index b5f2ee0f8e2c..64a937262a40 100644
--- a/drivers/dma/coh901318.c
+++ b/drivers/dma/coh901318.c
@@ -613,8 +613,6 @@ static void dma_tasklet(unsigned long data)
        cohd_fin->pending_irqs--;
        cohc->completed = cohd_fin->desc.cookie;
-        BUG_ON(cohc->nbr_active_done && cohd_fin == NULL);
        if (cohc->nbr_active_done == 0)
                return;
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 6f51a0a7a8bb..e7a3230fb7d5 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -826,6 +826,7 @@ void dma_async_device_unregister(struct dma_device *device)
                chan->dev->chan = NULL;
                mutex_unlock(&dma_list_mutex);
                device_unregister(&chan->dev->device);
+                free_percpu(chan->local);
        }
 }
 EXPORT_SYMBOL(dma_async_device_unregister);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 8b905161fbf4..948d563941c9 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -467,7 +467,7 @@ err_srcs:
        if (iterations > 0)
                while (!kthread_should_stop()) {
-                        DECLARE_WAIT_QUEUE_HEAD(wait_dmatest_exit);
+                        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wait_dmatest_exit);
                        interruptible_sleep_on(&wait_dmatest_exit);
                }
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 5f7a500e18d0..5cc37afe2bc1 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -249,7 +249,7 @@ int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo)
        if (is_ioat_active(status) || is_ioat_idle(status))
                ioat_suspend(chan);
        while (is_ioat_active(status) || is_ioat_idle(status)) {
-                if (end && time_after(jiffies, end)) {
+                if (tmo && time_after(jiffies, end)) {
                        err = -ETIMEDOUT;
                        break;
                }
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index 9a5bc1a7389e..e80bae1673fa 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -761,12 +761,10 @@ static void ipu_select_buffer(enum ipu_channel channel, int buffer_n)
 * @buffer_n:   buffer number to update.
 *              0 or 1 are the only valid values.
 * @phyaddr:    buffer physical address.
- * @return:     Returns 0 on success or negative error code on failure. This
- *              function will fail if the buffer is set to ready.
 */
 /* Called under spin_lock(_irqsave)(&ichan->lock) */
-static int ipu_update_channel_buffer(struct idmac_channel *ichan,
+static void ipu_update_channel_buffer(struct idmac_channel *ichan,
-                                     int buffer_n, dma_addr_t phyaddr)
+                                      int buffer_n, dma_addr_t phyaddr)
 {
        enum ipu_channel channel = ichan->dma_chan.chan_id;
        uint32_t reg;
@@ -806,8 +804,6 @@ static int ipu_update_channel_buffer(struct idmac_channel *ichan,
        }
        spin_unlock_irqrestore(&ipu_data.lock, flags);
-        return 0;
 }
 /* Called under spin_lock_irqsave(&ichan->lock) */
@@ -816,7 +812,6 @@ static int ipu_submit_buffer(struct idmac_channel *ichan,
 {
        unsigned int chan_id = ichan->dma_chan.chan_id;
        struct device *dev = &ichan->dma_chan.dev->device;
-        int ret;
        if (async_tx_test_ack(&desc->txd))
                return -EINTR;
@@ -827,14 +822,7 @@ static int ipu_submit_buffer(struct idmac_channel *ichan,
         * could make it conditional on status >= IPU_CHANNEL_ENABLED, but
         * doing it again shouldn't hurt either.
         */
-        ret = ipu_update_channel_buffer(ichan, buf_idx,
+        ipu_update_channel_buffer(ichan, buf_idx, sg_dma_address(sg));
-                                        sg_dma_address(sg));
-        if (ret < 0) {
-                dev_err(dev, "Updating sg %p on channel 0x%x buffer %d failed!\n",
-                        sg, chan_id, buf_idx);
-                return ret;
-        }
        ipu_select_buffer(chan_id, buf_idx);
        dev_dbg(dev, "Updated sg %p on channel 0x%x buffer %d\n",
@@ -1379,10 +1367,11 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
        if (likely(sgnew) &&
            ipu_submit_buffer(ichan, descnew, sgnew, ichan->active_buffer) < 0) {
-                callback = desc->txd.callback;
+                callback = descnew->txd.callback;
-                callback_param = desc->txd.callback_param;
+                callback_param = descnew->txd.callback_param;
                spin_unlock(&ichan->lock);
-                callback(callback_param);
+                if (callback)
+                        callback(callback_param);
                spin_lock(&ichan->lock);
        }
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index cf27402af97b..ecd5928d7110 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -804,8 +804,8 @@ static void __devinit mpc85xx_init_csrows(struct mem_ctl_info *mci)
                end   <<= (24 - PAGE_SHIFT);
                end    |= (1 << (24 - PAGE_SHIFT)) - 1;
-                csrow->first_page = start >> PAGE_SHIFT;
+                csrow->first_page = start;
-                csrow->last_page = end >> PAGE_SHIFT;
+                csrow->last_page = end;
                csrow->nr_pages = end + 1 - start;
                csrow->grain = 8;
                csrow->mtype = mtype;
@@ -892,10 +892,6 @@ static int __devinit mpc85xx_mc_err_probe(struct of_device *op,
        mpc85xx_init_csrows(mci);
-#ifdef CONFIG_EDAC_DEBUG
-        edac_mc_register_mcidev_debug((struct attribute **)debug_attr);
-#endif
        /* store the original error disable bits */
        orig_ddr_err_disable =
            in_be32(pdata->mc_vbase + MPC85XX_MC_ERR_DISABLE);
diff --git a/drivers/gpu/drm/ati_pcigart.c b/drivers/gpu/drm/ati_pcigart.c
index a1fce68e3bbe..17be051b7aa3 100644
--- a/drivers/gpu/drm/ati_pcigart.c
+++ b/drivers/gpu/drm/ati_pcigart.c
@@ -113,7 +113,7 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga
                if (pci_set_dma_mask(dev->pdev, gart_info->table_mask)) {
                        DRM_ERROR("fail to set dma mask to 0x%Lx\n",
-                                  gart_info->table_mask);
+                                  (unsigned long long)gart_info->table_mask);
                        ret = 1;
                        goto done;
                }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 46d88965852a..ecac882e1d54 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -120,7 +120,7 @@ const static struct intel_device_info intel_gm45_info = {
 const static struct intel_device_info intel_pineview_info = {
        .is_g33 = 1, .is_pineview = 1, .is_mobile = 1, .is_i9xx = 1,
-        .has_pipe_cxsr = 1,
+        .need_gfx_hws = 1,
        .has_hotplug = 1,
 };
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index dda787aafcc6..b4c8c0230689 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3564,6 +3564,9 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object2 *exec_list,
        uint32_t reloc_count = 0, i;
        int ret = 0;
+        if (relocs == NULL)
+            return 0;
        for (i = 0; i < buffer_count; i++) {
                struct drm_i915_gem_relocation_entry __user *user_relocs;
                int unwritten;
@@ -3653,7 +3656,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
        struct drm_gem_object *batch_obj;
        struct drm_i915_gem_object *obj_priv;
        struct drm_clip_rect *cliprects = NULL;
-        struct drm_i915_gem_relocation_entry *relocs;
+        struct drm_i915_gem_relocation_entry *relocs = NULL;
        int ret = 0, ret2, i, pinned = 0;
        uint64_t exec_offset;
        uint32_t seqno, flush_domains, reloc_index;
@@ -3722,6 +3725,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                if (object_list[i] == NULL) {
                        DRM_ERROR("Invalid object handle %d at index %d\n",
                                   exec_list[i].handle, i);
+                        /* prevent error path from reading uninitialized data */
+                        args->buffer_count = i + 1;
                        ret = -EBADF;
                        goto err;
                }
@@ -3730,6 +3735,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                if (obj_priv->in_execbuffer) {
                        DRM_ERROR("Object %p appears more than once in object list\n",
                                   object_list[i]);
+                        /* prevent error path from reading uninitialized data */
+                        args->buffer_count = i + 1;
                        ret = -EBADF;
                        goto err;
                }
@@ -3926,6 +3933,7 @@ err:
        mutex_unlock(&dev->struct_mutex);
+pre_mutex_err:
        /* Copy the updated relocations out regardless of current error
         * state.  Failure to update the relocs would mean that the next
         * time userland calls execbuf, it would do so with presumed offset
@@ -3940,7 +3948,6 @@ err:
                        ret = ret2;
        }
-pre_mutex_err:
        drm_free_large(object_list);
        kfree(cliprects);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 89a071a3e6fb..50ddf4a95c5e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -309,6 +309,22 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
        if (de_iir & DE_GSE)
                ironlake_opregion_gse_intr(dev);
+        if (de_iir & DE_PLANEA_FLIP_DONE)
+                intel_prepare_page_flip(dev, 0);
+        if (de_iir & DE_PLANEB_FLIP_DONE)
+                intel_prepare_page_flip(dev, 1);
+        if (de_iir & DE_PIPEA_VBLANK) {
+                drm_handle_vblank(dev, 0);
+                intel_finish_page_flip(dev, 0);
+        }
+        if (de_iir & DE_PIPEB_VBLANK) {
+                drm_handle_vblank(dev, 1);
+                intel_finish_page_flip(dev, 1);
+        }
        /* check event from PCH */
        if ((de_iir & DE_PCH_EVENT) &&
            (pch_iir & SDE_HOTPLUG_MASK)) {
@@ -844,11 +860,11 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
        if (!(pipeconf & PIPEACONF_ENABLE))
                return -EINVAL;
-        if (IS_IRONLAKE(dev))
-                return 0;
        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-        if (IS_I965G(dev))
+        if (IS_IRONLAKE(dev))
+                ironlake_enable_display_irq(dev_priv, (pipe == 0) ? 
+                                            DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+        else if (IS_I965G(dev))
                i915_enable_pipestat(dev_priv, pipe,
                                     PIPE_START_VBLANK_INTERRUPT_ENABLE);
        else
@@ -866,13 +882,14 @@ void i915_disable_vblank(struct drm_device *dev, int pipe)
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        unsigned long irqflags;
-        if (IS_IRONLAKE(dev))
-                return;
        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-        i915_disable_pipestat(dev_priv, pipe,
+        if (IS_IRONLAKE(dev))
-                              PIPE_VBLANK_INTERRUPT_ENABLE |
+                ironlake_disable_display_irq(dev_priv, (pipe == 0) ? 
-                              PIPE_START_VBLANK_INTERRUPT_ENABLE);
+                                             DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+        else
+                i915_disable_pipestat(dev_priv, pipe,
+                                      PIPE_VBLANK_INTERRUPT_ENABLE |
+                                      PIPE_START_VBLANK_INTERRUPT_ENABLE);
        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
 }
@@ -1015,13 +1032,14 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        /* enable kind of interrupts always enabled */
-        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT;
+        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
+                           DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
        u32 render_mask = GT_USER_INTERRUPT;
        u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
                           SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
        dev_priv->irq_mask_reg = ~display_mask;
-        dev_priv->de_irq_enable_reg = display_mask;
+        dev_priv->de_irq_enable_reg = display_mask | DE_PIPEA_VBLANK | DE_PIPEB_VBLANK;
        /* should always can generate irq */
        I915_WRITE(DEIIR, I915_READ(DEIIR));
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index ddefc871edfe..79dd4026586f 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -157,6 +157,9 @@ static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
        adpa = I915_READ(PCH_ADPA);
        adpa &= ~ADPA_CRT_HOTPLUG_MASK;
+        /* disable HPD first */
+        I915_WRITE(PCH_ADPA, adpa);
+        (void)I915_READ(PCH_ADPA);
        adpa |= (ADPA_CRT_HOTPLUG_PERIOD_128 |
                        ADPA_CRT_HOTPLUG_WARMUP_10MS |
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 45da78ef4a92..12775df1bbfd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1638,6 +1638,7 @@ static void ironlake_crtc_dpms(struct drm_crtc *crtc, int mode)
        case DRM_MODE_DPMS_OFF:
                DRM_DEBUG_KMS("crtc %d dpms off\n", pipe);
+                drm_vblank_off(dev, pipe);
                /* Disable display plane */
                temp = I915_READ(dspcntr_reg);
                if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
@@ -2519,6 +2520,10 @@ static void g4x_update_wm(struct drm_device *dev,  int planea_clock,
                sr_entries = roundup(sr_entries / cacheline_size, 1);
                DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
        }
        DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, SR %d\n",
@@ -2562,6 +2567,10 @@ static void i965_update_wm(struct drm_device *dev, int planea_clock,
                        srwm = 1;
                srwm &= 0x3f;
                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
        }
        DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
@@ -2630,6 +2639,10 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
                if (srwm < 0)
                        srwm = 1;
                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN | (srwm & 0x3f));
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
        }
        DRM_DEBUG_KMS("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
@@ -3984,6 +3997,12 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
        spin_lock_irqsave(&dev->event_lock, flags);
        work = intel_crtc->unpin_work;
        if (work == NULL || !work->pending) {
+                if (work && !work->pending) {
+                        obj_priv = work->obj->driver_private;
+                        DRM_DEBUG_DRIVER("flip finish: %p (%d) not pending?\n",
+                                         obj_priv,
+                                         atomic_read(&obj_priv->pending_flip));
+                }
                spin_unlock_irqrestore(&dev->event_lock, flags);
                return;
        }
@@ -4005,7 +4024,10 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
        spin_unlock_irqrestore(&dev->event_lock, flags);
        obj_priv = work->obj->driver_private;
-        if (atomic_dec_and_test(&obj_priv->pending_flip))
+        /* Initial scanout buffer will have a 0 pending flip count */
+        if ((atomic_read(&obj_priv->pending_flip) == 0) ||
+            atomic_dec_and_test(&obj_priv->pending_flip))
                DRM_WAKEUP(&dev_priv->pending_flip_queue);
        schedule_work(&work->work);
 }
@@ -4018,8 +4040,11 @@ void intel_prepare_page_flip(struct drm_device *dev, int plane)
        unsigned long flags;
        spin_lock_irqsave(&dev->event_lock, flags);
-        if (intel_crtc->unpin_work)
+        if (intel_crtc->unpin_work) {
                intel_crtc->unpin_work->pending = 1;
+        } else {
+                DRM_DEBUG_DRIVER("preparing flip with no unpin work?\n");
+        }
        spin_unlock_irqrestore(&dev->event_lock, flags);
 }
@@ -4053,6 +4078,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        /* We borrow the event spin lock for protecting unpin_work */
        spin_lock_irqsave(&dev->event_lock, flags);
        if (intel_crtc->unpin_work) {
+                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
                spin_unlock_irqrestore(&dev->event_lock, flags);
                kfree(work);
                mutex_unlock(&dev->struct_mutex);
@@ -4066,7 +4092,10 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        ret = intel_pin_and_fence_fb_obj(dev, obj);
        if (ret != 0) {
+                DRM_DEBUG_DRIVER("flip queue: %p pin & fence failed\n",
+                          obj->driver_private);
                kfree(work);
+                intel_crtc->unpin_work = NULL;
                mutex_unlock(&dev->struct_mutex);
                return ret;
        }
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index aa74e59bec61..b1d0acbae4e4 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -611,7 +611,7 @@ static const struct dmi_system_id bad_lid_status[] = {
        {
                .ident = "Samsung SX20S",
                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Phoenix Technologies LTD"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Samsung Electronics"),
                        DMI_MATCH(DMI_BOARD_NAME, "SX20S"),
                },
        },
@@ -623,6 +623,13 @@ static const struct dmi_system_id bad_lid_status[] = {
                },
        },
        {
+                .ident = "Aspire 1810T",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1810T"),
+                },
+        },
+        {
                .ident = "PC-81005",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "MALATA"),
@@ -643,7 +650,7 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
 {
        enum drm_connector_status status = connector_status_connected;
-        if (!acpi_lid_open() && !dmi_check_system(bad_lid_status))
+        if (!dmi_check_system(bad_lid_status) && !acpi_lid_open())
                status = connector_status_disconnected;
        return status;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index eaacfd0920df..82678d30ab06 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2345,6 +2345,14 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                connector->connector_type = DRM_MODE_CONNECTOR_VGA;
                intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
                                        (1 << INTEL_ANALOG_CLONE_BIT);
+        } else if (flags & SDVO_OUTPUT_CVBS0) {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_CVBS0;
+                encoder->encoder_type = DRM_MODE_ENCODER_TVDAC;
+                connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
+                sdvo_priv->is_tv = true;
+                intel_output->needs_tv_clock = true;
+                intel_output->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
        } else if (flags & SDVO_OUTPUT_LVDS0) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 1cf488247a16..48227e744753 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -90,21 +90,21 @@ int nouveau_hybrid_setup(struct drm_device *dev)
 {
        int result;
-        if (nouveau_dsm(dev, NOUVEAU_DSM_ACTIVE, NOUVEAU_DSM_ACTIVE_QUERY,
+        if (nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_STATE,
                                                                &result))
                return -ENODEV;
        NV_INFO(dev, "_DSM hardware status gave 0x%x\n", result);
-        if (result & 0x1) {     /* Stamina mode - disable the external GPU */
+        if (result) { /* Ensure that the external GPU is enabled */
+                nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_SPEED, NULL);
+                nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_SPEED,
+                                                                        NULL);
+        } else { /* Stamina mode - disable the external GPU */
                nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_STAMINA,
                                                                        NULL);
                nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_STAMINA,
                                                                        NULL);
-        } else {                /* Ensure that the external GPU is enabled */
-                nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_SPEED, NULL);
-                nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_SPEED,
-                                                                        NULL);
        }
        return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index d7f8d8b4a4b8..2cd0fad17dac 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -1865,7 +1865,7 @@ init_compute_mem(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
        struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
-        if (dev_priv->card_type >= NV_50)
+        if (dev_priv->card_type >= NV_40)
                return 1;
        /*
@@ -3765,7 +3765,6 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
         */
        struct drm_nouveau_private *dev_priv = dev->dev_private;
-        struct init_exec iexec = {true, false};
        struct nvbios *bios = &dev_priv->VBIOS;
        uint8_t *table = &bios->data[bios->display.script_table_ptr];
        uint8_t *otable = NULL;
@@ -3845,8 +3844,6 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                }
        }
-        bios->display.output = dcbent;
        if (pxclk == 0) {
                script = ROM16(otable[6]);
                if (!script) {
@@ -3855,7 +3852,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                }
                NV_TRACE(dev, "0x%04X: parsing output script 0\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
        } else
        if (pxclk == -1) {
                script = ROM16(otable[8]);
@@ -3865,7 +3862,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                }
                NV_TRACE(dev, "0x%04X: parsing output script 1\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
        } else
        if (pxclk == -2) {
                if (table[4] >= 12)
@@ -3878,7 +3875,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                }
                NV_TRACE(dev, "0x%04X: parsing output script 2\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
        } else
        if (pxclk > 0) {
                script = ROM16(otable[table[4] + i*6 + 2]);
@@ -3890,7 +3887,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                }
                NV_TRACE(dev, "0x%04X: parsing clock script 0\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
        } else
        if (pxclk < 0) {
                script = ROM16(otable[table[4] + i*6 + 4]);
@@ -3902,7 +3899,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                }
                NV_TRACE(dev, "0x%04X: parsing clock script 1\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
        }
        return 0;
@@ -5864,10 +5861,13 @@ nouveau_bios_run_init_table(struct drm_device *dev, uint16_t table,
        struct drm_nouveau_private *dev_priv = dev->dev_private;
        struct nvbios *bios = &dev_priv->VBIOS;
        struct init_exec iexec = { true, false };
+        unsigned long flags;
+        spin_lock_irqsave(&bios->lock, flags);
        bios->display.output = dcbent;
        parse_init_table(bios, table, &iexec);
        bios->display.output = NULL;
+        spin_unlock_irqrestore(&bios->lock, flags);
 }
 static bool NVInitVBIOS(struct drm_device *dev)
@@ -5876,6 +5876,7 @@ static bool NVInitVBIOS(struct drm_device *dev)
        struct nvbios *bios = &dev_priv->VBIOS;
        memset(bios, 0, sizeof(struct nvbios));
+        spin_lock_init(&bios->lock);
        bios->dev = dev;
        if (!NVShadowVBIOS(dev, bios->data))
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.h b/drivers/gpu/drm/nouveau/nouveau_bios.h
index 058e98c76d89..68446fd4146b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.h
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.h
@@ -205,6 +205,8 @@ struct nvbios {
        struct drm_device *dev;
        struct nouveau_bios_info pub;
+        spinlock_t lock;
        uint8_t data[NV_PROM_SIZE];
        unsigned int length;
        bool execute;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index db0ed4c13f98..028719fddf76 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -65,8 +65,10 @@ nouveau_bo_fixup_align(struct drm_device *dev,
        /*
         * Some of the tile_flags have a periodic structure of N*4096 bytes,
-         * align to to that as well as the page size. Overallocate memory to
+         * align to to that as well as the page size. Align the size to the
-         * avoid corruption of other buffer objects.
+         * appropriate boundaries. This does imply that sizes are rounded up
+         * 3-7 pages, so be aware of this and do not waste memory by allocating
+         * many small buffers.
         */
        if (dev_priv->card_type == NV_50) {
                uint32_t block_size = nouveau_mem_fb_amount(dev) >> 15;
@@ -77,22 +79,20 @@ nouveau_bo_fixup_align(struct drm_device *dev,
                case 0x2800:
                case 0x4800:
                case 0x7a00:
-                        *size = roundup(*size, block_size);
                        if (is_power_of_2(block_size)) {
-                                *size += 3 * block_size;
                                for (i = 1; i < 10; i++) {
                                        *align = 12 * i * block_size;
                                        if (!(*align % 65536))
                                                break;
                                }
                        } else {
-                                *size += 6 * block_size;
                                for (i = 1; i < 10; i++) {
                                        *align = 8 * i * block_size;
                                        if (!(*align % 65536))
                                                break;
                                }
                        }
+                        *size = roundup(*size, *align);
                        break;
                default:
                        break;
diff --git a/drivers/gpu/drm/nouveau/nouveau_channel.c b/drivers/gpu/drm/nouveau/nouveau_channel.c
index 343d718a9667..2281f99da7fc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_channel.c
+++ b/drivers/gpu/drm/nouveau/nouveau_channel.c
@@ -278,12 +278,11 @@ nouveau_channel_free(struct nouveau_channel *chan)
        /* Ensure the channel is no longer active on the GPU */
        pfifo->reassign(dev, false);
-        if (pgraph->channel(dev) == chan) {
+        pgraph->fifo_access(dev, false);
-                pgraph->fifo_access(dev, false);
+        if (pgraph->channel(dev) == chan)
                pgraph->unload_context(dev);
-                pgraph->fifo_access(dev, true);
-        }
        pgraph->destroy_context(chan);
+        pgraph->fifo_access(dev, true);
        if (pfifo->channel_id(dev) == chan->id) {
                pfifo->disable(dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 7e6d673f3a23..d2f63353ea97 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -88,13 +88,14 @@ nouveau_connector_destroy(struct drm_connector *drm_connector)
 {
        struct nouveau_connector *nv_connector =
                nouveau_connector(drm_connector);
-        struct drm_device *dev = nv_connector->base.dev;
+        struct drm_device *dev;
-        NV_DEBUG_KMS(dev, "\n");
        if (!nv_connector)
                return;
+        dev = nv_connector->base.dev;
+        NV_DEBUG_KMS(dev, "\n");
        kfree(nv_connector->edid);
        drm_sysfs_connector_remove(drm_connector);
        drm_connector_cleanup(drm_connector);
diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c
index dd4937224220..f954ad93e81f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -502,12 +502,12 @@ nouveau_dp_auxch(struct nouveau_i2c_chan *auxch, int cmd, int addr,
                        break;
        }
-        if ((stat & NV50_AUXCH_STAT_COUNT) != data_nr) {
-                ret = -EREMOTEIO;
-                goto out;
-        }
        if (cmd & 1) {
+                if ((stat & NV50_AUXCH_STAT_COUNT) != data_nr) {
+                        ret = -EREMOTEIO;
+                        goto out;
+                }
                for (i = 0; i < 4; i++) {
                        data32[i] = nv_rd32(dev, NV50_AUXCH_DATA_IN(index, i));
                        NV_DEBUG_KMS(dev, "rd %d: 0x%08x\n", i, data32[i]);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.c b/drivers/gpu/drm/nouveau/nouveau_drv.c
index 343ab7f17ccc..da3b93b84502 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
@@ -56,7 +56,7 @@ int nouveau_vram_pushbuf;
 module_param_named(vram_pushbuf, nouveau_vram_pushbuf, int, 0400);
 MODULE_PARM_DESC(vram_notify, "Force DMA notifiers to be in VRAM");
-int nouveau_vram_notify;
+int nouveau_vram_notify = 1;
 module_param_named(vram_notify, nouveau_vram_notify, int, 0400);
 MODULE_PARM_DESC(duallink, "Allow dual-link TMDS (>=GeForce 8)");
@@ -75,6 +75,14 @@ MODULE_PARM_DESC(ignorelid, "Ignore ACPI lid status");
 int nouveau_ignorelid = 0;
 module_param_named(ignorelid, nouveau_ignorelid, int, 0400);
+MODULE_PARM_DESC(noagp, "Disable all acceleration");
+int nouveau_noaccel = 0;
+module_param_named(noaccel, nouveau_noaccel, int, 0400);
+MODULE_PARM_DESC(noagp, "Disable fbcon acceleration");
+int nouveau_nofbaccel = 0;
+module_param_named(nofbaccel, nouveau_nofbaccel, int, 0400);
 MODULE_PARM_DESC(tv_norm, "Default TV norm.\n"
                 "\t\tSupported: PAL, PAL-M, PAL-N, PAL-Nc, NTSC-M, NTSC-J,\n"
                 "\t\t\thd480i, hd480p, hd576i, hd576p, hd720p, hd1080i.\n"
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 6b9690418bc7..5445cefdd03e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -678,6 +678,8 @@ extern int nouveau_reg_debug;
 extern char *nouveau_vbios;
 extern int nouveau_ctxfw;
 extern int nouveau_ignorelid;
+extern int nouveau_nofbaccel;
+extern int nouveau_noaccel;
 /* nouveau_state.c */
 extern void nouveau_preclose(struct drm_device *dev, struct drm_file *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 0b05c869e0e7..ea879a2efef3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -107,6 +107,34 @@ static struct fb_ops nouveau_fbcon_ops = {
        .fb_setcmap = drm_fb_helper_setcmap,
 };
+static struct fb_ops nv04_fbcon_ops = {
+        .owner = THIS_MODULE,
+        .fb_check_var = drm_fb_helper_check_var,
+        .fb_set_par = drm_fb_helper_set_par,
+        .fb_setcolreg = drm_fb_helper_setcolreg,
+        .fb_fillrect = nv04_fbcon_fillrect,
+        .fb_copyarea = nv04_fbcon_copyarea,
+        .fb_imageblit = nv04_fbcon_imageblit,
+        .fb_sync = nouveau_fbcon_sync,
+        .fb_pan_display = drm_fb_helper_pan_display,
+        .fb_blank = drm_fb_helper_blank,
+        .fb_setcmap = drm_fb_helper_setcmap,
+};
+static struct fb_ops nv50_fbcon_ops = {
+        .owner = THIS_MODULE,
+        .fb_check_var = drm_fb_helper_check_var,
+        .fb_set_par = drm_fb_helper_set_par,
+        .fb_setcolreg = drm_fb_helper_setcolreg,
+        .fb_fillrect = nv50_fbcon_fillrect,
+        .fb_copyarea = nv50_fbcon_copyarea,
+        .fb_imageblit = nv50_fbcon_imageblit,
+        .fb_sync = nouveau_fbcon_sync,
+        .fb_pan_display = drm_fb_helper_pan_display,
+        .fb_blank = drm_fb_helper_blank,
+        .fb_setcmap = drm_fb_helper_setcmap,
+};
 static void nouveau_fbcon_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                    u16 blue, int regno)
 {
@@ -267,8 +295,12 @@ nouveau_fbcon_create(struct drm_device *dev, uint32_t fb_width,
        dev_priv->fbdev_info = info;
        strcpy(info->fix.id, "nouveaufb");
-        info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA |
+        if (nouveau_nofbaccel)
-                      FBINFO_HWACCEL_FILLRECT | FBINFO_HWACCEL_IMAGEBLIT;
+                info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_DISABLED;
+        else
+                info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA |
+                              FBINFO_HWACCEL_FILLRECT |
+                              FBINFO_HWACCEL_IMAGEBLIT;
        info->fbops = &nouveau_fbcon_ops;
        info->fix.smem_start = dev->mode_config.fb_base + nvbo->bo.offset -
                               dev_priv->vm_vram_base;
@@ -316,13 +348,15 @@ nouveau_fbcon_create(struct drm_device *dev, uint32_t fb_width,
        par->nouveau_fb = nouveau_fb;
        par->dev = dev;
-        if (dev_priv->channel) {
+        if (dev_priv->channel && !nouveau_nofbaccel) {
                switch (dev_priv->card_type) {
                case NV_50:
                        nv50_fbcon_accel_init(info);
+                        info->fbops = &nv50_fbcon_ops;
                        break;
                default:
                        nv04_fbcon_accel_init(info);
+                        info->fbops = &nv04_fbcon_ops;
                        break;
                };
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.h b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
index 462e0b87b4bd..f9c34e1a8c11 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
@@ -40,7 +40,13 @@ int nouveau_fbcon_remove(struct drm_device *dev, struct drm_framebuffer *fb);
 void nouveau_fbcon_restore(void);
 void nouveau_fbcon_zfill(struct drm_device *dev);
+void nv04_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region);
+void nv04_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect);
+void nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image);
 int nv04_fbcon_accel_init(struct fb_info *info);
+void nv50_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect);
+void nv50_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region);
+void nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image);
 int nv50_fbcon_accel_init(struct fb_info *info);
 void nouveau_fbcon_gpu_lockup(struct fb_info *info);
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 6ac804b0c9f9..70cc30803e3b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -925,7 +925,9 @@ nouveau_gem_ioctl_cpu_prep(struct drm_device *dev, void *data,
        }
        if (req->flags & NOUVEAU_GEM_CPU_PREP_NOBLOCK) {
+                spin_lock(&nvbo->bo.lock);
                ret = ttm_bo_wait(&nvbo->bo, false, false, no_wait);
+                spin_unlock(&nvbo->bo.lock);
        } else {
                ret = ttm_bo_synccpu_write_grab(&nvbo->bo, no_wait);
                if (ret == 0)
diff --git a/drivers/gpu/drm/nouveau/nouveau_grctx.c b/drivers/gpu/drm/nouveau/nouveau_grctx.c
index 419f4c2b3b89..c7ebec696747 100644
--- a/drivers/gpu/drm/nouveau/nouveau_grctx.c
+++ b/drivers/gpu/drm/nouveau/nouveau_grctx.c
@@ -97,8 +97,8 @@ nouveau_grctx_prog_load(struct drm_device *dev)
                }
                pgraph->ctxvals = kmalloc(fw->size, GFP_KERNEL);
-                if (!pgraph->ctxprog) {
+                if (!pgraph->ctxvals) {
-                        NV_ERROR(dev, "OOM copying ctxprog\n");
+                        NV_ERROR(dev, "OOM copying ctxvals\n");
                        release_firmware(fw);
                        nouveau_grctx_fini(dev);
                        return -ENOMEM;
diff --git a/drivers/gpu/drm/nouveau/nouveau_irq.c b/drivers/gpu/drm/nouveau/nouveau_irq.c
index 3b9bad66162a..447f9f69d6b1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_irq.c
+++ b/drivers/gpu/drm/nouveau/nouveau_irq.c
@@ -211,6 +211,20 @@ nouveau_fifo_irq_handler(struct drm_device *dev)
                                                                get + 4);
                }
+                if (status & NV_PFIFO_INTR_SEMAPHORE) {
+                        uint32_t sem;
+                        status &= ~NV_PFIFO_INTR_SEMAPHORE;
+                        nv_wr32(dev, NV03_PFIFO_INTR_0,
+                                NV_PFIFO_INTR_SEMAPHORE);
+                        sem = nv_rd32(dev, NV10_PFIFO_CACHE1_SEMAPHORE);
+                        nv_wr32(dev, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
+                        nv_wr32(dev, NV03_PFIFO_CACHE1_GET, get + 4);
+                        nv_wr32(dev, NV04_PFIFO_CACHE1_PULL0, 1);
+                }
                if (status) {
                        NV_INFO(dev, "PFIFO_INTR 0x%08x - Ch %d\n",
                                status, chid);
@@ -566,86 +580,99 @@ nouveau_pgraph_irq_handler(struct drm_device *dev)
 static void
 nv50_pgraph_irq_handler(struct drm_device *dev)
 {
-        uint32_t status, nsource;
+        uint32_t status;
-        status = nv_rd32(dev, NV03_PGRAPH_INTR);
+        while ((status = nv_rd32(dev, NV03_PGRAPH_INTR))) {
-        nsource = nv_rd32(dev, NV03_PGRAPH_NSOURCE);
+                uint32_t nsource = nv_rd32(dev, NV03_PGRAPH_NSOURCE);
-        if (status & 0x00000001) {
+                if (status & 0x00000001) {
-                nouveau_pgraph_intr_notify(dev, nsource);
+                        nouveau_pgraph_intr_notify(dev, nsource);
-                status &= ~0x00000001;
+                        status &= ~0x00000001;
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000001);
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000001);
-        }
+                }
-        if (status & 0x00000010) {
+                if (status & 0x00000010) {
-                nouveau_pgraph_intr_error(dev, nsource |
+                        nouveau_pgraph_intr_error(dev, nsource |
-                                          NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD);
+                                        NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD);
-                status &= ~0x00000010;
+                        status &= ~0x00000010;
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000010);
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000010);
-        }
+                }
-        if (status & 0x00001000) {
+                if (status & 0x00001000) {
-                nv_wr32(dev, 0x400500, 0x00000000);
+                        nv_wr32(dev, 0x400500, 0x00000000);
-                nv_wr32(dev, NV03_PGRAPH_INTR, NV_PGRAPH_INTR_CONTEXT_SWITCH);
+                        nv_wr32(dev, NV03_PGRAPH_INTR,
-                nv_wr32(dev, NV40_PGRAPH_INTR_EN, nv_rd32(dev,
+                                NV_PGRAPH_INTR_CONTEXT_SWITCH);
-                        NV40_PGRAPH_INTR_EN) & ~NV_PGRAPH_INTR_CONTEXT_SWITCH);
+                        nv_wr32(dev, NV40_PGRAPH_INTR_EN, nv_rd32(dev,
-                nv_wr32(dev, 0x400500, 0x00010001);
+                                NV40_PGRAPH_INTR_EN) &
+                                ~NV_PGRAPH_INTR_CONTEXT_SWITCH);
+                        nv_wr32(dev, 0x400500, 0x00010001);
-                nv50_graph_context_switch(dev);
+                        nv50_graph_context_switch(dev);
-                status &= ~NV_PGRAPH_INTR_CONTEXT_SWITCH;
+                        status &= ~NV_PGRAPH_INTR_CONTEXT_SWITCH;
-        }
+                }
-        if (status & 0x00100000) {
+                if (status & 0x00100000) {
-                nouveau_pgraph_intr_error(dev, nsource |
+                        nouveau_pgraph_intr_error(dev, nsource |
-                                          NV03_PGRAPH_NSOURCE_DATA_ERROR);
+                                        NV03_PGRAPH_NSOURCE_DATA_ERROR);
-                status &= ~0x00100000;
+                        status &= ~0x00100000;
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00100000);
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00100000);
-        }
+                }
-        if (status & 0x00200000) {
+                if (status & 0x00200000) {
-                int r;
+                        int r;
-                nouveau_pgraph_intr_error(dev, nsource |
+                        nouveau_pgraph_intr_error(dev, nsource |
-                                          NV03_PGRAPH_NSOURCE_PROTECTION_ERROR);
+                                        NV03_PGRAPH_NSOURCE_PROTECTION_ERROR);
-                NV_ERROR(dev, "magic set 1:\n");
+                        NV_ERROR(dev, "magic set 1:\n");
-                for (r = 0x408900; r <= 0x408910; r += 4)
+                        for (r = 0x408900; r <= 0x408910; r += 4)
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
-                nv_wr32(dev, 0x408900, nv_rd32(dev, 0x408904) | 0xc0000000);
+                                        nv_rd32(dev, r));
-                for (r = 0x408e08; r <= 0x408e24; r += 4)
+                        nv_wr32(dev, 0x408900,
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+                                nv_rd32(dev, 0x408904) | 0xc0000000);
-                nv_wr32(dev, 0x408e08, nv_rd32(dev, 0x408e08) | 0xc0000000);
+                        for (r = 0x408e08; r <= 0x408e24; r += 4)
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
-                NV_ERROR(dev, "magic set 2:\n");
+                                                        nv_rd32(dev, r));
-                for (r = 0x409900; r <= 0x409910; r += 4)
+                        nv_wr32(dev, 0x408e08,
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+                                nv_rd32(dev, 0x408e08) | 0xc0000000);
-                nv_wr32(dev, 0x409900, nv_rd32(dev, 0x409904) | 0xc0000000);
-                for (r = 0x409e08; r <= 0x409e24; r += 4)
+                        NV_ERROR(dev, "magic set 2:\n");
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+                        for (r = 0x409900; r <= 0x409910; r += 4)
-                nv_wr32(dev, 0x409e08, nv_rd32(dev, 0x409e08) | 0xc0000000);
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
+                                        nv_rd32(dev, r));
-                status &= ~0x00200000;
+                        nv_wr32(dev, 0x409900,
-                nv_wr32(dev, NV03_PGRAPH_NSOURCE, nsource);
+                                nv_rd32(dev, 0x409904) | 0xc0000000);
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00200000);
+                        for (r = 0x409e08; r <= 0x409e24; r += 4)
-        }
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
+                                        nv_rd32(dev, r));
+                        nv_wr32(dev, 0x409e08,
+                                nv_rd32(dev, 0x409e08) | 0xc0000000);
+                        status &= ~0x00200000;
+                        nv_wr32(dev, NV03_PGRAPH_NSOURCE, nsource);
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00200000);
+                }
-        if (status) {
+                if (status) {
-                NV_INFO(dev, "Unhandled PGRAPH_INTR - 0x%08x\n", status);
+                        NV_INFO(dev, "Unhandled PGRAPH_INTR - 0x%08x\n",
-                nv_wr32(dev, NV03_PGRAPH_INTR, status);
+                                status);
-        }
+                        nv_wr32(dev, NV03_PGRAPH_INTR, status);
+                }
-        {
+                {
-                const int isb = (1 << 16) | (1 << 0);
+                        const int isb = (1 << 16) | (1 << 0);
-                if ((nv_rd32(dev, 0x400500) & isb) != isb)
+                        if ((nv_rd32(dev, 0x400500) & isb) != isb)
-                        nv_wr32(dev, 0x400500, nv_rd32(dev, 0x400500) | isb);
+                                nv_wr32(dev, 0x400500,
-                nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) & ~(1 << 31));
+                                        nv_rd32(dev, 0x400500) | isb);
+                }
        }
        nv_wr32(dev, NV03_PMC_INTR_0, NV_PMC_INTR_0_PGRAPH_PENDING);
+        nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) & ~(1 << 31));
 }
 static void
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 6c66a34b6345..d99dc087f9b1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -34,15 +34,20 @@ nouveau_notifier_init_channel(struct nouveau_channel *chan)
 {
        struct drm_device *dev = chan->dev;
        struct nouveau_bo *ntfy = NULL;
+        uint32_t flags;
        int ret;
-        ret = nouveau_gem_new(dev, NULL, PAGE_SIZE, 0, nouveau_vram_notify ?
+        if (nouveau_vram_notify)
-                              TTM_PL_FLAG_VRAM : TTM_PL_FLAG_TT,
+                flags = TTM_PL_FLAG_VRAM;
+        else
+                flags = TTM_PL_FLAG_TT;
+        ret = nouveau_gem_new(dev, NULL, PAGE_SIZE, 0, flags,
                              0, 0x0000, false, true, &ntfy);
        if (ret)
                return ret;
-        ret = nouveau_bo_pin(ntfy, TTM_PL_FLAG_VRAM);
+        ret = nouveau_bo_pin(ntfy, flags);
        if (ret)
                goto out_err;
@@ -128,6 +133,8 @@ nouveau_notifier_alloc(struct nouveau_channel *chan, uint32_t handle,
                        target = NV_DMA_TARGET_PCI;
                } else {
                        target = NV_DMA_TARGET_AGP;
+                        if (dev_priv->card_type >= NV_50)
+                                offset += dev_priv->vm_gart_base;
                }
        } else {
                NV_ERROR(dev, "Bad DMA target, mem_type %d!\n",
diff --git a/drivers/gpu/drm/nouveau/nouveau_object.c b/drivers/gpu/drm/nouveau/nouveau_object.c
index 6c2cf81716df..e7c100ba63a1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_object.c
+++ b/drivers/gpu/drm/nouveau/nouveau_object.c
@@ -885,11 +885,12 @@ int
 nouveau_gpuobj_sw_new(struct nouveau_channel *chan, int class,
                      struct nouveau_gpuobj **gpuobj_ret)
 {
-        struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+        struct drm_nouveau_private *dev_priv;
        struct nouveau_gpuobj *gpuobj;
        if (!chan || !gpuobj_ret || *gpuobj_ret != NULL)
                return -EINVAL;
+        dev_priv = chan->dev->dev_private;
        gpuobj = kzalloc(sizeof(*gpuobj), GFP_KERNEL);
        if (!gpuobj)
diff --git a/drivers/gpu/drm/nouveau/nouveau_reg.h b/drivers/gpu/drm/nouveau/nouveau_reg.h
index 251f1b3b38b9..aa9b310e41be 100644
--- a/drivers/gpu/drm/nouveau/nouveau_reg.h
+++ b/drivers/gpu/drm/nouveau/nouveau_reg.h
@@ -99,6 +99,7 @@
 * the card will hang early on in the X init process.
 */
 #    define NV_PMC_ENABLE_UNK13                               (1<<13)
+#define NV40_PMC_GRAPH_UNITS                               0x00001540
 #define NV40_PMC_BACKLIGHT                                 0x000015f0
 #       define NV40_PMC_BACKLIGHT_MASK                     0x001f0000
 #define NV40_PMC_1700                                      0x00001700
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index 4c7f1e403e80..ed1590577b6c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -54,11 +54,12 @@ static void
 nouveau_sgdma_clear(struct ttm_backend *be)
 {
        struct nouveau_sgdma_be *nvbe = (struct nouveau_sgdma_be *)be;
-        struct drm_device *dev = nvbe->dev;
+        struct drm_device *dev;
-        NV_DEBUG(nvbe->dev, "\n");
        if (nvbe && nvbe->pages) {
+                dev = nvbe->dev;
+                NV_DEBUG(dev, "\n");
                if (nvbe->bound)
                        be->func->unbind(be);
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index f2d0187ba152..a4851af5b05e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -310,6 +310,14 @@ static int nouveau_init_engine_ptrs(struct drm_device *dev)
 static unsigned int
 nouveau_vga_set_decode(void *priv, bool state)
 {
+        struct drm_device *dev = priv;
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        if (dev_priv->chipset >= 0x40)
+                nv_wr32(dev, 0x88054, state);
+        else
+                nv_wr32(dev, 0x1854, state);
        if (state)
                return VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM |
                       VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;
@@ -427,15 +435,19 @@ nouveau_card_init(struct drm_device *dev)
        if (ret)
                goto out_timer;
-        /* PGRAPH */
+        if (nouveau_noaccel)
-        ret = engine->graph.init(dev);
+                engine->graph.accel_blocked = true;
-        if (ret)
+        else {
-                goto out_fb;
+                /* PGRAPH */
+                ret = engine->graph.init(dev);
+                if (ret)
+                        goto out_fb;
-        /* PFIFO */
+                /* PFIFO */
-        ret = engine->fifo.init(dev);
+                ret = engine->fifo.init(dev);
-        if (ret)
+                if (ret)
-                goto out_graph;
+                        goto out_graph;
+        }
        /* this call irq_preinstall, register irq handler and
         * call irq_postinstall
@@ -479,9 +491,11 @@ nouveau_card_init(struct drm_device *dev)
 out_irq:
        drm_irq_uninstall(dev);
 out_fifo:
-        engine->fifo.takedown(dev);
+        if (!nouveau_noaccel)
+                engine->fifo.takedown(dev);
 out_graph:
-        engine->graph.takedown(dev);
+        if (!nouveau_noaccel)
+                engine->graph.takedown(dev);
 out_fb:
        engine->fb.takedown(dev);
 out_timer:
@@ -518,8 +532,10 @@ static void nouveau_card_takedown(struct drm_device *dev)
                        dev_priv->channel = NULL;
                }
-                engine->fifo.takedown(dev);
+                if (!nouveau_noaccel) {
-                engine->graph.takedown(dev);
+                        engine->fifo.takedown(dev);
+                        engine->graph.takedown(dev);
+                }
                engine->fb.takedown(dev);
                engine->timer.takedown(dev);
                engine->mc.takedown(dev);
@@ -817,6 +833,15 @@ int nouveau_ioctl_getparam(struct drm_device *dev, void *data,
        case NOUVEAU_GETPARAM_VM_VRAM_BASE:
                getparam->value = dev_priv->vm_vram_base;
                break;
+        case NOUVEAU_GETPARAM_GRAPH_UNITS:
+                /* NV40 and NV50 versions are quite different, but register
+                 * address is the same. User is supposed to know the card
+                 * family anyway... */
+                if (dev_priv->chipset >= 0x40) {
+                        getparam->value = nv_rd32(dev, NV40_PMC_GRAPH_UNITS);
+                        break;
+                }
+                /* FALLTHRU */
        default:
                NV_ERROR(dev, "unknown parameter %lld\n", getparam->param);
                return -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
index d910873c1368..fd01caabd5c3 100644
--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
@@ -27,7 +27,7 @@
 #include "nouveau_dma.h"
 #include "nouveau_fbcon.h"
-static void
+void
 nv04_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
 {
        struct nouveau_fbcon_par *par = info->par;
@@ -54,7 +54,7 @@ nv04_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
        FIRE_RING(chan);
 }
-static void
+void
 nv04_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
 {
        struct nouveau_fbcon_par *par = info->par;
@@ -88,7 +88,7 @@ nv04_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
        FIRE_RING(chan);
 }
-static void
+void
 nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
 {
        struct nouveau_fbcon_par *par = info->par;
@@ -307,9 +307,6 @@ nv04_fbcon_accel_init(struct fb_info *info)
        FIRE_RING(chan);
-        info->fbops->fb_fillrect = nv04_fbcon_fillrect;
-        info->fbops->fb_copyarea = nv04_fbcon_copyarea;
-        info->fbops->fb_imageblit = nv04_fbcon_imageblit;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
index 40b7360841f8..d1a651e3400c 100644
--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -298,14 +298,17 @@ nv50_crtc_set_clock(struct drm_device *dev, int head, int pclk)
 static void
 nv50_crtc_destroy(struct drm_crtc *crtc)
 {
-        struct drm_device *dev = crtc->dev;
+        struct drm_device *dev;
-        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+        struct nouveau_crtc *nv_crtc;
-        NV_DEBUG_KMS(dev, "\n");
        if (!crtc)
                return;
+        dev = crtc->dev;
+        nv_crtc = nouveau_crtc(crtc);
+        NV_DEBUG_KMS(dev, "\n");
        drm_crtc_cleanup(&nv_crtc->base);
        nv50_cursor_fini(nv_crtc);
diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
index e4f279ee61cf..0f57cdf7ccb2 100644
--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
@@ -3,7 +3,7 @@
 #include "nouveau_dma.h"
 #include "nouveau_fbcon.h"
-static void
+void
 nv50_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
 {
        struct nouveau_fbcon_par *par = info->par;
@@ -46,7 +46,7 @@ nv50_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
        FIRE_RING(chan);
 }
-static void
+void
 nv50_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
 {
        struct nouveau_fbcon_par *par = info->par;
@@ -81,7 +81,7 @@ nv50_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
        FIRE_RING(chan);
 }
-static void
+void
 nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
 {
        struct nouveau_fbcon_par *par = info->par;
@@ -262,9 +262,6 @@ nv50_fbcon_accel_init(struct fb_info *info)
        OUT_RING(chan, info->fix.smem_start - dev_priv->fb_phys +
                         dev_priv->vm_vram_base);
-        info->fbops->fb_fillrect = nv50_fbcon_fillrect;
-        info->fbops->fb_copyarea = nv50_fbcon_copyarea;
-        info->fbops->fb_imageblit = nv50_fbcon_imageblit;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_fifo.c b/drivers/gpu/drm/nouveau/nv50_fifo.c
index 32b244bcb482..204a79ff10f4 100644
--- a/drivers/gpu/drm/nouveau/nv50_fifo.c
+++ b/drivers/gpu/drm/nouveau/nv50_fifo.c
@@ -317,17 +317,20 @@ void
 nv50_fifo_destroy_context(struct nouveau_channel *chan)
 {
        struct drm_device *dev = chan->dev;
+        struct nouveau_gpuobj_ref *ramfc = chan->ramfc;
        NV_DEBUG(dev, "ch%d\n", chan->id);
-        nouveau_gpuobj_ref_del(dev, &chan->ramfc);
+        /* This will ensure the channel is seen as disabled. */
-        nouveau_gpuobj_ref_del(dev, &chan->cache);
+        chan->ramfc = NULL;
        nv50_fifo_channel_disable(dev, chan->id, false);
        /* Dummy channel, also used on ch 127 */
        if (chan->id == 0)
                nv50_fifo_channel_disable(dev, 127, false);
+        nouveau_gpuobj_ref_del(dev, &ramfc);
+        nouveau_gpuobj_ref_del(dev, &chan->cache);
 }
 int
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 20319e59d368..6d504801b514 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -165,6 +165,12 @@ nv50_graph_channel(struct drm_device *dev)
        uint32_t inst;
        int i;
+        /* Be sure we're not in the middle of a context switch or bad things
+         * will happen, such as unloading the wrong pgraph context.
+         */
+        if (!nv_wait(0x400300, 0x00000001, 0x00000000))
+                NV_ERROR(dev, "Ctxprog is still running\n");
        inst = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
        if (!(inst & NV50_PGRAPH_CTXCTL_CUR_LOADED))
                return NULL;
@@ -275,7 +281,7 @@ nv50_graph_load_context(struct nouveau_channel *chan)
 int
 nv50_graph_unload_context(struct drm_device *dev)
 {
-        uint32_t inst, fifo = nv_rd32(dev, 0x400500);
+        uint32_t inst;
        inst  = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
        if (!(inst & NV50_PGRAPH_CTXCTL_CUR_LOADED))
@@ -283,12 +289,10 @@ nv50_graph_unload_context(struct drm_device *dev)
        inst &= NV50_PGRAPH_CTXCTL_CUR_INSTANCE;
        nouveau_wait_for_idle(dev);
-        nv_wr32(dev, 0x400500, fifo & ~1);
        nv_wr32(dev, 0x400784, inst);
        nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) | 0x20);
        nv_wr32(dev, 0x400304, nv_rd32(dev, 0x400304) | 0x01);
        nouveau_wait_for_idle(dev);
-        nv_wr32(dev, 0x400500, fifo);
        nv_wr32(dev, NV50_PGRAPH_CTXCTL_CUR, inst);
        return 0;
diff --git a/drivers/gpu/drm/nouveau/nv50_sor.c b/drivers/gpu/drm/nouveau/nv50_sor.c
index ecf1936b8224..c2fff543b06f 100644
--- a/drivers/gpu/drm/nouveau/nv50_sor.c
+++ b/drivers/gpu/drm/nouveau/nv50_sor.c
@@ -101,6 +101,7 @@ nv50_sor_dpms(struct drm_encoder *encoder, int mode)
                struct nouveau_encoder *nvenc = nouveau_encoder(enc);
                if (nvenc == nv_encoder ||
+                    nvenc->disconnect != nv50_sor_disconnect ||
                    nvenc->dcb->or != nv_encoder->dcb->or)
                        continue;
diff --git a/drivers/gpu/drm/radeon/Kconfig b/drivers/gpu/drm/radeon/Kconfig
index 5982321be4d5..1c02d23f6fcc 100644
--- a/drivers/gpu/drm/radeon/Kconfig
+++ b/drivers/gpu/drm/radeon/Kconfig
@@ -1,10 +1,14 @@
 config DRM_RADEON_KMS
-        bool "Enable modesetting on radeon by default"
+        bool "Enable modesetting on radeon by default - NEW DRIVER"
        depends on DRM_RADEON
        help
-          Choose this option if you want kernel modesetting enabled by default,
+          Choose this option if you want kernel modesetting enabled by default.
-          and you have a new enough userspace to support this. Running old
-          userspaces with this enabled will cause pain.
+          This is a completely new driver. It's only part of the existing drm
+          for compatibility reasons. It requires an entirely different graphics
+          stack above it and works very differently from the old drm stack.
+          i.e. don't enable this unless you know what you are doing it may
+          cause issues or bugs compared to the previous userspace driver stack.
          When kernel modesetting is enabled the IOCTL of radeon/drm
          driver are considered as invalid and an error message is printed
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 71060114d5de..b32eeea5bb8b 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -332,11 +332,13 @@ bool radeon_process_aux_ch(struct radeon_i2c_chan *chan, u8 *req_bytes,
        PROCESS_AUX_CHANNEL_TRANSACTION_PS_ALLOCATION args;
        int index = GetIndexIntoMasterTable(COMMAND, ProcessAuxChannelTransaction);
        unsigned char *base;
+        int retry_count = 0;
        memset(&args, 0, sizeof(args));
        base = (unsigned char *)rdev->mode_info.atom_context->scratch;
+retry:
        memcpy(base, req_bytes, num_bytes);
        args.lpAuxRequest = 0;
@@ -347,10 +349,12 @@ bool radeon_process_aux_ch(struct radeon_i2c_chan *chan, u8 *req_bytes,
        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
-        if (args.ucReplyStatus) {
+        if (args.ucReplyStatus && !args.ucDataOutLen) {
-                DRM_DEBUG("failed to get auxch %02x%02x %02x %02x 0x%02x %02x\n",
+                if (args.ucReplyStatus == 0x20 && retry_count < 10)
+                        goto retry;
+                DRM_DEBUG("failed to get auxch %02x%02x %02x %02x 0x%02x %02x after %d retries\n",
                          req_bytes[1], req_bytes[0], req_bytes[2], req_bytes[3],
-                          chan->rec.i2c_id, args.ucReplyStatus);
+                          chan->rec.i2c_id, args.ucReplyStatus, retry_count);
                return false;
        }
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 11c9a3fe6810..c0d4650cdb79 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -354,11 +354,17 @@ u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc)
                return RREG32(RADEON_CRTC2_CRNT_FRAME);
 }
+/* Who ever call radeon_fence_emit should call ring_lock and ask
+ * for enough space (today caller are ib schedule and buffer move) */
 void r100_fence_ring_emit(struct radeon_device *rdev,
                          struct radeon_fence *fence)
 {
-        /* Who ever call radeon_fence_emit should call ring_lock and ask
+        /* We have to make sure that caches are flushed before
-         * for enough space (today caller are ib schedule and buffer move) */
+         * CPU might read something from VRAM. */
+        radeon_ring_write(rdev, PACKET0(RADEON_RB3D_DSTCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RADEON_RB3D_DC_FLUSH_ALL);
+        radeon_ring_write(rdev, PACKET0(RADEON_RB3D_ZCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RADEON_RB3D_ZC_FLUSH_ALL);
        /* Wait until IDLE & CLEAN */
        radeon_ring_write(rdev, PACKET0(0x1720, 0));
        radeon_ring_write(rdev, (1 << 16) | (1 << 17));
@@ -3369,7 +3375,6 @@ int r100_suspend(struct radeon_device *rdev)
 void r100_fini(struct radeon_device *rdev)
 {
-        r100_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -3481,13 +3486,12 @@ int r100_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r100_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                if (rdev->flags & RADEON_IS_PCI)
                        r100_pci_gart_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 0051d11b907c..43b55a030b4d 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -506,11 +506,14 @@ void r300_vram_info(struct radeon_device *rdev)
        /* DDR for all card after R300 & IGP */
        rdev->mc.vram_is_ddr = true;
        tmp = RREG32(RADEON_MEM_CNTL);
-        if (tmp & R300_MEM_NUM_CHANNELS_MASK) {
+        tmp &= R300_MEM_NUM_CHANNELS_MASK;
-                rdev->mc.vram_width = 128;
+        switch (tmp) {
-        } else {
+        case 0: rdev->mc.vram_width = 64; break;
-                rdev->mc.vram_width = 64;
+        case 1: rdev->mc.vram_width = 128; break;
+        case 2: rdev->mc.vram_width = 256; break;
+        default:  rdev->mc.vram_width = 128; break;
        }
        r100_vram_init_sizes(rdev);
@@ -1327,7 +1330,6 @@ int r300_suspend(struct radeon_device *rdev)
 void r300_fini(struct radeon_device *rdev)
 {
-        r300_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -1418,15 +1420,15 @@ int r300_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r300_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                if (rdev->flags & RADEON_IS_PCIE)
                        rv370_pcie_gart_fini(rdev);
                if (rdev->flags & RADEON_IS_PCI)
                        r100_pci_gart_fini(rdev);
-                radeon_irq_kms_fini(rdev);
+                radeon_agp_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 4526faaacca8..d9373246c97f 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -389,16 +389,15 @@ int r420_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r420_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                if (rdev->flags & RADEON_IS_PCIE)
                        rv370_pcie_gart_fini(rdev);
                if (rdev->flags & RADEON_IS_PCI)
                        r100_pci_gart_fini(rdev);
                radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 9a189072f2b9..ddf5731eba0d 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -294,13 +294,12 @@ int r520_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rv515_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                rv370_pcie_gart_fini(rdev);
                radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 1b6d0001b20e..2ffcf5a03551 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1654,6 +1654,12 @@ void r600_ring_init(struct radeon_device *rdev, unsigned ring_size)
        rdev->cp.align_mask = 16 - 1;
 }
+void r600_cp_fini(struct radeon_device *rdev)
+{
+        r600_cp_stop(rdev);
+        radeon_ring_fini(rdev);
+}
 /*
 * GPU scratch registers helpers function.
@@ -1861,6 +1867,12 @@ int r600_startup(struct radeon_device *rdev)
                        return r;
        }
        r600_gpu_init(rdev);
+        r = r600_blit_init(rdev);
+        if (r) {
+                r600_blit_fini(rdev);
+                rdev->asic->copy = NULL;
+                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+        }
        /* pin copy shader into vram */
        if (rdev->r600_blit.shader_obj) {
                r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
@@ -1938,6 +1950,13 @@ int r600_resume(struct radeon_device *rdev)
                DRM_ERROR("radeon: failled testing IB (%d).\n", r);
                return r;
        }
+        r = r600_audio_init(rdev);
+        if (r) {
+                DRM_ERROR("radeon: audio resume failed\n");
+                return r;
+        }
        return r;
 }
@@ -1945,6 +1964,7 @@ int r600_suspend(struct radeon_device *rdev)
 {
        int r;
+        r600_audio_fini(rdev);
        /* FIXME: we should wait for ring to be empty */
        r600_cp_stop(rdev);
        rdev->cp.ready = false;
@@ -2045,19 +2065,15 @@ int r600_init(struct radeon_device *rdev)
        r = r600_pcie_gart_init(rdev);
        if (r)
                return r;
-        r = r600_blit_init(rdev);
-        if (r) {
-                r600_blit_fini(rdev);
-                rdev->asic->copy = NULL;
-                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
-        }
        rdev->accel_working = true;
        r = r600_startup(rdev);
        if (r) {
-                r600_suspend(rdev);
+                dev_err(rdev->dev, "disabling GPU acceleration\n");
+                r600_cp_fini(rdev);
                r600_wb_fini(rdev);
-                radeon_ring_fini(rdev);
+                r600_irq_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                r600_pcie_gart_fini(rdev);
                rdev->accel_working = false;
        }
@@ -2083,20 +2099,17 @@ int r600_init(struct radeon_device *rdev)
 void r600_fini(struct radeon_device *rdev)
 {
-        /* Suspend operations */
-        r600_suspend(rdev);
        r600_audio_fini(rdev);
        r600_blit_fini(rdev);
+        r600_cp_fini(rdev);
+        r600_wb_fini(rdev);
        r600_irq_fini(rdev);
        radeon_irq_kms_fini(rdev);
-        radeon_ring_fini(rdev);
-        r600_wb_fini(rdev);
        r600_pcie_gart_fini(rdev);
+        radeon_agp_fini(rdev);
        radeon_gem_fini(rdev);
        radeon_fence_driver_fini(rdev);
        radeon_clocks_fini(rdev);
-        radeon_agp_fini(rdev);
        radeon_bo_fini(rdev);
        radeon_atombios_fini(rdev);
        kfree(rdev->bios);
@@ -2900,3 +2913,18 @@ int r600_debugfs_mc_info_init(struct radeon_device *rdev)
        return 0;
 #endif
 }
+/**
+ * r600_ioctl_wait_idle - flush host path cache on wait idle ioctl
+ * rdev: radeon device structure
+ * bo: buffer object struct which userspace is waiting for idle
+ *
+ * Some R6XX/R7XX doesn't seems to take into account HDP flush performed
+ * through ring buffer, this leads to corruption in rendering, see
+ * http://bugzilla.kernel.org/show_bug.cgi?id=15186 to avoid this we
+ * directly perform HDP flush by writing register through MMIO.
+ */
+void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
+{
+        WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
+}
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index 99e2c3891a7d..0dcb6904c4ff 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -35,7 +35,7 @@
 */
 static int r600_audio_chipset_supported(struct radeon_device *rdev)
 {
-        return rdev->family >= CHIP_R600
+        return (rdev->family >= CHIP_R600 && rdev->family < CHIP_RV710)
                || rdev->family == CHIP_RS600
                || rdev->family == CHIP_RS690
                || rdev->family == CHIP_RS740;
@@ -261,7 +261,6 @@ void r600_audio_fini(struct radeon_device *rdev)
        if (!r600_audio_chipset_supported(rdev))
                return;
-        WREG32_P(R600_AUDIO_ENABLE, 0x0, ~0x81000000);
        del_timer(&rdev->audio_timer);
+        WREG32_P(R600_AUDIO_ENABLE, 0x0, ~0x81000000);
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 2d5f2bfa7201..f57480ba1355 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -661,6 +661,13 @@ struct radeon_asic {
        void (*hpd_fini)(struct radeon_device *rdev);
        bool (*hpd_sense)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
        void (*hpd_set_polarity)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
+        /* ioctl hw specific callback. Some hw might want to perform special
+         * operation on specific ioctl. For instance on wait idle some hw
+         * might want to perform and HDP flush through MMIO as it seems that
+         * some R6XX/R7XX hw doesn't take HDP flush into account if programmed
+         * through ring.
+         */
+        void (*ioctl_wait_idle)(struct radeon_device *rdev, struct radeon_bo *bo);
 };
 /*
@@ -1143,6 +1150,7 @@ extern bool r600_card_posted(struct radeon_device *rdev);
 extern void r600_cp_stop(struct radeon_device *rdev);
 extern void r600_ring_init(struct radeon_device *rdev, unsigned ring_size);
 extern int r600_cp_resume(struct radeon_device *rdev);
+extern void r600_cp_fini(struct radeon_device *rdev);
 extern int r600_count_pipe_bits(uint32_t val);
 extern int r600_gart_clear_page(struct radeon_device *rdev, int i);
 extern int r600_mc_wait_for_idle(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index f2fbd2e4e9df..05ee1aeac3fd 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -117,6 +117,7 @@ static struct radeon_asic r100_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -176,6 +177,7 @@ static struct radeon_asic r300_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 /*
@@ -219,6 +221,7 @@ static struct radeon_asic r420_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -267,6 +270,7 @@ static struct radeon_asic rs400_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -323,6 +327,7 @@ static struct radeon_asic rs600_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -370,6 +375,7 @@ static struct radeon_asic rs690_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -421,6 +427,7 @@ static struct radeon_asic rv515_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -463,6 +470,7 @@ static struct radeon_asic r520_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 /*
@@ -504,6 +512,7 @@ void r600_hpd_fini(struct radeon_device *rdev);
 bool r600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
 void r600_hpd_set_polarity(struct radeon_device *rdev,
                           enum radeon_hpd_id hpd);
+extern void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo);
 static struct radeon_asic r600_asic = {
        .init = &r600_init,
@@ -538,6 +547,7 @@ static struct radeon_asic r600_asic = {
        .hpd_fini = &r600_hpd_fini,
        .hpd_sense = &r600_hpd_sense,
        .hpd_set_polarity = &r600_hpd_set_polarity,
+        .ioctl_wait_idle = r600_ioctl_wait_idle,
 };
 /*
@@ -582,6 +592,7 @@ static struct radeon_asic rv770_asic = {
        .hpd_fini = &r600_hpd_fini,
        .hpd_sense = &r600_hpd_sense,
        .hpd_set_polarity = &r600_hpd_set_polarity,
+        .ioctl_wait_idle = r600_ioctl_wait_idle,
 };
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index fa82ca74324e..2dcda6115874 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -287,6 +287,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                        *connector_type = DRM_MODE_CONNECTOR_DVID;
        }
+        /* XFX Pine Group device rv730 reports no VGA DDC lines
+         * even though they are wired up to record 0x93
+         */
+        if ((dev->pdev->device == 0x9498) &&
+            (dev->pdev->subsystem_vendor == 0x1682) &&
+            (dev->pdev->subsystem_device == 0x2452)) {
+                struct radeon_device *rdev = dev->dev_private;
+                *i2c_bus = radeon_lookup_i2c_gpio(rdev, 0x93);
+        }
        return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
index 4ddfd4b5bc51..7932dc4d6b90 100644
--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
@@ -65,31 +65,42 @@ void radeon_benchmark_move(struct radeon_device *rdev, unsigned bsize,
        if (r) {
                goto out_cleanup;
        }
-        start_jiffies = jiffies;
-        for (i = 0; i < n; i++) {
+        /* r100 doesn't have dma engine so skip the test */
-                r = radeon_fence_create(rdev, &fence);
+        if (rdev->asic->copy_dma) {
-                if (r) {
-                        goto out_cleanup;
+                start_jiffies = jiffies;
+                for (i = 0; i < n; i++) {
+                        r = radeon_fence_create(rdev, &fence);
+                        if (r) {
+                                goto out_cleanup;
+                        }
+                        r = radeon_copy_dma(rdev, saddr, daddr,
+                                        size / RADEON_GPU_PAGE_SIZE, fence);
+                        if (r) {
+                                goto out_cleanup;
+                        }
+                        r = radeon_fence_wait(fence, false);
+                        if (r) {
+                                goto out_cleanup;
+                        }
+                        radeon_fence_unref(&fence);
                }
-                r = radeon_copy_dma(rdev, saddr, daddr, size / RADEON_GPU_PAGE_SIZE, fence);
+                end_jiffies = jiffies;
-                if (r) {
+                time = end_jiffies - start_jiffies;
-                        goto out_cleanup;
+                time = jiffies_to_msecs(time);
+                if (time > 0) {
+                        i = ((n * size) >> 10) / time;
+                        printk(KERN_INFO "radeon: dma %u bo moves of %ukb from"
+                                        " %d to %d in %lums (%ukb/ms %ukb/s %uM/s)\n",
+                                        n, size >> 10,
+                                        sdomain, ddomain, time,
+                                        i, i * 1000, (i * 1000) / 1024);
                }
-                r = radeon_fence_wait(fence, false);
-                if (r) {
-                        goto out_cleanup;
-                }
-                radeon_fence_unref(&fence);
-        }
-        end_jiffies = jiffies;
-        time = end_jiffies - start_jiffies;
-        time = jiffies_to_msecs(time);
-        if (time > 0) {
-                i = ((n * size) >> 10) / time;
-                printk(KERN_INFO "radeon: dma %u bo moves of %ukb from %d to %d"
-                       " in %lums (%ukb/ms %ukb/s %uM/s)\n", n, size >> 10,
-                       sdomain, ddomain, time, i, i * 1000, (i * 1000) / 1024);
        }
        start_jiffies = jiffies;
        for (i = 0; i < n; i++) {
                r = radeon_fence_create(rdev, &fence);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 579c8920e081..e7b19440102e 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -971,8 +971,7 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder
                         lvds->native_mode.vdisplay);
                lvds->panel_vcc_delay = RBIOS16(lcd_info + 0x2c);
-                if (lvds->panel_vcc_delay > 2000 || lvds->panel_vcc_delay < 0)
+                lvds->panel_vcc_delay = min_t(u16, lvds->panel_vcc_delay, 2000);
-                        lvds->panel_vcc_delay = 2000;
                lvds->panel_pwr_delay = RBIOS8(lcd_info + 0x24);
                lvds->panel_digon_delay = RBIOS16(lcd_info + 0x38) & 0xf;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 55266416fa47..238188540017 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -580,16 +580,18 @@ static enum drm_connector_status radeon_vga_detect(struct drm_connector *connect
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
        struct drm_encoder *encoder;
        struct drm_encoder_helper_funcs *encoder_funcs;
-        bool dret;
+        bool dret = false;
        enum drm_connector_status ret = connector_status_disconnected;
        encoder = radeon_best_single_encoder(connector);
        if (!encoder)
                ret = connector_status_disconnected;
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
+        if (radeon_connector->ddc_bus) {
-        dret = radeon_ddc_probe(radeon_connector);
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+                dret = radeon_ddc_probe(radeon_connector);
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+        }
        if (dret) {
                if (radeon_connector->edid) {
                        kfree(radeon_connector->edid);
@@ -740,11 +742,13 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
        struct drm_mode_object *obj;
        int i;
        enum drm_connector_status ret = connector_status_disconnected;
-        bool dret;
+        bool dret = false;
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
+        if (radeon_connector->ddc_bus) {
-        dret = radeon_ddc_probe(radeon_connector);
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+                dret = radeon_ddc_probe(radeon_connector);
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+        }
        if (dret) {
                if (radeon_connector->edid) {
                        kfree(radeon_connector->edid);
@@ -1343,7 +1347,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                radeon_connector->dac_load_detect = false;
                        drm_connector_attach_property(&radeon_connector->base,
                                                      rdev->mode_info.load_detect_property,
-                                                      1);
+                                                      radeon_connector->dac_load_detect);
                        drm_connector_attach_property(&radeon_connector->base,
                                                      rdev->mode_info.tv_std_property,
                                                      radeon_combios_get_tv_info(rdev));
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 6a92f994cc26..7e17a362b54b 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -278,7 +278,7 @@ static void radeon_print_display_setup(struct drm_device *dev)
                DRM_INFO("  %s\n", connector_names[connector->connector_type]);
                if (radeon_connector->hpd.hpd != RADEON_HPD_NONE)
                        DRM_INFO("  %s\n", hpd_names[radeon_connector->hpd.hpd]);
-                if (radeon_connector->ddc_bus)
+                if (radeon_connector->ddc_bus) {
                        DRM_INFO("  DDC: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
                                 radeon_connector->ddc_bus->rec.mask_clk_reg,
                                 radeon_connector->ddc_bus->rec.mask_data_reg,
@@ -288,6 +288,15 @@ static void radeon_print_display_setup(struct drm_device *dev)
                                 radeon_connector->ddc_bus->rec.en_data_reg,
                                 radeon_connector->ddc_bus->rec.y_clk_reg,
                                 radeon_connector->ddc_bus->rec.y_data_reg);
+                } else {
+                        if (connector->connector_type == DRM_MODE_CONNECTOR_VGA ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_DVII ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_DVID ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_DVIA ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_HDMIA ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_HDMIB)
+                                DRM_INFO("  DDC: no ddc bus - possible BIOS bug - please report to xorg-driver-ati@lists.x.org\n");
+                }
                DRM_INFO("  Encoders:\n");
                list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
                        radeon_encoder = to_radeon_encoder(encoder);
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 3ba213d1b06c..d71e346e9ab5 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -248,7 +248,7 @@ int radeonfb_create(struct drm_device *dev,
        if (ret)
                goto out_unref;
-        memset_io(fbptr, 0xff, aligned_size);
+        memset_io(fbptr, 0x0, aligned_size);
        strcpy(info->fix.id, "radeondrmfb");
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 0e1325e18534..db8e9a355a01 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -308,6 +308,9 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
        }
        robj = gobj->driver_private;
        r = radeon_bo_wait(robj, NULL, false);
+        /* callback hw specific functions if any */
+        if (robj->rdev->asic->ioctl_wait_idle)
+                robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
        mutex_lock(&dev->struct_mutex);
        drm_gem_object_unreference(gobj);
        mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index 9f5418983e2a..287fcebfb4e6 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -223,15 +223,31 @@ int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
        return 0;
 }
+int rs400_mc_wait_for_idle(struct radeon_device *rdev)
+{
+        unsigned i;
+        uint32_t tmp;
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                /* read MC_STATUS */
+                tmp = RREG32(0x0150);
+                if (tmp & (1 << 2)) {
+                        return 0;
+                }
+                DRM_UDELAY(1);
+        }
+        return -1;
+}
 void rs400_gpu_init(struct radeon_device *rdev)
 {
        /* FIXME: HDP same place on rs400 ? */
        r100_hdp_reset(rdev);
        /* FIXME: is this correct ? */
        r420_pipes_init(rdev);
-        if (r300_mc_wait_for_idle(rdev)) {
+        if (rs400_mc_wait_for_idle(rdev)) {
-                printk(KERN_WARNING "Failed to wait MC idle while "
+                printk(KERN_WARNING "rs400: Failed to wait MC idle while "
-                       "programming pipes. Bad things might happen.\n");
+                       "programming pipes. Bad things might happen. %08x\n", RREG32(0x150));
        }
 }
@@ -370,8 +386,8 @@ void rs400_mc_program(struct radeon_device *rdev)
        r100_mc_stop(rdev, &save);
        /* Wait for mc idle */
-        if (r300_mc_wait_for_idle(rdev))
+        if (rs400_mc_wait_for_idle(rdev))
-                dev_warn(rdev->dev, "Wait MC idle timeout before updating MC.\n");
+                dev_warn(rdev->dev, "rs400: Wait MC idle timeout before updating MC.\n");
        WREG32(R_000148_MC_FB_LOCATION,
                S_000148_MC_FB_START(rdev->mc.vram_start >> 16) |
                S_000148_MC_FB_TOP(rdev->mc.vram_end >> 16));
@@ -448,7 +464,6 @@ int rs400_suspend(struct radeon_device *rdev)
 void rs400_fini(struct radeon_device *rdev)
 {
-        rs400_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -527,7 +542,6 @@ int rs400_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs400_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index d5255751e7b3..c3818562a13e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -610,7 +610,6 @@ int rs600_suspend(struct radeon_device *rdev)
 void rs600_fini(struct radeon_device *rdev)
 {
-        rs600_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -689,7 +688,6 @@ int rs600_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs600_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index cd31da913771..06e2771aee5a 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -676,7 +676,6 @@ int rs690_suspend(struct radeon_device *rdev)
 void rs690_fini(struct radeon_device *rdev)
 {
-        rs690_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -756,7 +755,6 @@ int rs690_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs690_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 62756717b044..0e1e6b8632b8 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -537,7 +537,6 @@ void rv515_set_safe_registers(struct radeon_device *rdev)
 void rv515_fini(struct radeon_device *rdev)
 {
-        rv515_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -615,13 +614,12 @@ int rv515_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rv515_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                rv370_pcie_gart_fini(rdev);
                radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index afd9e8213c29..5943d561fd1e 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -887,6 +887,12 @@ static int rv770_startup(struct radeon_device *rdev)
                        return r;
        }
        rv770_gpu_init(rdev);
+        r = r600_blit_init(rdev);
+        if (r) {
+                r600_blit_fini(rdev);
+                rdev->asic->copy = NULL;
+                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+        }
        /* pin copy shader into vram */
        if (rdev->r600_blit.shader_obj) {
                r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
@@ -1055,19 +1061,15 @@ int rv770_init(struct radeon_device *rdev)
        r = r600_pcie_gart_init(rdev);
        if (r)
                return r;
-        r = r600_blit_init(rdev);
-        if (r) {
-                r600_blit_fini(rdev);
-                rdev->asic->copy = NULL;
-                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
-        }
        rdev->accel_working = true;
        r = rv770_startup(rdev);
        if (r) {
-                rv770_suspend(rdev);
+                dev_err(rdev->dev, "disabling GPU acceleration\n");
+                r600_cp_fini(rdev);
                r600_wb_fini(rdev);
-                radeon_ring_fini(rdev);
+                r600_irq_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                rv770_pcie_gart_fini(rdev);
                rdev->accel_working = false;
        }
@@ -1089,13 +1091,11 @@ int rv770_init(struct radeon_device *rdev)
 void rv770_fini(struct radeon_device *rdev)
 {
-        rv770_suspend(rdev);
        r600_blit_fini(rdev);
+        r600_cp_fini(rdev);
+        r600_wb_fini(rdev);
        r600_irq_fini(rdev);
        radeon_irq_kms_fini(rdev);
-        radeon_ring_fini(rdev);
-        r600_wb_fini(rdev);
        rv770_pcie_gart_fini(rdev);
        radeon_gem_fini(rdev);
        radeon_fence_driver_fini(rdev);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 135be9688c90..356dc935ec13 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -39,10 +39,10 @@
 #include "ttm/ttm_execbuf_util.h"
 #include "ttm/ttm_module.h"
-#define VMWGFX_DRIVER_DATE "20090724"
+#define VMWGFX_DRIVER_DATE "20100209"
-#define VMWGFX_DRIVER_MAJOR 0
+#define VMWGFX_DRIVER_MAJOR 1
-#define VMWGFX_DRIVER_MINOR 1
+#define VMWGFX_DRIVER_MINOR 0
-#define VMWGFX_DRIVER_PATCHLEVEL 2
+#define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
 #define VMWGFX_MAX_RELOCATIONS 2048
@@ -113,6 +113,7 @@ struct vmw_fifo_state {
        unsigned long static_buffer_size;
        bool using_bounce_buffer;
        uint32_t capabilities;
+        struct mutex fifo_mutex;
        struct rw_semaphore rwsem;
 };
@@ -213,7 +214,7 @@ struct vmw_private {
         * Fencing and IRQs.
         */
-        uint32_t fence_seq;
+        atomic_t fence_seq;
        wait_queue_head_t fence_queue;
        wait_queue_head_t fifo_queue;
        atomic_t fence_queue_waiters;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index 4157547cc6e4..39d43a01d846 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -74,6 +74,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
        fifo->reserved_size = 0;
        fifo->using_bounce_buffer = false;
+        mutex_init(&fifo->fifo_mutex);
        init_rwsem(&fifo->rwsem);
        /*
@@ -117,7 +118,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
                 (unsigned int) min,
                 (unsigned int) fifo->capabilities);
-        dev_priv->fence_seq = dev_priv->last_read_sequence;
+        atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
        iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
        return vmw_fifo_send_fence(dev_priv, &dummy);
@@ -283,7 +284,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
        uint32_t reserveable = fifo_state->capabilities & SVGA_FIFO_CAP_RESERVE;
        int ret;
-        down_write(&fifo_state->rwsem);
+        mutex_lock(&fifo_state->fifo_mutex);
        max = ioread32(fifo_mem + SVGA_FIFO_MAX);
        min = ioread32(fifo_mem + SVGA_FIFO_MIN);
        next_cmd = ioread32(fifo_mem + SVGA_FIFO_NEXT_CMD);
@@ -351,7 +352,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
        }
 out_err:
        fifo_state->reserved_size = 0;
-        up_write(&fifo_state->rwsem);
+        mutex_unlock(&fifo_state->fifo_mutex);
        return NULL;
 }
@@ -426,6 +427,7 @@ void vmw_fifo_commit(struct vmw_private *dev_priv, uint32_t bytes)
        }
+        down_write(&fifo_state->rwsem);
        if (fifo_state->using_bounce_buffer || reserveable) {
                next_cmd += bytes;
                if (next_cmd >= max)
@@ -437,8 +439,9 @@ void vmw_fifo_commit(struct vmw_private *dev_priv, uint32_t bytes)
        if (reserveable)
                iowrite32(0, fifo_mem + SVGA_FIFO_RESERVED);
        mb();
-        vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
        up_write(&fifo_state->rwsem);
+        vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
+        mutex_unlock(&fifo_state->fifo_mutex);
 }
 int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
@@ -451,9 +454,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
        fm = vmw_fifo_reserve(dev_priv, bytes);
        if (unlikely(fm == NULL)) {
-                down_write(&fifo_state->rwsem);
+                *sequence = atomic_read(&dev_priv->fence_seq);
-                *sequence = dev_priv->fence_seq;
-                up_write(&fifo_state->rwsem);
                ret = -ENOMEM;
                (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
                                        false, 3*HZ);
@@ -461,7 +462,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
        }
        do {
-                *sequence = dev_priv->fence_seq++;
+                *sequence = atomic_add_return(1, &dev_priv->fence_seq);
        } while (*sequence == 0);
        if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 778851f9f1d6..1c7a316454d8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -48,6 +48,12 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
        case DRM_VMW_PARAM_FIFO_OFFSET:
                param->value = dev_priv->mmio_start;
                break;
+        case DRM_VMW_PARAM_HW_CAPS:
+                param->value = dev_priv->capabilities;
+                break;
+        case DRM_VMW_PARAM_FIFO_CAPS:
+                param->value = dev_priv->fifo.capabilities;
+                break;
        default:
                DRM_ERROR("Illegal vmwgfx get param request: %d\n",
                          param->param);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
index d40086fc8647..4d7cb5393860 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
@@ -85,19 +85,12 @@ bool vmw_fence_signaled(struct vmw_private *dev_priv,
                return true;
        /**
-         * Below is to signal stale fences that have wrapped.
-         * First, block fence submission.
-         */
-        down_read(&fifo_state->rwsem);
-        /**
         * Then check if the sequence is higher than what we've actually
         * emitted. Then the fence is stale and signaled.
         */
-        ret = ((dev_priv->fence_seq - sequence) > VMW_FENCE_WRAP);
+        ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
-        up_read(&fifo_state->rwsem);
+               > VMW_FENCE_WRAP);
        return ret;
 }
@@ -127,7 +120,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
        if (fifo_idle)
                down_read(&fifo_state->rwsem);
-        signal_seq = dev_priv->fence_seq;
+        signal_seq = atomic_read(&dev_priv->fence_seq);
        ret = 0;
        for (;;) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index eeba6d1d06e4..31f9afed0a63 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -769,10 +769,10 @@ int vmw_kms_init(struct vmw_private *dev_priv)
        drm_mode_config_init(dev);
        dev->mode_config.funcs = &vmw_kms_funcs;
-        dev->mode_config.min_width = 640;
+        dev->mode_config.min_width = 1;
-        dev->mode_config.min_height = 480;
+        dev->mode_config.min_height = 1;
-        dev->mode_config.max_width = 2048;
+        dev->mode_config.max_width = dev_priv->fb_max_width;
-        dev->mode_config.max_height = 2048;
+        dev->mode_config.max_height = dev_priv->fb_max_height;
        ret = vmw_kms_init_legacy_display_system(dev_priv);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index c7efbd47ab84..f8fbbc67a406 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -35,11 +35,6 @@
 #define VMW_RES_SURFACE ttm_driver_type1
 #define VMW_RES_STREAM ttm_driver_type2
-/* XXX: This isn't a real hardware flag, but just a hack for kernel to
- * know about primary surfaces. Find a better way to accomplish this.
- */
-#define SVGA3D_SURFACE_HINT_SCANOUT (1 << 9)
 struct vmw_user_context {
        struct ttm_base_object base;
        struct vmw_resource res;
@@ -579,6 +574,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
        srf->flags = req->flags;
        srf->format = req->format;
+        srf->scanout = req->scanout;
        memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
        srf->num_sizes = 0;
        for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
@@ -604,16 +600,6 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
        if (unlikely(ret != 0))
                goto out_err1;
-        if (srf->flags & SVGA3D_SURFACE_HINT_SCANOUT) {
-                /* we should not send this flag down to hardware since
-                 * its not a official one
-                 */
-                srf->flags &= ~SVGA3D_SURFACE_HINT_SCANOUT;
-                srf->scanout = true;
-        } else {
-                srf->scanout = false;
-        }
        if (srf->scanout &&
            srf->num_sizes == 1 &&
            srf->sizes[0].width == 64 &&
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 1ac0c93603c9..24b56dc54597 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -961,7 +961,7 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
                remaining -= 7;
                pr_devel("client 0x%p called 'target'\n", priv);
                /* if target is default */
-                if (!strncmp(buf, "default", 7))
+                if (!strncmp(kbuf, "default", 7))
                        pdev = pci_dev_get(vga_default_device());
                else {
                        if (!vga_pci_str_to_vars(curr_pos, remaining,
diff --git a/drivers/hwmon/adt7462.c b/drivers/hwmon/adt7462.c
index a31e77c776ae..b8156b4893bb 100644
--- a/drivers/hwmon/adt7462.c
+++ b/drivers/hwmon/adt7462.c
@@ -179,7 +179,7 @@ static const unsigned short normal_i2c[] = { 0x58, 0x5C, I2C_CLIENT_END };
 *
 * Some, but not all, of these voltages have low/high limits.
 */
-#define ADT7462_VOLT_COUNT      12
+#define ADT7462_VOLT_COUNT      13
 #define ADT7462_VENDOR          0x41
 #define ADT7462_DEVICE          0x62
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index cadcbd90ff3b..72ff2c4e757d 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -851,17 +851,16 @@ static struct lm78_data *lm78_update_device(struct device *dev)
 static int __init lm78_isa_found(unsigned short address)
 {
        int val, save, found = 0;
+        int port;
-        /* We have to request the region in two parts because some
-           boards declare base+4 to base+7 as a PNP device */
+        /* Some boards declare base+0 to base+7 as a PNP device, some base+4
-        if (!request_region(address, 4, "lm78")) {
+         * to base+7 and some base+5 to base+6. So we better request each port
-                pr_debug("lm78: Failed to request low part of region\n");
+         * individually for the probing phase. */
-                return 0;
+        for (port = address; port < address + LM78_EXTENT; port++) {
-        }
+                if (!request_region(port, 1, "lm78")) {
-        if (!request_region(address + 4, 4, "lm78")) {
+                        pr_debug("lm78: Failed to request port 0x%x\n", port);
-                pr_debug("lm78: Failed to request high part of region\n");
+                        goto release;
-                release_region(address, 4);
+                }
-                return 0;
        }
 #define REALLY_SLOW_IO
@@ -925,8 +924,8 @@ static int __init lm78_isa_found(unsigned short address)
                        val & 0x80 ? "LM79" : "LM78", (int)address);
 release:
-        release_region(address + 4, 4);
+        for (port--; port >= address; port--)
-        release_region(address, 4);
+                release_region(port, 1);
        return found;
 }
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index 05f9225b6f94..32d4adee73db 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -1793,17 +1793,17 @@ static int __init
 w83781d_isa_found(unsigned short address)
 {
        int val, save, found = 0;
+        int port;
-        /* We have to request the region in two parts because some
-           boards declare base+4 to base+7 as a PNP device */
+        /* Some boards declare base+0 to base+7 as a PNP device, some base+4
-        if (!request_region(address, 4, "w83781d")) {
+         * to base+7 and some base+5 to base+6. So we better request each port
-                pr_debug("w83781d: Failed to request low part of region\n");
+         * individually for the probing phase. */
-                return 0;
+        for (port = address; port < address + W83781D_EXTENT; port++) {
-        }
+                if (!request_region(port, 1, "w83781d")) {
-        if (!request_region(address + 4, 4, "w83781d")) {
+                        pr_debug("w83781d: Failed to request port 0x%x\n",
-                pr_debug("w83781d: Failed to request high part of region\n");
+                                 port);
-                release_region(address, 4);
+                        goto release;
-                return 0;
+                }
        }
 #define REALLY_SLOW_IO
@@ -1877,8 +1877,8 @@ w83781d_isa_found(unsigned short address)
                        val == 0x30 ? "W83782D" : "W83781D", (int)address);
 release:
-        release_region(address + 4, 4);
+        for (port--; port >= address; port--)
-        release_region(address, 4);
+                release_region(port, 1);
        return found;
 }
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index b1c050ff311d..e29b6d5ba8ef 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/module.h>
+#include <linux/types.h>
 /* include interfaces to usb layer */
 #include <linux/usb.h>
@@ -31,8 +32,8 @@
 #define CMD_I2C_IO_END          (1<<1)
 /* i2c bit delay, default is 10us -> 100kHz */
-static int delay = 10;
+static unsigned short delay = 10;
-module_param(delay, int, 0);
+module_param(delay, ushort, 0);
 MODULE_PARM_DESC(delay, "bit delay in microseconds, "
                 "e.g. 10 for 100kHz (default is 100kHz)");
@@ -109,7 +110,7 @@ static int usb_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, int num)
 static u32 usb_func(struct i2c_adapter *adapter)
 {
-        u32 func;
+        __le32 func;
        /* get functionality from adapter */
        if (usb_read(adapter, CMD_GET_FUNC, 0, 0, &func, sizeof(func)) !=
@@ -118,7 +119,7 @@ static u32 usb_func(struct i2c_adapter *adapter)
                return 0;
        }
-        return func;
+        return le32_to_cpu(func);
 }
 /* This is the actual algorithm we define */
@@ -216,8 +217,7 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,
                 "i2c-tiny-usb at bus %03d device %03d",
                 dev->usb_dev->bus->busnum, dev->usb_dev->devnum);
-        if (usb_write(&dev->adapter, CMD_SET_DELAY,
+        if (usb_write(&dev->adapter, CMD_SET_DELAY, delay, 0, NULL, 0) != 0) {
-                      cpu_to_le16(delay), 0, NULL, 0) != 0) {
                dev_err(&dev->adapter.dev,
                        "failure setting delay to %dus\n", delay);
                retval = -EIO;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index cc9b5940fa97..875e34e0b235 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2115,9 +2115,7 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
        if (ret)
                goto err1;
-        if (cma_loopback_addr(addr)) {
+        if (!cma_any_addr(addr)) {
-                ret = cma_bind_loopback(id_priv);
-        } else if (!cma_zero_addr(addr)) {
                ret = rdma_translate_ip(addr, &id->route.addr.dev_addr);
                if (ret)
                        goto err1;
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 9774bdfaa482..d8c0c8d6992c 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1141,7 +1141,14 @@ static void psmouse_cleanup(struct serio *serio)
                psmouse_deactivate(parent);
        }
-        psmouse_deactivate(psmouse);
+        psmouse_set_state(psmouse, PSMOUSE_INITIALIZING);
+        /*
+         * Disable stream mode so cleanup routine can proceed undisturbed.
+         */
+        if (ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_DISABLE))
+                printk(KERN_WARNING "psmouse.c: Failed to disable mouse on %s\n",
+                        psmouse->ps2dev.serio->phys);
        if (psmouse->cleanup)
                psmouse->cleanup(psmouse);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index dd3dfe42d5a9..a20a71e5efd3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4075,8 +4075,10 @@ static void mddev_delayed_delete(struct work_struct *ws)
 {
        mddev_t *mddev = container_of(ws, mddev_t, del_work);
-        if (mddev->private == &md_redundancy_group) {
+        if (mddev->private) {
                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+                if (mddev->private != (void*)1)
+                        sysfs_remove_group(&mddev->kobj, mddev->private);
                if (mddev->sysfs_action)
                        sysfs_put(mddev->sysfs_action);
                mddev->sysfs_action = NULL;
@@ -4287,10 +4289,7 @@ static int do_md_run(mddev_t * mddev)
                sysfs_notify_dirent(rdev->sysfs_state);
        }
-        md_probe(mddev->unit, NULL, NULL);
        disk = mddev->gendisk;
-        if (!disk)
-                return -ENOMEM;
        spin_lock(&pers_lock);
        pers = find_pers(mddev->level, mddev->clevel);
@@ -4530,8 +4529,8 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                        mddev->queue->unplug_fn = NULL;
                        mddev->queue->backing_dev_info.congested_fn = NULL;
                        module_put(mddev->pers->owner);
-                        if (mddev->pers->sync_request)
+                        if (mddev->pers->sync_request && mddev->private == NULL)
-                                mddev->private = &md_redundancy_group;
+                                mddev->private = (void*)1;
                        mddev->pers = NULL;
                        /* tell userspace to handle 'inactive' */
                        sysfs_notify_dirent(mddev->sysfs_state);
@@ -4578,9 +4577,6 @@ out:
                }
                mddev->bitmap_info.offset = 0;
-                /* make sure all md_delayed_delete calls have finished */
-                flush_scheduled_work();
                export_array(mddev);
                mddev->array_sectors = 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e84204eb12df..ceb24afdc147 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5136,9 +5136,8 @@ static int stop(mddev_t *mddev)
        mddev->thread = NULL;
        mddev->queue->backing_dev_info.congested_fn = NULL;
        blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
-        sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
        free_conf(conf);
-        mddev->private = NULL;
+        mddev->private = &raid5_attrs_group;
        return 0;
 }
@@ -5464,11 +5463,11 @@ static int raid5_start_reshape(mddev_t *mddev)
                    !test_bit(Faulty, &rdev->flags)) {
                        if (raid5_add_disk(mddev, rdev) == 0) {
                                char nm[20];
-                                if (rdev->raid_disk >= conf->previous_raid_disks)
+                                if (rdev->raid_disk >= conf->previous_raid_disks) {
                                        set_bit(In_sync, &rdev->flags);
-                                else
+                                        added_devices++;
+                                } else
                                        rdev->recovery_offset = 0;
-                                added_devices++;
                                sprintf(nm, "rd%d", rdev->raid_disk);
                                if (sysfs_create_link(&mddev->kobj,
                                                      &rdev->kobj, nm))
@@ -5480,9 +5479,12 @@ static int raid5_start_reshape(mddev_t *mddev)
                                break;
                }
+        /* When a reshape changes the number of devices, ->degraded
+         * is measured against the large of the pre and post number of
+         * devices.*/
        if (mddev->delta_disks > 0) {
                spin_lock_irqsave(&conf->device_lock, flags);
-                mddev->degraded = (conf->raid_disks - conf->previous_raid_disks)
+                mddev->degraded += (conf->raid_disks - conf->previous_raid_disks)
                        - added_devices;
                spin_unlock_irqrestore(&conf->device_lock, flags);
        }
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index c37790ad92d0..9ddc57909d49 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -761,7 +761,6 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
        dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192);
        dmxdevfilter->type = DMXDEV_TYPE_NONE;
        dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_ALLOCATED);
-        INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
        init_timer(&dmxdevfilter->timer);
        dvbdev->users++;
@@ -887,6 +886,7 @@ static int dvb_dmxdev_pes_filter_set(struct dmxdev *dmxdev,
        dmxdevfilter->type = DMXDEV_TYPE_PES;
        memcpy(&dmxdevfilter->params, params,
               sizeof(struct dmx_pes_filter_params));
+        INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
        dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_SET);
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index b78cfb7d1897..67f189b7aa1f 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -426,16 +426,7 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                };
        };
-        if (dvb_demux_tscheck) {
+        if (demux->cnt_storage) {
-                if (!demux->cnt_storage)
-                        demux->cnt_storage = vmalloc(MAX_PID + 1);
-                if (!demux->cnt_storage) {
-                        printk(KERN_WARNING "Couldn't allocate memory for TS/TEI check. Disabling it\n");
-                        dvb_demux_tscheck = 0;
-                        goto no_dvb_demux_tscheck;
-                }
                /* check pkt counter */
                if (pid < MAX_PID) {
                        if (buf[1] & 0x80)
@@ -454,7 +445,6 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                };
                /* end check */
        };
-no_dvb_demux_tscheck:
        list_for_each_entry(feed, &demux->feed_list, list_head) {
                if ((feed->pid != pid) && (feed->pid != 0x2000))
@@ -1246,6 +1236,7 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
        dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed));
        if (!dvbdemux->feed) {
                vfree(dvbdemux->filter);
+                dvbdemux->filter = NULL;
                return -ENOMEM;
        }
        for (i = 0; i < dvbdemux->filternum; i++) {
@@ -1257,6 +1248,13 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
                dvbdemux->feed[i].index = i;
        }
+        if (dvb_demux_tscheck) {
+                dvbdemux->cnt_storage = vmalloc(MAX_PID + 1);
+                if (!dvbdemux->cnt_storage)
+                        printk(KERN_WARNING "Couldn't allocate memory for TS/TEI check. Disabling it\n");
+        }
        INIT_LIST_HEAD(&dvbdemux->frontend_list);
        for (i = 0; i < DMX_TS_PES_OTHER; i++) {
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 57752751712b..81279b3d694c 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -1796,7 +1796,7 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
                dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "task abort: "
                   "Command not in the active list! (sc=%p)\n", ioc->name,
                   SCpnt));
-                retval = 0;
+                retval = SUCCESS;
                goto out;
        }
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index b9f1e84897cc..e7f8027165e6 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -74,6 +74,9 @@ static void mmc_test_prepare_mrq(struct mmc_test_card *test,
        }
        mrq->cmd->arg = dev_addr;
+        if (!mmc_card_blockaddr(test->card))
+                mrq->cmd->arg <<= 9;
        mrq->cmd->flags = MMC_RSP_R1 | MMC_CMD_ADTC;
        if (blocks == 1)
@@ -190,7 +193,7 @@ static int __mmc_test_prepare(struct mmc_test_card *test, int write)
        }
        for (i = 0;i < BUFFER_SIZE / 512;i++) {
-                ret = mmc_test_buffer_transfer(test, test->buffer, i * 512, 512, 1);
+                ret = mmc_test_buffer_transfer(test, test->buffer, i, 512, 1);
                if (ret)
                        return ret;
        }
@@ -219,7 +222,7 @@ static int mmc_test_cleanup(struct mmc_test_card *test)
        memset(test->buffer, 0, 512);
        for (i = 0;i < BUFFER_SIZE / 512;i++) {
-                ret = mmc_test_buffer_transfer(test, test->buffer, i * 512, 512, 1);
+                ret = mmc_test_buffer_transfer(test, test->buffer, i, 512, 1);
                if (ret)
                        return ret;
        }
@@ -426,7 +429,7 @@ static int mmc_test_transfer(struct mmc_test_card *test,
                for (i = 0;i < sectors;i++) {
                        ret = mmc_test_buffer_transfer(test,
                                test->buffer + i * 512,
-                                dev_addr + i * 512, 512, 0);
+                                dev_addr + i, 512, 0);
                        if (ret)
                                return ret;
                }
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 62d9c9cc5671..1dd4403247ca 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -921,7 +921,7 @@ static int ax_probe(struct platform_device *pdev)
                size = (res->end - res->start) + 1;
                ax->mem2 = request_mem_region(res->start, size, pdev->name);
-                if (ax->mem == NULL) {
+                if (ax->mem2 == NULL) {
                        dev_err(&pdev->dev, "cannot reserve registers\n");
                        ret = -ENXIO;
                        goto exit_mem1;
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index bdbd14727e4b..318a018ca7c5 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2079,6 +2079,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                         struct sge_fl *fl, int len, int complete)
 {
        struct rx_sw_desc *sd = &fl->sdesc[fl->cidx];
+        struct port_info *pi = netdev_priv(qs->netdev);
        struct sk_buff *skb = NULL;
        struct cpl_rx_pkt *cpl;
        struct skb_frag_struct *rx_frag;
@@ -2116,11 +2117,18 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
        if (!nr_frags) {
                offset = 2 + sizeof(struct cpl_rx_pkt);
-                qs->lro_va = sd->pg_chunk.va + 2;
+                cpl = qs->lro_va = sd->pg_chunk.va + 2;
-        }
-        len -= offset;
-        prefetch(qs->lro_va);
+                if ((pi->rx_offload & T3_RX_CSUM) &&
+                     cpl->csum_valid && cpl->csum == htons(0xffff)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
+                } else
+                        skb->ip_summed = CHECKSUM_NONE;
+        } else
+                cpl = qs->lro_va;
+        len -= offset;
        rx_frag += nr_frags;
        rx_frag->page = sd->pg_chunk.page;
@@ -2136,12 +2144,8 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                return;
        skb_record_rx_queue(skb, qs - &adap->sge.qs[0]);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        cpl = qs->lro_va;
        if (unlikely(cpl->vlan_valid)) {
-                struct net_device *dev = qs->netdev;
-                struct port_info *pi = netdev_priv(dev);
                struct vlan_group *grp = pi->vlan_grp;
                if (likely(grp != NULL)) {
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 997124d2992a..c881347cb26d 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -421,6 +421,8 @@ static void igb_assign_vector(struct igb_q_vector *q_vector, int msix_vector)
                        msixbm = E1000_EICR_RX_QUEUE0 << rx_queue;
                if (tx_queue > IGB_N0_QUEUE)
                        msixbm |= E1000_EICR_TX_QUEUE0 << tx_queue;
+                if (!adapter->msix_entries && msix_vector == 0)
+                        msixbm |= E1000_EIMS_OTHER;
                array_wr32(E1000_MSIXBM(0), msix_vector, msixbm);
                q_vector->eims_value = msixbm;
                break;
@@ -877,7 +879,6 @@ static int igb_request_irq(struct igb_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
        struct pci_dev *pdev = adapter->pdev;
-        struct e1000_hw *hw = &adapter->hw;
        int err = 0;
        if (adapter->msix_entries) {
@@ -909,20 +910,7 @@ static int igb_request_irq(struct igb_adapter *adapter)
                igb_setup_all_tx_resources(adapter);
                igb_setup_all_rx_resources(adapter);
        } else {
-                switch (hw->mac.type) {
+                igb_assign_vector(adapter->q_vector[0], 0);
-                case e1000_82575:
-                        wr32(E1000_MSIXBM(0),
-                             (E1000_EICR_RX_QUEUE0 |
-                              E1000_EICR_TX_QUEUE0 |
-                              E1000_EIMS_OTHER));
-                        break;
-                case e1000_82580:
-                case e1000_82576:
-                        wr32(E1000_IVAR0, E1000_IVAR_VALID);
-                        break;
-                default:
-                        break;
-                }
        }
        if (adapter->flags & IGB_FLAG_HAS_MSI) {
@@ -1140,6 +1128,8 @@ int igb_up(struct igb_adapter *adapter)
        }
        if (adapter->msix_entries)
                igb_configure_msix(adapter);
+        else
+                igb_assign_vector(adapter->q_vector[0], 0);
        /* Clear any pending interrupts. */
        rd32(E1000_ICR);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index b5f64ad67975..7b7c8486c0bf 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5179,7 +5179,7 @@ dma_error:
                ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
        }
-        return count;
+        return 0;
 }
 static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
@@ -5329,8 +5329,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
        struct ixgbe_adapter *adapter = netdev_priv(dev);
        int txq = smp_processor_id();
-        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE)
+        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) {
+                while (unlikely(txq >= dev->real_num_tx_queues))
+                        txq -= dev->real_num_tx_queues;
                return txq;
+        }
 #ifdef IXGBE_FCOE
        if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 9f9d6081959b..24279e6e55f5 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1941,7 +1941,7 @@ static void netxen_tx_timeout_task(struct work_struct *work)
                netif_wake_queue(adapter->netdev);
                clear_bit(__NX_RESETTING, &adapter->state);
+                return;
        } else {
                clear_bit(__NX_RESETTING, &adapter->state);
                if (!netxen_nic_reset_context(adapter)) {
@@ -2240,7 +2240,9 @@ netxen_detach_work(struct work_struct *work)
        netxen_nic_down(adapter, netdev);
+        rtnl_lock();
        netxen_nic_detach(adapter);
+        rtnl_unlock();
        status = NXRD32(adapter, NETXEN_PEG_HALT_STATUS1);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index d760650c5c04..67249c3c9f50 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1025,11 +1025,8 @@ static void sky2_prefetch_init(struct sky2_hw *hw, u32 qaddr,
 static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2, u16 *slot)
 {
        struct sky2_tx_le *le = sky2->tx_le + *slot;
-        struct tx_ring_info *re = sky2->tx_ring + *slot;
        *slot = RING_NEXT(*slot, sky2->tx_ring_size);
-        re->flags = 0;
-        re->skb = NULL;
        le->ctrl = 0;
        return le;
 }
@@ -1622,8 +1619,7 @@ static unsigned tx_le_req(const struct sk_buff *skb)
        return count;
 }
-static void sky2_tx_unmap(struct pci_dev *pdev,
+static void sky2_tx_unmap(struct pci_dev *pdev, struct tx_ring_info *re)
-                          const struct tx_ring_info *re)
 {
        if (re->flags & TX_MAP_SINGLE)
                pci_unmap_single(pdev, pci_unmap_addr(re, mapaddr),
@@ -1633,6 +1629,7 @@ static void sky2_tx_unmap(struct pci_dev *pdev,
                pci_unmap_page(pdev, pci_unmap_addr(re, mapaddr),
                               pci_unmap_len(re, maplen),
                               PCI_DMA_TODEVICE);
+        re->flags = 0;
 }
 /*
@@ -1839,6 +1836,7 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
                        dev->stats.tx_packets++;
                        dev->stats.tx_bytes += skb->len;
+                        re->skb = NULL;
                        dev_kfree_skb_any(skb);
                        sky2->tx_next = RING_NEXT(idx, sky2->tx_ring_size);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c74694345b6e..d58b94030ef3 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -338,6 +338,23 @@ static void __devinit quirk_s3_64M(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_868,           quirk_s3_64M);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_968,           quirk_s3_64M);
+/*
+ * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
+ * ver. 1.33  20070103) don't set the correct ISA PCI region header info.
+ * BAR0 should be 8 bytes; instead, it may be set to something like 8k
+ * (which conflicts w/ BAR1's memory range).
+ */
+static void __devinit quirk_cs5536_vsa(struct pci_dev *dev)
+{
+        if (pci_resource_len(dev, 0) != 8) {
+                struct resource *res = &dev->resource[0];
+                res->end = res->start + 8 - 1;
+                dev_info(&dev->dev, "CS5536 ISA bridge bug detected "
+                                "(incorrect header); workaround applied.\n");
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
 static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region,
        unsigned size, int nr, const char *name)
 {
diff --git a/drivers/power/wm97xx_battery.c b/drivers/power/wm97xx_battery.c
index fa39e759a275..6ea3cb5837c7 100644
--- a/drivers/power/wm97xx_battery.c
+++ b/drivers/power/wm97xx_battery.c
@@ -175,8 +175,14 @@ static int __devinit wm97xx_bat_probe(struct platform_device *dev)
                dev_err(&dev->dev, "Do not pass platform_data through "
                        "wm97xx_bat_set_pdata!\n");
                return -EINVAL;
-        } else
+        }
-                pdata = wmdata->batt_pdata;
+        if (!wmdata) {
+                dev_err(&dev->dev, "No platform data supplied\n");
+                return -EINVAL;
+        }
+        pdata = wmdata->batt_pdata;
        if (dev->id != -1)
                return -EINVAL;
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 999fe80c4051..62b654af9237 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -531,7 +531,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
        qdio_siga_sync_q(q);
        get_buf_state(q, q->first_to_check, &state, 0);
-        if (state == SLSB_P_INPUT_PRIMED)
+        if (state == SLSB_P_INPUT_PRIMED || state == SLSB_P_INPUT_ERROR)
                /* more work coming */
                return 0;
@@ -960,6 +960,8 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                        qdio_handle_activate_check(cdev, intparm, cstat,
                                                   dstat);
                break;
+        case QDIO_IRQ_STATE_STOPPED:
+                break;
        default:
                WARN_ON(1);
        }
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index 0f7b493fb105..271399f62f1b 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -671,12 +671,11 @@ static void zfcp_fc_ct_els_job_handler(void *data)
 {
        struct fc_bsg_job *job = data;
        struct zfcp_fsf_ct_els *zfcp_ct_els = job->dd_data;
-        int status = zfcp_ct_els->status;
+        struct fc_bsg_reply *jr = job->reply;
-        int reply_status;
-        reply_status = status ? FC_CTELS_STATUS_REJECT : FC_CTELS_STATUS_OK;
+        jr->reply_payload_rcv_len = job->reply_payload.payload_len;
-        job->reply->reply_data.ctels_reply.status = reply_status;
+        jr->reply_data.ctels_reply.status = FC_CTELS_STATUS_OK;
-        job->reply->reply_payload_rcv_len = job->reply_payload.payload_len;
+        jr->result = zfcp_ct_els->status ? -EIO : 0;
        job->job_done(job);
 }
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index f61fb8d01330..8bc6f53691e9 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -453,6 +453,5 @@ extern void qla24xx_wrt_req_reg(struct qla_hw_data *, uint16_t, uint16_t);
 extern void qla25xx_wrt_req_reg(struct qla_hw_data *, uint16_t, uint16_t);
 extern void qla25xx_wrt_rsp_reg(struct qla_hw_data *, uint16_t, uint16_t);
 extern void qla24xx_wrt_rsp_reg(struct qla_hw_data *, uint16_t, uint16_t);
-extern struct scsi_qla_host * qla25xx_get_host(struct rsp_que *);
 #endif /* _QLA_GBL_H */
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index ffd0efdff40e..6fc63b98818c 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1917,6 +1917,7 @@ qla24xx_msix_rsp_q(int irq, void *dev_id)
        struct rsp_que *rsp;
        struct device_reg_24xx __iomem *reg;
        struct scsi_qla_host *vha;
+        unsigned long flags;
        rsp = (struct rsp_que *) dev_id;
        if (!rsp) {
@@ -1927,15 +1928,15 @@ qla24xx_msix_rsp_q(int irq, void *dev_id)
        ha = rsp->hw;
        reg = &ha->iobase->isp24;
-        spin_lock_irq(&ha->hardware_lock);
+        spin_lock_irqsave(&ha->hardware_lock, flags);
-        vha = qla25xx_get_host(rsp);
+        vha = pci_get_drvdata(ha->pdev);
        qla24xx_process_response_queue(vha, rsp);
        if (!ha->flags.disable_msix_handshake) {
                WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
                RD_REG_DWORD_RELAXED(&reg->hccr);
        }
-        spin_unlock_irq(&ha->hardware_lock);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        return IRQ_HANDLED;
 }
@@ -1946,6 +1947,7 @@ qla25xx_msix_rsp_q(int irq, void *dev_id)
        struct qla_hw_data *ha;
        struct rsp_que *rsp;
        struct device_reg_24xx __iomem *reg;
+        unsigned long flags;
        rsp = (struct rsp_que *) dev_id;
        if (!rsp) {
@@ -1958,10 +1960,10 @@ qla25xx_msix_rsp_q(int irq, void *dev_id)
        /* Clear the interrupt, if enabled, for this response queue */
        if (rsp->options & ~BIT_6) {
                reg = &ha->iobase->isp24;
-                spin_lock_irq(&ha->hardware_lock);
+                spin_lock_irqsave(&ha->hardware_lock, flags);
                WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
                RD_REG_DWORD_RELAXED(&reg->hccr);
-                spin_unlock_irq(&ha->hardware_lock);
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
        }
        queue_work_on((int) (rsp->id - 1), ha->wq, &rsp->q_work);
@@ -1979,6 +1981,7 @@ qla24xx_msix_default(int irq, void *dev_id)
        uint32_t        stat;
        uint32_t        hccr;
        uint16_t        mb[4];
+        unsigned long flags;
        rsp = (struct rsp_que *) dev_id;
        if (!rsp) {
@@ -1990,7 +1993,7 @@ qla24xx_msix_default(int irq, void *dev_id)
        reg = &ha->iobase->isp24;
        status = 0;
-        spin_lock_irq(&ha->hardware_lock);
+        spin_lock_irqsave(&ha->hardware_lock, flags);
        vha = pci_get_drvdata(ha->pdev);
        do {
                stat = RD_REG_DWORD(&reg->host_status);
@@ -2039,7 +2042,7 @@ qla24xx_msix_default(int irq, void *dev_id)
                }
                WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
        } while (0);
-        spin_unlock_irq(&ha->hardware_lock);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
@@ -2277,30 +2280,3 @@ int qla25xx_request_irq(struct rsp_que *rsp)
        msix->rsp = rsp;
        return ret;
 }
-struct scsi_qla_host *
-qla25xx_get_host(struct rsp_que *rsp)
-{
-        srb_t *sp;
-        struct qla_hw_data *ha = rsp->hw;
-        struct scsi_qla_host *vha = NULL;
-        struct sts_entry_24xx *pkt;
-        struct req_que *req;
-        uint16_t que;
-        uint32_t handle;
-        pkt = (struct sts_entry_24xx *) rsp->ring_ptr;
-        que = MSW(pkt->handle);
-        handle = (uint32_t) LSW(pkt->handle);
-        req = ha->req_q_map[que];
-        if (handle < MAX_OUTSTANDING_COMMANDS) {
-                sp = req->outstanding_cmds[handle];
-                if (sp)
-                        return  sp->fcport->vha;
-                else
-                        goto base_que;
-        }
-base_que:
-        vha = pci_get_drvdata(ha->pdev);
-        return vha;
-}
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index b901aa267e7d..ff17dee28613 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -636,13 +636,15 @@ failed:
 static void qla_do_work(struct work_struct *work)
 {
+        unsigned long flags;
        struct rsp_que *rsp = container_of(work, struct rsp_que, q_work);
        struct scsi_qla_host *vha;
+        struct qla_hw_data *ha = rsp->hw;
-        spin_lock_irq(&rsp->hw->hardware_lock);
+        spin_lock_irqsave(&rsp->hw->hardware_lock, flags);
-        vha = qla25xx_get_host(rsp);
+        vha = pci_get_drvdata(ha->pdev);
        qla24xx_process_response_queue(vha, rsp);
-        spin_unlock_irq(&rsp->hw->hardware_lock);
+        spin_unlock_irqrestore(&rsp->hw->hardware_lock, flags);
 }
 /* create response queue */
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 0ceec123ddfd..bee558aed427 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -35,7 +35,9 @@
 #include <linux/usb.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
+#include <linux/mm.h>
 #include <linux/irq.h>
+#include <asm/cacheflush.h>
 #include "../core/hcd.h"
 #include "r8a66597.h"
@@ -820,6 +822,26 @@ static void enable_r8a66597_pipe(struct r8a66597 *r8a66597, struct urb *urb,
        enable_r8a66597_pipe_dma(r8a66597, dev, pipe, urb);
 }
+static void r8a66597_urb_done(struct r8a66597 *r8a66597, struct urb *urb,
+                              int status)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
+{
+        if (usb_pipein(urb->pipe) && usb_pipetype(urb->pipe) != PIPE_CONTROL) {
+                void *ptr;
+                for (ptr = urb->transfer_buffer;
+                     ptr < urb->transfer_buffer + urb->transfer_buffer_length;
+                     ptr += PAGE_SIZE)
+                        flush_dcache_page(virt_to_page(ptr));
+        }
+        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
+        spin_unlock(&r8a66597->lock);
+        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb, status);
+        spin_lock(&r8a66597->lock);
+}
 /* this function must be called with interrupt disabled */
 static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
 {
@@ -838,15 +860,9 @@ static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
                list_del(&td->queue);
                kfree(td);
-                if (urb) {
+                if (urb)
-                        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597),
+                        r8a66597_urb_done(r8a66597, urb, -ENODEV);
-                                        urb);
-                        spin_unlock(&r8a66597->lock);
-                        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb,
-                                        -ENODEV);
-                        spin_lock(&r8a66597->lock);
-                }
                break;
        }
 }
@@ -1006,6 +1022,8 @@ static void start_root_hub_sampling(struct r8a66597 *r8a66597, int port,
 /* this function must be called with interrupt disabled */
 static void r8a66597_check_syssts(struct r8a66597 *r8a66597, int port,
                                        u16 syssts)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
 {
        if (syssts == SE0) {
                r8a66597_write(r8a66597, ~ATTCH, get_intsts_reg(port));
@@ -1023,7 +1041,9 @@ static void r8a66597_check_syssts(struct r8a66597 *r8a66597, int port,
                        usb_hcd_resume_root_hub(r8a66597_to_hcd(r8a66597));
        }
+        spin_unlock(&r8a66597->lock);
        usb_hcd_poll_rh_status(r8a66597_to_hcd(r8a66597));
+        spin_lock(&r8a66597->lock);
 }
 /* this function must be called with interrupt disabled */
@@ -1283,10 +1303,7 @@ __releases(r8a66597->lock) __acquires(r8a66597->lock)
                if (usb_pipeisoc(urb->pipe))
                        urb->start_frame = r8a66597_get_frame(hcd);
-                usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
+                r8a66597_urb_done(r8a66597, urb, status);
-                spin_unlock(&r8a66597->lock);
-                usb_hcd_giveback_urb(hcd, urb, status);
-                spin_lock(&r8a66597->lock);
        }
        if (restart) {