1173 files changed, 16352 insertions, 30893 deletions
diff --git a/drivers/Makefile b/drivers/Makefile
index e3ced91b1784..7183b6af5dac 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -53,8 +53,8 @@ obj-y				+= gpu/
 obj-$(CONFIG_CONNECTOR)         += connector/
 # i810fb and intelfb depend on char/agp/
-obj-$(CONFIG_FB_I810)           += video/i810/
+obj-$(CONFIG_FB_I810)           += video/fbdev/i810/
-obj-$(CONFIG_FB_INTEL)          += video/intelfb/
+obj-$(CONFIG_FB_INTEL)          += video/fbdev/intelfb/
 obj-$(CONFIG_PARPORT)           += parport/
 obj-y                           += base/ block/ misc/ mfd/ nfc/
@@ -119,7 +119,7 @@ obj-$(CONFIG_SGI_SN)		+= sn/
 obj-y                           += firmware/
 obj-$(CONFIG_CRYPTO)            += crypto/
 obj-$(CONFIG_SUPERH)            += sh/
-obj-$(CONFIG_ARCH_SHMOBILE_LEGACY)      += sh/
+obj-$(CONFIG_ARCH_SHMOBILE)     += sh/
 ifndef CONFIG_ARCH_USES_GETTIMEOFFSET
 obj-y                           += clocksource/
 endif
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index ab686b310100..a34a22841002 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -47,6 +47,23 @@ config ACPI_SLEEP
        depends on SUSPEND || HIBERNATION
        default y
+config ACPI_PROCFS_POWER
+        bool "Deprecated power /proc/acpi directories"
+        depends on PROC_FS
+        help
+          For backwards compatibility, this option allows
+          deprecated power /proc/acpi/ directories to exist, even when
+          they have been replaced by functions in /sys.
+          The deprecated directories (and their replacements) include:
+          /proc/acpi/battery/* (/sys/class/power_supply/*)
+          /proc/acpi/ac_adapter/* (sys/class/power_supply/*)
+          This option has no effect on /proc/acpi/ directories
+          and functions, which do not yet exist in /sys
+          This option, together with the proc directories, will be
+          deleted in the future.
+          Say N to delete power /proc/acpi/ directories that have moved to /sys/
 config ACPI_EC_DEBUGFS
        tristate "EC read/write access through /sys/kernel/debug/ec"
        default n
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 0331f91d56e6..bce34afadcd0 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -47,6 +47,7 @@ acpi-y				+= sysfs.o
 acpi-$(CONFIG_X86)              += acpi_cmos_rtc.o
 acpi-$(CONFIG_DEBUG_FS)         += debugfs.o
 acpi-$(CONFIG_ACPI_NUMA)        += numa.o
+acpi-$(CONFIG_ACPI_PROCFS_POWER) += cm_sbs.o
 ifdef CONFIG_ACPI_VIDEO
 acpi-y                          += video_detect.o
 endif
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 2c01c1da29ce..c67f6f5ad611 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -52,11 +52,39 @@ MODULE_AUTHOR("Paul Diefenbaugh");
 MODULE_DESCRIPTION("ACPI AC Adapter Driver");
 MODULE_LICENSE("GPL");
+static int acpi_ac_add(struct acpi_device *device);
+static int acpi_ac_remove(struct acpi_device *device);
+static void acpi_ac_notify(struct acpi_device *device, u32 event);
+static const struct acpi_device_id ac_device_ids[] = {
+        {"ACPI0003", 0},
+        {"", 0},
+};
+MODULE_DEVICE_TABLE(acpi, ac_device_ids);
+#ifdef CONFIG_PM_SLEEP
+static int acpi_ac_resume(struct device *dev);
+#endif
+static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
 static int ac_sleep_before_get_state_ms;
+static struct acpi_driver acpi_ac_driver = {
+        .name = "ac",
+        .class = ACPI_AC_CLASS,
+        .ids = ac_device_ids,
+        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
+        .ops = {
+                .add = acpi_ac_add,
+                .remove = acpi_ac_remove,
+                .notify = acpi_ac_notify,
+                },
+        .drv.pm = &acpi_ac_pm,
+};
 struct acpi_ac {
        struct power_supply charger;
-        struct platform_device *pdev;
+        struct acpi_device * device;
        unsigned long long state;
        struct notifier_block battery_nb;
 };
@@ -69,10 +97,12 @@ struct acpi_ac {
 static int acpi_ac_get_state(struct acpi_ac *ac)
 {
-        acpi_status status;
+        acpi_status status = AE_OK;
-        acpi_handle handle = ACPI_HANDLE(&ac->pdev->dev);
+        if (!ac)
+                return -EINVAL;
-        status = acpi_evaluate_integer(handle, "_PSR", NULL,
+        status = acpi_evaluate_integer(ac->device->handle, "_PSR", NULL,
                                       &ac->state);
        if (ACPI_FAILURE(status)) {
                ACPI_EXCEPTION((AE_INFO, status,
@@ -117,10 +147,9 @@ static enum power_supply_property ac_props[] = {
                                   Driver Model
   -------------------------------------------------------------------------- */
-static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
+static void acpi_ac_notify(struct acpi_device *device, u32 event)
 {
-        struct acpi_ac *ac = data;
+        struct acpi_ac *ac = acpi_driver_data(device);
-        struct acpi_device *adev;
        if (!ac)
                return;
@@ -143,11 +172,10 @@ static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
                        msleep(ac_sleep_before_get_state_ms);
                acpi_ac_get_state(ac);
-                adev = ACPI_COMPANION(&ac->pdev->dev);
+                acpi_bus_generate_netlink_event(device->pnp.device_class,
-                acpi_bus_generate_netlink_event(adev->pnp.device_class,
+                                                  dev_name(&device->dev), event,
-                                                dev_name(&ac->pdev->dev),
+                                                  (u32) ac->state);
-                                                event, (u32) ac->state);
+                acpi_notifier_call_chain(device, event, (u32) ac->state);
-                acpi_notifier_call_chain(adev, event, (u32) ac->state);
                kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
        }
@@ -192,49 +220,39 @@ static struct dmi_system_id ac_dmi_table[] = {
        {},
 };
-static int acpi_ac_probe(struct platform_device *pdev)
+static int acpi_ac_add(struct acpi_device *device)
 {
        int result = 0;
        struct acpi_ac *ac = NULL;
-        struct acpi_device *adev;
-        if (!pdev)
-                return -EINVAL;
-        adev = ACPI_COMPANION(&pdev->dev);
+        if (!device)
-        if (!adev)
+                return -EINVAL;
-                return -ENODEV;
        ac = kzalloc(sizeof(struct acpi_ac), GFP_KERNEL);
        if (!ac)
                return -ENOMEM;
-        strcpy(acpi_device_name(adev), ACPI_AC_DEVICE_NAME);
+        ac->device = device;
-        strcpy(acpi_device_class(adev), ACPI_AC_CLASS);
+        strcpy(acpi_device_name(device), ACPI_AC_DEVICE_NAME);
-        ac->pdev = pdev;
+        strcpy(acpi_device_class(device), ACPI_AC_CLASS);
-        platform_set_drvdata(pdev, ac);
+        device->driver_data = ac;
        result = acpi_ac_get_state(ac);
        if (result)
                goto end;
-        ac->charger.name = acpi_device_bid(adev);
+        ac->charger.name = acpi_device_bid(device);
        ac->charger.type = POWER_SUPPLY_TYPE_MAINS;
        ac->charger.properties = ac_props;
        ac->charger.num_properties = ARRAY_SIZE(ac_props);
        ac->charger.get_property = get_ac_property;
-        result = power_supply_register(&pdev->dev, &ac->charger);
+        result = power_supply_register(&ac->device->dev, &ac->charger);
        if (result)
                goto end;
-        result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler, ac);
-        if (result) {
-                power_supply_unregister(&ac->charger);
-                goto end;
-        }
        printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
-               acpi_device_name(adev), acpi_device_bid(adev),
+               acpi_device_name(device), acpi_device_bid(device),
               ac->state ? "on-line" : "off-line");
        ac->battery_nb.notifier_call = acpi_ac_battery_notify;
@@ -256,7 +274,7 @@ static int acpi_ac_resume(struct device *dev)
        if (!dev)
                return -EINVAL;
-        ac = platform_get_drvdata(to_platform_device(dev));
+        ac = acpi_driver_data(to_acpi_device(dev));
        if (!ac)
                return -EINVAL;
@@ -270,19 +288,17 @@ static int acpi_ac_resume(struct device *dev)
 #else
 #define acpi_ac_resume NULL
 #endif
-static SIMPLE_DEV_PM_OPS(acpi_ac_pm_ops, NULL, acpi_ac_resume);
-static int acpi_ac_remove(struct platform_device *pdev)
+static int acpi_ac_remove(struct acpi_device *device)
 {
-        struct acpi_ac *ac;
+        struct acpi_ac *ac = NULL;
-        if (!pdev)
+        if (!device || !acpi_driver_data(device))
                return -EINVAL;
-        acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
+        ac = acpi_driver_data(device);
-                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler);
-        ac = platform_get_drvdata(pdev);
        if (ac->charger.dev)
                power_supply_unregister(&ac->charger);
        unregister_acpi_notifier(&ac->battery_nb);
@@ -292,23 +308,6 @@ static int acpi_ac_remove(struct platform_device *pdev)
        return 0;
 }
-static const struct acpi_device_id acpi_ac_match[] = {
-        { "ACPI0003", 0 },
-        { }
-};
-MODULE_DEVICE_TABLE(acpi, acpi_ac_match);
-static struct platform_driver acpi_ac_driver = {
-        .probe          = acpi_ac_probe,
-        .remove         = acpi_ac_remove,
-        .driver         = {
-                .name   = "acpi-ac",
-                .owner  = THIS_MODULE,
-                .pm     = &acpi_ac_pm_ops,
-                .acpi_match_table = ACPI_PTR(acpi_ac_match),
-        },
-};
 static int __init acpi_ac_init(void)
 {
        int result;
@@ -316,7 +315,7 @@ static int __init acpi_ac_init(void)
        if (acpi_disabled)
                return -ENODEV;
-        result = platform_driver_register(&acpi_ac_driver);
+        result = acpi_bus_register_driver(&acpi_ac_driver);
        if (result < 0)
                return -ENODEV;
@@ -325,7 +324,7 @@ static int __init acpi_ac_init(void)
 static void __exit acpi_ac_exit(void)
 {
-        platform_driver_unregister(&acpi_ac_driver);
+        acpi_bus_unregister_driver(&acpi_ac_driver);
 }
 module_init(acpi_ac_init);
 module_exit(acpi_ac_exit);
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index dbfe49e5fd63..1d4950388fa1 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -29,7 +29,6 @@ ACPI_MODULE_NAME("platform");
 static const struct acpi_device_id acpi_platform_device_ids[] = {
        { "PNP0D40" },
-        { "ACPI0003" },
        { "VPC2004" },
        { "BCM4752" },
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index c29c2c3ec0ad..52c81c49cc7d 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -170,6 +170,9 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
        acpi_status status;
        int ret;
+        if (pr->apic_id == -1)
+                return -ENODEV;
        status = acpi_evaluate_integer(pr->handle, "_STA", NULL, &sta);
        if (ACPI_FAILURE(status) || !(sta & ACPI_STA_DEVICE_PRESENT))
                return -ENODEV;
@@ -260,10 +263,8 @@ static int acpi_processor_get_info(struct acpi_device *device)
        }
        apic_id = acpi_get_apicid(pr->handle, device_declaration, pr->acpi_id);
-        if (apic_id < 0) {
+        if (apic_id < 0)
                acpi_handle_debug(pr->handle, "failed to get CPU APIC ID.\n");
-                return -ENODEV;
-        }
        pr->apic_id = apic_id;
        cpu_index = acpi_map_cpuid(pr->apic_id, pr->acpi_id);
@@ -404,7 +405,6 @@ static int acpi_processor_add(struct acpi_device *device,
                goto err;
        pr->dev = dev;
-        dev->offline = pr->flags.need_hotplug_init;
        /* Trigger the processor driver's .probe() if present. */
        if (device_attach(dev) >= 0)
diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
index 49bbc71fad54..a08a448068dd 100644
--- a/drivers/acpi/acpica/acglobal.h
+++ b/drivers/acpi/acpica/acglobal.h
@@ -141,9 +141,9 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE);
 * address. Although ACPICA adheres to the ACPI specification which
 * requires the use of the corresponding 64-bit address if it is non-zero,
 * some machines have been found to have a corrupted non-zero 64-bit
- * address. Default is FALSE, do not favor the 32-bit addresses.
+ * address. Default is TRUE, favor the 32-bit addresses.
 */
-ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, FALSE);
+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
 /*
 * Optionally truncate I/O addresses to 16 bits. Provides compatibility
diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c
index 68d97441432c..12878e1982f7 100644
--- a/drivers/acpi/acpica/exfield.c
+++ b/drivers/acpi/acpica/exfield.c
@@ -45,10 +45,71 @@
 #include "accommon.h"
 #include "acdispat.h"
 #include "acinterp.h"
+#include "amlcode.h"
 #define _COMPONENT          ACPI_EXECUTER
 ACPI_MODULE_NAME("exfield")
+/* Local prototypes */
+static u32
+acpi_ex_get_serial_access_length(u32 accessor_type, u32 access_length);
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_get_serial_access_bytes
+ *
+ * PARAMETERS:  accessor_type   - The type of the protocol indicated by region
+ *                                field access attributes
+ *              access_length   - The access length of the region field
+ *
+ * RETURN:      Decoded access length
+ *
+ * DESCRIPTION: This routine returns the length of the generic_serial_bus
+ *              protocol bytes
+ *
+ ******************************************************************************/
+static u32
+acpi_ex_get_serial_access_length(u32 accessor_type, u32 access_length)
+{
+        u32 length;
+        switch (accessor_type) {
+        case AML_FIELD_ATTRIB_QUICK:
+                length = 0;
+                break;
+        case AML_FIELD_ATTRIB_SEND_RCV:
+        case AML_FIELD_ATTRIB_BYTE:
+                length = 1;
+                break;
+        case AML_FIELD_ATTRIB_WORD:
+        case AML_FIELD_ATTRIB_WORD_CALL:
+                length = 2;
+                break;
+        case AML_FIELD_ATTRIB_MULTIBYTE:
+        case AML_FIELD_ATTRIB_RAW_BYTES:
+        case AML_FIELD_ATTRIB_RAW_PROCESS:
+                length = access_length;
+                break;
+        case AML_FIELD_ATTRIB_BLOCK:
+        case AML_FIELD_ATTRIB_BLOCK_CALL:
+        default:
+                length = ACPI_GSBUS_BUFFER_SIZE;
+                break;
+        }
+        return (length);
+}
 /*******************************************************************************
 *
 * FUNCTION:    acpi_ex_read_data_from_field
@@ -63,8 +124,9 @@ ACPI_MODULE_NAME("exfield")
 *              Buffer, depending on the size of the field.
 *
 ******************************************************************************/
 acpi_status
-acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
+acpi_ex_read_data_from_field(struct acpi_walk_state * walk_state,
                             union acpi_operand_object *obj_desc,
                             union acpi_operand_object **ret_buffer_desc)
 {
@@ -73,6 +135,7 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
        acpi_size length;
        void *buffer;
        u32 function;
+        u16 accessor_type;
        ACPI_FUNCTION_TRACE_PTR(ex_read_data_from_field, obj_desc);
@@ -116,9 +179,22 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
                            ACPI_READ | (obj_desc->field.attribute << 16);
                } else if (obj_desc->field.region_obj->region.space_id ==
                           ACPI_ADR_SPACE_GSBUS) {
-                        length = ACPI_GSBUS_BUFFER_SIZE;
+                        accessor_type = obj_desc->field.attribute;
-                        function =
+                        length = acpi_ex_get_serial_access_length(accessor_type,
-                            ACPI_READ | (obj_desc->field.attribute << 16);
+                                                                  obj_desc->
+                                                                  field.
+                                                                  access_length);
+                        /*
+                         * Add additional 2 bytes for modeled generic_serial_bus data buffer:
+                         * typedef struct {
+                         *     BYTEStatus; // Byte 0 of the data buffer
+                         *     BYTELength; // Byte 1 of the data buffer
+                         *     BYTE[x-1]Data; // Bytes 2-x of the arbitrary length data buffer,
+                         * }
+                         */
+                        length += 2;
+                        function = ACPI_READ | (accessor_type << 16);
                } else {        /* IPMI */
                        length = ACPI_IPMI_BUFFER_SIZE;
@@ -231,6 +307,7 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc,
        void *buffer;
        union acpi_operand_object *buffer_desc;
        u32 function;
+        u16 accessor_type;
        ACPI_FUNCTION_TRACE_PTR(ex_write_data_to_field, obj_desc);
@@ -284,9 +361,22 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc,
                            ACPI_WRITE | (obj_desc->field.attribute << 16);
                } else if (obj_desc->field.region_obj->region.space_id ==
                           ACPI_ADR_SPACE_GSBUS) {
-                        length = ACPI_GSBUS_BUFFER_SIZE;
+                        accessor_type = obj_desc->field.attribute;
-                        function =
+                        length = acpi_ex_get_serial_access_length(accessor_type,
-                            ACPI_WRITE | (obj_desc->field.attribute << 16);
+                                                                  obj_desc->
+                                                                  field.
+                                                                  access_length);
+                        /*
+                         * Add additional 2 bytes for modeled generic_serial_bus data buffer:
+                         * typedef struct {
+                         *     BYTEStatus; // Byte 0 of the data buffer
+                         *     BYTELength; // Byte 1 of the data buffer
+                         *     BYTE[x-1]Data; // Bytes 2-x of the arbitrary length data buffer,
+                         * }
+                         */
+                        length += 2;
+                        function = ACPI_WRITE | (accessor_type << 16);
                } else {        /* IPMI */
                        length = ACPI_IPMI_BUFFER_SIZE;
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index a4702eee91a8..9fb85f38de90 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -461,6 +461,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
        u32 table_count;
        struct acpi_table_header *table;
        acpi_physical_address address;
+        acpi_physical_address rsdt_address;
        u32 length;
        u8 *table_entry;
        acpi_status status;
@@ -488,11 +489,14 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
                 * as per the ACPI specification.
                 */
                address = (acpi_physical_address) rsdp->xsdt_physical_address;
+                rsdt_address =
+                    (acpi_physical_address) rsdp->rsdt_physical_address;
                table_entry_size = ACPI_XSDT_ENTRY_SIZE;
        } else {
                /* Root table is an RSDT (32-bit physical addresses) */
                address = (acpi_physical_address) rsdp->rsdt_physical_address;
+                rsdt_address = address;
                table_entry_size = ACPI_RSDT_ENTRY_SIZE;
        }
@@ -515,8 +519,7 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
                        /* Fall back to the RSDT */
-                        address =
+                        address = rsdt_address;
-                            (acpi_physical_address) rsdp->rsdt_physical_address;
                        table_entry_size = ACPI_RSDT_ENTRY_SIZE;
                }
        }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 9a2c63b20050..6e7b2a12860d 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -36,6 +36,12 @@
 #include <linux/suspend.h>
 #include <asm/unaligned.h>
+#ifdef CONFIG_ACPI_PROCFS_POWER
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <asm/uaccess.h>
+#endif
 #include <linux/acpi.h>
 #include <linux/power_supply.h>
@@ -64,6 +70,19 @@ static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
+#ifdef CONFIG_ACPI_PROCFS_POWER
+extern struct proc_dir_entry *acpi_lock_battery_dir(void);
+extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
+enum acpi_battery_files {
+        info_tag = 0,
+        state_tag,
+        alarm_tag,
+        ACPI_BATTERY_NUMFILES,
+};
+#endif
 static const struct acpi_device_id battery_device_ids[] = {
        {"PNP0C0A", 0},
        {"", 0},
@@ -299,6 +318,14 @@ static enum power_supply_property energy_battery_props[] = {
        POWER_SUPPLY_PROP_SERIAL_NUMBER,
 };
+#ifdef CONFIG_ACPI_PROCFS_POWER
+inline char *acpi_battery_units(struct acpi_battery *battery)
+{
+        return (battery->power_unit == ACPI_BATTERY_POWER_UNIT_MA) ?
+                "mA" : "mW";
+}
+#endif
 /* --------------------------------------------------------------------------
                               Battery Management
   -------------------------------------------------------------------------- */
@@ -717,6 +744,279 @@ static void acpi_battery_refresh(struct acpi_battery *battery)
 }
 /* --------------------------------------------------------------------------
+                              FS Interface (/proc)
+   -------------------------------------------------------------------------- */
+#ifdef CONFIG_ACPI_PROCFS_POWER
+static struct proc_dir_entry *acpi_battery_dir;
+static int acpi_battery_print_info(struct seq_file *seq, int result)
+{
+        struct acpi_battery *battery = seq->private;
+        if (result)
+                goto end;
+        seq_printf(seq, "present:                 %s\n",
+                   acpi_battery_present(battery) ? "yes" : "no");
+        if (!acpi_battery_present(battery))
+                goto end;
+        if (battery->design_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "design capacity:         unknown\n");
+        else
+                seq_printf(seq, "design capacity:         %d %sh\n",
+                           battery->design_capacity,
+                           acpi_battery_units(battery));
+        if (battery->full_charge_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "last full capacity:      unknown\n");
+        else
+                seq_printf(seq, "last full capacity:      %d %sh\n",
+                           battery->full_charge_capacity,
+                           acpi_battery_units(battery));
+        seq_printf(seq, "battery technology:      %srechargeable\n",
+                   (!battery->technology)?"non-":"");
+        if (battery->design_voltage == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "design voltage:          unknown\n");
+        else
+                seq_printf(seq, "design voltage:          %d mV\n",
+                           battery->design_voltage);
+        seq_printf(seq, "design capacity warning: %d %sh\n",
+                   battery->design_capacity_warning,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "design capacity low:     %d %sh\n",
+                   battery->design_capacity_low,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "cycle count:             %i\n", battery->cycle_count);
+        seq_printf(seq, "capacity granularity 1:  %d %sh\n",
+                   battery->capacity_granularity_1,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "capacity granularity 2:  %d %sh\n",
+                   battery->capacity_granularity_2,
+                   acpi_battery_units(battery));
+        seq_printf(seq, "model number:            %s\n", battery->model_number);
+        seq_printf(seq, "serial number:           %s\n", battery->serial_number);
+        seq_printf(seq, "battery type:            %s\n", battery->type);
+        seq_printf(seq, "OEM info:                %s\n", battery->oem_info);
+      end:
+        if (result)
+                seq_printf(seq, "ERROR: Unable to read battery info\n");
+        return result;
+}
+static int acpi_battery_print_state(struct seq_file *seq, int result)
+{
+        struct acpi_battery *battery = seq->private;
+        if (result)
+                goto end;
+        seq_printf(seq, "present:                 %s\n",
+                   acpi_battery_present(battery) ? "yes" : "no");
+        if (!acpi_battery_present(battery))
+                goto end;
+        seq_printf(seq, "capacity state:          %s\n",
+                        (battery->state & 0x04) ? "critical" : "ok");
+        if ((battery->state & 0x01) && (battery->state & 0x02))
+                seq_printf(seq,
+                           "charging state:          charging/discharging\n");
+        else if (battery->state & 0x01)
+                seq_printf(seq, "charging state:          discharging\n");
+        else if (battery->state & 0x02)
+                seq_printf(seq, "charging state:          charging\n");
+        else
+                seq_printf(seq, "charging state:          charged\n");
+        if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "present rate:            unknown\n");
+        else
+                seq_printf(seq, "present rate:            %d %s\n",
+                           battery->rate_now, acpi_battery_units(battery));
+        if (battery->capacity_now == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "remaining capacity:      unknown\n");
+        else
+                seq_printf(seq, "remaining capacity:      %d %sh\n",
+                           battery->capacity_now, acpi_battery_units(battery));
+        if (battery->voltage_now == ACPI_BATTERY_VALUE_UNKNOWN)
+                seq_printf(seq, "present voltage:         unknown\n");
+        else
+                seq_printf(seq, "present voltage:         %d mV\n",
+                           battery->voltage_now);
+      end:
+        if (result)
+                seq_printf(seq, "ERROR: Unable to read battery state\n");
+        return result;
+}
+static int acpi_battery_print_alarm(struct seq_file *seq, int result)
+{
+        struct acpi_battery *battery = seq->private;
+        if (result)
+                goto end;
+        if (!acpi_battery_present(battery)) {
+                seq_printf(seq, "present:                 no\n");
+                goto end;
+        }
+        seq_printf(seq, "alarm:                   ");
+        if (!battery->alarm)
+                seq_printf(seq, "unsupported\n");
+        else
+                seq_printf(seq, "%u %sh\n", battery->alarm,
+                                acpi_battery_units(battery));
+      end:
+        if (result)
+                seq_printf(seq, "ERROR: Unable to read battery alarm\n");
+        return result;
+}
+static ssize_t acpi_battery_write_alarm(struct file *file,
+                                        const char __user * buffer,
+                                        size_t count, loff_t * ppos)
+{
+        int result = 0;
+        char alarm_string[12] = { '\0' };
+        struct seq_file *m = file->private_data;
+        struct acpi_battery *battery = m->private;
+        if (!battery || (count > sizeof(alarm_string) - 1))
+                return -EINVAL;
+        if (!acpi_battery_present(battery)) {
+                result = -ENODEV;
+                goto end;
+        }
+        if (copy_from_user(alarm_string, buffer, count)) {
+                result = -EFAULT;
+                goto end;
+        }
+        alarm_string[count] = '\0';
+        battery->alarm = simple_strtol(alarm_string, NULL, 0);
+        result = acpi_battery_set_alarm(battery);
+      end:
+        if (!result)
+                return count;
+        return result;
+}
+typedef int(*print_func)(struct seq_file *seq, int result);
+static print_func acpi_print_funcs[ACPI_BATTERY_NUMFILES] = {
+        acpi_battery_print_info,
+        acpi_battery_print_state,
+        acpi_battery_print_alarm,
+};
+static int acpi_battery_read(int fid, struct seq_file *seq)
+{
+        struct acpi_battery *battery = seq->private;
+        int result = acpi_battery_update(battery);
+        return acpi_print_funcs[fid](seq, result);
+}
+#define DECLARE_FILE_FUNCTIONS(_name) \
+static int acpi_battery_read_##_name(struct seq_file *seq, void *offset) \
+{ \
+        return acpi_battery_read(_name##_tag, seq); \
+} \
+static int acpi_battery_##_name##_open_fs(struct inode *inode, struct file *file) \
+{ \
+        return single_open(file, acpi_battery_read_##_name, PDE_DATA(inode)); \
+}
+DECLARE_FILE_FUNCTIONS(info);
+DECLARE_FILE_FUNCTIONS(state);
+DECLARE_FILE_FUNCTIONS(alarm);
+#undef DECLARE_FILE_FUNCTIONS
+#define FILE_DESCRIPTION_RO(_name) \
+        { \
+        .name = __stringify(_name), \
+        .mode = S_IRUGO, \
+        .ops = { \
+                .open = acpi_battery_##_name##_open_fs, \
+                .read = seq_read, \
+                .llseek = seq_lseek, \
+                .release = single_release, \
+                .owner = THIS_MODULE, \
+                }, \
+        }
+#define FILE_DESCRIPTION_RW(_name) \
+        { \
+        .name = __stringify(_name), \
+        .mode = S_IFREG | S_IRUGO | S_IWUSR, \
+        .ops = { \
+                .open = acpi_battery_##_name##_open_fs, \
+                .read = seq_read, \
+                .llseek = seq_lseek, \
+                .write = acpi_battery_write_##_name, \
+                .release = single_release, \
+                .owner = THIS_MODULE, \
+                }, \
+        }
+static const struct battery_file {
+        struct file_operations ops;
+        umode_t mode;
+        const char *name;
+} acpi_battery_file[] = {
+        FILE_DESCRIPTION_RO(info),
+        FILE_DESCRIPTION_RO(state),
+        FILE_DESCRIPTION_RW(alarm),
+};
+#undef FILE_DESCRIPTION_RO
+#undef FILE_DESCRIPTION_RW
+static int acpi_battery_add_fs(struct acpi_device *device)
+{
+        struct proc_dir_entry *entry = NULL;
+        int i;
+        printk(KERN_WARNING PREFIX "Deprecated procfs I/F for battery is loaded,"
+                        " please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
+        if (!acpi_device_dir(device)) {
+                acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device),
+                                                     acpi_battery_dir);
+                if (!acpi_device_dir(device))
+                        return -ENODEV;
+        }
+        for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i) {
+                entry = proc_create_data(acpi_battery_file[i].name,
+                                         acpi_battery_file[i].mode,
+                                         acpi_device_dir(device),
+                                         &acpi_battery_file[i].ops,
+                                         acpi_driver_data(device));
+                if (!entry)
+                        return -ENODEV;
+        }
+        return 0;
+}
+static void acpi_battery_remove_fs(struct acpi_device *device)
+{
+        int i;
+        if (!acpi_device_dir(device))
+                return;
+        for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i)
+                remove_proc_entry(acpi_battery_file[i].name,
+                                  acpi_device_dir(device));
+        remove_proc_entry(acpi_device_bid(device), acpi_battery_dir);
+        acpi_device_dir(device) = NULL;
+}
+#endif
+/* --------------------------------------------------------------------------
                                 Driver Interface
   -------------------------------------------------------------------------- */
@@ -790,6 +1090,15 @@ static int acpi_battery_add(struct acpi_device *device)
        result = acpi_battery_update(battery);
        if (result)
                goto fail;
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        result = acpi_battery_add_fs(device);
+#endif
+        if (result) {
+#ifdef CONFIG_ACPI_PROCFS_POWER
+                acpi_battery_remove_fs(device);
+#endif
+                goto fail;
+        }
        printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
                ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
@@ -816,6 +1125,9 @@ static int acpi_battery_remove(struct acpi_device *device)
                return -EINVAL;
        battery = acpi_driver_data(device);
        unregister_pm_notifier(&battery->pm_nb);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_battery_remove_fs(device);
+#endif
        sysfs_remove_battery(battery);
        mutex_destroy(&battery->lock);
        mutex_destroy(&battery->sysfs_lock);
@@ -866,7 +1178,19 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
        if (dmi_check_system(bat_dmi_table))
                battery_bix_broken_package = 1;
-        acpi_bus_register_driver(&acpi_battery_driver);
+        
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_battery_dir = acpi_lock_battery_dir();
+        if (!acpi_battery_dir)
+                return;
+#endif
+        if (acpi_bus_register_driver(&acpi_battery_driver) < 0) {
+#ifdef CONFIG_ACPI_PROCFS_POWER
+                acpi_unlock_battery_dir(acpi_battery_dir);
+#endif
+                return;
+        }
+        return;
 }
 static int __init acpi_battery_init(void)
@@ -878,6 +1202,9 @@ static int __init acpi_battery_init(void)
 static void __exit acpi_battery_exit(void)
 {
        acpi_bus_unregister_driver(&acpi_battery_driver);
+#ifdef CONFIG_ACPI_PROCFS_POWER
+        acpi_unlock_battery_dir(acpi_battery_dir);
+#endif
 }
 module_init(acpi_battery_init);
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index afec4526c48a..3d8413d02a97 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -314,6 +314,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
                },
        },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "Dell Inspiron 7737",
+        .matches = {
+                    DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                    DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7737"),
+                },
+        },
        /*
         * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
@@ -374,6 +382,19 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T500"),
                },
        },
+        /*
+         * Without this this EEEpc exports a non working WMI interface, with
+         * this it exports a working "good old" eeepc_laptop interface, fixing
+         * both brightness control, and rfkill not working.
+         */
+        {
+        .callback = dmi_enable_osi_linux,
+        .ident = "Asus EEE PC 1015PX",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "1015PX"),
+                },
+        },
        {}
 };
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index e7e5844c87d0..cf925c4f36b7 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -380,9 +380,8 @@ static void acpi_bus_notify(acpi_handle handle, u32 type, void *data)
                break;
        default:
-                acpi_handle_warn(handle, "Unsupported event type 0x%x\n", type);
+                acpi_handle_debug(handle, "Unknown event type 0x%x\n", type);
-                ost_code = ACPI_OST_SC_UNRECOGNIZED_NOTIFY;
+                break;
-                goto err;
        }
        adev = acpi_bus_get_acpi_device(handle);
diff --git a/drivers/acpi/cm_sbs.c b/drivers/acpi/cm_sbs.c
new file mode 100644
index 000000000000..6c9ee68e46fb
--- /dev/null
+++ b/drivers/acpi/cm_sbs.c
@@ -0,0 +1,105 @@
+/*
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or (at
+ *  your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/acpi.h>
+#include <linux/types.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <acpi/acpi_bus.h>
+#include <acpi/acpi_drivers.h>
+#define PREFIX "ACPI: "
+ACPI_MODULE_NAME("cm_sbs");
+#define ACPI_AC_CLASS           "ac_adapter"
+#define ACPI_BATTERY_CLASS      "battery"
+#define _COMPONENT              ACPI_SBS_COMPONENT
+static struct proc_dir_entry *acpi_ac_dir;
+static struct proc_dir_entry *acpi_battery_dir;
+static DEFINE_MUTEX(cm_sbs_mutex);
+static int lock_ac_dir_cnt;
+static int lock_battery_dir_cnt;
+struct proc_dir_entry *acpi_lock_ac_dir(void)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (!acpi_ac_dir)
+                acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir);
+        if (acpi_ac_dir) {
+                lock_ac_dir_cnt++;
+        } else {
+                printk(KERN_ERR PREFIX
+                                  "Cannot create %s\n", ACPI_AC_CLASS);
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return acpi_ac_dir;
+}
+EXPORT_SYMBOL(acpi_lock_ac_dir);
+void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir_param)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (acpi_ac_dir_param)
+                lock_ac_dir_cnt--;
+        if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) {
+                remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
+                acpi_ac_dir = NULL;
+        }
+        mutex_unlock(&cm_sbs_mutex);
+}
+EXPORT_SYMBOL(acpi_unlock_ac_dir);
+struct proc_dir_entry *acpi_lock_battery_dir(void)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (!acpi_battery_dir) {
+                acpi_battery_dir =
+                    proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir);
+        }
+        if (acpi_battery_dir) {
+                lock_battery_dir_cnt++;
+        } else {
+                printk(KERN_ERR PREFIX
+                                  "Cannot create %s\n", ACPI_BATTERY_CLASS);
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return acpi_battery_dir;
+}
+EXPORT_SYMBOL(acpi_lock_battery_dir);
+void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir_param)
+{
+        mutex_lock(&cm_sbs_mutex);
+        if (acpi_battery_dir_param)
+                lock_battery_dir_cnt--;
+        if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param
+            && acpi_battery_dir) {
+                remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
+                acpi_battery_dir = NULL;
+        }
+        mutex_unlock(&cm_sbs_mutex);
+        return;
+}
+EXPORT_SYMBOL(acpi_unlock_battery_dir);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index d7d32c28829b..ad11ba4a412d 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -206,13 +206,13 @@ unlock:
        spin_unlock_irqrestore(&ec->lock, flags);
 }
-static int acpi_ec_sync_query(struct acpi_ec *ec);
+static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data);
 static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
 {
        if (state & ACPI_EC_FLAG_SCI) {
                if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
-                        return acpi_ec_sync_query(ec);
+                        return acpi_ec_sync_query(ec, NULL);
        }
        return 0;
 }
@@ -443,10 +443,8 @@ acpi_handle ec_get_handle(void)
 EXPORT_SYMBOL(ec_get_handle);
-static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
 /*
- * Clears stale _Q events that might have accumulated in the EC.
+ * Process _Q events that might have accumulated in the EC.
 * Run with locked ec mutex.
 */
 static void acpi_ec_clear(struct acpi_ec *ec)
@@ -455,7 +453,7 @@ static void acpi_ec_clear(struct acpi_ec *ec)
        u8 value = 0;
        for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
-                status = acpi_ec_query_unlocked(ec, &value);
+                status = acpi_ec_sync_query(ec, &value);
                if (status || !value)
                        break;
        }
@@ -582,13 +580,18 @@ static void acpi_ec_run(void *cxt)
        kfree(handler);
 }
-static int acpi_ec_sync_query(struct acpi_ec *ec)
+static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data)
 {
        u8 value = 0;
        int status;
        struct acpi_ec_query_handler *handler, *copy;
-        if ((status = acpi_ec_query_unlocked(ec, &value)))
+        status = acpi_ec_query_unlocked(ec, &value);
+        if (data)
+                *data = value;
+        if (status)
                return status;
        list_for_each_entry(handler, &ec->list, node) {
                if (value == handler->query_bit) {
                        /* have custom handler for this bit */
@@ -612,7 +615,7 @@ static void acpi_ec_gpe_query(void *ec_cxt)
        if (!ec)
                return;
        mutex_lock(&ec->mutex);
-        acpi_ec_sync_query(ec);
+        acpi_ec_sync_query(ec, NULL);
        mutex_unlock(&ec->mutex);
 }
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index c1e31a41f949..25bbc55dca89 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -1278,8 +1278,8 @@ static int __init acpi_thermal_init(void)
 static void __exit acpi_thermal_exit(void)
 {
-        destroy_workqueue(acpi_thermal_pm_queue);
        acpi_bus_unregister_driver(&acpi_thermal_driver);
+        destroy_workqueue(acpi_thermal_pm_queue);
        return;
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 8b6990e417ec..f8bc5a755dda 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -457,10 +457,10 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
        },
        {
         .callback = video_set_use_native_backlight,
-         .ident = "ThinkPad T430s",
+         .ident = "ThinkPad T430 and T430s",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430s"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T430"),
                },
        },
        {
@@ -472,7 +472,7 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                },
        },
        {
-        .callback = video_set_use_native_backlight,
+         .callback = video_set_use_native_backlight,
        .ident = "ThinkPad X1 Carbon",
        .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
@@ -500,7 +500,7 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
         .ident = "Dell Inspiron 7520",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "Inspiron 7520"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7520"),
                },
        },
        {
@@ -513,6 +513,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
        },
        {
         .callback = video_set_use_native_backlight,
+         .ident = "Acer Aspire 5742G",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5742G"),
+                },
+        },
+        {
+         .callback = video_set_use_native_backlight,
         .ident = "Acer Aspire V5-431",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 20e03a7eb8b4..0033fafc470b 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -116,7 +116,7 @@ config AHCI_ST
 config AHCI_IMX
        tristate "Freescale i.MX AHCI SATA support"
-        depends on MFD_SYSCON
+        depends on MFD_SYSCON && (ARCH_MXC || COMPILE_TEST)
        help
          This option enables support for the Freescale i.MX SoC's
          onboard AHCI SATA.
@@ -134,8 +134,7 @@ config AHCI_SUNXI
 config AHCI_XGENE
        tristate "APM X-Gene 6.0Gbps AHCI SATA host controller support"
-        depends on ARM64 || COMPILE_TEST
+        depends on PHY_XGENE
-        select PHY_XGENE
        help
         This option enables support for APM X-Gene SoC SATA host controller.
@@ -816,7 +815,7 @@ config PATA_AT32
 config PATA_AT91
        tristate "PATA support for AT91SAM9260"
-        depends on ARM && ARCH_AT91
+        depends on ARM && SOC_AT91SAM9
        help
          This option enables support for IDE devices on the Atmel AT91SAM9260 SoC.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 5a0bf8ed649b..60707814a84b 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1115,6 +1115,17 @@ static bool ahci_broken_online(struct pci_dev *pdev)
        return pdev->bus->number == (val >> 8) && pdev->devfn == (val & 0xff);
 }
+static bool ahci_broken_devslp(struct pci_dev *pdev)
+{
+        /* device with broken DEVSLP but still showing SDS capability */
+        static const struct pci_device_id ids[] = {
+                { PCI_VDEVICE(INTEL, 0x0f23)}, /* Valleyview SoC */
+                {}
+        };
+        return pci_match_id(ids, pdev);
+}
 #ifdef CONFIG_ATA_ACPI
 static void ahci_gtf_filter_workaround(struct ata_host *host)
 {
@@ -1164,9 +1175,9 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 #endif
 static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
-                         struct ahci_host_priv *hpriv)
+                                struct ahci_host_priv *hpriv)
 {
-        int nvec;
+        int rc, nvec;
        if (hpriv->flags & AHCI_HFLAG_NO_MSI)
                goto intx;
@@ -1183,12 +1194,19 @@ static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
        if (nvec < n_ports)
                goto single_msi;
-        nvec = pci_enable_msi_range(pdev, nvec, nvec);
+        rc = pci_enable_msi_exact(pdev, nvec);
-        if (nvec == -ENOSPC)
+        if (rc == -ENOSPC)
                goto single_msi;
-        else if (nvec < 0)
+        else if (rc < 0)
                goto intx;
+        /* fallback to single MSI mode if the controller enforced MRSM mode */
+        if (readl(hpriv->mmio + HOST_CTL) & HOST_MRSM) {
+                pci_disable_msi(pdev);
+                printk(KERN_INFO "ahci: MRSM is on, fallback to single MSI\n");
+                goto single_msi;
+        }
        return nvec;
 single_msi:
@@ -1232,18 +1250,18 @@ int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis)
                return rc;
        for (i = 0; i < host->n_ports; i++) {
-                const char* desc;
                struct ahci_port_priv *pp = host->ports[i]->private_data;
-                /* pp is NULL for dummy ports */
+                /* Do not receive interrupts sent by dummy ports */
-                if (pp)
+                if (!pp) {
-                        desc = pp->irq_desc;
+                        disable_irq(irq + i);
-                else
+                        continue;
-                        desc = dev_driver_string(host->dev);
+                }
-                rc = devm_request_threaded_irq(host->dev,
+                rc = devm_request_threaded_irq(host->dev, irq + i,
-                        irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED,
+                                               ahci_hw_interrupt,
-                        desc, host->ports[i]);
+                                               ahci_thread_fn, IRQF_SHARED,
+                                               pp->irq_desc, host->ports[i]);
                if (rc)
                        goto out_free_irqs;
        }
@@ -1357,6 +1375,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        hpriv->mmio = pcim_iomap_table(pdev)[ahci_pci_bar];
+        /* must set flag prior to save config in order to take effect */
+        if (ahci_broken_devslp(pdev))
+                hpriv->flags |= AHCI_HFLAG_NO_DEVSLP;
        /* save initial config */
        ahci_pci_save_initial_config(pdev, hpriv);
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 51af275b3388..af63c75c2001 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -94,6 +94,7 @@ enum {
        /* HOST_CTL bits */
        HOST_RESET              = (1 << 0),  /* reset controller; self-clear */
        HOST_IRQ_EN             = (1 << 1),  /* global IRQ enable */
+        HOST_MRSM               = (1 << 2),  /* MSI Revert to Single Message */
        HOST_AHCI_EN            = (1 << 31), /* AHCI enabled */
        /* HOST_CAP bits */
@@ -235,6 +236,7 @@ enum {
                                                        port start (wait until
                                                        error-handling stage) */
        AHCI_HFLAG_MULTI_MSI            = (1 << 16), /* multiple PCI MSIs */
+        AHCI_HFLAG_NO_DEVSLP            = (1 << 17), /* no device sleep */
        /* ap->flags bits */
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
index 497c7abe1c7d..8befeb69eeb1 100644
--- a/drivers/ata/ahci_imx.c
+++ b/drivers/ata/ahci_imx.c
@@ -29,9 +29,25 @@
 #include "ahci.h"
 enum {
-        PORT_PHY_CTL = 0x178,                   /* Port0 PHY Control */
+        /* Timer 1-ms Register */
-        PORT_PHY_CTL_PDDQ_LOC = 0x100000,       /* PORT_PHY_CTL bits */
+        IMX_TIMER1MS                            = 0x00e0,
-        HOST_TIMER1MS = 0xe0,                   /* Timer 1-ms */
+        /* Port0 PHY Control Register */
+        IMX_P0PHYCR                             = 0x0178,
+        IMX_P0PHYCR_TEST_PDDQ                   = 1 << 20,
+        IMX_P0PHYCR_CR_READ                     = 1 << 19,
+        IMX_P0PHYCR_CR_WRITE                    = 1 << 18,
+        IMX_P0PHYCR_CR_CAP_DATA                 = 1 << 17,
+        IMX_P0PHYCR_CR_CAP_ADDR                 = 1 << 16,
+        /* Port0 PHY Status Register */
+        IMX_P0PHYSR                             = 0x017c,
+        IMX_P0PHYSR_CR_ACK                      = 1 << 18,
+        IMX_P0PHYSR_CR_DATA_OUT                 = 0xffff << 0,
+        /* Lane0 Output Status Register */
+        IMX_LANE0_OUT_STAT                      = 0x2003,
+        IMX_LANE0_OUT_STAT_RX_PLL_STATE         = 1 << 1,
+        /* Clock Reset Register */
+        IMX_CLOCK_RESET                         = 0x7f3f,
+        IMX_CLOCK_RESET_RESET                   = 1 << 0,
 };
 enum ahci_imx_type {
@@ -54,9 +70,149 @@ MODULE_PARM_DESC(hotplug, "AHCI IMX hot-plug support (0=Don't support, 1=support
 static void ahci_imx_host_stop(struct ata_host *host);
+static int imx_phy_crbit_assert(void __iomem *mmio, u32 bit, bool assert)
+{
+        int timeout = 10;
+        u32 crval;
+        u32 srval;
+        /* Assert or deassert the bit */
+        crval = readl(mmio + IMX_P0PHYCR);
+        if (assert)
+                crval |= bit;
+        else
+                crval &= ~bit;
+        writel(crval, mmio + IMX_P0PHYCR);
+        /* Wait for the cr_ack signal */
+        do {
+                srval = readl(mmio + IMX_P0PHYSR);
+                if ((assert ? srval : ~srval) & IMX_P0PHYSR_CR_ACK)
+                        break;
+                usleep_range(100, 200);
+        } while (--timeout);
+        return timeout ? 0 : -ETIMEDOUT;
+}
+static int imx_phy_reg_addressing(u16 addr, void __iomem *mmio)
+{
+        u32 crval = addr;
+        int ret;
+        /* Supply the address on cr_data_in */
+        writel(crval, mmio + IMX_P0PHYCR);
+        /* Assert the cr_cap_addr signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_ADDR, true);
+        if (ret)
+                return ret;
+        /* Deassert cr_cap_addr */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_ADDR, false);
+        if (ret)
+                return ret;
+        return 0;
+}
+static int imx_phy_reg_write(u16 val, void __iomem *mmio)
+{
+        u32 crval = val;
+        int ret;
+        /* Supply the data on cr_data_in */
+        writel(crval, mmio + IMX_P0PHYCR);
+        /* Assert the cr_cap_data signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_DATA, true);
+        if (ret)
+                return ret;
+        /* Deassert cr_cap_data */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_CAP_DATA, false);
+        if (ret)
+                return ret;
+        if (val & IMX_CLOCK_RESET_RESET) {
+                /*
+                 * In case we're resetting the phy, it's unable to acknowledge,
+                 * so we return immediately here.
+                 */
+                crval |= IMX_P0PHYCR_CR_WRITE;
+                writel(crval, mmio + IMX_P0PHYCR);
+                goto out;
+        }
+        /* Assert the cr_write signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_WRITE, true);
+        if (ret)
+                return ret;
+        /* Deassert cr_write */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_WRITE, false);
+        if (ret)
+                return ret;
+out:
+        return 0;
+}
+static int imx_phy_reg_read(u16 *val, void __iomem *mmio)
+{
+        int ret;
+        /* Assert the cr_read signal */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_READ, true);
+        if (ret)
+                return ret;
+        /* Capture the data from cr_data_out[] */
+        *val = readl(mmio + IMX_P0PHYSR) & IMX_P0PHYSR_CR_DATA_OUT;
+        /* Deassert cr_read */
+        ret = imx_phy_crbit_assert(mmio, IMX_P0PHYCR_CR_READ, false);
+        if (ret)
+                return ret;
+        return 0;
+}
+static int imx_sata_phy_reset(struct ahci_host_priv *hpriv)
+{
+        void __iomem *mmio = hpriv->mmio;
+        int timeout = 10;
+        u16 val;
+        int ret;
+        /* Reset SATA PHY by setting RESET bit of PHY register CLOCK_RESET */
+        ret = imx_phy_reg_addressing(IMX_CLOCK_RESET, mmio);
+        if (ret)
+                return ret;
+        ret = imx_phy_reg_write(IMX_CLOCK_RESET_RESET, mmio);
+        if (ret)
+                return ret;
+        /* Wait for PHY RX_PLL to be stable */
+        do {
+                usleep_range(100, 200);
+                ret = imx_phy_reg_addressing(IMX_LANE0_OUT_STAT, mmio);
+                if (ret)
+                        return ret;
+                ret = imx_phy_reg_read(&val, mmio);
+                if (ret)
+                        return ret;
+                if (val & IMX_LANE0_OUT_STAT_RX_PLL_STATE)
+                        break;
+        } while (--timeout);
+        return timeout ? 0 : -ETIMEDOUT;
+}
 static int imx_sata_enable(struct ahci_host_priv *hpriv)
 {
        struct imx_ahci_priv *imxpriv = hpriv->plat_data;
+        struct device *dev = &imxpriv->ahci_pdev->dev;
        int ret;
        if (imxpriv->no_device)
@@ -101,6 +257,14 @@ static int imx_sata_enable(struct ahci_host_priv *hpriv)
                regmap_update_bits(imxpriv->gpr, IOMUXC_GPR13,
                                   IMX6Q_GPR13_SATA_MPLL_CLK_EN,
                                   IMX6Q_GPR13_SATA_MPLL_CLK_EN);
+                usleep_range(100, 200);
+                ret = imx_sata_phy_reset(hpriv);
+                if (ret) {
+                        dev_err(dev, "failed to reset phy: %d\n", ret);
+                        goto disable_regulator;
+                }
        }
        usleep_range(1000, 2000);
@@ -156,8 +320,8 @@ static void ahci_imx_error_handler(struct ata_port *ap)
         * without full reset once the pddq mode is enabled making it
         * impossible to use as part of libata LPM.
         */
-        reg_val = readl(mmio + PORT_PHY_CTL);
+        reg_val = readl(mmio + IMX_P0PHYCR);
-        writel(reg_val | PORT_PHY_CTL_PDDQ_LOC, mmio + PORT_PHY_CTL);
+        writel(reg_val | IMX_P0PHYCR_TEST_PDDQ, mmio + IMX_P0PHYCR);
        imx_sata_disable(hpriv);
        imxpriv->no_device = true;
 }
@@ -217,6 +381,7 @@ static int imx_ahci_probe(struct platform_device *pdev)
        if (!imxpriv)
                return -ENOMEM;
+        imxpriv->ahci_pdev = pdev;
        imxpriv->no_device = false;
        imxpriv->first_time = true;
        imxpriv->type = (enum ahci_imx_type)of_id->data;
@@ -248,7 +413,7 @@ static int imx_ahci_probe(struct platform_device *pdev)
        /*
         * Configure the HWINIT bits of the HOST_CAP and HOST_PORTS_IMPL,
-         * and IP vendor specific register HOST_TIMER1MS.
+         * and IP vendor specific register IMX_TIMER1MS.
         * Configure CAP_SSS (support stagered spin up).
         * Implement the port0.
         * Get the ahb clock rate, and configure the TIMER1MS register.
@@ -265,7 +430,7 @@ static int imx_ahci_probe(struct platform_device *pdev)
        }
        reg_val = clk_get_rate(imxpriv->ahb_clk) / 1000;
-        writel(reg_val, hpriv->mmio + HOST_TIMER1MS);
+        writel(reg_val, hpriv->mmio + IMX_TIMER1MS);
        ret = ahci_platform_init_host(pdev, hpriv, &ahci_imx_port_info, 0, 0);
        if (ret)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 6bd4f660b4e1..b9861453fc81 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -452,6 +452,13 @@ void ahci_save_initial_config(struct device *dev,
                cap &= ~HOST_CAP_SNTF;
        }
+        if ((cap2 & HOST_CAP2_SDS) && (hpriv->flags & AHCI_HFLAG_NO_DEVSLP)) {
+                dev_info(dev,
+                         "controller can't do DEVSLP, turning off\n");
+                cap2 &= ~HOST_CAP2_SDS;
+                cap2 &= ~HOST_CAP2_SADM;
+        }
        if (!(cap & HOST_CAP_FBS) && (hpriv->flags & AHCI_HFLAG_YES_FBS)) {
                dev_info(dev, "controller can do FBS, turning on CAP_FBS\n");
                cap |= HOST_CAP_FBS;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index c19734d96d7e..ea83828bfea9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4224,8 +4224,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
        /* devices that don't properly handle queued TRIM commands */
-        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M500*",               "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M550*",               NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M550SSD*",      NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
        /*
         * Some WD SATA-I drives spin up and down erratically when the link
@@ -4792,21 +4794,26 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
 {
        struct ata_queued_cmd *qc = NULL;
-        unsigned int i;
+        unsigned int i, tag;
        /* no command while frozen */
        if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
                return NULL;
-        /* the last tag is reserved for internal command. */
+        for (i = 0; i < ATA_MAX_QUEUE; i++) {
-        for (i = 0; i < ATA_MAX_QUEUE - 1; i++)
+                tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
-                if (!test_and_set_bit(i, &ap->qc_allocated)) {
-                        qc = __ata_qc_from_tag(ap, i);
+                /* the last tag is reserved for internal command. */
+                if (tag == ATA_TAG_INTERNAL)
+                        continue;
+                if (!test_and_set_bit(tag, &ap->qc_allocated)) {
+                        qc = __ata_qc_from_tag(ap, tag);
+                        qc->tag = tag;
+                        ap->last_tag = tag;
                        break;
                }
+        }
-        if (qc)
-                qc->tag = i;
        return qc;
 }
@@ -6307,6 +6314,8 @@ int ata_host_activate(struct ata_host *host, int irq,
 static void ata_port_detach(struct ata_port *ap)
 {
        unsigned long flags;
+        struct ata_link *link;
+        struct ata_device *dev;
        if (!ap->ops->error_handler)
                goto skip_eh;
@@ -6326,6 +6335,13 @@ static void ata_port_detach(struct ata_port *ap)
        cancel_delayed_work_sync(&ap->hotplug_task);
 skip_eh:
+        /* clean up zpodd on port removal */
+        ata_for_each_link(link, ap, HOST_FIRST) {
+                ata_for_each_dev(dev, link, ALL) {
+                        if (zpodd_dev_enabled(dev))
+                                zpodd_exit(dev);
+                }
+        }
        if (ap->pmp_link) {
                int i;
                for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index 6fac524c2f50..4edb1a81f63f 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -898,9 +898,12 @@ static int arasan_cf_probe(struct platform_device *pdev)
        cf_card_detect(acdev, 0);
-        return ata_host_activate(host, acdev->irq, irq_handler, 0,
+        ret = ata_host_activate(host, acdev->irq, irq_handler, 0,
-                        &arasan_cf_sht);
+                                &arasan_cf_sht);
+        if (!ret)
+                return 0;
+        cf_exit(acdev);
 free_clk:
        clk_put(acdev->clk);
        return ret;
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index e9c87274a781..8a66f23af4c4 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -407,12 +407,13 @@ static int pata_at91_probe(struct platform_device *pdev)
        host->private_data = info;
-        return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
+        ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
-                        gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
+                                gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
-                        irq_flags, &pata_at91_sht);
+                                irq_flags, &pata_at91_sht);
+        if (ret)
+                goto err_put;
-        if (!ret)
+        return 0;
-                return 0;
 err_put:
        clk_put(info->mck);
diff --git a/drivers/ata/pata_samsung_cf.c b/drivers/ata/pata_samsung_cf.c
index a79566d05666..0610e78c8a2a 100644
--- a/drivers/ata/pata_samsung_cf.c
+++ b/drivers/ata/pata_samsung_cf.c
@@ -594,9 +594,13 @@ static int __init pata_s3c_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, host);
-        return ata_host_activate(host, info->irq,
+        ret = ata_host_activate(host, info->irq,
-                        info->irq ? pata_s3c_irq : NULL,
+                                info->irq ? pata_s3c_irq : NULL,
-                        0, &pata_s3c_sht);
+                                0, &pata_s3c_sht);
+        if (ret)
+                goto stop_clk;
+        return 0;
 stop_clk:
        clk_disable(info->clk);
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 0dd65281cc65..20da3ad1696b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -614,39 +614,6 @@ void device_remove_bin_file(struct device *dev,
 }
 EXPORT_SYMBOL_GPL(device_remove_bin_file);
-/**
- * device_schedule_callback_owner - helper to schedule a callback for a device
- * @dev: device.
- * @func: callback function to invoke later.
- * @owner: module owning the callback routine
- *
- * Attribute methods must not unregister themselves or their parent device
- * (which would amount to the same thing).  Attempts to do so will deadlock,
- * since unregistration is mutually exclusive with driver callbacks.
- *
- * Instead methods can call this routine, which will attempt to allocate
- * and schedule a workqueue request to call back @func with @dev as its
- * argument in the workqueue's process context.  @dev will be pinned until
- * @func returns.
- *
- * This routine is usually called via the inline device_schedule_callback(),
- * which automatically sets @owner to THIS_MODULE.
- *
- * Returns 0 if the request was submitted, -ENOMEM if storage could not
- * be allocated, -ENODEV if a reference to @owner isn't available.
- *
- * NOTE: This routine won't work if CONFIG_SYSFS isn't set!  It uses an
- * underlying sysfs routine (since it is intended for use by attribute
- * methods), and if sysfs isn't available you'll get nothing but -ENOSYS.
- */
-int device_schedule_callback_owner(struct device *dev,
-                void (*func)(struct device *), struct module *owner)
-{
-        return sysfs_schedule_callback(&dev->kobj,
-                        (void (*)(void *)) func, dev, owner);
-}
-EXPORT_SYMBOL_GPL(device_schedule_callback_owner);
 static void klist_children_get(struct klist_node *n)
 {
        struct device_private *p = to_device_private_parent(n);
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 06051767393f..62ec61e8f84a 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -52,6 +52,7 @@ static DEFINE_MUTEX(deferred_probe_mutex);
 static LIST_HEAD(deferred_probe_pending_list);
 static LIST_HEAD(deferred_probe_active_list);
 static struct workqueue_struct *deferred_wq;
+static atomic_t deferred_trigger_count = ATOMIC_INIT(0);
 /**
 * deferred_probe_work_func() - Retry probing devices in the active list.
@@ -135,6 +136,17 @@ static bool driver_deferred_probe_enable = false;
 * This functions moves all devices from the pending list to the active
 * list and schedules the deferred probe workqueue to process them.  It
 * should be called anytime a driver is successfully bound to a device.
+ *
+ * Note, there is a race condition in multi-threaded probe. In the case where
+ * more than one device is probing at the same time, it is possible for one
+ * probe to complete successfully while another is about to defer. If the second
+ * depends on the first, then it will get put on the pending list after the
+ * trigger event has already occured and will be stuck there.
+ *
+ * The atomic 'deferred_trigger_count' is used to determine if a successful
+ * trigger has occurred in the midst of probing a driver. If the trigger count
+ * changes in the midst of a probe, then deferred processing should be triggered
+ * again.
 */
 static void driver_deferred_probe_trigger(void)
 {
@@ -147,6 +159,7 @@ static void driver_deferred_probe_trigger(void)
         * into the active list so they can be retried by the workqueue
         */
        mutex_lock(&deferred_probe_mutex);
+        atomic_inc(&deferred_trigger_count);
        list_splice_tail_init(&deferred_probe_pending_list,
                              &deferred_probe_active_list);
        mutex_unlock(&deferred_probe_mutex);
@@ -187,8 +200,8 @@ static void driver_bound(struct device *dev)
                return;
        }
-        pr_debug("driver: '%s': %s: bound to device '%s'\n", dev_name(dev),
+        pr_debug("driver: '%s': %s: bound to device '%s'\n", dev->driver->name,
-                 __func__, dev->driver->name);
+                 __func__, dev_name(dev));
        klist_add_tail(&dev->p->knode_driver, &dev->driver->p->klist_devices);
@@ -265,6 +278,7 @@ static DECLARE_WAIT_QUEUE_HEAD(probe_waitqueue);
 static int really_probe(struct device *dev, struct device_driver *drv)
 {
        int ret = 0;
+        int local_trigger_count = atomic_read(&deferred_trigger_count);
        atomic_inc(&probe_count);
        pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
@@ -310,6 +324,9 @@ probe_failed:
                /* Driver requested deferred probing */
                dev_info(dev, "Driver %s requests probe deferral\n", drv->name);
                driver_deferred_probe_add(dev);
+                /* Did a trigger occur while probing? Need to re-trigger if yes */
+                if (local_trigger_count != atomic_read(&deferred_trigger_count))
+                        driver_deferred_probe_trigger();
        } else if (ret != -ENODEV && ret != -ENXIO) {
                /* driver matched but the probe failed */
                printk(KERN_WARNING
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index e714709704e4..5b47210889e0 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -13,6 +13,7 @@
 #include <linux/string.h>
 #include <linux/platform_device.h>
 #include <linux/of_device.h>
+#include <linux/of_irq.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/dma-mapping.h>
@@ -87,7 +88,11 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
                return -ENXIO;
        return dev->archdata.irqs[num];
 #else
-        struct resource *r = platform_get_resource(dev, IORESOURCE_IRQ, num);
+        struct resource *r;
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
+                return of_irq_get(dev->dev.of_node, num);
+        r = platform_get_resource(dev, IORESOURCE_IRQ, num);
        return r ? r->start : -ENXIO;
 #endif
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index bbcbd3c43926..be7c1fb7c0c9 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -39,8 +39,7 @@
 static ssize_t show_##name(struct device *dev,                  \
                struct device_attribute *attr, char *buf)       \
 {                                                               \
-        unsigned int cpu = dev->id;                             \
+        return sprintf(buf, "%d\n", topology_##name(dev->id));  \
-        return sprintf(buf, "%d\n", topology_##name(cpu));      \
 }
 #if defined(topology_thread_cpumask) || defined(topology_core_cpumask) || \
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 8f5565bf34cd..fa9bb742df6e 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3067,7 +3067,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
        int ret;
        while (ptr) {
-                ret = copy_to_user(param, ptr, sizeof(*ptr));
+                struct floppy_raw_cmd cmd = *ptr;
+                cmd.next = NULL;
+                cmd.kernel_data = NULL;
+                ret = copy_to_user(param, &cmd, sizeof(cmd));
                if (ret)
                        return -EFAULT;
                param += sizeof(struct floppy_raw_cmd);
@@ -3121,10 +3124,11 @@ loop:
                return -ENOMEM;
        *rcmd = ptr;
        ret = copy_from_user(ptr, param, sizeof(*ptr));
-        if (ret)
-                return -EFAULT;
        ptr->next = NULL;
        ptr->buffer_length = 0;
+        ptr->kernel_data = NULL;
+        if (ret)
+                return -EFAULT;
        param += sizeof(struct floppy_raw_cmd);
        if (ptr->cmd_count > 33)
                        /* the command may now also take up the space
@@ -3140,7 +3144,6 @@ loop:
        for (i = 0; i < 16; i++)
                ptr->reply[i] = 0;
        ptr->resultcode = 0;
-        ptr->kernel_data = NULL;
        if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
                if (ptr->length <= 0)
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 6d8a87f252de..cb9b1f8326c3 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -144,11 +144,11 @@ static void virtblk_done(struct virtqueue *vq)
                if (unlikely(virtqueue_is_broken(vq)))
                        break;
        } while (!virtqueue_enable_cb(vq));
-        spin_unlock_irqrestore(&vblk->vq_lock, flags);
        /* In case queue is stopped waiting for more buffers. */
        if (req_done)
                blk_mq_start_stopped_hw_queues(vblk->disk->queue);
+        spin_unlock_irqrestore(&vblk->vq_lock, flags);
 }
 static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req)
@@ -202,8 +202,8 @@ static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req)
        err = __virtblk_add_req(vblk->vq, vbr, vbr->sg, num);
        if (err) {
                virtqueue_kick(vblk->vq);
-                spin_unlock_irqrestore(&vblk->vq_lock, flags);
                blk_mq_stop_hw_queue(hctx);
+                spin_unlock_irqrestore(&vblk->vq_lock, flags);
                /* Out of mem doesn't actually happen, since we fall back
                 * to direct descriptors */
                if (err == -ENOMEM || err == -ENOSPC)
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index be571fef185d..a83b57e57b63 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x04CA, 0x3004) },
        { USB_DEVICE(0x04CA, 0x3005) },
        { USB_DEVICE(0x04CA, 0x3006) },
+        { USB_DEVICE(0x04CA, 0x3007) },
        { USB_DEVICE(0x04CA, 0x3008) },
        { USB_DEVICE(0x04CA, 0x300b) },
        { USB_DEVICE(0x0930, 0x0219) },
@@ -131,6 +132,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f338b0c5a8de..a7dfbf9a3afb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -152,6 +152,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
@@ -1485,10 +1486,8 @@ static int btusb_probe(struct usb_interface *intf,
        if (id->driver_info & BTUSB_BCM92035)
                hdev->setup = btusb_setup_bcm92035;
-        if (id->driver_info & BTUSB_INTEL) {
+        if (id->driver_info & BTUSB_INTEL)
-                usb_enable_autosuspend(data->udev);
                hdev->setup = btusb_setup_intel;
-        }
        /* Interface numbers are hardcoded in the specification */
        data->isoc = usb_ifnum_to_if(data->udev, 1);
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index 293e2e0a0a87..00b73448b22e 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -56,6 +56,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/debugfs.h>
+#include <linux/log2.h>
 /*
 * DDR target is the same on all platforms.
@@ -222,12 +223,6 @@ static int mvebu_mbus_window_conflicts(struct mvebu_mbus_state *mbus,
                 */
                if ((u64)base < wend && end > wbase)
                        return 0;
-                /*
-                 * Check if target/attribute conflicts
-                 */
-                if (target == wtarget && attr == wattr)
-                        return 0;
        }
        return 1;
@@ -266,6 +261,17 @@ static int mvebu_mbus_setup_window(struct mvebu_mbus_state *mbus,
                mbus->soc->win_cfg_offset(win);
        u32 ctrl, remap_addr;
+        if (!is_power_of_2(size)) {
+                WARN(true, "Invalid MBus window size: 0x%zx\n", size);
+                return -EINVAL;
+        }
+        if ((base & (phys_addr_t)(size - 1)) != 0) {
+                WARN(true, "Invalid MBus base/size: %pa len 0x%zx\n", &base,
+                     size);
+                return -EINVAL;
+        }
        ctrl = ((size - 1) & WIN_CTRL_SIZE_MASK) |
                (attr << WIN_CTRL_ATTR_SHIFT)    |
                (target << WIN_CTRL_TGT_SHIFT)   |
@@ -413,6 +419,10 @@ static int mvebu_devs_debug_show(struct seq_file *seq, void *v)
                           win, (unsigned long long)wbase,
                           (unsigned long long)(wbase + wsize), wtarget, wattr);
+                if (!is_power_of_2(wsize) ||
+                    ((wbase & (u64)(wsize - 1)) != 0))
+                        seq_puts(seq, " (Invalid base/size!!)");
                if (win < mbus->soc->num_remappable_wins) {
                        seq_printf(seq, " (remap %016llx)\n",
                                   (unsigned long long)wremap);
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index fbae63e3d304..6e9f74a5c095 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -40,7 +40,7 @@ config SGI_MBCS
 source "drivers/tty/serial/Kconfig"
 config TTY_PRINTK
-        bool "TTY driver to output user messages via printk"
+        tristate "TTY driver to output user messages via printk"
        depends on EXPERT && TTY
        default n
        ---help---
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index 8121b4c70ede..b29703324e94 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -730,6 +730,7 @@ static int agpioc_info_wrap(struct agp_file_private *priv, void __user *arg)
        agp_copy_info(agp_bridge, &kerninfo);
+        memset(&userinfo, 0, sizeof(userinfo));
        userinfo.version.major = kerninfo.version.major;
        userinfo.version.minor = kerninfo.version.minor;
        userinfo.bridge_id = kerninfo.device->vendor |
diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
index 8c3b255e629a..e900961cdd2e 100644
--- a/drivers/char/hw_random/bcm2835-rng.c
+++ b/drivers/char/hw_random/bcm2835-rng.c
@@ -61,18 +61,18 @@ static int bcm2835_rng_probe(struct platform_device *pdev)
        }
        bcm2835_rng_ops.priv = (unsigned long)rng_base;
+        /* set warm-up count & enable */
+        __raw_writel(RNG_WARMUP_COUNT, rng_base + RNG_STATUS);
+        __raw_writel(RNG_RBGEN, rng_base + RNG_CTRL);
        /* register driver */
        err = hwrng_register(&bcm2835_rng_ops);
        if (err) {
                dev_err(dev, "hwrng registration failed\n");
                iounmap(rng_base);
-        } else {
+        } else
                dev_info(dev, "hwrng registered\n");
-                /* set warm-up count & enable */
-                __raw_writel(RNG_WARMUP_COUNT, rng_base + RNG_STATUS);
-                __raw_writel(RNG_RBGEN, rng_base + RNG_CTRL);
-        }
        return err;
 }
diff --git a/drivers/char/ipmi/Kconfig b/drivers/char/ipmi/Kconfig
index 0baa8fab4ea7..db1c9b7adaa6 100644
--- a/drivers/char/ipmi/Kconfig
+++ b/drivers/char/ipmi/Kconfig
@@ -50,6 +50,18 @@ config IPMI_SI
         Currently, only KCS and SMIC are supported.  If
         you are using IPMI, you should probably say "y" here.
+config IPMI_SI_PROBE_DEFAULTS
+       bool 'Probe for all possible IPMI system interfaces by default'
+       default n
+       depends on IPMI_SI
+       help
+         Modern systems will usually expose IPMI interfaces via a discoverable
+         firmware mechanism such as ACPI or DMI. Older systems do not, and so
+         the driver is forced to probe hardware manually. This may cause boot
+         delays. Say "n" here to disable this manual probing. IPMI will then
+         only be available on older systems if the "ipmi_si_intf.trydefaults=1"
+         boot argument is passed.
 config IPMI_WATCHDOG
       tristate 'IPMI Watchdog Timer'
       help
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index f5e4cd7617f6..61e71616689b 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -352,7 +352,7 @@ static inline void write_all_bytes(struct si_sm_data *bt)
 static inline int read_all_bytes(struct si_sm_data *bt)
 {
-        unsigned char i;
+        unsigned int i;
        /*
         * length is "framing info", minimum = 4: NetFn, Seq, Cmd, cCode.
diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c
index 6a4bdc18955a..8c25f596808a 100644
--- a/drivers/char/ipmi/ipmi_kcs_sm.c
+++ b/drivers/char/ipmi/ipmi_kcs_sm.c
@@ -251,8 +251,9 @@ static inline int check_obf(struct si_sm_data *kcs, unsigned char status,
        if (!GET_STATUS_OBF(status)) {
                kcs->obf_timeout -= time;
                if (kcs->obf_timeout < 0) {
-                    start_error_recovery(kcs, "OBF not ready in time");
+                        kcs->obf_timeout = OBF_RETRY_TIMEOUT;
-                    return 1;
+                        start_error_recovery(kcs, "OBF not ready in time");
+                        return 1;
                }
                return 0;
        }
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index ec4e10fcf1a5..e6db9381b2c7 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -55,6 +55,7 @@ static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void);
 static int ipmi_init_msghandler(void);
 static void smi_recv_tasklet(unsigned long);
 static void handle_new_recv_msgs(ipmi_smi_t intf);
+static void need_waiter(ipmi_smi_t intf);
 static int initialized;
@@ -73,14 +74,28 @@ static struct proc_dir_entry *proc_ipmi_root;
 */
 #define MAX_MSG_TIMEOUT         60000
+/* Call every ~1000 ms. */
+#define IPMI_TIMEOUT_TIME       1000
+/* How many jiffies does it take to get to the timeout time. */
+#define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
+/*
+ * Request events from the queue every second (this is the number of
+ * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
+ * future, IPMI will add a way to know immediately if an event is in
+ * the queue and this silliness can go away.
+ */
+#define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
 /*
 * The main "user" data structure.
 */
 struct ipmi_user {
        struct list_head link;
-        /* Set to "0" when the user is destroyed. */
+        /* Set to false when the user is destroyed. */
-        int valid;
+        bool valid;
        struct kref refcount;
@@ -92,7 +107,7 @@ struct ipmi_user {
        ipmi_smi_t intf;
        /* Does this interface receive IPMI events? */
-        int gets_events;
+        bool gets_events;
 };
 struct cmd_rcvr {
@@ -383,6 +398,9 @@ struct ipmi_smi {
        unsigned int     waiting_events_count; /* How many events in queue? */
        char             delivering_events;
        char             event_msg_printed;
+        atomic_t         event_waiters;
+        unsigned int     ticks_to_req_ev;
+        int              last_needs_timer;
        /*
         * The event receiver for my BMC, only really used at panic
@@ -395,7 +413,7 @@ struct ipmi_smi {
        /* For handling of maintenance mode. */
        int maintenance_mode;
-        int maintenance_mode_enable;
+        bool maintenance_mode_enable;
        int auto_maintenance_timeout;
        spinlock_t maintenance_mode_lock; /* Used in a timer... */
@@ -451,7 +469,6 @@ static DEFINE_MUTEX(ipmi_interfaces_mutex);
 static LIST_HEAD(smi_watchers);
 static DEFINE_MUTEX(smi_watchers_mutex);
 #define ipmi_inc_stat(intf, stat) \
        atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
 #define ipmi_get_stat(intf, stat) \
@@ -772,6 +789,7 @@ static int intf_next_seq(ipmi_smi_t           intf,
                *seq = i;
                *seqid = intf->seq_table[i].seqid;
                intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
+                need_waiter(intf);
        } else {
                rv = -EAGAIN;
        }
@@ -941,7 +959,7 @@ int ipmi_create_user(unsigned int          if_num,
        new_user->handler = handler;
        new_user->handler_data = handler_data;
        new_user->intf = intf;
-        new_user->gets_events = 0;
+        new_user->gets_events = false;
        if (!try_module_get(intf->handlers->owner)) {
                rv = -ENODEV;
@@ -962,10 +980,15 @@ int ipmi_create_user(unsigned int          if_num,
         */
        mutex_unlock(&ipmi_interfaces_mutex);
-        new_user->valid = 1;
+        new_user->valid = true;
        spin_lock_irqsave(&intf->seq_lock, flags);
        list_add_rcu(&new_user->link, &intf->users);
        spin_unlock_irqrestore(&intf->seq_lock, flags);
+        if (handler->ipmi_watchdog_pretimeout) {
+                /* User wants pretimeouts, so make sure to watch for them. */
+                if (atomic_inc_return(&intf->event_waiters) == 1)
+                        need_waiter(intf);
+        }
        *user = new_user;
        return 0;
@@ -1019,7 +1042,13 @@ int ipmi_destroy_user(ipmi_user_t user)
        struct cmd_rcvr  *rcvr;
        struct cmd_rcvr  *rcvrs = NULL;
-        user->valid = 0;
+        user->valid = false;
+        if (user->handler->ipmi_watchdog_pretimeout)
+                atomic_dec(&intf->event_waiters);
+        if (user->gets_events)
+                atomic_dec(&intf->event_waiters);
        /* Remove the user from the interface's sequence table. */
        spin_lock_irqsave(&intf->seq_lock, flags);
@@ -1155,25 +1184,23 @@ int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
        if (intf->maintenance_mode != mode) {
                switch (mode) {
                case IPMI_MAINTENANCE_MODE_AUTO:
-                        intf->maintenance_mode = mode;
                        intf->maintenance_mode_enable
                                = (intf->auto_maintenance_timeout > 0);
                        break;
                case IPMI_MAINTENANCE_MODE_OFF:
-                        intf->maintenance_mode = mode;
+                        intf->maintenance_mode_enable = false;
-                        intf->maintenance_mode_enable = 0;
                        break;
                case IPMI_MAINTENANCE_MODE_ON:
-                        intf->maintenance_mode = mode;
+                        intf->maintenance_mode_enable = true;
-                        intf->maintenance_mode_enable = 1;
                        break;
                default:
                        rv = -EINVAL;
                        goto out_unlock;
                }
+                intf->maintenance_mode = mode;
                maintenance_mode_update(intf);
        }
@@ -1184,7 +1211,7 @@ int ipmi_set_maintenance_mode(ipmi_user_t user, int mode)
 }
 EXPORT_SYMBOL(ipmi_set_maintenance_mode);
-int ipmi_set_gets_events(ipmi_user_t user, int val)
+int ipmi_set_gets_events(ipmi_user_t user, bool val)
 {
        unsigned long        flags;
        ipmi_smi_t           intf = user->intf;
@@ -1194,8 +1221,18 @@ int ipmi_set_gets_events(ipmi_user_t user, int val)
        INIT_LIST_HEAD(&msgs);
        spin_lock_irqsave(&intf->events_lock, flags);
+        if (user->gets_events == val)
+                goto out;
        user->gets_events = val;
+        if (val) {
+                if (atomic_inc_return(&intf->event_waiters) == 1)
+                        need_waiter(intf);
+        } else {
+                atomic_dec(&intf->event_waiters);
+        }
        if (intf->delivering_events)
                /*
                 * Another thread is delivering events for this, so
@@ -1289,6 +1326,9 @@ int ipmi_register_for_cmd(ipmi_user_t   user,
                goto out_unlock;
        }
+        if (atomic_inc_return(&intf->event_waiters) == 1)
+                need_waiter(intf);
        list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
 out_unlock:
@@ -1330,6 +1370,7 @@ int ipmi_unregister_for_cmd(ipmi_user_t   user,
        mutex_unlock(&intf->cmd_rcvrs_mutex);
        synchronize_rcu();
        while (rcvrs) {
+                atomic_dec(&intf->event_waiters);
                rcvr = rcvrs;
                rcvrs = rcvr->next;
                kfree(rcvr);
@@ -1535,7 +1576,7 @@ static int i_ipmi_request(ipmi_user_t          user,
                                = IPMI_MAINTENANCE_MODE_TIMEOUT;
                        if (!intf->maintenance_mode
                            && !intf->maintenance_mode_enable) {
-                                intf->maintenance_mode_enable = 1;
+                                intf->maintenance_mode_enable = true;
                                maintenance_mode_update(intf);
                        }
                        spin_unlock_irqrestore(&intf->maintenance_mode_lock,
@@ -2876,6 +2917,8 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                     (unsigned long) intf);
        atomic_set(&intf->watchdog_pretimeouts_to_deliver, 0);
        spin_lock_init(&intf->events_lock);
+        atomic_set(&intf->event_waiters, 0);
+        intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
        INIT_LIST_HEAD(&intf->waiting_events);
        intf->waiting_events_count = 0;
        mutex_init(&intf->cmd_rcvrs_mutex);
@@ -3965,7 +4008,8 @@ smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
 static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
                              struct list_head *timeouts, long timeout_period,
-                              int slot, unsigned long *flags)
+                              int slot, unsigned long *flags,
+                              unsigned int *waiting_msgs)
 {
        struct ipmi_recv_msg     *msg;
        struct ipmi_smi_handlers *handlers;
@@ -3977,8 +4021,10 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
                return;
        ent->timeout -= timeout_period;
-        if (ent->timeout > 0)
+        if (ent->timeout > 0) {
+                (*waiting_msgs)++;
                return;
+        }
        if (ent->retries_left == 0) {
                /* The message has used all its retries. */
@@ -3995,6 +4041,8 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
                struct ipmi_smi_msg *smi_msg;
                /* More retries, send again. */
+                (*waiting_msgs)++;
                /*
                 * Start with the max timer, set to normal timer after
                 * the message is sent.
@@ -4040,117 +4088,118 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
        }
 }
-static void ipmi_timeout_handler(long timeout_period)
+static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period)
 {
-        ipmi_smi_t           intf;
        struct list_head     timeouts;
        struct ipmi_recv_msg *msg, *msg2;
        unsigned long        flags;
        int                  i;
+        unsigned int         waiting_msgs = 0;
-        rcu_read_lock();
+        /*
-        list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
+         * Go through the seq table and find any messages that
-                tasklet_schedule(&intf->recv_tasklet);
+         * have timed out, putting them in the timeouts
+         * list.
-                /*
+         */
-                 * Go through the seq table and find any messages that
+        INIT_LIST_HEAD(&timeouts);
-                 * have timed out, putting them in the timeouts
+        spin_lock_irqsave(&intf->seq_lock, flags);
-                 * list.
+        for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
-                 */
+                check_msg_timeout(intf, &(intf->seq_table[i]),
-                INIT_LIST_HEAD(&timeouts);
+                                  &timeouts, timeout_period, i,
-                spin_lock_irqsave(&intf->seq_lock, flags);
+                                  &flags, &waiting_msgs);
-                for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
+        spin_unlock_irqrestore(&intf->seq_lock, flags);
-                        check_msg_timeout(intf, &(intf->seq_table[i]),
-                                          &timeouts, timeout_period, i,
-                                          &flags);
-                spin_unlock_irqrestore(&intf->seq_lock, flags);
-                list_for_each_entry_safe(msg, msg2, &timeouts, link)
+        list_for_each_entry_safe(msg, msg2, &timeouts, link)
-                        deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
+                deliver_err_response(msg, IPMI_TIMEOUT_COMPLETION_CODE);
-                /*
+        /*
-                 * Maintenance mode handling.  Check the timeout
+         * Maintenance mode handling.  Check the timeout
-                 * optimistically before we claim the lock.  It may
+         * optimistically before we claim the lock.  It may
-                 * mean a timeout gets missed occasionally, but that
+         * mean a timeout gets missed occasionally, but that
-                 * only means the timeout gets extended by one period
+         * only means the timeout gets extended by one period
-                 * in that case.  No big deal, and it avoids the lock
+         * in that case.  No big deal, and it avoids the lock
-                 * most of the time.
+         * most of the time.
-                 */
+         */
+        if (intf->auto_maintenance_timeout > 0) {
+                spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
                if (intf->auto_maintenance_timeout > 0) {
-                        spin_lock_irqsave(&intf->maintenance_mode_lock, flags);
+                        intf->auto_maintenance_timeout
-                        if (intf->auto_maintenance_timeout > 0) {
+                                -= timeout_period;
-                                intf->auto_maintenance_timeout
+                        if (!intf->maintenance_mode
-                                        -= timeout_period;
+                            && (intf->auto_maintenance_timeout <= 0)) {
-                                if (!intf->maintenance_mode
+                                intf->maintenance_mode_enable = false;
-                                    && (intf->auto_maintenance_timeout <= 0)) {
+                                maintenance_mode_update(intf);
-                                        intf->maintenance_mode_enable = 0;
-                                        maintenance_mode_update(intf);
-                                }
                        }
-                        spin_unlock_irqrestore(&intf->maintenance_mode_lock,
-                                               flags);
                }
+                spin_unlock_irqrestore(&intf->maintenance_mode_lock,
+                                       flags);
        }
-        rcu_read_unlock();
+        tasklet_schedule(&intf->recv_tasklet);
+        return waiting_msgs;
 }
-static void ipmi_request_event(void)
+static void ipmi_request_event(ipmi_smi_t intf)
 {
-        ipmi_smi_t               intf;
        struct ipmi_smi_handlers *handlers;
-        rcu_read_lock();
+        /* No event requests when in maintenance mode. */
-        /*
+        if (intf->maintenance_mode_enable)
-         * Called from the timer, no need to check if handlers is
+                return;
-         * valid.
-         */
-        list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
-                /* No event requests when in maintenance mode. */
-                if (intf->maintenance_mode_enable)
-                        continue;
-                handlers = intf->handlers;
+        handlers = intf->handlers;
-                if (handlers)
+        if (handlers)
-                        handlers->request_events(intf->send_info);
+                handlers->request_events(intf->send_info);
-        }
-        rcu_read_unlock();
 }
 static struct timer_list ipmi_timer;
-/* Call every ~1000 ms. */
-#define IPMI_TIMEOUT_TIME       1000
-/* How many jiffies does it take to get to the timeout time. */
-#define IPMI_TIMEOUT_JIFFIES    ((IPMI_TIMEOUT_TIME * HZ) / 1000)
-/*
- * Request events from the queue every second (this is the number of
- * IPMI_TIMEOUT_TIMES between event requests).  Hopefully, in the
- * future, IPMI will add a way to know immediately if an event is in
- * the queue and this silliness can go away.
- */
-#define IPMI_REQUEST_EV_TIME    (1000 / (IPMI_TIMEOUT_TIME))
 static atomic_t stop_operation;
-static unsigned int ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
 static void ipmi_timeout(unsigned long data)
 {
+        ipmi_smi_t intf;
+        int nt = 0;
        if (atomic_read(&stop_operation))
                return;
-        ticks_to_req_ev--;
+        rcu_read_lock();
-        if (ticks_to_req_ev == 0) {
+        list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
-                ipmi_request_event();
+                int lnt = 0;
-                ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
-        }
+                if (atomic_read(&intf->event_waiters)) {
+                        intf->ticks_to_req_ev--;
+                        if (intf->ticks_to_req_ev == 0) {
+                                ipmi_request_event(intf);
+                                intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
+                        }
+                        lnt++;
+                }
-        ipmi_timeout_handler(IPMI_TIMEOUT_TIME);
+                lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
-        mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+                lnt = !!lnt;
+                if (lnt != intf->last_needs_timer &&
+                                        intf->handlers->set_need_watch)
+                        intf->handlers->set_need_watch(intf->send_info, lnt);
+                intf->last_needs_timer = lnt;
+                nt += lnt;
+        }
+        rcu_read_unlock();
+        if (nt)
+                mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
 }
+static void need_waiter(ipmi_smi_t intf)
+{
+        /* Racy, but worst case we start the timer twice. */
+        if (!timer_pending(&ipmi_timer))
+                mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+}
 static atomic_t smi_msg_inuse_count = ATOMIC_INIT(0);
 static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index b7efd3c1a882..1c4bb4f6ce93 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -217,7 +217,7 @@ struct smi_info {
        unsigned char       msg_flags;
        /* Does the BMC have an event buffer? */
-        char                has_event_buffer;
+        bool                has_event_buffer;
        /*
         * If set to true, this will request events the next time the
@@ -230,7 +230,7 @@ struct smi_info {
         * call.  Generally used after a panic to make sure stuff goes
         * out.
         */
-        int                 run_to_completion;
+        bool                run_to_completion;
        /* The I/O port of an SI interface. */
        int                 port;
@@ -248,19 +248,25 @@ struct smi_info {
        /* The timer for this si. */
        struct timer_list   si_timer;
+        /* This flag is set, if the timer is running (timer_pending() isn't enough) */
+        bool                timer_running;
        /* The time (in jiffies) the last timeout occurred at. */
        unsigned long       last_timeout_jiffies;
        /* Used to gracefully stop the timer without race conditions. */
        atomic_t            stop_operation;
+        /* Are we waiting for the events, pretimeouts, received msgs? */
+        atomic_t            need_watch;
        /*
         * The driver will disable interrupts when it gets into a
         * situation where it cannot handle messages due to lack of
         * memory.  Once that situation clears up, it will re-enable
         * interrupts.
         */
-        int interrupt_disabled;
+        bool interrupt_disabled;
        /* From the get device id response... */
        struct ipmi_device_id device_id;
@@ -273,7 +279,7 @@ struct smi_info {
         * True if we allocated the device, false if it came from
         * someplace else (like PCI).
         */
-        int dev_registered;
+        bool dev_registered;
        /* Slave address, could be reported from DMI. */
        unsigned char slave_addr;
@@ -297,19 +303,19 @@ struct smi_info {
 static int force_kipmid[SI_MAX_PARMS];
 static int num_force_kipmid;
 #ifdef CONFIG_PCI
-static int pci_registered;
+static bool pci_registered;
 #endif
 #ifdef CONFIG_ACPI
-static int pnp_registered;
+static bool pnp_registered;
 #endif
 #ifdef CONFIG_PARISC
-static int parisc_registered;
+static bool parisc_registered;
 #endif
 static unsigned int kipmid_max_busy_us[SI_MAX_PARMS];
 static int num_max_busy_us;
-static int unload_when_empty = 1;
+static bool unload_when_empty = true;
 static int add_smi(struct smi_info *smi);
 static int try_smi_init(struct smi_info *smi);
@@ -434,6 +440,13 @@ static void start_clear_flags(struct smi_info *smi_info)
        smi_info->si_state = SI_CLEARING_FLAGS;
 }
+static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
+{
+        smi_info->last_timeout_jiffies = jiffies;
+        mod_timer(&smi_info->si_timer, new_val);
+        smi_info->timer_running = true;
+}
 /*
 * When we have a situtaion where we run out of memory and cannot
 * allocate messages, we just leave them in the BMC and run the system
@@ -444,10 +457,9 @@ static inline void disable_si_irq(struct smi_info *smi_info)
 {
        if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
                start_disable_irq(smi_info);
-                smi_info->interrupt_disabled = 1;
+                smi_info->interrupt_disabled = true;
                if (!atomic_read(&smi_info->stop_operation))
-                        mod_timer(&smi_info->si_timer,
+                        smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
-                                  jiffies + SI_TIMEOUT_JIFFIES);
        }
 }
@@ -455,7 +467,7 @@ static inline void enable_si_irq(struct smi_info *smi_info)
 {
        if ((smi_info->irq) && (smi_info->interrupt_disabled)) {
                start_enable_irq(smi_info);
-                smi_info->interrupt_disabled = 0;
+                smi_info->interrupt_disabled = false;
        }
 }
@@ -700,7 +712,7 @@ static void handle_transaction_done(struct smi_info *smi_info)
                        dev_warn(smi_info->dev,
                                 "Maybe ok, but ipmi might run very slowly.\n");
                } else
-                        smi_info->interrupt_disabled = 0;
+                        smi_info->interrupt_disabled = false;
                smi_info->si_state = SI_NORMAL;
                break;
        }
@@ -853,6 +865,19 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
        return si_sm_result;
 }
+static void check_start_timer_thread(struct smi_info *smi_info)
+{
+        if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
+                smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
+                if (smi_info->thread)
+                        wake_up_process(smi_info->thread);
+                start_next_msg(smi_info);
+                smi_event_handler(smi_info, 0);
+        }
+}
 static void sender(void                *send_info,
                   struct ipmi_smi_msg *msg,
                   int                 priority)
@@ -906,27 +931,11 @@ static void sender(void                *send_info,
        else
                list_add_tail(&msg->link, &smi_info->xmit_msgs);
-        if (smi_info->si_state == SI_NORMAL && smi_info->curr_msg == NULL) {
+        check_start_timer_thread(smi_info);
-                /*
-                 * last_timeout_jiffies is updated here to avoid
-                 * smi_timeout() handler passing very large time_diff
-                 * value to smi_event_handler() that causes
-                 * the send command to abort.
-                 */
-                smi_info->last_timeout_jiffies = jiffies;
-                mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
-                if (smi_info->thread)
-                        wake_up_process(smi_info->thread);
-                start_next_msg(smi_info);
-                smi_event_handler(smi_info, 0);
-        }
        spin_unlock_irqrestore(&smi_info->si_lock, flags);
 }
-static void set_run_to_completion(void *send_info, int i_run_to_completion)
+static void set_run_to_completion(void *send_info, bool i_run_to_completion)
 {
        struct smi_info   *smi_info = send_info;
        enum si_sm_result result;
@@ -1004,6 +1013,17 @@ static int ipmi_thread(void *data)
                spin_lock_irqsave(&(smi_info->si_lock), flags);
                smi_result = smi_event_handler(smi_info, 0);
+                /*
+                 * If the driver is doing something, there is a possible
+                 * race with the timer.  If the timer handler see idle,
+                 * and the thread here sees something else, the timer
+                 * handler won't restart the timer even though it is
+                 * required.  So start it here if necessary.
+                 */
+                if (smi_result != SI_SM_IDLE && !smi_info->timer_running)
+                        smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
                spin_unlock_irqrestore(&(smi_info->si_lock), flags);
                busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
                                                  &busy_until);
@@ -1011,9 +1031,15 @@ static int ipmi_thread(void *data)
                        ; /* do nothing */
                else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait)
                        schedule();
-                else if (smi_result == SI_SM_IDLE)
+                else if (smi_result == SI_SM_IDLE) {
-                        schedule_timeout_interruptible(100);
+                        if (atomic_read(&smi_info->need_watch)) {
-                else
+                                schedule_timeout_interruptible(100);
+                        } else {
+                                /* Wait to be woken up when we are needed. */
+                                __set_current_state(TASK_INTERRUPTIBLE);
+                                schedule();
+                        }
+                } else
                        schedule_timeout_interruptible(1);
        }
        return 0;
@@ -1024,7 +1050,7 @@ static void poll(void *send_info)
 {
        struct smi_info *smi_info = send_info;
        unsigned long flags = 0;
-        int run_to_completion = smi_info->run_to_completion;
+        bool run_to_completion = smi_info->run_to_completion;
        /*
         * Make sure there is some delay in the poll loop so we can
@@ -1049,6 +1075,17 @@ static void request_events(void *send_info)
        atomic_set(&smi_info->req_events, 1);
 }
+static void set_need_watch(void *send_info, bool enable)
+{
+        struct smi_info *smi_info = send_info;
+        unsigned long flags;
+        atomic_set(&smi_info->need_watch, enable);
+        spin_lock_irqsave(&smi_info->si_lock, flags);
+        check_start_timer_thread(smi_info);
+        spin_unlock_irqrestore(&smi_info->si_lock, flags);
+}
 static int initialized;
 static void smi_timeout(unsigned long data)
@@ -1073,10 +1110,6 @@ static void smi_timeout(unsigned long data)
                     * SI_USEC_PER_JIFFY);
        smi_result = smi_event_handler(smi_info, time_diff);
-        spin_unlock_irqrestore(&(smi_info->si_lock), flags);
-        smi_info->last_timeout_jiffies = jiffies_now;
        if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
                /* Running with interrupts, only do long timeouts. */
                timeout = jiffies + SI_TIMEOUT_JIFFIES;
@@ -1098,7 +1131,10 @@ static void smi_timeout(unsigned long data)
 do_mod_timer:
        if (smi_result != SI_SM_IDLE)
-                mod_timer(&(smi_info->si_timer), timeout);
+                smi_mod_timer(smi_info, timeout);
+        else
+                smi_info->timer_running = false;
+        spin_unlock_irqrestore(&(smi_info->si_lock), flags);
 }
 static irqreturn_t si_irq_handler(int irq, void *data)
@@ -1146,8 +1182,7 @@ static int smi_start_processing(void       *send_info,
        /* Set up the timer that drives the interface. */
        setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
-        new_smi->last_timeout_jiffies = jiffies;
+        smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
-        mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
        /*
         * Check if the user forcefully enabled the daemon.
@@ -1188,7 +1223,7 @@ static int get_smi_info(void *send_info, struct ipmi_smi_info *data)
        return 0;
 }
-static void set_maintenance_mode(void *send_info, int enable)
+static void set_maintenance_mode(void *send_info, bool enable)
 {
        struct smi_info   *smi_info = send_info;
@@ -1202,6 +1237,7 @@ static struct ipmi_smi_handlers handlers = {
        .get_smi_info           = get_smi_info,
        .sender                 = sender,
        .request_events         = request_events,
+        .set_need_watch         = set_need_watch,
        .set_maintenance_mode   = set_maintenance_mode,
        .set_run_to_completion  = set_run_to_completion,
        .poll                   = poll,
@@ -1229,7 +1265,7 @@ static bool          si_tryplatform = 1;
 #ifdef CONFIG_PCI
 static bool          si_trypci = 1;
 #endif
-static bool          si_trydefaults = 1;
+static bool          si_trydefaults = IS_ENABLED(CONFIG_IPMI_SI_PROBE_DEFAULTS);
 static char          *si_type[SI_MAX_PARMS];
 #define MAX_SI_TYPE_STR 30
 static char          si_type_str[MAX_SI_TYPE_STR];
@@ -1328,7 +1364,7 @@ module_param_array(force_kipmid, int, &num_force_kipmid, 0);
 MODULE_PARM_DESC(force_kipmid, "Force the kipmi daemon to be enabled (1) or"
                 " disabled(0).  Normally the IPMI driver auto-detects"
                 " this, but the value may be overridden by this parm.");
-module_param(unload_when_empty, int, 0);
+module_param(unload_when_empty, bool, 0);
 MODULE_PARM_DESC(unload_when_empty, "Unload the module if no interfaces are"
                 " specified or found, default is 1.  Setting to 0"
                 " is useful for hot add of devices using hotmod.");
@@ -3336,18 +3372,19 @@ static int try_smi_init(struct smi_info *new_smi)
        INIT_LIST_HEAD(&(new_smi->hp_xmit_msgs));
        new_smi->curr_msg = NULL;
        atomic_set(&new_smi->req_events, 0);
-        new_smi->run_to_completion = 0;
+        new_smi->run_to_completion = false;
        for (i = 0; i < SI_NUM_STATS; i++)
                atomic_set(&new_smi->stats[i], 0);
-        new_smi->interrupt_disabled = 1;
+        new_smi->interrupt_disabled = true;
        atomic_set(&new_smi->stop_operation, 0);
+        atomic_set(&new_smi->need_watch, 0);
        new_smi->intf_num = smi_num;
        smi_num++;
        rv = try_enable_event_buffer(new_smi);
        if (rv == 0)
-                new_smi->has_event_buffer = 1;
+                new_smi->has_event_buffer = true;
        /*
         * Start clearing the flags before we enable interrupts or the
@@ -3381,7 +3418,7 @@ static int try_smi_init(struct smi_info *new_smi)
                               rv);
                        goto out_err;
                }
-                new_smi->dev_registered = 1;
+                new_smi->dev_registered = true;
        }
        rv = ipmi_register_smi(&handlers,
@@ -3430,7 +3467,7 @@ static int try_smi_init(struct smi_info *new_smi)
        wait_for_timer_and_thread(new_smi);
 out_err:
-        new_smi->interrupt_disabled = 1;
+        new_smi->interrupt_disabled = true;
        if (new_smi->intf) {
                ipmi_unregister_smi(new_smi->intf);
@@ -3466,7 +3503,7 @@ static int try_smi_init(struct smi_info *new_smi)
        if (new_smi->dev_registered) {
                platform_device_unregister(new_smi->pdev);
-                new_smi->dev_registered = 0;
+                new_smi->dev_registered = false;
        }
        return rv;
@@ -3521,14 +3558,14 @@ static int init_ipmi_si(void)
                        printk(KERN_ERR PFX "Unable to register "
                               "PCI driver: %d\n", rv);
                else
-                        pci_registered = 1;
+                        pci_registered = true;
        }
 #endif
 #ifdef CONFIG_ACPI
        if (si_tryacpi) {
                pnp_register_driver(&ipmi_pnp_driver);
-                pnp_registered = 1;
+                pnp_registered = true;
        }
 #endif
@@ -3544,7 +3581,7 @@ static int init_ipmi_si(void)
 #ifdef CONFIG_PARISC
        register_parisc_driver(&ipmi_parisc_driver);
-        parisc_registered = 1;
+        parisc_registered = true;
        /* poking PC IO addresses will crash machine, don't do it */
        si_trydefaults = 0;
 #endif
diff --git a/drivers/char/pcmcia/Kconfig b/drivers/char/pcmcia/Kconfig
index b27f5342fe76..8d3dfb0c8a26 100644
--- a/drivers/char/pcmcia/Kconfig
+++ b/drivers/char/pcmcia/Kconfig
@@ -15,7 +15,7 @@ config SYNCLINK_CS
          This driver may be built as a module ( = code which can be
          inserted in and removed from the running kernel whenever you want).
-          The module will be called synclinkmp.  If you want to do that, say M
+          The module will be called synclink_cs.  If you want to do that, say M
          here.
 config CARDMAN_4000
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 6b75713d953a..102c50d38902 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -995,8 +995,11 @@ retry:
                ibytes = min_t(size_t, ibytes, have_bytes - reserved);
        if (ibytes < min)
                ibytes = 0;
-        entropy_count = max_t(int, 0,
+        if (have_bytes >= ibytes + reserved)
-                              entropy_count - (ibytes << (ENTROPY_SHIFT + 3)));
+                entropy_count -= ibytes << (ENTROPY_SHIFT + 3);
+        else
+                entropy_count = reserved << (ENTROPY_SHIFT + 3);
        if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
                goto retry;
diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
index b3ea223585bd..61dcc8011ec7 100644
--- a/drivers/char/tpm/tpm_ppi.c
+++ b/drivers/char/tpm/tpm_ppi.c
@@ -328,13 +328,11 @@ int tpm_add_ppi(struct kobject *parent)
        /* Cache TPM ACPI handle and version string */
        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
                            ppi_callback, NULL, NULL, &tpm_ppi_handle);
-        if (tpm_ppi_handle == NULL)
+        return tpm_ppi_handle ? sysfs_create_group(parent, &ppi_attr_grp) : 0;
-                return -ENODEV;
-        return sysfs_create_group(parent, &ppi_attr_grp);
 }
 void tpm_remove_ppi(struct kobject *parent)
 {
-        sysfs_remove_group(parent, &ppi_attr_grp);
+        if (tpm_ppi_handle)
+                sysfs_remove_group(parent, &ppi_attr_grp);
 }
diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
index daea84c41743..a15ce4ef39cd 100644
--- a/drivers/char/ttyprintk.c
+++ b/drivers/char/ttyprintk.c
@@ -17,7 +17,7 @@
 #include <linux/device.h>
 #include <linux/serial.h>
 #include <linux/tty.h>
-#include <linux/export.h>
+#include <linux/module.h>
 struct ttyprintk_port {
        struct tty_port port;
@@ -210,10 +210,19 @@ static int __init ttyprintk_init(void)
        return 0;
 error:
-        tty_unregister_driver(ttyprintk_driver);
        put_tty_driver(ttyprintk_driver);
        tty_port_destroy(&tpk_port.port);
-        ttyprintk_driver = NULL;
        return ret;
 }
+static void __exit ttyprintk_exit(void)
+{
+        tty_unregister_driver(ttyprintk_driver);
+        put_tty_driver(ttyprintk_driver);
+        tty_port_destroy(&tpk_port.port);
+}
 device_initcall(ttyprintk_init);
+module_exit(ttyprintk_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/clk/bcm/clk-kona-setup.c b/drivers/clk/bcm/clk-kona-setup.c
index c7607feb18dd..54a06526f64f 100644
--- a/drivers/clk/bcm/clk-kona-setup.c
+++ b/drivers/clk/bcm/clk-kona-setup.c
@@ -27,7 +27,7 @@ LIST_HEAD(ccu_list);	/* The list of set up CCUs */
 static bool clk_requires_trigger(struct kona_clk *bcm_clk)
 {
-        struct peri_clk_data *peri = bcm_clk->peri;
+        struct peri_clk_data *peri = bcm_clk->u.peri;
        struct bcm_clk_sel *sel;
        struct bcm_clk_div *div;
@@ -63,7 +63,7 @@ static bool peri_clk_data_offsets_valid(struct kona_clk *bcm_clk)
        u32 limit;
        BUG_ON(bcm_clk->type != bcm_clk_peri);
-        peri = bcm_clk->peri;
+        peri = bcm_clk->u.peri;
        name = bcm_clk->name;
        range = bcm_clk->ccu->range;
@@ -81,19 +81,19 @@ static bool peri_clk_data_offsets_valid(struct kona_clk *bcm_clk)
        div = &peri->div;
        if (divider_exists(div)) {
-                if (div->offset > limit) {
+                if (div->u.s.offset > limit) {
                        pr_err("%s: bad divider offset for %s (%u > %u)\n",
-                                __func__, name, div->offset, limit);
+                                __func__, name, div->u.s.offset, limit);
                        return false;
                }
        }
        div = &peri->pre_div;
        if (divider_exists(div)) {
-                if (div->offset > limit) {
+                if (div->u.s.offset > limit) {
                        pr_err("%s: bad pre-divider offset for %s "
                                        "(%u > %u)\n",
-                                __func__, name, div->offset, limit);
+                                __func__, name, div->u.s.offset, limit);
                        return false;
                }
        }
@@ -249,21 +249,22 @@ static bool div_valid(struct bcm_clk_div *div, const char *field_name,
 {
        if (divider_is_fixed(div)) {
                /* Any fixed divider value but 0 is OK */
-                if (div->fixed == 0) {
+                if (div->u.fixed == 0) {
                        pr_err("%s: bad %s fixed value 0 for %s\n", __func__,
                                field_name, clock_name);
                        return false;
                }
                return true;
        }
-        if (!bitfield_valid(div->shift, div->width, field_name, clock_name))
+        if (!bitfield_valid(div->u.s.shift, div->u.s.width,
+                                field_name, clock_name))
                return false;
        if (divider_has_fraction(div))
-                if (div->frac_width > div->width) {
+                if (div->u.s.frac_width > div->u.s.width) {
                        pr_warn("%s: bad %s fraction width for %s (%u > %u)\n",
                                __func__, field_name, clock_name,
-                                div->frac_width, div->width);
+                                div->u.s.frac_width, div->u.s.width);
                        return false;
                }
@@ -278,7 +279,7 @@ static bool div_valid(struct bcm_clk_div *div, const char *field_name,
 */
 static bool kona_dividers_valid(struct kona_clk *bcm_clk)
 {
-        struct peri_clk_data *peri = bcm_clk->peri;
+        struct peri_clk_data *peri = bcm_clk->u.peri;
        struct bcm_clk_div *div;
        struct bcm_clk_div *pre_div;
        u32 limit;
@@ -295,7 +296,7 @@ static bool kona_dividers_valid(struct kona_clk *bcm_clk)
        limit = BITS_PER_BYTE * sizeof(u32);
-        return div->frac_width + pre_div->frac_width <= limit;
+        return div->u.s.frac_width + pre_div->u.s.frac_width <= limit;
 }
@@ -328,7 +329,7 @@ peri_clk_data_valid(struct kona_clk *bcm_clk)
        if (!peri_clk_data_offsets_valid(bcm_clk))
                return false;
-        peri = bcm_clk->peri;
+        peri = bcm_clk->u.peri;
        name = bcm_clk->name;
        gate = &peri->gate;
        if (gate_exists(gate) && !gate_valid(gate, "gate", name))
@@ -588,12 +589,12 @@ static void bcm_clk_teardown(struct kona_clk *bcm_clk)
 {
        switch (bcm_clk->type) {
        case bcm_clk_peri:
-                peri_clk_teardown(bcm_clk->data, &bcm_clk->init_data);
+                peri_clk_teardown(bcm_clk->u.data, &bcm_clk->init_data);
                break;
        default:
                break;
        }
-        bcm_clk->data = NULL;
+        bcm_clk->u.data = NULL;
        bcm_clk->type = bcm_clk_none;
 }
@@ -644,7 +645,7 @@ struct clk *kona_clk_setup(struct ccu_data *ccu, const char *name,
                break;
        }
        bcm_clk->type = type;
-        bcm_clk->data = data;
+        bcm_clk->u.data = data;
        /* Make sure everything makes sense before we set it up */
        if (!kona_clk_valid(bcm_clk)) {
diff --git a/drivers/clk/bcm/clk-kona.c b/drivers/clk/bcm/clk-kona.c
index e3d339e08309..db11a87449f2 100644
--- a/drivers/clk/bcm/clk-kona.c
+++ b/drivers/clk/bcm/clk-kona.c
@@ -61,7 +61,7 @@ u64 do_div_round_closest(u64 dividend, unsigned long divisor)
 /* Convert a divider into the scaled divisor value it represents. */
 static inline u64 scaled_div_value(struct bcm_clk_div *div, u32 reg_div)
 {
-        return (u64)reg_div + ((u64)1 << div->frac_width);
+        return (u64)reg_div + ((u64)1 << div->u.s.frac_width);
 }
 /*
@@ -77,7 +77,7 @@ u64 scaled_div_build(struct bcm_clk_div *div, u32 div_value, u32 billionths)
        BUG_ON(billionths >= BILLION);
        combined = (u64)div_value * BILLION + billionths;
-        combined <<= div->frac_width;
+        combined <<= div->u.s.frac_width;
        return do_div_round_closest(combined, BILLION);
 }
@@ -87,7 +87,7 @@ static inline u64
 scaled_div_min(struct bcm_clk_div *div)
 {
        if (divider_is_fixed(div))
-                return (u64)div->fixed;
+                return (u64)div->u.fixed;
        return scaled_div_value(div, 0);
 }
@@ -98,9 +98,9 @@ u64 scaled_div_max(struct bcm_clk_div *div)
        u32 reg_div;
        if (divider_is_fixed(div))
-                return (u64)div->fixed;
+                return (u64)div->u.fixed;
-        reg_div = ((u32)1 << div->width) - 1;
+        reg_div = ((u32)1 << div->u.s.width) - 1;
        return scaled_div_value(div, reg_div);
 }
@@ -115,7 +115,7 @@ divider(struct bcm_clk_div *div, u64 scaled_div)
        BUG_ON(scaled_div < scaled_div_min(div));
        BUG_ON(scaled_div > scaled_div_max(div));
-        return (u32)(scaled_div - ((u64)1 << div->frac_width));
+        return (u32)(scaled_div - ((u64)1 << div->u.s.frac_width));
 }
 /* Return a rate scaled for use when dividing by a scaled divisor. */
@@ -125,7 +125,7 @@ scale_rate(struct bcm_clk_div *div, u32 rate)
        if (divider_is_fixed(div))
                return (u64)rate;
-        return (u64)rate << div->frac_width;
+        return (u64)rate << div->u.s.frac_width;
 }
 /* CCU access */
@@ -398,14 +398,14 @@ static u64 divider_read_scaled(struct ccu_data *ccu, struct bcm_clk_div *div)
        u32 reg_div;
        if (divider_is_fixed(div))
-                return (u64)div->fixed;
+                return (u64)div->u.fixed;
        flags = ccu_lock(ccu);
-        reg_val = __ccu_read(ccu, div->offset);
+        reg_val = __ccu_read(ccu, div->u.s.offset);
        ccu_unlock(ccu, flags);
        /* Extract the full divider field from the register value */
-        reg_div = bitfield_extract(reg_val, div->shift, div->width);
+        reg_div = bitfield_extract(reg_val, div->u.s.shift, div->u.s.width);
        /* Return the scaled divisor value it represents */
        return scaled_div_value(div, reg_div);
@@ -433,16 +433,17 @@ static int __div_commit(struct ccu_data *ccu, struct bcm_clk_gate *gate,
         * state was defined in the device tree, we just find out
         * what its current value is rather than updating it.
         */
-        if (div->scaled_div == BAD_SCALED_DIV_VALUE) {
+        if (div->u.s.scaled_div == BAD_SCALED_DIV_VALUE) {
-                reg_val = __ccu_read(ccu, div->offset);
+                reg_val = __ccu_read(ccu, div->u.s.offset);
-                reg_div = bitfield_extract(reg_val, div->shift, div->width);
+                reg_div = bitfield_extract(reg_val, div->u.s.shift,
-                div->scaled_div = scaled_div_value(div, reg_div);
+                                                div->u.s.width);
+                div->u.s.scaled_div = scaled_div_value(div, reg_div);
                return 0;
        }
        /* Convert the scaled divisor to the value we need to record */
-        reg_div = divider(div, div->scaled_div);
+        reg_div = divider(div, div->u.s.scaled_div);
        /* Clock needs to be enabled before changing the rate */
        enabled = __is_clk_gate_enabled(ccu, gate);
@@ -452,9 +453,10 @@ static int __div_commit(struct ccu_data *ccu, struct bcm_clk_gate *gate,
        }
        /* Replace the divider value and record the result */
-        reg_val = __ccu_read(ccu, div->offset);
+        reg_val = __ccu_read(ccu, div->u.s.offset);
-        reg_val = bitfield_replace(reg_val, div->shift, div->width, reg_div);
+        reg_val = bitfield_replace(reg_val, div->u.s.shift, div->u.s.width,
-        __ccu_write(ccu, div->offset, reg_val);
+                                        reg_div);
+        __ccu_write(ccu, div->u.s.offset, reg_val);
        /* If the trigger fails we still want to disable the gate */
        if (!__clk_trigger(ccu, trig))
@@ -490,11 +492,11 @@ static int divider_write(struct ccu_data *ccu, struct bcm_clk_gate *gate,
        BUG_ON(divider_is_fixed(div));
-        previous = div->scaled_div;
+        previous = div->u.s.scaled_div;
        if (previous == scaled_div)
                return 0;       /* No change */
-        div->scaled_div = scaled_div;
+        div->u.s.scaled_div = scaled_div;
        flags = ccu_lock(ccu);
        __ccu_write_enable(ccu);
@@ -505,7 +507,7 @@ static int divider_write(struct ccu_data *ccu, struct bcm_clk_gate *gate,
        ccu_unlock(ccu, flags);
        if (ret)
-                div->scaled_div = previous;             /* Revert the change */
+                div->u.s.scaled_div = previous;         /* Revert the change */
        return ret;
@@ -802,7 +804,7 @@ static int selector_write(struct ccu_data *ccu, struct bcm_clk_gate *gate,
 static int kona_peri_clk_enable(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_gate *gate = &bcm_clk->peri->gate;
+        struct bcm_clk_gate *gate = &bcm_clk->u.peri->gate;
        return clk_gate(bcm_clk->ccu, bcm_clk->name, gate, true);
 }
@@ -810,7 +812,7 @@ static int kona_peri_clk_enable(struct clk_hw *hw)
 static void kona_peri_clk_disable(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_gate *gate = &bcm_clk->peri->gate;
+        struct bcm_clk_gate *gate = &bcm_clk->u.peri->gate;
        (void)clk_gate(bcm_clk->ccu, bcm_clk->name, gate, false);
 }
@@ -818,7 +820,7 @@ static void kona_peri_clk_disable(struct clk_hw *hw)
 static int kona_peri_clk_is_enabled(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_gate *gate = &bcm_clk->peri->gate;
+        struct bcm_clk_gate *gate = &bcm_clk->u.peri->gate;
        return is_clk_gate_enabled(bcm_clk->ccu, gate) ? 1 : 0;
 }
@@ -827,7 +829,7 @@ static unsigned long kona_peri_clk_recalc_rate(struct clk_hw *hw,
                        unsigned long parent_rate)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        return clk_recalc_rate(bcm_clk->ccu, &data->div, &data->pre_div,
                                parent_rate);
@@ -837,20 +839,20 @@ static long kona_peri_clk_round_rate(struct clk_hw *hw, unsigned long rate,
                        unsigned long *parent_rate)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct bcm_clk_div *div = &bcm_clk->peri->div;
+        struct bcm_clk_div *div = &bcm_clk->u.peri->div;
        if (!divider_exists(div))
                return __clk_get_rate(hw->clk);
        /* Quietly avoid a zero rate */
-        return round_rate(bcm_clk->ccu, div, &bcm_clk->peri->pre_div,
+        return round_rate(bcm_clk->ccu, div, &bcm_clk->u.peri->pre_div,
                                rate ? rate : 1, *parent_rate, NULL);
 }
 static int kona_peri_clk_set_parent(struct clk_hw *hw, u8 index)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        struct bcm_clk_sel *sel = &data->sel;
        struct bcm_clk_trig *trig;
        int ret;
@@ -884,7 +886,7 @@ static int kona_peri_clk_set_parent(struct clk_hw *hw, u8 index)
 static u8 kona_peri_clk_get_parent(struct clk_hw *hw)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        u8 index;
        index = selector_read_index(bcm_clk->ccu, &data->sel);
@@ -897,7 +899,7 @@ static int kona_peri_clk_set_rate(struct clk_hw *hw, unsigned long rate,
                        unsigned long parent_rate)
 {
        struct kona_clk *bcm_clk = to_kona_clk(hw);
-        struct peri_clk_data *data = bcm_clk->peri;
+        struct peri_clk_data *data = bcm_clk->u.peri;
        struct bcm_clk_div *div = &data->div;
        u64 scaled_div = 0;
        int ret;
@@ -958,7 +960,7 @@ struct clk_ops kona_peri_clk_ops = {
 static bool __peri_clk_init(struct kona_clk *bcm_clk)
 {
        struct ccu_data *ccu = bcm_clk->ccu;
-        struct peri_clk_data *peri = bcm_clk->peri;
+        struct peri_clk_data *peri = bcm_clk->u.peri;
        const char *name = bcm_clk->name;
        struct bcm_clk_trig *trig;
diff --git a/drivers/clk/bcm/clk-kona.h b/drivers/clk/bcm/clk-kona.h
index 5e139adc3dc5..dee690951bb6 100644
--- a/drivers/clk/bcm/clk-kona.h
+++ b/drivers/clk/bcm/clk-kona.h
@@ -57,7 +57,7 @@
 #define divider_exists(div)             FLAG_TEST(div, DIV, EXISTS)
 #define divider_is_fixed(div)           FLAG_TEST(div, DIV, FIXED)
 #define divider_has_fraction(div)       (!divider_is_fixed(div) && \
-                                                (div)->frac_width > 0)
+                                                (div)->u.s.frac_width > 0)
 #define selector_exists(sel)            ((sel)->width != 0)
 #define trigger_exists(trig)            FLAG_TEST(trig, TRIG, EXISTS)
@@ -244,9 +244,9 @@ struct bcm_clk_div {
                        u32 frac_width; /* field fraction width */
                        u64 scaled_div; /* scaled divider value */
-                };
+                } s;
                u32 fixed;      /* non-zero fixed divider value */
-        };
+        } u;
        u32 flags;              /* BCM_CLK_DIV_FLAGS_* below */
 };
@@ -263,28 +263,28 @@ struct bcm_clk_div {
 /* A fixed (non-zero) divider */
 #define FIXED_DIVIDER(_value)                                           \
        {                                                               \
-                .fixed = (_value),                                      \
+                .u.fixed = (_value),                                    \
                .flags = FLAG(DIV, EXISTS)|FLAG(DIV, FIXED),            \
        }
 /* A divider with an integral divisor */
 #define DIVIDER(_offset, _shift, _width)                                \
        {                                                               \
-                .offset = (_offset),                                    \
+                .u.s.offset = (_offset),                                \
-                .shift = (_shift),                                      \
+                .u.s.shift = (_shift),                                  \
-                .width = (_width),                                      \
+                .u.s.width = (_width),                                  \
-                .scaled_div = BAD_SCALED_DIV_VALUE,                     \
+                .u.s.scaled_div = BAD_SCALED_DIV_VALUE,                 \
                .flags = FLAG(DIV, EXISTS),                             \
        }
 /* A divider whose divisor has an integer and fractional part */
 #define FRAC_DIVIDER(_offset, _shift, _width, _frac_width)              \
        {                                                               \
-                .offset = (_offset),                                    \
+                .u.s.offset = (_offset),                                \
-                .shift = (_shift),                                      \
+                .u.s.shift = (_shift),                                  \
-                .width = (_width),                                      \
+                .u.s.width = (_width),                                  \
-                .frac_width = (_frac_width),                            \
+                .u.s.frac_width = (_frac_width),                        \
-                .scaled_div = BAD_SCALED_DIV_VALUE,                     \
+                .u.s.scaled_div = BAD_SCALED_DIV_VALUE,                 \
                .flags = FLAG(DIV, EXISTS),                             \
        }
@@ -380,7 +380,7 @@ struct kona_clk {
        union {
                void *data;
                struct peri_clk_data *peri;
-        };
+        } u;
 };
 #define to_kona_clk(_hw) \
        container_of(_hw, struct kona_clk, hw)
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index ec22112e569f..3fbee4540228 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -144,6 +144,37 @@ static bool _is_valid_div(struct clk_divider *divider, unsigned int div)
        return true;
 }
+static int _round_up_table(const struct clk_div_table *table, int div)
+{
+        const struct clk_div_table *clkt;
+        int up = INT_MAX;
+        for (clkt = table; clkt->div; clkt++) {
+                if (clkt->div == div)
+                        return clkt->div;
+                else if (clkt->div < div)
+                        continue;
+                if ((clkt->div - div) < (up - div))
+                        up = clkt->div;
+        }
+        return up;
+}
+static int _div_round_up(struct clk_divider *divider,
+                unsigned long parent_rate, unsigned long rate)
+{
+        int div = DIV_ROUND_UP(parent_rate, rate);
+        if (divider->flags & CLK_DIVIDER_POWER_OF_TWO)
+                div = __roundup_pow_of_two(div);
+        if (divider->table)
+                div = _round_up_table(divider->table, div);
+        return div;
+}
 static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
                unsigned long *best_parent_rate)
 {
@@ -159,7 +190,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
        if (!(__clk_get_flags(hw->clk) & CLK_SET_RATE_PARENT)) {
                parent_rate = *best_parent_rate;
-                bestdiv = DIV_ROUND_UP(parent_rate, rate);
+                bestdiv = _div_round_up(divider, parent_rate, rate);
                bestdiv = bestdiv == 0 ? 1 : bestdiv;
                bestdiv = bestdiv > maxdiv ? maxdiv : bestdiv;
                return bestdiv;
@@ -219,6 +250,10 @@ static int clk_divider_set_rate(struct clk_hw *hw, unsigned long rate,
        u32 val;
        div = DIV_ROUND_UP(parent_rate, rate);
+        if (!_is_valid_div(divider, div))
+                return -EINVAL;
        value = _get_val(divider, div);
        if (value > div_mask(divider))
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index dff0373f53c1..7cf2c093cc54 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1984,9 +1984,28 @@ struct clk *__clk_register(struct device *dev, struct clk_hw *hw)
 }
 EXPORT_SYMBOL_GPL(__clk_register);
-static int _clk_register(struct device *dev, struct clk_hw *hw, struct clk *clk)
+/**
+ * clk_register - allocate a new clock, register it and return an opaque cookie
+ * @dev: device that is registering this clock
+ * @hw: link to hardware-specific clock data
+ *
+ * clk_register is the primary interface for populating the clock tree with new
+ * clock nodes.  It returns a pointer to the newly allocated struct clk which
+ * cannot be dereferenced by driver code but may be used in conjuction with the
+ * rest of the clock API.  In the event of an error clk_register will return an
+ * error code; drivers must test for an error code after calling clk_register.
+ */
+struct clk *clk_register(struct device *dev, struct clk_hw *hw)
 {
        int i, ret;
+        struct clk *clk;
+        clk = kzalloc(sizeof(*clk), GFP_KERNEL);
+        if (!clk) {
+                pr_err("%s: could not allocate clk\n", __func__);
+                ret = -ENOMEM;
+                goto fail_out;
+        }
        clk->name = kstrdup(hw->init->name, GFP_KERNEL);
        if (!clk->name) {
@@ -2026,7 +2045,7 @@ static int _clk_register(struct device *dev, struct clk_hw *hw, struct clk *clk)
        ret = __clk_init(dev, clk);
        if (!ret)
-                return 0;
+                return clk;
 fail_parent_names_copy:
        while (--i >= 0)
@@ -2035,36 +2054,6 @@ fail_parent_names_copy:
 fail_parent_names:
        kfree(clk->name);
 fail_name:
-        return ret;
-}
-/**
- * clk_register - allocate a new clock, register it and return an opaque cookie
- * @dev: device that is registering this clock
- * @hw: link to hardware-specific clock data
- *
- * clk_register is the primary interface for populating the clock tree with new
- * clock nodes.  It returns a pointer to the newly allocated struct clk which
- * cannot be dereferenced by driver code but may be used in conjuction with the
- * rest of the clock API.  In the event of an error clk_register will return an
- * error code; drivers must test for an error code after calling clk_register.
- */
-struct clk *clk_register(struct device *dev, struct clk_hw *hw)
-{
-        int ret;
-        struct clk *clk;
-        clk = kzalloc(sizeof(*clk), GFP_KERNEL);
-        if (!clk) {
-                pr_err("%s: could not allocate clk\n", __func__);
-                ret = -ENOMEM;
-                goto fail_out;
-        }
-        ret = _clk_register(dev, hw, clk);
-        if (!ret)
-                return clk;
        kfree(clk);
 fail_out:
        return ERR_PTR(ret);
@@ -2151,9 +2140,10 @@ void clk_unregister(struct clk *clk)
        if (!hlist_empty(&clk->children)) {
                struct clk *child;
+                struct hlist_node *t;
                /* Reparent all children to the orphan list. */
-                hlist_for_each_entry(child, &clk->children, child_node)
+                hlist_for_each_entry_safe(child, t, &clk->children, child_node)
                        clk_set_parent(child, NULL);
        }
@@ -2173,7 +2163,7 @@ EXPORT_SYMBOL_GPL(clk_unregister);
 static void devm_clk_release(struct device *dev, void *res)
 {
-        clk_unregister(res);
+        clk_unregister(*(struct clk **)res);
 }
 /**
@@ -2188,18 +2178,18 @@ static void devm_clk_release(struct device *dev, void *res)
 struct clk *devm_clk_register(struct device *dev, struct clk_hw *hw)
 {
        struct clk *clk;
-        int ret;
+        struct clk **clkp;
-        clk = devres_alloc(devm_clk_release, sizeof(*clk), GFP_KERNEL);
+        clkp = devres_alloc(devm_clk_release, sizeof(*clkp), GFP_KERNEL);
-        if (!clk)
+        if (!clkp)
                return ERR_PTR(-ENOMEM);
-        ret = _clk_register(dev, hw, clk);
+        clk = clk_register(dev, hw);
-        if (!ret) {
+        if (!IS_ERR(clk)) {
-                devres_add(dev, clk);
+                *clkp = clk;
+                devres_add(dev, clkp);
        } else {
-                devres_free(clk);
+                devres_free(clkp);
-                clk = ERR_PTR(ret);
        }
        return clk;
diff --git a/drivers/clk/shmobile/clk-mstp.c b/drivers/clk/shmobile/clk-mstp.c
index 2e5810c88d11..1f6324e29a80 100644
--- a/drivers/clk/shmobile/clk-mstp.c
+++ b/drivers/clk/shmobile/clk-mstp.c
@@ -156,6 +156,7 @@ cpg_mstp_clock_register(const char *name, const char *parent_name,
 static void __init cpg_mstp_clocks_init(struct device_node *np)
 {
        struct mstp_clock_group *group;
+        const char *idxname;
        struct clk **clks;
        unsigned int i;
@@ -184,6 +185,11 @@ static void __init cpg_mstp_clocks_init(struct device_node *np)
        for (i = 0; i < MSTP_MAX_CLOCKS; ++i)
                clks[i] = ERR_PTR(-ENOENT);
+        if (of_find_property(np, "clock-indices", &i))
+                idxname = "clock-indices";
+        else
+                idxname = "renesas,clock-indices";
        for (i = 0; i < MSTP_MAX_CLOCKS; ++i) {
                const char *parent_name;
                const char *name;
@@ -197,8 +203,7 @@ static void __init cpg_mstp_clocks_init(struct device_node *np)
                        continue;
                parent_name = of_clk_get_parent_name(np, i);
-                ret = of_property_read_u32_index(np, "renesas,clock-indices", i,
+                ret = of_property_read_u32_index(np, idxname, i, &clkidx);
-                                                 &clkidx);
                if (parent_name == NULL || ret < 0)
                        break;
diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
index 88dafb5e9627..de6da957a09d 100644
--- a/drivers/clk/socfpga/clk-pll.c
+++ b/drivers/clk/socfpga/clk-pll.c
@@ -20,6 +20,7 @@
 #include <linux/clk-provider.h>
 #include <linux/io.h>
 #include <linux/of.h>
+#include <linux/of_address.h>
 #include "clk.h"
@@ -43,6 +44,8 @@
 #define to_socfpga_clk(p) container_of(p, struct socfpga_pll, hw.hw)
+void __iomem *clk_mgr_base_addr;
 static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
                                         unsigned long parent_rate)
 {
@@ -87,6 +90,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
        const char *clk_name = node->name;
        const char *parent_name[SOCFPGA_MAX_PARENTS];
        struct clk_init_data init;
+        struct device_node *clkmgr_np;
        int rc;
        int i = 0;
@@ -96,6 +100,9 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
        if (WARN_ON(!pll_clk))
                return NULL;
+        clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+        clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
+        BUG_ON(!clk_mgr_base_addr);
        pll_clk->hw.reg = clk_mgr_base_addr + reg;
        of_property_read_string(node, "clock-output-names", &clk_name);
diff --git a/drivers/clk/socfpga/clk.c b/drivers/clk/socfpga/clk.c
index 35a960a993f9..43db947e5f0e 100644
--- a/drivers/clk/socfpga/clk.c
+++ b/drivers/clk/socfpga/clk.c
@@ -17,28 +17,11 @@
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
-#include <linux/clk.h>
-#include <linux/clkdev.h>
-#include <linux/clk-provider.h>
-#include <linux/io.h>
 #include <linux/of.h>
-#include <linux/of_address.h>
 #include "clk.h"
-void __iomem *clk_mgr_base_addr;
+CLK_OF_DECLARE(socfpga_pll_clk, "altr,socfpga-pll-clock", socfpga_pll_init);
+CLK_OF_DECLARE(socfpga_perip_clk, "altr,socfpga-perip-clk", socfpga_periph_init);
-static const struct of_device_id socfpga_child_clocks[] __initconst = {
+CLK_OF_DECLARE(socfpga_gate_clk, "altr,socfpga-gate-clk", socfpga_gate_init);
-        { .compatible = "altr,socfpga-pll-clock", socfpga_pll_init, },
-        { .compatible = "altr,socfpga-perip-clk", socfpga_periph_init, },
-        { .compatible = "altr,socfpga-gate-clk", socfpga_gate_init, },
-        {},
-};
-static void __init socfpga_clkmgr_init(struct device_node *node)
-{
-        clk_mgr_base_addr = of_iomap(node, 0);
-        of_clk_init(socfpga_child_clocks);
-}
-CLK_OF_DECLARE(socfpga_mgr, "altr,clk-mgr", socfpga_clkmgr_init);
diff --git a/drivers/clk/st/clkgen-pll.c b/drivers/clk/st/clkgen-pll.c
index bca0a0badbfa..a886702f7c8b 100644
--- a/drivers/clk/st/clkgen-pll.c
+++ b/drivers/clk/st/clkgen-pll.c
@@ -521,8 +521,10 @@ static struct clk * __init clkgen_odf_register(const char *parent_name,
        gate->lock = odf_lock;
        div = kzalloc(sizeof(*div), GFP_KERNEL);
-        if (!div)
+        if (!div) {
+                kfree(gate);
                return ERR_PTR(-ENOMEM);
+        }
        div->flags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO;
        div->reg = reg + pll_data->odf[odf].offset;
diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index 0d20241e0770..6aad8abc69a2 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -58,9 +58,9 @@
 #define PLLDU_LFCON_SET_DIVN 600
 #define PLLE_BASE_DIVCML_SHIFT 24
-#define PLLE_BASE_DIVCML_WIDTH 4
+#define PLLE_BASE_DIVCML_MASK 0xf
 #define PLLE_BASE_DIVP_SHIFT 16
-#define PLLE_BASE_DIVP_WIDTH 7
+#define PLLE_BASE_DIVP_WIDTH 6
 #define PLLE_BASE_DIVN_SHIFT 8
 #define PLLE_BASE_DIVN_WIDTH 8
 #define PLLE_BASE_DIVM_SHIFT 0
@@ -183,6 +183,14 @@
 #define divp_mask(p) (p->params->flags & TEGRA_PLLU ? PLLU_POST_DIVP_MASK :\
                      mask(p->params->div_nmp->divp_width))
+#define divm_shift(p) (p)->params->div_nmp->divm_shift
+#define divn_shift(p) (p)->params->div_nmp->divn_shift
+#define divp_shift(p) (p)->params->div_nmp->divp_shift
+#define divm_mask_shifted(p) (divm_mask(p) << divm_shift(p))
+#define divn_mask_shifted(p) (divn_mask(p) << divn_shift(p))
+#define divp_mask_shifted(p) (divp_mask(p) << divp_shift(p))
 #define divm_max(p) (divm_mask(p))
 #define divn_max(p) (divn_mask(p))
 #define divp_max(p) (1 << (divp_mask(p)))
@@ -476,13 +484,12 @@ static void _update_pll_mnp(struct tegra_clk_pll *pll,
        } else {
                val = pll_readl_base(pll);
-                val &= ~((divm_mask(pll) << div_nmp->divm_shift) |
+                val &= ~(divm_mask_shifted(pll) | divn_mask_shifted(pll) |
-                 (divn_mask(pll) << div_nmp->divn_shift) |
+                         divp_mask_shifted(pll));
-                 (divp_mask(pll) << div_nmp->divp_shift));
-                val |= ((cfg->m << div_nmp->divm_shift) |
+                val |= (cfg->m << divm_shift(pll)) |
-                        (cfg->n << div_nmp->divn_shift) |
+                       (cfg->n << divn_shift(pll)) |
-                        (cfg->p << div_nmp->divp_shift));
+                       (cfg->p << divp_shift(pll));
                pll_writel_base(val, pll);
        }
@@ -730,11 +737,12 @@ static int clk_plle_enable(struct clk_hw *hw)
        if (pll->params->flags & TEGRA_PLLE_CONFIGURE) {
                /* configure dividers */
                val = pll_readl_base(pll);
-                val &= ~(divm_mask(pll) | divn_mask(pll) | divp_mask(pll));
+                val &= ~(divp_mask_shifted(pll) | divn_mask_shifted(pll) |
-                val &= ~(PLLE_BASE_DIVCML_WIDTH << PLLE_BASE_DIVCML_SHIFT);
+                         divm_mask_shifted(pll));
-                val |= sel.m << pll->params->div_nmp->divm_shift;
+                val &= ~(PLLE_BASE_DIVCML_MASK << PLLE_BASE_DIVCML_SHIFT);
-                val |= sel.n << pll->params->div_nmp->divn_shift;
+                val |= sel.m << divm_shift(pll);
-                val |= sel.p << pll->params->div_nmp->divp_shift;
+                val |= sel.n << divn_shift(pll);
+                val |= sel.p << divp_shift(pll);
                val |= sel.cpcon << PLLE_BASE_DIVCML_SHIFT;
                pll_writel_base(val, pll);
        }
@@ -745,10 +753,11 @@ static int clk_plle_enable(struct clk_hw *hw)
        pll_writel_misc(val, pll);
        val = readl(pll->clk_base + PLLE_SS_CTRL);
+        val &= ~PLLE_SS_COEFFICIENTS_MASK;
        val |= PLLE_SS_DISABLE;
        writel(val, pll->clk_base + PLLE_SS_CTRL);
-        val |= pll_readl_base(pll);
+        val = pll_readl_base(pll);
        val |= (PLL_BASE_BYPASS | PLL_BASE_ENABLE);
        pll_writel_base(val, pll);
@@ -1292,10 +1301,11 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
        pll_writel(val, PLLE_SS_CTRL, pll);
        val = pll_readl_base(pll);
-        val &= ~(divm_mask(pll) | divn_mask(pll) | divp_mask(pll));
+        val &= ~(divp_mask_shifted(pll) | divn_mask_shifted(pll) |
-        val &= ~(PLLE_BASE_DIVCML_WIDTH << PLLE_BASE_DIVCML_SHIFT);
+                 divm_mask_shifted(pll));
-        val |= sel.m << pll->params->div_nmp->divm_shift;
+        val &= ~(PLLE_BASE_DIVCML_MASK << PLLE_BASE_DIVCML_SHIFT);
-        val |= sel.n << pll->params->div_nmp->divn_shift;
+        val |= sel.m << divm_shift(pll);
+        val |= sel.n << divn_shift(pll);
        val |= sel.cpcon << PLLE_BASE_DIVCML_SHIFT;
        pll_writel_base(val, pll);
        udelay(1);
@@ -1410,6 +1420,15 @@ struct clk *tegra_clk_register_pll(const char *name, const char *parent_name,
        return clk;
 }
+static struct div_nmp pll_e_nmp = {
+        .divn_shift = PLLE_BASE_DIVN_SHIFT,
+        .divn_width = PLLE_BASE_DIVN_WIDTH,
+        .divm_shift = PLLE_BASE_DIVM_SHIFT,
+        .divm_width = PLLE_BASE_DIVM_WIDTH,
+        .divp_shift = PLLE_BASE_DIVP_SHIFT,
+        .divp_width = PLLE_BASE_DIVP_WIDTH,
+};
 struct clk *tegra_clk_register_plle(const char *name, const char *parent_name,
                void __iomem *clk_base, void __iomem *pmc,
                unsigned long flags, struct tegra_clk_pll_params *pll_params,
@@ -1420,6 +1439,10 @@ struct clk *tegra_clk_register_plle(const char *name, const char *parent_name,
        pll_params->flags |= TEGRA_PLL_LOCK_MISC | TEGRA_PLL_BYPASS;
        pll_params->flags |= TEGRA_PLL_HAS_LOCK_ENABLE;
+        if (!pll_params->div_nmp)
+                pll_params->div_nmp = &pll_e_nmp;
        pll = _tegra_init_pll(clk_base, pmc, pll_params, lock);
        if (IS_ERR(pll))
                return ERR_CAST(pll);
@@ -1557,9 +1580,8 @@ struct clk *tegra_clk_register_pllre(const char *name, const char *parent_name,
                int m;
                m = _pll_fixed_mdiv(pll_params, parent_rate);
-                val = m << PLL_BASE_DIVM_SHIFT;
+                val = m << divm_shift(pll);
-                val |= (pll_params->vco_min / parent_rate)
+                val |= (pll_params->vco_min / parent_rate) << divn_shift(pll);
-                                << PLL_BASE_DIVN_SHIFT;
                pll_writel_base(val, pll);
        }
@@ -1718,7 +1740,7 @@ struct clk *tegra_clk_register_plle_tegra114(const char *name,
                                        "pll_re_vco");
        } else {
                val_aux &= ~(PLLE_AUX_PLLRE_SEL | PLLE_AUX_PLLP_SEL);
-                pll_writel(val, pll_params->aux_reg, pll);
+                pll_writel(val_aux, pll_params->aux_reg, pll);
        }
        clk = _tegra_clk_register_pll(pll, name, parent_name, flags,
diff --git a/drivers/clk/tegra/clk-tegra124.c b/drivers/clk/tegra/clk-tegra124.c
index 166e02f16c8a..cc37c342c4cb 100644
--- a/drivers/clk/tegra/clk-tegra124.c
+++ b/drivers/clk/tegra/clk-tegra124.c
@@ -764,7 +764,6 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
        [tegra_clk_i2s1] = { .dt_id = TEGRA124_CLK_I2S1, .present = true },
        [tegra_clk_i2c1] = { .dt_id = TEGRA124_CLK_I2C1, .present = true },
-        [tegra_clk_ndflash] = { .dt_id = TEGRA124_CLK_NDFLASH, .present = true },
        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
        [tegra_clk_pwm] = { .dt_id = TEGRA124_CLK_PWM, .present = true },
@@ -809,7 +808,6 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
        [tegra_clk_trace] = { .dt_id = TEGRA124_CLK_TRACE, .present = true },
        [tegra_clk_soc_therm] = { .dt_id = TEGRA124_CLK_SOC_THERM, .present = true },
        [tegra_clk_dtv] = { .dt_id = TEGRA124_CLK_DTV, .present = true },
-        [tegra_clk_ndspeed] = { .dt_id = TEGRA124_CLK_NDSPEED, .present = true },
        [tegra_clk_i2cslow] = { .dt_id = TEGRA124_CLK_I2CSLOW, .present = true },
        [tegra_clk_dsib] = { .dt_id = TEGRA124_CLK_DSIB, .present = true },
        [tegra_clk_tsec] = { .dt_id = TEGRA124_CLK_TSEC, .present = true },
@@ -952,7 +950,6 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
        [tegra_clk_clk_out_3_mux] = { .dt_id = TEGRA124_CLK_CLK_OUT_3_MUX, .present = true },
        [tegra_clk_dsia_mux] = { .dt_id = TEGRA124_CLK_DSIA_MUX, .present = true },
        [tegra_clk_dsib_mux] = { .dt_id = TEGRA124_CLK_DSIB_MUX, .present = true },
-        [tegra_clk_uarte] = { .dt_id = TEGRA124_CLK_UARTE, .present = true },
 };
 static struct tegra_devclk devclks[] __initdata = {
diff --git a/drivers/clk/versatile/clk-vexpress-osc.c b/drivers/clk/versatile/clk-vexpress-osc.c
index 2dc8b41a339d..422391242b39 100644
--- a/drivers/clk/versatile/clk-vexpress-osc.c
+++ b/drivers/clk/versatile/clk-vexpress-osc.c
@@ -100,9 +100,11 @@ void __init vexpress_osc_of_setup(struct device_node *node)
        struct clk *clk;
        u32 range[2];
+        vexpress_sysreg_of_early_init();
        osc = kzalloc(sizeof(*osc), GFP_KERNEL);
        if (!osc)
-                goto error;
+                return;
        osc->func = vexpress_config_func_get_by_node(node);
        if (!osc->func) {
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 57e823c44d2a..5163ec13429d 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -66,6 +66,7 @@ static int arch_timer_ppi[MAX_TIMER_PPI];
 static struct clock_event_device __percpu *arch_timer_evt;
 static bool arch_timer_use_virtual = true;
+static bool arch_timer_c3stop;
 static bool arch_timer_mem_use_virtual;
 /*
@@ -263,7 +264,8 @@ static void __arch_timer_setup(unsigned type,
        clk->features = CLOCK_EVT_FEAT_ONESHOT;
        if (type == ARCH_CP15_TIMER) {
-                clk->features |= CLOCK_EVT_FEAT_C3STOP;
+                if (arch_timer_c3stop)
+                        clk->features |= CLOCK_EVT_FEAT_C3STOP;
                clk->name = "arch_sys_timer";
                clk->rating = 450;
                clk->cpumask = cpumask_of(smp_processor_id());
@@ -665,6 +667,8 @@ static void __init arch_timer_init(struct device_node *np)
                }
        }
+        arch_timer_c3stop = !of_property_read_bool(np, "always-on");
        arch_timer_register();
        arch_timer_common_init();
 }
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index a6ee6d7cd63f..acf5a329d538 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -416,8 +416,6 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
        evt->set_mode = exynos4_tick_set_mode;
        evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
        evt->rating = 450;
-        clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
-                                        0xf, 0x7fffffff);
        exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
@@ -430,9 +428,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
                                evt->irq);
                        return -EIO;
                }
+                irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
        } else {
                enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
        }
+        clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
+                                        0xf, 0x7fffffff);
        return 0;
 }
@@ -450,7 +451,6 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                                           unsigned long action, void *hcpu)
 {
        struct mct_clock_event_device *mevt;
-        unsigned int cpu;
        /*
         * Grab cpu pointer in each case to avoid spurious
@@ -461,12 +461,6 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_setup(&mevt->evt);
                break;
-        case CPU_ONLINE:
-                cpu = (unsigned long)hcpu;
-                if (mct_int_type == MCT_INT_SPI)
-                        irq_set_affinity(mct_irqs[MCT_L0_IRQ + cpu],
-                                                cpumask_of(cpu));
-                break;
        case CPU_DYING:
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_stop(&mevt->evt);
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 00fdd1170284..a8d7ea14f183 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -100,7 +100,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
                        || tcd->clkevt.mode == CLOCK_EVT_MODE_ONESHOT) {
                __raw_writel(0xff, regs + ATMEL_TC_REG(2, IDR));
                __raw_writel(ATMEL_TC_CLKDIS, regs + ATMEL_TC_REG(2, CCR));
-                clk_disable_unprepare(tcd->clk);
+                clk_disable(tcd->clk);
        }
        switch (m) {
@@ -109,7 +109,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
         * of oneshot, we get lower overhead and improved accuracy.
         */
        case CLOCK_EVT_MODE_PERIODIC:
-                clk_prepare_enable(tcd->clk);
+                clk_enable(tcd->clk);
                /* slow clock, count up to RC, then irq and restart */
                __raw_writel(timer_clock
@@ -126,7 +126,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
                break;
        case CLOCK_EVT_MODE_ONESHOT:
-                clk_prepare_enable(tcd->clk);
+                clk_enable(tcd->clk);
                /* slow clock, count up to RC, then irq and stop */
                __raw_writel(timer_clock | ATMEL_TC_CPCSTOP
@@ -194,7 +194,7 @@ static int __init setup_clkevents(struct atmel_tc *tc, int clk32k_divisor_idx)
        ret = clk_prepare_enable(t2_clk);
        if (ret)
                return ret;
-        clk_disable_unprepare(t2_clk);
+        clk_disable(t2_clk);
        clkevt.regs = tc->regs;
        clkevt.clk = t2_clk;
diff --git a/drivers/clocksource/timer-marco.c b/drivers/clocksource/timer-marco.c
index b52e1c078b99..7f5374dbefd9 100644
--- a/drivers/clocksource/timer-marco.c
+++ b/drivers/clocksource/timer-marco.c
@@ -199,7 +199,7 @@ static int sirfsoc_local_timer_setup(struct clock_event_device *ce)
        action->dev_id = ce;
        BUG_ON(setup_irq(ce->irq, action));
-        irq_set_affinity(action->irq, cpumask_of(cpu));
+        irq_force_affinity(action->irq, cpumask_of(cpu));
        clockevents_register_device(ce);
        return 0;
diff --git a/drivers/clocksource/zevio-timer.c b/drivers/clocksource/zevio-timer.c
index ca81809d159d..7ce442148c3f 100644
--- a/drivers/clocksource/zevio-timer.c
+++ b/drivers/clocksource/zevio-timer.c
@@ -212,4 +212,9 @@ error_free:
        return ret;
 }
-CLOCKSOURCE_OF_DECLARE(zevio_timer, "lsi,zevio-timer", zevio_timer_add);
+static void __init zevio_timer_init(struct device_node *node)
+{
+        BUG_ON(zevio_timer_add(node));
+}
+CLOCKSOURCE_OF_DECLARE(zevio_timer, "lsi,zevio-timer", zevio_timer_init);
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 148d707a1d43..ccdd4c7e748b 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
                return;
        /* Can only change if privileged. */
-        if (!capable(CAP_NET_ADMIN)) {
+        if (!__netlink_ns_capable(nsp, &init_user_ns, CAP_NET_ADMIN)) {
                err = EPERM;
                goto out;
        }
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 0e9cce82844b..580503513f0f 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -92,11 +92,7 @@ config ARM_EXYNOS_CPU_FREQ_BOOST_SW
 config ARM_HIGHBANK_CPUFREQ
        tristate "Calxeda Highbank-based"
-        depends on ARCH_HIGHBANK
+        depends on ARCH_HIGHBANK && GENERIC_CPUFREQ_CPU0 && REGULATOR
-        select GENERIC_CPUFREQ_CPU0
-        select PM_OPP
-        select REGULATOR
        default m
        help
          This adds the CPUFreq driver for Calxeda Highbank SoC
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 1bf6bbac3e03..09b9129c7bd3 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -130,7 +130,7 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                return -ENOENT;
        }
-        cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu0");
+        cpu_reg = regulator_get_optional(cpu_dev, "cpu0");
        if (IS_ERR(cpu_reg)) {
                /*
                 * If cpu0 regulator supply node is present, but regulator is
@@ -145,23 +145,23 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                        PTR_ERR(cpu_reg));
        }
-        cpu_clk = devm_clk_get(cpu_dev, NULL);
+        cpu_clk = clk_get(cpu_dev, NULL);
        if (IS_ERR(cpu_clk)) {
                ret = PTR_ERR(cpu_clk);
                pr_err("failed to get cpu0 clock: %d\n", ret);
-                goto out_put_node;
+                goto out_put_reg;
        }
        ret = of_init_opp_table(cpu_dev);
        if (ret) {
                pr_err("failed to init OPP table: %d\n", ret);
-                goto out_put_node;
+                goto out_put_clk;
        }
        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
        if (ret) {
                pr_err("failed to init cpufreq table: %d\n", ret);
-                goto out_put_node;
+                goto out_put_clk;
        }
        of_property_read_u32(np, "voltage-tolerance", &voltage_tolerance);
@@ -216,6 +216,12 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
 out_free_table:
        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+out_put_clk:
+        if (!IS_ERR(cpu_clk))
+                clk_put(cpu_clk);
+out_put_reg:
+        if (!IS_ERR(cpu_reg))
+                regulator_put(cpu_reg);
 out_put_node:
        of_node_put(np);
        return ret;
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index ba43991ba98a..e1c6433b16e0 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -366,6 +366,11 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                break;
        case CPUFREQ_GOV_LIMITS:
+                mutex_lock(&dbs_data->mutex);
+                if (!cpu_cdbs->cur_policy) {
+                        mutex_unlock(&dbs_data->mutex);
+                        break;
+                }
                mutex_lock(&cpu_cdbs->timer_mutex);
                if (policy->max < cpu_cdbs->cur_policy->cur)
                        __cpufreq_driver_target(cpu_cdbs->cur_policy,
@@ -375,6 +380,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                        policy->min, CPUFREQ_RELATION_L);
                dbs_check_cpu(dbs_data, cpu);
                mutex_unlock(&cpu_cdbs->timer_mutex);
+                mutex_unlock(&dbs_data->mutex);
                break;
        }
        return 0;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 099967302bf2..eab8ccfe6beb 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -37,6 +37,7 @@
 #define BYT_RATIOS              0x66a
 #define BYT_VIDS                0x66b
 #define BYT_TURBO_RATIOS        0x66c
+#define BYT_TURBO_VIDS          0x66d
 #define FRAC_BITS 6
@@ -70,8 +71,9 @@ struct pstate_data {
 };
 struct vid_data {
-        int32_t min;
+        int min;
-        int32_t max;
+        int max;
+        int turbo;
        int32_t ratio;
 };
@@ -359,14 +361,14 @@ static int byt_get_min_pstate(void)
 {
        u64 value;
        rdmsrl(BYT_RATIOS, value);
-        return (value >> 8) & 0xFF;
+        return (value >> 8) & 0x3F;
 }
 static int byt_get_max_pstate(void)
 {
        u64 value;
        rdmsrl(BYT_RATIOS, value);
-        return (value >> 16) & 0xFF;
+        return (value >> 16) & 0x3F;
 }
 static int byt_get_turbo_pstate(void)
@@ -393,6 +395,9 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
        vid_fp = clamp_t(int32_t, vid_fp, cpudata->vid.min, cpudata->vid.max);
        vid = fp_toint(vid_fp);
+        if (pstate > cpudata->pstate.max_pstate)
+                vid = cpudata->vid.turbo;
        val |= vid;
        wrmsrl(MSR_IA32_PERF_CTL, val);
@@ -402,13 +407,17 @@ static void byt_get_vid(struct cpudata *cpudata)
 {
        u64 value;
        rdmsrl(BYT_VIDS, value);
-        cpudata->vid.min = int_tofp((value >> 8) & 0x7f);
+        cpudata->vid.min = int_tofp((value >> 8) & 0x3f);
-        cpudata->vid.max = int_tofp((value >> 16) & 0x7f);
+        cpudata->vid.max = int_tofp((value >> 16) & 0x3f);
        cpudata->vid.ratio = div_fp(
                cpudata->vid.max - cpudata->vid.min,
                int_tofp(cpudata->pstate.max_pstate -
                        cpudata->pstate.min_pstate));
+        rdmsrl(BYT_TURBO_VIDS, value);
+        cpudata->vid.turbo = value & 0x7f;
 }
@@ -545,12 +554,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
        if (pstate_funcs.get_vid)
                pstate_funcs.get_vid(cpu);
+        intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
-        /*
-         * goto max pstate so we don't slow up boot if we are built-in if we are
-         * a module we will take care of it during normal operation
-         */
-        intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
 }
 static inline void intel_pstate_calc_busy(struct cpudata *cpu,
@@ -695,11 +699,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu = all_cpu_data[cpunum];
        intel_pstate_get_cpu_pstates(cpu);
-        if (!cpu->pstate.current_pstate) {
-                all_cpu_data[cpunum] = NULL;
-                kfree(cpu);
-                return -ENODATA;
-        }
        cpu->cpu = cpunum;
@@ -710,7 +709,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu->timer.expires = jiffies + HZ/100;
        intel_pstate_busy_pid_reset(cpu);
        intel_pstate_sample(cpu);
-        intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
        add_timer_on(&cpu->timer, cpunum);
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index d00e5d1abd25..5c4369b5d834 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -242,7 +242,7 @@ static void do_powersaver(int cx_address, unsigned int mults_index,
 * Sets a new clock ratio.
 */
-static void longhaul_setstate(struct cpufreq_policy *policy,
+static int longhaul_setstate(struct cpufreq_policy *policy,
                unsigned int table_index)
 {
        unsigned int mults_index;
@@ -258,10 +258,12 @@ static void longhaul_setstate(struct cpufreq_policy *policy,
        /* Safety precautions */
        mult = mults[mults_index & 0x1f];
        if (mult == -1)
-                return;
+                return -EINVAL;
        speed = calc_speed(mult);
        if ((speed > highest_speed) || (speed < lowest_speed))
-                return;
+                return -EINVAL;
        /* Voltage transition before frequency transition? */
        if (can_scale_voltage && longhaul_index < table_index)
                dir = 1;
@@ -269,8 +271,6 @@ static void longhaul_setstate(struct cpufreq_policy *policy,
        freqs.old = calc_speed(longhaul_get_cpu_mult());
        freqs.new = speed;
-        cpufreq_freq_transition_begin(policy, &freqs);
        pr_debug("Setting to FSB:%dMHz Mult:%d.%dx (%s)\n",
                        fsb, mult/10, mult%10, print_speed(speed/1000));
 retry_loop:
@@ -385,12 +385,14 @@ retry_loop:
                        goto retry_loop;
                }
        }
-        /* Report true CPU frequency */
-        cpufreq_freq_transition_end(policy, &freqs, 0);
-        if (!bm_timeout)
+        if (!bm_timeout) {
                printk(KERN_INFO PFX "Warning: Timeout while waiting for "
                                "idle PCI bus.\n");
+                return -EBUSY;
+        }
+        return 0;
 }
 /*
@@ -631,9 +633,10 @@ static int longhaul_target(struct cpufreq_policy *policy,
        unsigned int i;
        unsigned int dir = 0;
        u8 vid, current_vid;
+        int retval = 0;
        if (!can_scale_voltage)
-                longhaul_setstate(policy, table_index);
+                retval = longhaul_setstate(policy, table_index);
        else {
                /* On test system voltage transitions exceeding single
                 * step up or down were turning motherboard off. Both
@@ -648,7 +651,7 @@ static int longhaul_target(struct cpufreq_policy *policy,
                while (i != table_index) {
                        vid = (longhaul_table[i].driver_data >> 8) & 0x1f;
                        if (vid != current_vid) {
-                                longhaul_setstate(policy, i);
+                                retval = longhaul_setstate(policy, i);
                                current_vid = vid;
                                msleep(200);
                        }
@@ -657,10 +660,11 @@ static int longhaul_target(struct cpufreq_policy *policy,
                        else
                                i--;
                }
-                longhaul_setstate(policy, table_index);
+                retval = longhaul_setstate(policy, table_index);
        }
        longhaul_index = table_index;
-        return 0;
+        return retval;
 }
@@ -968,7 +972,15 @@ static void __exit longhaul_exit(void)
        for (i = 0; i < numscales; i++) {
                if (mults[i] == maxmult) {
+                        struct cpufreq_freqs freqs;
+                        freqs.old = policy->cur;
+                        freqs.new = longhaul_table[i].frequency;
+                        freqs.flags = 0;
+                        cpufreq_freq_transition_begin(policy, &freqs);
                        longhaul_setstate(policy, i);
+                        cpufreq_freq_transition_end(policy, &freqs, 0);
                        break;
                }
        }
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index f0bc31f5db27..d4add8621944 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -62,7 +62,7 @@ static int loongson2_cpufreq_target(struct cpufreq_policy *policy,
        set_cpus_allowed_ptr(current, &cpus_allowed);
        /* setting the cpu frequency */
-        clk_set_rate(policy->clk, freq);
+        clk_set_rate(policy->clk, freq * 1000);
        return 0;
 }
@@ -92,7 +92,7 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
             i++)
                loongson2_clockmod_table[i].frequency = (rate * i) / 8;
-        ret = clk_set_rate(cpuclk, rate);
+        ret = clk_set_rate(cpuclk, rate * 1000);
        if (ret) {
                clk_put(cpuclk);
                return ret;
diff --git a/drivers/cpufreq/powernow-k6.c b/drivers/cpufreq/powernow-k6.c
index 49f120e1bc7b..78904e6ca4a0 100644
--- a/drivers/cpufreq/powernow-k6.c
+++ b/drivers/cpufreq/powernow-k6.c
@@ -138,22 +138,14 @@ static void powernow_k6_set_cpu_multiplier(unsigned int best_i)
 static int powernow_k6_target(struct cpufreq_policy *policy,
                unsigned int best_i)
 {
-        struct cpufreq_freqs freqs;
        if (clock_ratio[best_i].driver_data > max_multiplier) {
                printk(KERN_ERR PFX "invalid target frequency\n");
                return -EINVAL;
        }
-        freqs.old = busfreq * powernow_k6_get_cpu_multiplier();
-        freqs.new = busfreq * clock_ratio[best_i].driver_data;
-        cpufreq_freq_transition_begin(policy, &freqs);
        powernow_k6_set_cpu_multiplier(best_i);
-        cpufreq_freq_transition_end(policy, &freqs, 0);
        return 0;
 }
@@ -227,9 +219,20 @@ have_busfreq:
 static int powernow_k6_cpu_exit(struct cpufreq_policy *policy)
 {
        unsigned int i;
-        for (i = 0; i < 8; i++) {
-                if (i == max_multiplier)
+        for (i = 0; (clock_ratio[i].frequency != CPUFREQ_TABLE_END); i++) {
+                if (clock_ratio[i].driver_data == max_multiplier) {
+                        struct cpufreq_freqs freqs;
+                        freqs.old = policy->cur;
+                        freqs.new = clock_ratio[i].frequency;
+                        freqs.flags = 0;
+                        cpufreq_freq_transition_begin(policy, &freqs);
                        powernow_k6_target(policy, i);
+                        cpufreq_freq_transition_end(policy, &freqs, 0);
+                        break;
+                }
        }
        return 0;
 }
diff --git a/drivers/cpufreq/powernow-k7.c b/drivers/cpufreq/powernow-k7.c
index f911645c3f6d..e61e224475ad 100644
--- a/drivers/cpufreq/powernow-k7.c
+++ b/drivers/cpufreq/powernow-k7.c
@@ -269,8 +269,6 @@ static int powernow_target(struct cpufreq_policy *policy, unsigned int index)
        freqs.new = powernow_table[index].frequency;
-        cpufreq_freq_transition_begin(policy, &freqs);
        /* Now do the magic poking into the MSRs.  */
        if (have_a0 == 1)       /* A0 errata 5 */
@@ -290,8 +288,6 @@ static int powernow_target(struct cpufreq_policy *policy, unsigned int index)
        if (have_a0 == 1)
                local_irq_enable();
-        cpufreq_freq_transition_end(policy, &freqs, 0);
        return 0;
 }
diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
index 9edccc63245d..af4968813e76 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -29,6 +29,7 @@
 #include <asm/cputhreads.h>
 #include <asm/reg.h>
+#include <asm/smp.h> /* Required for cpu_sibling_mask() in UP configs */
 #define POWERNV_MAX_PSTATES     256
diff --git a/drivers/cpufreq/ppc-corenet-cpufreq.c b/drivers/cpufreq/ppc-corenet-cpufreq.c
index b7e677be1df0..0af618abebaf 100644
--- a/drivers/cpufreq/ppc-corenet-cpufreq.c
+++ b/drivers/cpufreq/ppc-corenet-cpufreq.c
@@ -138,6 +138,7 @@ static int corenet_cpufreq_cpu_init(struct cpufreq_policy *policy)
        struct cpufreq_frequency_table *table;
        struct cpu_data *data;
        unsigned int cpu = policy->cpu;
+        u64 transition_latency_hz;
        np = of_get_cpu_node(cpu, NULL);
        if (!np)
@@ -205,8 +206,10 @@ static int corenet_cpufreq_cpu_init(struct cpufreq_policy *policy)
        for_each_cpu(i, per_cpu(cpu_mask, cpu))
                per_cpu(cpu_data, i) = data;
+        transition_latency_hz = 12ULL * NSEC_PER_SEC;
        policy->cpuinfo.transition_latency =
-                                (12 * NSEC_PER_SEC) / fsl_get_sys_freq();
+                do_div(transition_latency_hz, fsl_get_sys_freq());
        of_node_put(np);
        return 0;
diff --git a/drivers/cpufreq/unicore2-cpufreq.c b/drivers/cpufreq/unicore2-cpufreq.c
index 8d045afa7fb4..6f9dfa80563a 100644
--- a/drivers/cpufreq/unicore2-cpufreq.c
+++ b/drivers/cpufreq/unicore2-cpufreq.c
@@ -60,9 +60,7 @@ static int __init ucv2_cpu_init(struct cpufreq_policy *policy)
        policy->max = policy->cpuinfo.max_freq = 1000000;
        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
        policy->clk = clk_get(NULL, "MAIN_CLK");
-        if (IS_ERR(policy->clk))
+        return PTR_ERR_OR_ZERO(policy->clk);
-                return PTR_ERR(policy->clk);
-        return 0;
 }
 static struct cpufreq_driver ucv2_driver = {
diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
index 9f25f5296029..0eabd81e1a90 100644
--- a/drivers/crypto/caam/error.c
+++ b/drivers/crypto/caam/error.c
@@ -16,9 +16,13 @@
        char *tmp;                                              \
                                                                \
        tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC);  \
-        sprintf(tmp, format, param);                            \
+        if (likely(tmp)) {                                      \
-        strcat(str, tmp);                                       \
+                sprintf(tmp, format, param);                    \
-        kfree(tmp);                                             \
+                strcat(str, tmp);                               \
+                kfree(tmp);                                     \
+        } else {                                                \
+                strcat(str, "kmalloc failure in SPRINTFCAT");   \
+        }                                                       \
 }
 static void report_jump_idx(u32 status, char *outstr)
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index ba06d1d2f99e..5c5863842de9 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -197,7 +197,7 @@ config AMCC_PPC440SPE_ADMA
 config TIMB_DMA
        tristate "Timberdale FPGA DMA support"
-        depends on MFD_TIMBERDALE || HAS_IOMEM
+        depends on MFD_TIMBERDALE
        select DMA_ENGINE
        help
          Enable support for the Timberdale FPGA DMA engine.
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index a886713937fd..d5d30ed863ce 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1009,6 +1009,7 @@ static void dmaengine_unmap(struct kref *kref)
                dma_unmap_page(dev, unmap->addr[i], unmap->len,
                               DMA_BIDIRECTIONAL);
        }
+        cnt = unmap->map_cnt;
        mempool_free(unmap, __get_unmap_pool(cnt)->pool);
 }
@@ -1074,6 +1075,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
        memset(unmap, 0, sizeof(*unmap));
        kref_init(&unmap->kref);
        unmap->dev = dev;
+        unmap->map_cnt = nr;
        return unmap;
 }
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index cfdbb92aae1d..7a740769c2fa 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1548,11 +1548,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
        /* Disable BLOCK interrupts as well */
        channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
-        err = devm_request_irq(chip->dev, chip->irq, dw_dma_interrupt,
-                               IRQF_SHARED, "dw_dmac", dw);
-        if (err)
-                return err;
        /* Create a pool of consistent memory blocks for hardware descriptors */
        dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
                                         sizeof(struct dw_desc), 4, 0);
@@ -1563,6 +1558,11 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
        tasklet_init(&dw->tasklet, dw_dma_tasklet, (unsigned long)dw);
+        err = request_irq(chip->irq, dw_dma_interrupt, IRQF_SHARED,
+                          "dw_dmac", dw);
+        if (err)
+                return err;
        INIT_LIST_HEAD(&dw->dma.channels);
        for (i = 0; i < nr_channels; i++) {
                struct dw_dma_chan      *dwc = &dw->chan[i];
@@ -1667,6 +1667,7 @@ int dw_dma_remove(struct dw_dma_chip *chip)
        dw_dma_off(dw);
        dma_async_device_unregister(&dw->dma);
+        free_irq(chip->irq, dw);
        tasklet_kill(&dw->tasklet);
        list_for_each_entry_safe(dwc, _dwc, &dw->dma.channels,
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index cd04eb7b182e..926360c2db6a 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -182,11 +182,13 @@ static void edma_execute(struct edma_chan *echan)
                                  echan->ecc->dummy_slot);
        }
-        edma_resume(echan->ch_num);
        if (edesc->processed <= MAX_NR_SG) {
                dev_dbg(dev, "first transfer starting %d\n", echan->ch_num);
                edma_start(echan->ch_num);
+        } else {
+                dev_dbg(dev, "chan: %d: completed %d elements, resuming\n",
+                        echan->ch_num, edesc->processed);
+                edma_resume(echan->ch_num);
        }
        /*
diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
index 381e793184ba..b396a7fb53ab 100644
--- a/drivers/dma/fsl-edma.c
+++ b/drivers/dma/fsl-edma.c
@@ -968,7 +968,17 @@ static struct platform_driver fsl_edma_driver = {
        .remove         = fsl_edma_remove,
 };
-module_platform_driver(fsl_edma_driver);
+static int __init fsl_edma_init(void)
+{
+        return platform_driver_register(&fsl_edma_driver);
+}
+subsys_initcall(fsl_edma_init);
+static void __exit fsl_edma_exit(void)
+{
+        platform_driver_unregister(&fsl_edma_driver);
+}
+module_exit(fsl_edma_exit);
 MODULE_ALIAS("platform:fsl-edma");
 MODULE_DESCRIPTION("Freescale eDMA engine driver");
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 766b68ed505c..394cbc5c93e3 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -191,12 +191,10 @@ static void mv_set_mode(struct mv_xor_chan *chan,
 static void mv_chan_activate(struct mv_xor_chan *chan)
 {
-        u32 activation;
        dev_dbg(mv_chan_to_devp(chan), " activate chan.\n");
-        activation = readl_relaxed(XOR_ACTIVATION(chan));
-        activation |= 0x1;
+        /* writel ensures all descriptors are flushed before activation */
-        writel_relaxed(activation, XOR_ACTIVATION(chan));
+        writel(BIT(0), XOR_ACTIVATION(chan));
 }
 static char mv_chan_is_busy(struct mv_xor_chan *chan)
diff --git a/drivers/dma/sa11x0-dma.c b/drivers/dma/sa11x0-dma.c
index ab26d46bbe15..5ebdfbc1051e 100644
--- a/drivers/dma/sa11x0-dma.c
+++ b/drivers/dma/sa11x0-dma.c
@@ -113,11 +113,9 @@ struct sa11x0_dma_phy {
        struct sa11x0_dma_desc  *txd_load;
        unsigned                sg_done;
        struct sa11x0_dma_desc  *txd_done;
-#ifdef CONFIG_PM_SLEEP
        u32                     dbs[2];
        u32                     dbt[2];
        u32                     dcsr;
-#endif
 };
 struct sa11x0_dma_dev {
@@ -984,7 +982,6 @@ static int sa11x0_dma_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
 static int sa11x0_dma_suspend(struct device *dev)
 {
        struct sa11x0_dma_dev *d = dev_get_drvdata(dev);
@@ -1054,7 +1051,6 @@ static int sa11x0_dma_resume(struct device *dev)
        return 0;
 }
-#endif
 static const struct dev_pm_ops sa11x0_dma_pm_ops = {
        .suspend_noirq = sa11x0_dma_suspend,
diff --git a/drivers/dma/sirf-dma.c b/drivers/dma/sirf-dma.c
index a1bd8298d55f..03f7820fa333 100644
--- a/drivers/dma/sirf-dma.c
+++ b/drivers/dma/sirf-dma.c
@@ -666,7 +666,7 @@ static struct dma_chan *of_dma_sirfsoc_xlate(struct of_phandle_args *dma_spec,
        struct sirfsoc_dma *sdma = ofdma->of_dma_data;
        unsigned int request = dma_spec->args[0];
-        if (request > SIRFSOC_DMA_CHANNELS)
+        if (request >= SIRFSOC_DMA_CHANNELS)
                return NULL;
        return dma_get_slave_channel(&sdma->channels[request].chan);
diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
index c98764aeeec6..f477308b6e9c 100644
--- a/drivers/firewire/core.h
+++ b/drivers/firewire/core.h
@@ -237,8 +237,8 @@ static inline bool is_next_generation(int new_generation, int old_generation)
 #define LOCAL_BUS 0xffc0
-/* arbitrarily chosen maximum range for physical DMA: 128 TB */
+/* OHCI-1394's default upper bound for physical DMA: 4 GB */
-#define FW_MAX_PHYSICAL_RANGE           (128ULL << 40)
+#define FW_MAX_PHYSICAL_RANGE           (1ULL << 32)
 void fw_core_handle_request(struct fw_card *card, struct fw_packet *request);
 void fw_core_handle_response(struct fw_card *card, struct fw_packet *packet);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 8db663219560..586f2f7f6993 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -3716,7 +3716,7 @@ static int pci_probe(struct pci_dev *dev,
                    version >> 16, version & 0xff, ohci->card.index,
                    ohci->n_ir, ohci->n_it, ohci->quirks,
                    reg_read(ohci, OHCI1394_PhyUpperBound) ?
-                        ", >4 GB phys DMA" : "");
+                        ", physUB" : "");
        return 0;
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index 3ee852c9925b..071c2c969eec 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -756,6 +756,7 @@ static const struct {
         */
        { ACPI_SIG_IBFT },
        { "iBFT" },
+        { "BIFT" },     /* Broadcom iSCSI Offload */
 };
 static void __init acpi_find_ibft_region(void)
diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
index e73c6755a5eb..70304220a479 100644
--- a/drivers/gpio/gpio-ich.c
+++ b/drivers/gpio/gpio-ich.c
@@ -305,6 +305,8 @@ static struct ichx_desc ich6_desc = {
        .ngpio = 50,
        .have_blink = true,
+        .regs = ichx_regs,
+        .reglen = ichx_reglen,
 };
 /* Intel 3100 */
@@ -324,6 +326,8 @@ static struct ichx_desc i3100_desc = {
        .uses_gpe0 = true,
        .ngpio = 50,
+        .regs = ichx_regs,
+        .reglen = ichx_reglen,
 };
 /* ICH7 and ICH8-based */
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index 99a68310e7c0..3d53fd6880d1 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -894,9 +894,11 @@ static int mcp23s08_probe(struct spi_device *spi)
                        dev_err(&spi->dev, "invalid spi-present-mask\n");
                        return -ENODEV;
                }
+                for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
-                for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++)
+                        if ((spi_present_mask & (1 << addr)))
+                                chips++;
                        pullups[addr] = 0;
+                }
        } else {
                type = spi_get_device_id(spi)->driver_data;
                pdata = dev_get_platdata(&spi->dev);
@@ -919,12 +921,12 @@ static int mcp23s08_probe(struct spi_device *spi)
                        pullups[addr] = pdata->chip[addr].pullups;
                }
-                if (!chips)
-                        return -ENODEV;
                base = pdata->base;
        }
+        if (!chips)
+                return -ENODEV;
        data = kzalloc(sizeof(*data) + chips * sizeof(struct mcp23s08),
                        GFP_KERNEL);
        if (!data)
diff --git a/drivers/gpio/gpio-spear-spics.c b/drivers/gpio/gpio-spear-spics.c
index e9a0415834ea..30bcc539425d 100644
--- a/drivers/gpio/gpio-spear-spics.c
+++ b/drivers/gpio/gpio-spear-spics.c
@@ -2,7 +2,7 @@
 * SPEAr platform SPI chipselect abstraction over gpiolib
 *
 * Copyright (C) 2012 ST Microelectronics
- * Shiraz Hashim <shiraz.hashim@st.com>
+ * Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -205,6 +205,6 @@ static int __init spics_gpio_init(void)
 }
 subsys_initcall(spics_gpio_init);
-MODULE_AUTHOR("Shiraz Hashim <shiraz.hashim@st.com>");
+MODULE_AUTHOR("Shiraz Hashim <shiraz.linux.kernel@gmail.com>");
 MODULE_DESCRIPTION("ST Microlectronics SPEAr SPI Chip Select Abstraction");
 MODULE_LICENSE("GPL");
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index bf0f8b476696..401add28933f 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -233,7 +233,7 @@ static void acpi_gpiochip_request_interrupts(struct acpi_gpio_chip *acpi_gpio)
 {
        struct gpio_chip *chip = acpi_gpio->chip;
-        if (!chip->dev || !chip->to_irq)
+        if (!chip->to_irq)
                return;
        INIT_LIST_HEAD(&acpi_gpio->events);
@@ -253,7 +253,7 @@ static void acpi_gpiochip_free_interrupts(struct acpi_gpio_chip *acpi_gpio)
        struct acpi_gpio_event *event, *ep;
        struct gpio_chip *chip = acpi_gpio->chip;
-        if (!chip->dev || !chip->to_irq)
+        if (!chip->to_irq)
                return;
        list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
@@ -451,7 +451,7 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address,
                if (function == ACPI_WRITE)
                        gpiod_set_raw_value(desc, !!((1 << i) & *value));
                else
-                        *value |= gpiod_get_raw_value(desc) << i;
+                        *value |= (u64)gpiod_get_raw_value(desc) << i;
        }
 out:
@@ -501,6 +501,9 @@ void acpi_gpiochip_add(struct gpio_chip *chip)
        acpi_handle handle;
        acpi_status status;
+        if (!chip || !chip->dev)
+                return;
        handle = ACPI_HANDLE(chip->dev);
        if (!handle)
                return;
@@ -531,6 +534,9 @@ void acpi_gpiochip_remove(struct gpio_chip *chip)
        acpi_handle handle;
        acpi_status status;
+        if (!chip || !chip->dev)
+                return;
        handle = ACPI_HANDLE(chip->dev);
        if (!handle)
                return;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 761013f8b82f..f48817d97480 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1387,8 +1387,8 @@ static int gpiochip_irq_map(struct irq_domain *d, unsigned int irq,
 {
        struct gpio_chip *chip = d->host_data;
-        irq_set_chip_and_handler(irq, chip->irqchip, chip->irq_handler);
        irq_set_chip_data(irq, chip);
+        irq_set_chip_and_handler(irq, chip->irqchip, chip->irq_handler);
 #ifdef CONFIG_ARM
        set_irq_flags(irq, IRQF_VALID);
 #else
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index 9d25dbbe6771..48e38ba22783 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -23,7 +23,7 @@ drm-$(CONFIG_DRM_PANEL) += drm_panel.o
 drm-usb-y   := drm_usb.o
-drm_kms_helper-y := drm_crtc_helper.o drm_dp_helper.o
+drm_kms_helper-y := drm_crtc_helper.o drm_dp_helper.o drm_probe_helper.o
 drm_kms_helper-$(CONFIG_DRM_LOAD_EDID_FIRMWARE) += drm_edid_load.o
 drm_kms_helper-$(CONFIG_DRM_KMS_FB_HELPER) += drm_fb_helper.o
 drm_kms_helper-$(CONFIG_DRM_KMS_CMA_HELPER) += drm_fb_cma_helper.o
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index 977cfb35837a..635f6ffc27c2 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -572,7 +572,7 @@ static u32 cbr_scan2(struct ast_private *ast)
                for (loop = 0; loop < CBR_PASSNUM2; loop++) {
                        if ((data = cbr_test2(ast)) != 0) {
                                data2 &= data;
-                                if (!data)
+                                if (!data2)
                                        return 0;
                                break;
                        }
diff --git a/drivers/gpu/drm/bochs/bochs.h b/drivers/gpu/drm/bochs/bochs.h
index 741965c001a6..7eb52dd44b01 100644
--- a/drivers/gpu/drm/bochs/bochs.h
+++ b/drivers/gpu/drm/bochs/bochs.h
@@ -1,5 +1,6 @@
 #include <linux/io.h>
 #include <linux/fb.h>
+#include <linux/console.h>
 #include <drm/drmP.h>
 #include <drm/drm_crtc.h>
@@ -87,8 +88,6 @@ struct bochs_device {
                struct bochs_framebuffer gfb;
                struct drm_fb_helper helper;
                int size;
-                int x1, y1, x2, y2; /* dirty rect */
-                spinlock_t dirty_lock;
                bool initialized;
        } fb;
 };
diff --git a/drivers/gpu/drm/bochs/bochs_drv.c b/drivers/gpu/drm/bochs/bochs_drv.c
index 395bba261c9a..9c13df29fd20 100644
--- a/drivers/gpu/drm/bochs/bochs_drv.c
+++ b/drivers/gpu/drm/bochs/bochs_drv.c
@@ -95,6 +95,49 @@ static struct drm_driver bochs_driver = {
 };
 /* ---------------------------------------------------------------------- */
+/* pm interface                                                           */
+static int bochs_pm_suspend(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        struct bochs_device *bochs = drm_dev->dev_private;
+        drm_kms_helper_poll_disable(drm_dev);
+        if (bochs->fb.initialized) {
+                console_lock();
+                fb_set_suspend(bochs->fb.helper.fbdev, 1);
+                console_unlock();
+        }
+        return 0;
+}
+static int bochs_pm_resume(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        struct bochs_device *bochs = drm_dev->dev_private;
+        drm_helper_resume_force_mode(drm_dev);
+        if (bochs->fb.initialized) {
+                console_lock();
+                fb_set_suspend(bochs->fb.helper.fbdev, 0);
+                console_unlock();
+        }
+        drm_kms_helper_poll_enable(drm_dev);
+        return 0;
+}
+static const struct dev_pm_ops bochs_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(bochs_pm_suspend,
+                                bochs_pm_resume)
+};
+/* ---------------------------------------------------------------------- */
 /* pci interface                                                          */
 static int bochs_kick_out_firmware_fb(struct pci_dev *pdev)
@@ -155,6 +198,7 @@ static struct pci_driver bochs_pci_driver = {
        .id_table =     bochs_pci_tbl,
        .probe =        bochs_pci_probe,
        .remove =       bochs_pci_remove,
+        .driver.pm =    &bochs_pm_ops,
 };
 /* ---------------------------------------------------------------------- */
diff --git a/drivers/gpu/drm/bochs/bochs_fbdev.c b/drivers/gpu/drm/bochs/bochs_fbdev.c
index 4da5206b7cc9..561b84474122 100644
--- a/drivers/gpu/drm/bochs/bochs_fbdev.c
+++ b/drivers/gpu/drm/bochs/bochs_fbdev.c
@@ -190,7 +190,6 @@ int bochs_fbdev_init(struct bochs_device *bochs)
        int ret;
        bochs->fb.helper.funcs = &bochs_fb_helper_funcs;
-        spin_lock_init(&bochs->fb.dirty_lock);
        ret = drm_fb_helper_init(bochs->dev, &bochs->fb.helper,
                                 1, 1);
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
index 953fc8aea69c..08ce520f61a5 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/console.h>
 #include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
 #include "cirrus_drv.h"
@@ -75,6 +76,41 @@ static void cirrus_pci_remove(struct pci_dev *pdev)
        drm_put_dev(dev);
 }
+static int cirrus_pm_suspend(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        struct cirrus_device *cdev = drm_dev->dev_private;
+        drm_kms_helper_poll_disable(drm_dev);
+        if (cdev->mode_info.gfbdev) {
+                console_lock();
+                fb_set_suspend(cdev->mode_info.gfbdev->helper.fbdev, 1);
+                console_unlock();
+        }
+        return 0;
+}
+static int cirrus_pm_resume(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        struct cirrus_device *cdev = drm_dev->dev_private;
+        drm_helper_resume_force_mode(drm_dev);
+        if (cdev->mode_info.gfbdev) {
+                console_lock();
+                fb_set_suspend(cdev->mode_info.gfbdev->helper.fbdev, 0);
+                console_unlock();
+        }
+        drm_kms_helper_poll_enable(drm_dev);
+        return 0;
+}
 static const struct file_operations cirrus_driver_fops = {
        .owner = THIS_MODULE,
        .open = drm_open,
@@ -103,11 +139,17 @@ static struct drm_driver driver = {
        .dumb_destroy = drm_gem_dumb_destroy,
 };
+static const struct dev_pm_ops cirrus_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(cirrus_pm_suspend,
+                                cirrus_pm_resume)
+};
 static struct pci_driver cirrus_pci_driver = {
        .name = DRIVER_NAME,
        .id_table = pciidlist,
        .probe = cirrus_pci_probe,
        .remove = cirrus_pci_remove,
+        .driver.pm = &cirrus_pm_ops,
 };
 static int __init cirrus_init(void)
diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c
index 2d64aea83df2..f59433b7610c 100644
--- a/drivers/gpu/drm/cirrus/cirrus_mode.c
+++ b/drivers/gpu/drm/cirrus/cirrus_mode.c
@@ -308,6 +308,9 @@ static int cirrus_crtc_mode_set(struct drm_crtc *crtc,
        WREG_HDR(hdr);
        cirrus_crtc_do_set_base(crtc, old_fb, x, y, 0);
+        /* Unblank (needed on S3 resume, vgabios doesn't do it then) */
+        outb(0x20, 0x3c0);
        return 0;
 }
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index c43825e8f5c1..df281b54db01 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -72,147 +72,6 @@ void drm_helper_move_panel_connectors_to_head(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_helper_move_panel_connectors_to_head);
-static bool drm_kms_helper_poll = true;
-module_param_named(poll, drm_kms_helper_poll, bool, 0600);
-static void drm_mode_validate_flag(struct drm_connector *connector,
-                                   int flags)
-{
-        struct drm_display_mode *mode;
-        if (flags == (DRM_MODE_FLAG_DBLSCAN | DRM_MODE_FLAG_INTERLACE |
-                      DRM_MODE_FLAG_3D_MASK))
-                return;
-        list_for_each_entry(mode, &connector->modes, head) {
-                if ((mode->flags & DRM_MODE_FLAG_INTERLACE) &&
-                                !(flags & DRM_MODE_FLAG_INTERLACE))
-                        mode->status = MODE_NO_INTERLACE;
-                if ((mode->flags & DRM_MODE_FLAG_DBLSCAN) &&
-                                !(flags & DRM_MODE_FLAG_DBLSCAN))
-                        mode->status = MODE_NO_DBLESCAN;
-                if ((mode->flags & DRM_MODE_FLAG_3D_MASK) &&
-                                !(flags & DRM_MODE_FLAG_3D_MASK))
-                        mode->status = MODE_NO_STEREO;
-        }
-        return;
-}
-/**
- * drm_helper_probe_single_connector_modes - get complete set of display modes
- * @connector: connector to probe
- * @maxX: max width for modes
- * @maxY: max height for modes
- *
- * Based on the helper callbacks implemented by @connector try to detect all
- * valid modes.  Modes will first be added to the connector's probed_modes list,
- * then culled (based on validity and the @maxX, @maxY parameters) and put into
- * the normal modes list.
- *
- * Intended to be use as a generic implementation of the ->fill_modes()
- * @connector vfunc for drivers that use the crtc helpers for output mode
- * filtering and detection.
- *
- * Returns:
- * The number of modes found on @connector.
- */
-int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
-                                            uint32_t maxX, uint32_t maxY)
-{
-        struct drm_device *dev = connector->dev;
-        struct drm_display_mode *mode;
-        struct drm_connector_helper_funcs *connector_funcs =
-                connector->helper_private;
-        int count = 0;
-        int mode_flags = 0;
-        bool verbose_prune = true;
-        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
-        DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id,
-                        drm_get_connector_name(connector));
-        /* set all modes to the unverified state */
-        list_for_each_entry(mode, &connector->modes, head)
-                mode->status = MODE_UNVERIFIED;
-        if (connector->force) {
-                if (connector->force == DRM_FORCE_ON)
-                        connector->status = connector_status_connected;
-                else
-                        connector->status = connector_status_disconnected;
-                if (connector->funcs->force)
-                        connector->funcs->force(connector);
-        } else {
-                connector->status = connector->funcs->detect(connector, true);
-        }
-        /* Re-enable polling in case the global poll config changed. */
-        if (drm_kms_helper_poll != dev->mode_config.poll_running)
-                drm_kms_helper_poll_enable(dev);
-        dev->mode_config.poll_running = drm_kms_helper_poll;
-        if (connector->status == connector_status_disconnected) {
-                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] disconnected\n",
-                        connector->base.id, drm_get_connector_name(connector));
-                drm_mode_connector_update_edid_property(connector, NULL);
-                verbose_prune = false;
-                goto prune;
-        }
-#ifdef CONFIG_DRM_LOAD_EDID_FIRMWARE
-        count = drm_load_edid_firmware(connector);
-        if (count == 0)
-#endif
-                count = (*connector_funcs->get_modes)(connector);
-        if (count == 0 && connector->status == connector_status_connected)
-                count = drm_add_modes_noedid(connector, 1024, 768);
-        if (count == 0)
-                goto prune;
-        drm_mode_connector_list_update(connector);
-        if (maxX && maxY)
-                drm_mode_validate_size(dev, &connector->modes, maxX, maxY);
-        if (connector->interlace_allowed)
-                mode_flags |= DRM_MODE_FLAG_INTERLACE;
-        if (connector->doublescan_allowed)
-                mode_flags |= DRM_MODE_FLAG_DBLSCAN;
-        if (connector->stereo_allowed)
-                mode_flags |= DRM_MODE_FLAG_3D_MASK;
-        drm_mode_validate_flag(connector, mode_flags);
-        list_for_each_entry(mode, &connector->modes, head) {
-                if (mode->status == MODE_OK)
-                        mode->status = connector_funcs->mode_valid(connector,
-                                                                   mode);
-        }
-prune:
-        drm_mode_prune_invalid(dev, &connector->modes, verbose_prune);
-        if (list_empty(&connector->modes))
-                return 0;
-        list_for_each_entry(mode, &connector->modes, head)
-                mode->vrefresh = drm_mode_vrefresh(mode);
-        drm_mode_sort(&connector->modes);
-        DRM_DEBUG_KMS("[CONNECTOR:%d:%s] probed modes :\n", connector->base.id,
-                        drm_get_connector_name(connector));
-        list_for_each_entry(mode, &connector->modes, head) {
-                drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
-                drm_mode_debug_printmodeline(mode);
-        }
-        return count;
-}
-EXPORT_SYMBOL(drm_helper_probe_single_connector_modes);
 /**
 * drm_helper_encoder_in_use - check if a given encoder is in use
 * @encoder: encoder to check
@@ -1020,232 +879,3 @@ void drm_helper_resume_force_mode(struct drm_device *dev)
        drm_modeset_unlock_all(dev);
 }
 EXPORT_SYMBOL(drm_helper_resume_force_mode);
-/**
- * drm_kms_helper_hotplug_event - fire off KMS hotplug events
- * @dev: drm_device whose connector state changed
- *
- * This function fires off the uevent for userspace and also calls the
- * output_poll_changed function, which is most commonly used to inform the fbdev
- * emulation code and allow it to update the fbcon output configuration.
- *
- * Drivers should call this from their hotplug handling code when a change is
- * detected. Note that this function does not do any output detection of its
- * own, like drm_helper_hpd_irq_event() does - this is assumed to be done by the
- * driver already.
- *
- * This function must be called from process context with no mode
- * setting locks held.
- */
-void drm_kms_helper_hotplug_event(struct drm_device *dev)
-{
-        /* send a uevent + call fbdev */
-        drm_sysfs_hotplug_event(dev);
-        if (dev->mode_config.funcs->output_poll_changed)
-                dev->mode_config.funcs->output_poll_changed(dev);
-}
-EXPORT_SYMBOL(drm_kms_helper_hotplug_event);
-#define DRM_OUTPUT_POLL_PERIOD (10*HZ)
-static void output_poll_execute(struct work_struct *work)
-{
-        struct delayed_work *delayed_work = to_delayed_work(work);
-        struct drm_device *dev = container_of(delayed_work, struct drm_device, mode_config.output_poll_work);
-        struct drm_connector *connector;
-        enum drm_connector_status old_status;
-        bool repoll = false, changed = false;
-        if (!drm_kms_helper_poll)
-                return;
-        mutex_lock(&dev->mode_config.mutex);
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                /* Ignore forced connectors. */
-                if (connector->force)
-                        continue;
-                /* Ignore HPD capable connectors and connectors where we don't
-                 * want any hotplug detection at all for polling. */
-                if (!connector->polled || connector->polled == DRM_CONNECTOR_POLL_HPD)
-                        continue;
-                repoll = true;
-                old_status = connector->status;
-                /* if we are connected and don't want to poll for disconnect
-                   skip it */
-                if (old_status == connector_status_connected &&
-                    !(connector->polled & DRM_CONNECTOR_POLL_DISCONNECT))
-                        continue;
-                connector->status = connector->funcs->detect(connector, false);
-                if (old_status != connector->status) {
-                        const char *old, *new;
-                        old = drm_get_connector_status_name(old_status);
-                        new = drm_get_connector_status_name(connector->status);
-                        DRM_DEBUG_KMS("[CONNECTOR:%d:%s] "
-                                      "status updated from %s to %s\n",
-                                      connector->base.id,
-                                      drm_get_connector_name(connector),
-                                      old, new);
-                        changed = true;
-                }
-        }
-        mutex_unlock(&dev->mode_config.mutex);
-        if (changed)
-                drm_kms_helper_hotplug_event(dev);
-        if (repoll)
-                schedule_delayed_work(delayed_work, DRM_OUTPUT_POLL_PERIOD);
-}
-/**
- * drm_kms_helper_poll_disable - disable output polling
- * @dev: drm_device
- *
- * This function disables the output polling work.
- *
- * Drivers can call this helper from their device suspend implementation. It is
- * not an error to call this even when output polling isn't enabled or arlready
- * disabled.
- */
-void drm_kms_helper_poll_disable(struct drm_device *dev)
-{
-        if (!dev->mode_config.poll_enabled)
-                return;
-        cancel_delayed_work_sync(&dev->mode_config.output_poll_work);
-}
-EXPORT_SYMBOL(drm_kms_helper_poll_disable);
-/**
- * drm_kms_helper_poll_enable - re-enable output polling.
- * @dev: drm_device
- *
- * This function re-enables the output polling work.
- *
- * Drivers can call this helper from their device resume implementation. It is
- * an error to call this when the output polling support has not yet been set
- * up.
- */
-void drm_kms_helper_poll_enable(struct drm_device *dev)
-{
-        bool poll = false;
-        struct drm_connector *connector;
-        if (!dev->mode_config.poll_enabled || !drm_kms_helper_poll)
-                return;
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                if (connector->polled & (DRM_CONNECTOR_POLL_CONNECT |
-                                         DRM_CONNECTOR_POLL_DISCONNECT))
-                        poll = true;
-        }
-        if (poll)
-                schedule_delayed_work(&dev->mode_config.output_poll_work, DRM_OUTPUT_POLL_PERIOD);
-}
-EXPORT_SYMBOL(drm_kms_helper_poll_enable);
-/**
- * drm_kms_helper_poll_init - initialize and enable output polling
- * @dev: drm_device
- *
- * This function intializes and then also enables output polling support for
- * @dev. Drivers which do not have reliable hotplug support in hardware can use
- * this helper infrastructure to regularly poll such connectors for changes in
- * their connection state.
- *
- * Drivers can control which connectors are polled by setting the
- * DRM_CONNECTOR_POLL_CONNECT and DRM_CONNECTOR_POLL_DISCONNECT flags. On
- * connectors where probing live outputs can result in visual distortion drivers
- * should not set the DRM_CONNECTOR_POLL_DISCONNECT flag to avoid this.
- * Connectors which have no flag or only DRM_CONNECTOR_POLL_HPD set are
- * completely ignored by the polling logic.
- *
- * Note that a connector can be both polled and probed from the hotplug handler,
- * in case the hotplug interrupt is known to be unreliable.
- */
-void drm_kms_helper_poll_init(struct drm_device *dev)
-{
-        INIT_DELAYED_WORK(&dev->mode_config.output_poll_work, output_poll_execute);
-        dev->mode_config.poll_enabled = true;
-        drm_kms_helper_poll_enable(dev);
-}
-EXPORT_SYMBOL(drm_kms_helper_poll_init);
-/**
- * drm_kms_helper_poll_fini - disable output polling and clean it up
- * @dev: drm_device
- */
-void drm_kms_helper_poll_fini(struct drm_device *dev)
-{
-        drm_kms_helper_poll_disable(dev);
-}
-EXPORT_SYMBOL(drm_kms_helper_poll_fini);
-/**
- * drm_helper_hpd_irq_event - hotplug processing
- * @dev: drm_device
- *
- * Drivers can use this helper function to run a detect cycle on all connectors
- * which have the DRM_CONNECTOR_POLL_HPD flag set in their &polled member. All
- * other connectors are ignored, which is useful to avoid reprobing fixed
- * panels.
- *
- * This helper function is useful for drivers which can't or don't track hotplug
- * interrupts for each connector.
- *
- * Drivers which support hotplug interrupts for each connector individually and
- * which have a more fine-grained detect logic should bypass this code and
- * directly call drm_kms_helper_hotplug_event() in case the connector state
- * changed.
- *
- * This function must be called from process context with no mode
- * setting locks held.
- *
- * Note that a connector can be both polled and probed from the hotplug handler,
- * in case the hotplug interrupt is known to be unreliable.
- */
-bool drm_helper_hpd_irq_event(struct drm_device *dev)
-{
-        struct drm_connector *connector;
-        enum drm_connector_status old_status;
-        bool changed = false;
-        if (!dev->mode_config.poll_enabled)
-                return false;
-        mutex_lock(&dev->mode_config.mutex);
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                /* Only handle HPD capable connectors. */
-                if (!(connector->polled & DRM_CONNECTOR_POLL_HPD))
-                        continue;
-                old_status = connector->status;
-                connector->status = connector->funcs->detect(connector, false);
-                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] status updated from %s to %s\n",
-                              connector->base.id,
-                              drm_get_connector_name(connector),
-                              drm_get_connector_status_name(old_status),
-                              drm_get_connector_status_name(connector->status));
-                if (old_status != connector->status)
-                        changed = true;
-        }
-        mutex_unlock(&dev->mode_config.mutex);
-        if (changed)
-                drm_kms_helper_hotplug_event(dev);
-        return changed;
-}
-EXPORT_SYMBOL(drm_helper_hpd_irq_event);
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 27671489477d..4b6e6f3ba0a1 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -577,7 +577,9 @@ static u32 drm_dp_i2c_functionality(struct i2c_adapter *adapter)
 /*
 * Transfer a single I2C-over-AUX message and handle various error conditions,
- * retrying the transaction as appropriate.
+ * retrying the transaction as appropriate.  It is assumed that the
+ * aux->transfer function does not modify anything in the msg other than the
+ * reply field.
 */
 static int drm_dp_i2c_do_msg(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
 {
@@ -665,11 +667,26 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
 {
        struct drm_dp_aux *aux = adapter->algo_data;
        unsigned int i, j;
+        struct drm_dp_aux_msg msg;
+        int err = 0;
-        for (i = 0; i < num; i++) {
+        memset(&msg, 0, sizeof(msg));
-                struct drm_dp_aux_msg msg;
-                int err;
+        for (i = 0; i < num; i++) {
+                msg.address = msgs[i].addr;
+                msg.request = (msgs[i].flags & I2C_M_RD) ?
+                        DP_AUX_I2C_READ :
+                        DP_AUX_I2C_WRITE;
+                msg.request |= DP_AUX_I2C_MOT;
+                /* Send a bare address packet to start the transaction.
+                 * Zero sized messages specify an address only (bare
+                 * address) transaction.
+                 */
+                msg.buffer = NULL;
+                msg.size = 0;
+                err = drm_dp_i2c_do_msg(aux, &msg);
+                if (err < 0)
+                        break;
                /*
                 * Many hardware implementations support FIFOs larger than a
                 * single byte, but it has been empirically determined that
@@ -678,30 +695,28 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
                 * transferred byte-by-byte.
                 */
                for (j = 0; j < msgs[i].len; j++) {
-                        memset(&msg, 0, sizeof(msg));
-                        msg.address = msgs[i].addr;
-                        msg.request = (msgs[i].flags & I2C_M_RD) ?
-                                        DP_AUX_I2C_READ :
-                                        DP_AUX_I2C_WRITE;
-                        /*
-                         * All messages except the last one are middle-of-
-                         * transfer messages.
-                         */
-                        if ((i < num - 1) || (j < msgs[i].len - 1))
-                                msg.request |= DP_AUX_I2C_MOT;
                        msg.buffer = msgs[i].buf + j;
                        msg.size = 1;
                        err = drm_dp_i2c_do_msg(aux, &msg);
                        if (err < 0)
-                                return err;
+                                break;
                }
+                if (err < 0)
+                        break;
        }
+        if (err >= 0)
+                err = num;
+        /* Send a bare address packet to close out the transaction.
+         * Zero sized messages specify an address only (bare
+         * address) transaction.
+         */
+        msg.request &= ~DP_AUX_I2C_MOT;
+        msg.buffer = NULL;
+        msg.size = 0;
+        (void)drm_dp_i2c_do_msg(aux, &msg);
-        return num;
+        return err;
 }
 static const struct i2c_algorithm drm_dp_i2c_algo = {
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 71e2d3fcd6ee..04a209e2b66d 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -207,8 +207,6 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node)
                return 0;
        }
-        WARN(1, "no hole found for node 0x%lx + 0x%lx\n",
-             node->start, node->size);
        return -ENOSPC;
 }
 EXPORT_SYMBOL(drm_mm_reserve_node);
diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c
index e768d35ff22e..d2b1c03b3d71 100644
--- a/drivers/gpu/drm/drm_plane_helper.c
+++ b/drivers/gpu/drm/drm_plane_helper.c
@@ -203,9 +203,9 @@ EXPORT_SYMBOL(drm_primary_helper_update);
 *
 * Provides a default plane disable handler for primary planes.  This is handler
 * is called in response to a userspace SetPlane operation on the plane with a
- * NULL framebuffer parameter.  We call the driver's modeset handler with a NULL
+ * NULL framebuffer parameter.  It unconditionally fails the disable call with
- * framebuffer to disable the CRTC if no other planes are currently enabled.
+ * -EINVAL the only way to disable the primary plane without driver support is
- * If other planes are still enabled on the same CRTC, we return -EBUSY.
+ * to disable the entier CRTC. Which does not match the plane ->disable hook.
 *
 * Note that some hardware may be able to disable the primary plane without
 * disabling the whole CRTC.  Drivers for such hardware should provide their
@@ -214,34 +214,11 @@ EXPORT_SYMBOL(drm_primary_helper_update);
 * disabled primary plane).
 *
 * RETURNS:
- * Zero on success, error code on failure
+ * Unconditionally returns -EINVAL.
 */
 int drm_primary_helper_disable(struct drm_plane *plane)
 {
-        struct drm_plane *p;
+        return -EINVAL;
-        struct drm_mode_set set = {
-                .crtc = plane->crtc,
-                .fb = NULL,
-        };
-        if (plane->crtc == NULL || plane->fb == NULL)
-                /* Already disabled */
-                return 0;
-        list_for_each_entry(p, &plane->dev->mode_config.plane_list, head)
-                if (p != plane && p->fb) {
-                        DRM_DEBUG_KMS("Cannot disable primary plane while other planes are still active on CRTC.\n");
-                        return -EBUSY;
-                }
-        /*
-         * N.B.  We call set_config() directly here rather than
-         * drm_mode_set_config_internal() since drm_mode_setplane() already
-         * handles the basic refcounting and we don't need the special
-         * cross-CRTC refcounting (no chance of stealing connectors from
-         * other CRTC's with this update).
-         */
-        return plane->crtc->funcs->set_config(&set);
 }
 EXPORT_SYMBOL(drm_primary_helper_disable);
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
new file mode 100644
index 000000000000..e70f54d4a581
--- /dev/null
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -0,0 +1,426 @@
+/*
+ * Copyright (c) 2006-2008 Intel Corporation
+ * Copyright (c) 2007 Dave Airlie <airlied@linux.ie>
+ *
+ * DRM core CRTC related functions
+ *
+ * Permission to use, copy, modify, distribute, and sell this software and its
+ * documentation for any purpose is hereby granted without fee, provided that
+ * the above copyright notice appear in all copies and that both that copyright
+ * notice and this permission notice appear in supporting documentation, and
+ * that the name of the copyright holders not be used in advertising or
+ * publicity pertaining to distribution of the software without specific,
+ * written prior permission.  The copyright holders make no representations
+ * about the suitability of this software for any purpose.  It is provided "as
+ * is" without express or implied warranty.
+ *
+ * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
+ * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+ * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
+ * OF THIS SOFTWARE.
+ *
+ * Authors:
+ *      Keith Packard
+ *      Eric Anholt <eric@anholt.net>
+ *      Dave Airlie <airlied@linux.ie>
+ *      Jesse Barnes <jesse.barnes@intel.com>
+ */
+#include <linux/export.h>
+#include <linux/moduleparam.h>
+#include <drm/drmP.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_fourcc.h>
+#include <drm/drm_crtc_helper.h>
+#include <drm/drm_fb_helper.h>
+#include <drm/drm_edid.h>
+/**
+ * DOC: output probing helper overview
+ *
+ * This library provides some helper code for output probing. It provides an
+ * implementation of the core connector->fill_modes interface with
+ * drm_helper_probe_single_connector_modes.
+ *
+ * It also provides support for polling connectors with a work item and for
+ * generic hotplug interrupt handling where the driver doesn't or cannot keep
+ * track of a per-connector hpd interrupt.
+ *
+ * This helper library can be used independently of the modeset helper library.
+ * Drivers can also overwrite different parts e.g. use their own hotplug
+ * handling code to avoid probing unrelated outputs.
+ */
+static bool drm_kms_helper_poll = true;
+module_param_named(poll, drm_kms_helper_poll, bool, 0600);
+static void drm_mode_validate_flag(struct drm_connector *connector,
+                                   int flags)
+{
+        struct drm_display_mode *mode;
+        if (flags == (DRM_MODE_FLAG_DBLSCAN | DRM_MODE_FLAG_INTERLACE |
+                      DRM_MODE_FLAG_3D_MASK))
+                return;
+        list_for_each_entry(mode, &connector->modes, head) {
+                if ((mode->flags & DRM_MODE_FLAG_INTERLACE) &&
+                                !(flags & DRM_MODE_FLAG_INTERLACE))
+                        mode->status = MODE_NO_INTERLACE;
+                if ((mode->flags & DRM_MODE_FLAG_DBLSCAN) &&
+                                !(flags & DRM_MODE_FLAG_DBLSCAN))
+                        mode->status = MODE_NO_DBLESCAN;
+                if ((mode->flags & DRM_MODE_FLAG_3D_MASK) &&
+                                !(flags & DRM_MODE_FLAG_3D_MASK))
+                        mode->status = MODE_NO_STEREO;
+        }
+        return;
+}
+/**
+ * drm_helper_probe_single_connector_modes - get complete set of display modes
+ * @connector: connector to probe
+ * @maxX: max width for modes
+ * @maxY: max height for modes
+ *
+ * Based on the helper callbacks implemented by @connector try to detect all
+ * valid modes.  Modes will first be added to the connector's probed_modes list,
+ * then culled (based on validity and the @maxX, @maxY parameters) and put into
+ * the normal modes list.
+ *
+ * Intended to be use as a generic implementation of the ->fill_modes()
+ * @connector vfunc for drivers that use the crtc helpers for output mode
+ * filtering and detection.
+ *
+ * Returns:
+ * The number of modes found on @connector.
+ */
+int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
+                                            uint32_t maxX, uint32_t maxY)
+{
+        struct drm_device *dev = connector->dev;
+        struct drm_display_mode *mode;
+        struct drm_connector_helper_funcs *connector_funcs =
+                connector->helper_private;
+        int count = 0;
+        int mode_flags = 0;
+        bool verbose_prune = true;
+        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+        DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id,
+                        drm_get_connector_name(connector));
+        /* set all modes to the unverified state */
+        list_for_each_entry(mode, &connector->modes, head)
+                mode->status = MODE_UNVERIFIED;
+        if (connector->force) {
+                if (connector->force == DRM_FORCE_ON)
+                        connector->status = connector_status_connected;
+                else
+                        connector->status = connector_status_disconnected;
+                if (connector->funcs->force)
+                        connector->funcs->force(connector);
+        } else {
+                connector->status = connector->funcs->detect(connector, true);
+        }
+        /* Re-enable polling in case the global poll config changed. */
+        if (drm_kms_helper_poll != dev->mode_config.poll_running)
+                drm_kms_helper_poll_enable(dev);
+        dev->mode_config.poll_running = drm_kms_helper_poll;
+        if (connector->status == connector_status_disconnected) {
+                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] disconnected\n",
+                        connector->base.id, drm_get_connector_name(connector));
+                drm_mode_connector_update_edid_property(connector, NULL);
+                verbose_prune = false;
+                goto prune;
+        }
+#ifdef CONFIG_DRM_LOAD_EDID_FIRMWARE
+        count = drm_load_edid_firmware(connector);
+        if (count == 0)
+#endif
+                count = (*connector_funcs->get_modes)(connector);
+        if (count == 0 && connector->status == connector_status_connected)
+                count = drm_add_modes_noedid(connector, 1024, 768);
+        if (count == 0)
+                goto prune;
+        drm_mode_connector_list_update(connector);
+        if (maxX && maxY)
+                drm_mode_validate_size(dev, &connector->modes, maxX, maxY);
+        if (connector->interlace_allowed)
+                mode_flags |= DRM_MODE_FLAG_INTERLACE;
+        if (connector->doublescan_allowed)
+                mode_flags |= DRM_MODE_FLAG_DBLSCAN;
+        if (connector->stereo_allowed)
+                mode_flags |= DRM_MODE_FLAG_3D_MASK;
+        drm_mode_validate_flag(connector, mode_flags);
+        list_for_each_entry(mode, &connector->modes, head) {
+                if (mode->status == MODE_OK)
+                        mode->status = connector_funcs->mode_valid(connector,
+                                                                   mode);
+        }
+prune:
+        drm_mode_prune_invalid(dev, &connector->modes, verbose_prune);
+        if (list_empty(&connector->modes))
+                return 0;
+        list_for_each_entry(mode, &connector->modes, head)
+                mode->vrefresh = drm_mode_vrefresh(mode);
+        drm_mode_sort(&connector->modes);
+        DRM_DEBUG_KMS("[CONNECTOR:%d:%s] probed modes :\n", connector->base.id,
+                        drm_get_connector_name(connector));
+        list_for_each_entry(mode, &connector->modes, head) {
+                drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
+                drm_mode_debug_printmodeline(mode);
+        }
+        return count;
+}
+EXPORT_SYMBOL(drm_helper_probe_single_connector_modes);
+/**
+ * drm_kms_helper_hotplug_event - fire off KMS hotplug events
+ * @dev: drm_device whose connector state changed
+ *
+ * This function fires off the uevent for userspace and also calls the
+ * output_poll_changed function, which is most commonly used to inform the fbdev
+ * emulation code and allow it to update the fbcon output configuration.
+ *
+ * Drivers should call this from their hotplug handling code when a change is
+ * detected. Note that this function does not do any output detection of its
+ * own, like drm_helper_hpd_irq_event() does - this is assumed to be done by the
+ * driver already.
+ *
+ * This function must be called from process context with no mode
+ * setting locks held.
+ */
+void drm_kms_helper_hotplug_event(struct drm_device *dev)
+{
+        /* send a uevent + call fbdev */
+        drm_sysfs_hotplug_event(dev);
+        if (dev->mode_config.funcs->output_poll_changed)
+                dev->mode_config.funcs->output_poll_changed(dev);
+}
+EXPORT_SYMBOL(drm_kms_helper_hotplug_event);
+#define DRM_OUTPUT_POLL_PERIOD (10*HZ)
+static void output_poll_execute(struct work_struct *work)
+{
+        struct delayed_work *delayed_work = to_delayed_work(work);
+        struct drm_device *dev = container_of(delayed_work, struct drm_device, mode_config.output_poll_work);
+        struct drm_connector *connector;
+        enum drm_connector_status old_status;
+        bool repoll = false, changed = false;
+        if (!drm_kms_helper_poll)
+                return;
+        mutex_lock(&dev->mode_config.mutex);
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                /* Ignore forced connectors. */
+                if (connector->force)
+                        continue;
+                /* Ignore HPD capable connectors and connectors where we don't
+                 * want any hotplug detection at all for polling. */
+                if (!connector->polled || connector->polled == DRM_CONNECTOR_POLL_HPD)
+                        continue;
+                repoll = true;
+                old_status = connector->status;
+                /* if we are connected and don't want to poll for disconnect
+                   skip it */
+                if (old_status == connector_status_connected &&
+                    !(connector->polled & DRM_CONNECTOR_POLL_DISCONNECT))
+                        continue;
+                connector->status = connector->funcs->detect(connector, false);
+                if (old_status != connector->status) {
+                        const char *old, *new;
+                        old = drm_get_connector_status_name(old_status);
+                        new = drm_get_connector_status_name(connector->status);
+                        DRM_DEBUG_KMS("[CONNECTOR:%d:%s] "
+                                      "status updated from %s to %s\n",
+                                      connector->base.id,
+                                      drm_get_connector_name(connector),
+                                      old, new);
+                        changed = true;
+                }
+        }
+        mutex_unlock(&dev->mode_config.mutex);
+        if (changed)
+                drm_kms_helper_hotplug_event(dev);
+        if (repoll)
+                schedule_delayed_work(delayed_work, DRM_OUTPUT_POLL_PERIOD);
+}
+/**
+ * drm_kms_helper_poll_disable - disable output polling
+ * @dev: drm_device
+ *
+ * This function disables the output polling work.
+ *
+ * Drivers can call this helper from their device suspend implementation. It is
+ * not an error to call this even when output polling isn't enabled or arlready
+ * disabled.
+ */
+void drm_kms_helper_poll_disable(struct drm_device *dev)
+{
+        if (!dev->mode_config.poll_enabled)
+                return;
+        cancel_delayed_work_sync(&dev->mode_config.output_poll_work);
+}
+EXPORT_SYMBOL(drm_kms_helper_poll_disable);
+/**
+ * drm_kms_helper_poll_enable - re-enable output polling.
+ * @dev: drm_device
+ *
+ * This function re-enables the output polling work.
+ *
+ * Drivers can call this helper from their device resume implementation. It is
+ * an error to call this when the output polling support has not yet been set
+ * up.
+ */
+void drm_kms_helper_poll_enable(struct drm_device *dev)
+{
+        bool poll = false;
+        struct drm_connector *connector;
+        if (!dev->mode_config.poll_enabled || !drm_kms_helper_poll)
+                return;
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                if (connector->polled & (DRM_CONNECTOR_POLL_CONNECT |
+                                         DRM_CONNECTOR_POLL_DISCONNECT))
+                        poll = true;
+        }
+        if (poll)
+                schedule_delayed_work(&dev->mode_config.output_poll_work, DRM_OUTPUT_POLL_PERIOD);
+}
+EXPORT_SYMBOL(drm_kms_helper_poll_enable);
+/**
+ * drm_kms_helper_poll_init - initialize and enable output polling
+ * @dev: drm_device
+ *
+ * This function intializes and then also enables output polling support for
+ * @dev. Drivers which do not have reliable hotplug support in hardware can use
+ * this helper infrastructure to regularly poll such connectors for changes in
+ * their connection state.
+ *
+ * Drivers can control which connectors are polled by setting the
+ * DRM_CONNECTOR_POLL_CONNECT and DRM_CONNECTOR_POLL_DISCONNECT flags. On
+ * connectors where probing live outputs can result in visual distortion drivers
+ * should not set the DRM_CONNECTOR_POLL_DISCONNECT flag to avoid this.
+ * Connectors which have no flag or only DRM_CONNECTOR_POLL_HPD set are
+ * completely ignored by the polling logic.
+ *
+ * Note that a connector can be both polled and probed from the hotplug handler,
+ * in case the hotplug interrupt is known to be unreliable.
+ */
+void drm_kms_helper_poll_init(struct drm_device *dev)
+{
+        INIT_DELAYED_WORK(&dev->mode_config.output_poll_work, output_poll_execute);
+        dev->mode_config.poll_enabled = true;
+        drm_kms_helper_poll_enable(dev);
+}
+EXPORT_SYMBOL(drm_kms_helper_poll_init);
+/**
+ * drm_kms_helper_poll_fini - disable output polling and clean it up
+ * @dev: drm_device
+ */
+void drm_kms_helper_poll_fini(struct drm_device *dev)
+{
+        drm_kms_helper_poll_disable(dev);
+}
+EXPORT_SYMBOL(drm_kms_helper_poll_fini);
+/**
+ * drm_helper_hpd_irq_event - hotplug processing
+ * @dev: drm_device
+ *
+ * Drivers can use this helper function to run a detect cycle on all connectors
+ * which have the DRM_CONNECTOR_POLL_HPD flag set in their &polled member. All
+ * other connectors are ignored, which is useful to avoid reprobing fixed
+ * panels.
+ *
+ * This helper function is useful for drivers which can't or don't track hotplug
+ * interrupts for each connector.
+ *
+ * Drivers which support hotplug interrupts for each connector individually and
+ * which have a more fine-grained detect logic should bypass this code and
+ * directly call drm_kms_helper_hotplug_event() in case the connector state
+ * changed.
+ *
+ * This function must be called from process context with no mode
+ * setting locks held.
+ *
+ * Note that a connector can be both polled and probed from the hotplug handler,
+ * in case the hotplug interrupt is known to be unreliable.
+ */
+bool drm_helper_hpd_irq_event(struct drm_device *dev)
+{
+        struct drm_connector *connector;
+        enum drm_connector_status old_status;
+        bool changed = false;
+        if (!dev->mode_config.poll_enabled)
+                return false;
+        mutex_lock(&dev->mode_config.mutex);
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                /* Only handle HPD capable connectors. */
+                if (!(connector->polled & DRM_CONNECTOR_POLL_HPD))
+                        continue;
+                old_status = connector->status;
+                connector->status = connector->funcs->detect(connector, false);
+                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] status updated from %s to %s\n",
+                              connector->base.id,
+                              drm_get_connector_name(connector),
+                              drm_get_connector_status_name(old_status),
+                              drm_get_connector_status_name(connector->status));
+                if (old_status != connector->status)
+                        changed = true;
+        }
+        mutex_unlock(&dev->mode_config.mutex);
+        if (changed)
+                drm_kms_helper_hotplug_event(dev);
+        return changed;
+}
+EXPORT_SYMBOL(drm_helper_hpd_irq_event);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index e930d4fe29c7..1ef5ab9c9d51 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -145,6 +145,7 @@ exynos_drm_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mode,
        plane->crtc = crtc;
        plane->fb = crtc->primary->fb;
+        drm_framebuffer_reference(plane->fb);
        return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index c786cd4f457b..2a3ad24276f8 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -263,7 +263,7 @@ struct drm_gem_object *exynos_dmabuf_prime_import(struct drm_device *drm_dev,
        buffer->sgt = sgt;
        exynos_gem_obj->base.import_attach = attach;
-        DRM_DEBUG_PRIME("dma_addr = 0x%x, size = 0x%lx\n", buffer->dma_addr,
+        DRM_DEBUG_PRIME("dma_addr = %pad, size = 0x%lx\n", &buffer->dma_addr,
                                                                buffer->size);
        return &exynos_gem_obj->base;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index eb73e3bf2a0c..4ac438187568 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1426,9 +1426,9 @@ static int exynos_dsi_probe(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        dsi->reg_base = devm_ioremap_resource(&pdev->dev, res);
-        if (!dsi->reg_base) {
+        if (IS_ERR(dsi->reg_base)) {
                dev_err(&pdev->dev, "failed to remap io region\n");
-                return -EADDRNOTAVAIL;
+                return PTR_ERR(dsi->reg_base);
        }
        dsi->phy = devm_phy_get(&pdev->dev, "dsim");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 7afead9c3f30..852f2dadaebd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -220,7 +220,7 @@ static void vidi_win_commit(struct exynos_drm_manager *mgr, int zpos)
        win_data->enabled = true;
-        DRM_DEBUG_KMS("dma_addr = 0x%x\n", win_data->dma_addr);
+        DRM_DEBUG_KMS("dma_addr = %pad\n", &win_data->dma_addr);
        if (ctx->vblank_on)
                schedule_work(&ctx->work);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 96177eec0a0e..eedb023af27d 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1833,7 +1833,6 @@ int i915_driver_unload(struct drm_device *dev)
                flush_workqueue(dev_priv->wq);
                mutex_lock(&dev->struct_mutex);
-                i915_gem_free_all_phys_object(dev);
                i915_gem_cleanup_ringbuffer(dev);
                i915_gem_context_fini(dev);
                WARN_ON(dev_priv->mm.aliasing_ppgtt);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 0905cd915589..388c028e223c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -242,18 +242,6 @@ struct intel_ddi_plls {
 #define WATCH_LISTS     0
 #define WATCH_GTT       0
-#define I915_GEM_PHYS_CURSOR_0 1
-#define I915_GEM_PHYS_CURSOR_1 2
-#define I915_GEM_PHYS_OVERLAY_REGS 3
-#define I915_MAX_PHYS_OBJECT (I915_GEM_PHYS_OVERLAY_REGS)
-struct drm_i915_gem_phys_object {
-        int id;
-        struct page **page_list;
-        drm_dma_handle_t *handle;
-        struct drm_i915_gem_object *cur_obj;
-};
 struct opregion_header;
 struct opregion_acpi;
 struct opregion_swsci;
@@ -1187,9 +1175,6 @@ struct i915_gem_mm {
        /** Bit 6 swizzling required for Y tiling */
        uint32_t bit_6_swizzle_y;
-        /* storage for physical objects */
-        struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];
        /* accounting, useful for userland debugging */
        spinlock_t object_stat_lock;
        size_t object_memory;
@@ -1308,6 +1293,7 @@ struct intel_vbt_data {
        struct {
                u16 pwm_freq_hz;
+                bool present;
                bool active_low_pwm;
        } backlight;
@@ -1768,7 +1754,7 @@ struct drm_i915_gem_object {
        struct drm_file *pin_filp;
        /** for phy allocated objects */
-        struct drm_i915_gem_phys_object *phys_obj;
+        drm_dma_handle_t *phys_handle;
 };
 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
@@ -1953,6 +1939,9 @@ struct drm_i915_cmd_table {
 #define IS_ULT(dev)             (IS_HSW_ULT(dev) || IS_BDW_ULT(dev))
 #define IS_HSW_GT3(dev)         (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0x00F0) == 0x0020)
+/* ULX machines are also considered ULT. */
+#define IS_HSW_ULX(dev)         ((dev)->pdev->device == 0x0A0E || \
+                                 (dev)->pdev->device == 0x0A1E)
 #define IS_PRELIMINARY_HW(intel_info) ((intel_info)->is_preliminary)
 /*
@@ -2200,10 +2189,12 @@ void i915_gem_vma_destroy(struct i915_vma *vma);
 #define PIN_MAPPABLE 0x1
 #define PIN_NONBLOCK 0x2
 #define PIN_GLOBAL 0x4
+#define PIN_OFFSET_BIAS 0x8
+#define PIN_OFFSET_MASK (~4095)
 int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,
                                     struct i915_address_space *vm,
                                     uint32_t alignment,
-                                     unsigned flags);
+                                     uint64_t flags);
 int __must_check i915_vma_unbind(struct i915_vma *vma);
 int i915_gem_object_put_pages(struct drm_i915_gem_object *obj);
 void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv);
@@ -2330,13 +2321,8 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
                                     u32 alignment,
                                     struct intel_ring_buffer *pipelined);
 void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj);
-int i915_gem_attach_phys_object(struct drm_device *dev,
+int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
-                                struct drm_i915_gem_object *obj,
-                                int id,
                                int align);
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj);
-void i915_gem_free_all_phys_object(struct drm_device *dev);
 int i915_gem_open(struct drm_device *dev, struct drm_file *file);
 void i915_gem_release(struct drm_device *dev, struct drm_file *file);
@@ -2431,20 +2417,18 @@ int i915_gem_context_open(struct drm_device *dev, struct drm_file *file);
 int i915_gem_context_enable(struct drm_i915_private *dev_priv);
 void i915_gem_context_close(struct drm_device *dev, struct drm_file *file);
 int i915_switch_context(struct intel_ring_buffer *ring,
-                        struct drm_file *file, struct i915_hw_context *to);
+                        struct i915_hw_context *to);
 struct i915_hw_context *
 i915_gem_context_get(struct drm_i915_file_private *file_priv, u32 id);
 void i915_gem_context_free(struct kref *ctx_ref);
 static inline void i915_gem_context_reference(struct i915_hw_context *ctx)
 {
-        if (ctx->obj && HAS_HW_CONTEXTS(ctx->obj->base.dev))
+        kref_get(&ctx->ref);
-                kref_get(&ctx->ref);
 }
 static inline void i915_gem_context_unreference(struct i915_hw_context *ctx)
 {
-        if (ctx->obj && HAS_HW_CONTEXTS(ctx->obj->base.dev))
+        kref_put(&ctx->ref, i915_gem_context_free);
-                kref_put(&ctx->ref, i915_gem_context_free);
 }
 static inline bool i915_gem_context_is_default(const struct i915_hw_context *c)
@@ -2463,6 +2447,8 @@ int __must_check i915_gem_evict_something(struct drm_device *dev,
                                          int min_size,
                                          unsigned alignment,
                                          unsigned cache_level,
+                                          unsigned long start,
+                                          unsigned long end,
                                          unsigned flags);
 int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);
 int i915_gem_evict_everything(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 6370a761d137..3326770c9ed2 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -43,10 +43,6 @@ static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *o
 static __must_check int
 i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
                               bool readonly);
-static int i915_gem_phys_pwrite(struct drm_device *dev,
-                                struct drm_i915_gem_object *obj,
-                                struct drm_i915_gem_pwrite *args,
-                                struct drm_file *file);
 static void i915_gem_write_fence(struct drm_device *dev, int reg,
                                 struct drm_i915_gem_object *obj);
@@ -209,6 +205,128 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
        return 0;
 }
+static void i915_gem_object_detach_phys(struct drm_i915_gem_object *obj)
+{
+        drm_dma_handle_t *phys = obj->phys_handle;
+        if (!phys)
+                return;
+        if (obj->madv == I915_MADV_WILLNEED) {
+                struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
+                char *vaddr = phys->vaddr;
+                int i;
+                for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                        struct page *page = shmem_read_mapping_page(mapping, i);
+                        if (!IS_ERR(page)) {
+                                char *dst = kmap_atomic(page);
+                                memcpy(dst, vaddr, PAGE_SIZE);
+                                drm_clflush_virt_range(dst, PAGE_SIZE);
+                                kunmap_atomic(dst);
+                                set_page_dirty(page);
+                                mark_page_accessed(page);
+                                page_cache_release(page);
+                        }
+                        vaddr += PAGE_SIZE;
+                }
+                i915_gem_chipset_flush(obj->base.dev);
+        }
+#ifdef CONFIG_X86
+        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+        drm_pci_free(obj->base.dev, phys);
+        obj->phys_handle = NULL;
+}
+int
+i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
+                            int align)
+{
+        drm_dma_handle_t *phys;
+        struct address_space *mapping;
+        char *vaddr;
+        int i;
+        if (obj->phys_handle) {
+                if ((unsigned long)obj->phys_handle->vaddr & (align -1))
+                        return -EBUSY;
+                return 0;
+        }
+        if (obj->madv != I915_MADV_WILLNEED)
+                return -EFAULT;
+        if (obj->base.filp == NULL)
+                return -EINVAL;
+        /* create a new object */
+        phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);
+        if (!phys)
+                return -ENOMEM;
+        vaddr = phys->vaddr;
+#ifdef CONFIG_X86
+        set_memory_wc((unsigned long)vaddr, phys->size / PAGE_SIZE);
+#endif
+        mapping = file_inode(obj->base.filp)->i_mapping;
+        for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                struct page *page;
+                char *src;
+                page = shmem_read_mapping_page(mapping, i);
+                if (IS_ERR(page)) {
+#ifdef CONFIG_X86
+                        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+                        drm_pci_free(obj->base.dev, phys);
+                        return PTR_ERR(page);
+                }
+                src = kmap_atomic(page);
+                memcpy(vaddr, src, PAGE_SIZE);
+                kunmap_atomic(src);
+                mark_page_accessed(page);
+                page_cache_release(page);
+                vaddr += PAGE_SIZE;
+        }
+        obj->phys_handle = phys;
+        return 0;
+}
+static int
+i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
+                     struct drm_i915_gem_pwrite *args,
+                     struct drm_file *file_priv)
+{
+        struct drm_device *dev = obj->base.dev;
+        void *vaddr = obj->phys_handle->vaddr + args->offset;
+        char __user *user_data = to_user_ptr(args->data_ptr);
+        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
+                unsigned long unwritten;
+                /* The physical object once assigned is fixed for the lifetime
+                 * of the obj, so we can safely drop the lock and continue
+                 * to access vaddr.
+                 */
+                mutex_unlock(&dev->struct_mutex);
+                unwritten = copy_from_user(vaddr, user_data, args->size);
+                mutex_lock(&dev->struct_mutex);
+                if (unwritten)
+                        return -EFAULT;
+        }
+        i915_gem_chipset_flush(dev);
+        return 0;
+}
 void *i915_gem_object_alloc(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -921,8 +1039,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
         * pread/pwrite currently are reading and writing from the CPU
         * perspective, requiring manual detiling by the client.
         */
-        if (obj->phys_obj) {
+        if (obj->phys_handle) {
-                ret = i915_gem_phys_pwrite(dev, obj, args, file);
+                ret = i915_gem_phys_pwrite(obj, args, file);
                goto out;
        }
@@ -2790,7 +2908,7 @@ int i915_gpu_idle(struct drm_device *dev)
        /* Flush everything onto the inactive list. */
        for_each_ring(ring, dev_priv, i) {
-                ret = i915_switch_context(ring, NULL, ring->default_context);
+                ret = i915_switch_context(ring, ring->default_context);
                if (ret)
                        return ret;
@@ -3208,12 +3326,14 @@ static struct i915_vma *
 i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
                           struct i915_address_space *vm,
                           unsigned alignment,
-                           unsigned flags)
+                           uint64_t flags)
 {
        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 size, fence_size, fence_alignment, unfenced_alignment;
-        size_t gtt_max =
+        unsigned long start =
+                flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
+        unsigned long end =
                flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
        struct i915_vma *vma;
        int ret;
@@ -3242,11 +3362,11 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
        /* If the object is bigger than the entire aperture, reject it early
         * before evicting everything in a vain attempt to find space.
         */
-        if (obj->base.size > gtt_max) {
+        if (obj->base.size > end) {
-                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%zu\n",
+                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",
                          obj->base.size,
                          flags & PIN_MAPPABLE ? "mappable" : "total",
-                          gtt_max);
+                          end);
                return ERR_PTR(-E2BIG);
        }
@@ -3263,12 +3383,15 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
 search_free:
        ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,
                                                  size, alignment,
-                                                  obj->cache_level, 0, gtt_max,
+                                                  obj->cache_level,
+                                                  start, end,
                                                  DRM_MM_SEARCH_DEFAULT,
                                                  DRM_MM_CREATE_DEFAULT);
        if (ret) {
                ret = i915_gem_evict_something(dev, vm, size, alignment,
-                                               obj->cache_level, flags);
+                                               obj->cache_level,
+                                               start, end,
+                                               flags);
                if (ret == 0)
                        goto search_free;
@@ -3828,11 +3951,30 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
        return ret;
 }
+static bool
+i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+        if (alignment &&
+            vma->node.start & (alignment - 1))
+                return true;
+        if (flags & PIN_MAPPABLE && !obj->map_and_fenceable)
+                return true;
+        if (flags & PIN_OFFSET_BIAS &&
+            vma->node.start < (flags & PIN_OFFSET_MASK))
+                return true;
+        return false;
+}
 int
 i915_gem_object_pin(struct drm_i915_gem_object *obj,
                    struct i915_address_space *vm,
                    uint32_t alignment,
-                    unsigned flags)
+                    uint64_t flags)
 {
        struct i915_vma *vma;
        int ret;
@@ -3845,15 +3987,13 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
                if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
                        return -EBUSY;
-                if ((alignment &&
+                if (i915_vma_misplaced(vma, alignment, flags)) {
-                     vma->node.start & (alignment - 1)) ||
-                    (flags & PIN_MAPPABLE && !obj->map_and_fenceable)) {
                        WARN(vma->pin_count,
                             "bo is already pinned with incorrect alignment:"
                             " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
                             " obj->map_and_fenceable=%d\n",
                             i915_gem_obj_offset(obj, vm), alignment,
-                             flags & PIN_MAPPABLE,
+                             !!(flags & PIN_MAPPABLE),
                             obj->map_and_fenceable);
                        ret = i915_vma_unbind(vma);
                        if (ret)
@@ -4163,9 +4303,6 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
        trace_i915_gem_object_destroy(obj);
-        if (obj->phys_obj)
-                i915_gem_detach_phys_object(dev, obj);
        list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
                int ret;
@@ -4183,6 +4320,8 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
                }
        }
+        i915_gem_object_detach_phys(obj);
        /* Stolen objects don't hold a ref, but do hold pin count. Fix that up
         * before progressing. */
        if (obj->stolen)
@@ -4646,190 +4785,6 @@ i915_gem_load(struct drm_device *dev)
        register_shrinker(&dev_priv->mm.inactive_shrinker);
 }
-/*
- * Create a physically contiguous memory object for this object
- * e.g. for cursor + overlay regs
- */
-static int i915_gem_init_phys_object(struct drm_device *dev,
-                                     int id, int size, int align)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-        int ret;
-        if (dev_priv->mm.phys_objs[id - 1] || !size)
-                return 0;
-        phys_obj = kzalloc(sizeof(*phys_obj), GFP_KERNEL);
-        if (!phys_obj)
-                return -ENOMEM;
-        phys_obj->id = id;
-        phys_obj->handle = drm_pci_alloc(dev, size, align);
-        if (!phys_obj->handle) {
-                ret = -ENOMEM;
-                goto kfree_obj;
-        }
-#ifdef CONFIG_X86
-        set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-        dev_priv->mm.phys_objs[id - 1] = phys_obj;
-        return 0;
-kfree_obj:
-        kfree(phys_obj);
-        return ret;
-}
-static void i915_gem_free_phys_object(struct drm_device *dev, int id)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-        if (!dev_priv->mm.phys_objs[id - 1])
-                return;
-        phys_obj = dev_priv->mm.phys_objs[id - 1];
-        if (phys_obj->cur_obj) {
-                i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
-        }
-#ifdef CONFIG_X86
-        set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-        drm_pci_free(dev, phys_obj->handle);
-        kfree(phys_obj);
-        dev_priv->mm.phys_objs[id - 1] = NULL;
-}
-void i915_gem_free_all_phys_object(struct drm_device *dev)
-{
-        int i;
-        for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
-                i915_gem_free_phys_object(dev, i);
-}
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        char *vaddr;
-        int i;
-        int page_count;
-        if (!obj->phys_obj)
-                return;
-        vaddr = obj->phys_obj->handle->vaddr;
-        page_count = obj->base.size / PAGE_SIZE;
-        for (i = 0; i < page_count; i++) {
-                struct page *page = shmem_read_mapping_page(mapping, i);
-                if (!IS_ERR(page)) {
-                        char *dst = kmap_atomic(page);
-                        memcpy(dst, vaddr + i*PAGE_SIZE, PAGE_SIZE);
-                        kunmap_atomic(dst);
-                        drm_clflush_pages(&page, 1);
-                        set_page_dirty(page);
-                        mark_page_accessed(page);
-                        page_cache_release(page);
-                }
-        }
-        i915_gem_chipset_flush(dev);
-        obj->phys_obj->cur_obj = NULL;
-        obj->phys_obj = NULL;
-}
-int
-i915_gem_attach_phys_object(struct drm_device *dev,
-                            struct drm_i915_gem_object *obj,
-                            int id,
-                            int align)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret = 0;
-        int page_count;
-        int i;
-        if (id > I915_MAX_PHYS_OBJECT)
-                return -EINVAL;
-        if (obj->phys_obj) {
-                if (obj->phys_obj->id == id)
-                        return 0;
-                i915_gem_detach_phys_object(dev, obj);
-        }
-        /* create a new object */
-        if (!dev_priv->mm.phys_objs[id - 1]) {
-                ret = i915_gem_init_phys_object(dev, id,
-                                                obj->base.size, align);
-                if (ret) {
-                        DRM_ERROR("failed to init phys object %d size: %zu\n",
-                                  id, obj->base.size);
-                        return ret;
-                }
-        }
-        /* bind to the object */
-        obj->phys_obj = dev_priv->mm.phys_objs[id - 1];
-        obj->phys_obj->cur_obj = obj;
-        page_count = obj->base.size / PAGE_SIZE;
-        for (i = 0; i < page_count; i++) {
-                struct page *page;
-                char *dst, *src;
-                page = shmem_read_mapping_page(mapping, i);
-                if (IS_ERR(page))
-                        return PTR_ERR(page);
-                src = kmap_atomic(page);
-                dst = obj->phys_obj->handle->vaddr + (i * PAGE_SIZE);
-                memcpy(dst, src, PAGE_SIZE);
-                kunmap_atomic(src);
-                mark_page_accessed(page);
-                page_cache_release(page);
-        }
-        return 0;
-}
-static int
-i915_gem_phys_pwrite(struct drm_device *dev,
-                     struct drm_i915_gem_object *obj,
-                     struct drm_i915_gem_pwrite *args,
-                     struct drm_file *file_priv)
-{
-        void *vaddr = obj->phys_obj->handle->vaddr + args->offset;
-        char __user *user_data = to_user_ptr(args->data_ptr);
-        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
-                unsigned long unwritten;
-                /* The physical object once assigned is fixed for the lifetime
-                 * of the obj, so we can safely drop the lock and continue
-                 * to access vaddr.
-                 */
-                mutex_unlock(&dev->struct_mutex);
-                unwritten = copy_from_user(vaddr, user_data, args->size);
-                mutex_lock(&dev->struct_mutex);
-                if (unwritten)
-                        return -EFAULT;
-        }
-        i915_gem_chipset_flush(dev);
-        return 0;
-}
 void i915_gem_release(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_file_private *file_priv = file->driver_priv;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 6043062ffce7..d72db15afa02 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -96,9 +96,6 @@
 #define GEN6_CONTEXT_ALIGN (64<<10)
 #define GEN7_CONTEXT_ALIGN 4096
-static int do_switch(struct intel_ring_buffer *ring,
-                     struct i915_hw_context *to);
 static void do_ppgtt_cleanup(struct i915_hw_ppgtt *ppgtt)
 {
        struct drm_device *dev = ppgtt->base.dev;
@@ -185,13 +182,15 @@ void i915_gem_context_free(struct kref *ctx_ref)
                                                   typeof(*ctx), ref);
        struct i915_hw_ppgtt *ppgtt = NULL;
-        /* We refcount even the aliasing PPGTT to keep the code symmetric */
+        if (ctx->obj) {
-        if (USES_PPGTT(ctx->obj->base.dev))
+                /* We refcount even the aliasing PPGTT to keep the code symmetric */
-                ppgtt = ctx_to_ppgtt(ctx);
+                if (USES_PPGTT(ctx->obj->base.dev))
+                        ppgtt = ctx_to_ppgtt(ctx);
-        /* XXX: Free up the object before tearing down the address space, in
+                /* XXX: Free up the object before tearing down the address space, in
-         * case we're bound in the PPGTT */
+                 * case we're bound in the PPGTT */
-        drm_gem_object_unreference(&ctx->obj->base);
+                drm_gem_object_unreference(&ctx->obj->base);
+        }
        if (ppgtt)
                kref_put(&ppgtt->ref, ppgtt_release);
@@ -232,32 +231,32 @@ __create_hw_context(struct drm_device *dev,
                return ERR_PTR(-ENOMEM);
        kref_init(&ctx->ref);
-        ctx->obj = i915_gem_alloc_object(dev, dev_priv->hw_context_size);
+        list_add_tail(&ctx->link, &dev_priv->context_list);
-        INIT_LIST_HEAD(&ctx->link);
-        if (ctx->obj == NULL) {
-                kfree(ctx);
-                DRM_DEBUG_DRIVER("Context object allocated failed\n");
-                return ERR_PTR(-ENOMEM);
-        }
-        if (INTEL_INFO(dev)->gen >= 7) {
+        if (dev_priv->hw_context_size) {
-                ret = i915_gem_object_set_cache_level(ctx->obj,
+                ctx->obj = i915_gem_alloc_object(dev, dev_priv->hw_context_size);
-                                                      I915_CACHE_L3_LLC);
+                if (ctx->obj == NULL) {
-                /* Failure shouldn't ever happen this early */
+                        ret = -ENOMEM;
-                if (WARN_ON(ret))
                        goto err_out;
-        }
+                }
-        list_add_tail(&ctx->link, &dev_priv->context_list);
+                if (INTEL_INFO(dev)->gen >= 7) {
+                        ret = i915_gem_object_set_cache_level(ctx->obj,
+                                                              I915_CACHE_L3_LLC);
+                        /* Failure shouldn't ever happen this early */
+                        if (WARN_ON(ret))
+                                goto err_out;
+                }
+        }
        /* Default context will never have a file_priv */
-        if (file_priv == NULL)
+        if (file_priv != NULL) {
-                return ctx;
+                ret = idr_alloc(&file_priv->context_idr, ctx,
+                                DEFAULT_CONTEXT_ID, 0, GFP_KERNEL);
-        ret = idr_alloc(&file_priv->context_idr, ctx, DEFAULT_CONTEXT_ID, 0,
+                if (ret < 0)
-                        GFP_KERNEL);
+                        goto err_out;
-        if (ret < 0)
+        } else
-                goto err_out;
+                ret = DEFAULT_CONTEXT_ID;
        ctx->file_priv = file_priv;
        ctx->id = ret;
@@ -294,7 +293,7 @@ i915_gem_create_context(struct drm_device *dev,
        if (IS_ERR(ctx))
                return ctx;
-        if (is_global_default_ctx) {
+        if (is_global_default_ctx && ctx->obj) {
                /* We may need to do things with the shrinker which
                 * require us to immediately switch back to the default
                 * context. This can cause a problem as pinning the
@@ -342,7 +341,7 @@ i915_gem_create_context(struct drm_device *dev,
        return ctx;
 err_unpin:
-        if (is_global_default_ctx)
+        if (is_global_default_ctx && ctx->obj)
                i915_gem_object_ggtt_unpin(ctx->obj);
 err_destroy:
        i915_gem_context_unreference(ctx);
@@ -352,32 +351,22 @@ err_destroy:
 void i915_gem_context_reset(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_ring_buffer *ring;
        int i;
-        if (!HAS_HW_CONTEXTS(dev))
-                return;
        /* Prevent the hardware from restoring the last context (which hung) on
         * the next switch */
        for (i = 0; i < I915_NUM_RINGS; i++) {
-                struct i915_hw_context *dctx;
+                struct intel_ring_buffer *ring = &dev_priv->ring[i];
-                if (!(INTEL_INFO(dev)->ring_mask & (1<<i)))
+                struct i915_hw_context *dctx = ring->default_context;
-                        continue;
                /* Do a fake switch to the default context */
-                ring = &dev_priv->ring[i];
+                if (ring->last_context == dctx)
-                dctx = ring->default_context;
-                if (WARN_ON(!dctx))
                        continue;
                if (!ring->last_context)
                        continue;
-                if (ring->last_context == dctx)
+                if (dctx->obj && i == RCS) {
-                        continue;
-                if (i == RCS) {
                        WARN_ON(i915_gem_obj_ggtt_pin(dctx->obj,
                                                      get_context_alignment(dev), 0));
                        /* Fake a finish/inactive */
@@ -394,44 +383,35 @@ void i915_gem_context_reset(struct drm_device *dev)
 int i915_gem_context_init(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_ring_buffer *ring;
+        struct i915_hw_context *ctx;
        int i;
-        if (!HAS_HW_CONTEXTS(dev))
-                return 0;
        /* Init should only be called once per module load. Eventually the
         * restriction on the context_disabled check can be loosened. */
        if (WARN_ON(dev_priv->ring[RCS].default_context))
                return 0;
-        dev_priv->hw_context_size = round_up(get_context_size(dev), 4096);
+        if (HAS_HW_CONTEXTS(dev)) {
+                dev_priv->hw_context_size = round_up(get_context_size(dev), 4096);
-        if (dev_priv->hw_context_size > (1<<20)) {
+                if (dev_priv->hw_context_size > (1<<20)) {
-                DRM_DEBUG_DRIVER("Disabling HW Contexts; invalid size\n");
+                        DRM_DEBUG_DRIVER("Disabling HW Contexts; invalid size %d\n",
-                return -E2BIG;
+                                         dev_priv->hw_context_size);
+                        dev_priv->hw_context_size = 0;
+                }
        }
-        dev_priv->ring[RCS].default_context =
+        ctx = i915_gem_create_context(dev, NULL, USES_PPGTT(dev));
-                i915_gem_create_context(dev, NULL, USES_PPGTT(dev));
+        if (IS_ERR(ctx)) {
+                DRM_ERROR("Failed to create default global context (error %ld)\n",
-        if (IS_ERR_OR_NULL(dev_priv->ring[RCS].default_context)) {
+                          PTR_ERR(ctx));
-                DRM_DEBUG_DRIVER("Disabling HW Contexts; create failed %ld\n",
+                return PTR_ERR(ctx);
-                                 PTR_ERR(dev_priv->ring[RCS].default_context));
-                return PTR_ERR(dev_priv->ring[RCS].default_context);
        }
-        for (i = RCS + 1; i < I915_NUM_RINGS; i++) {
+        /* NB: RCS will hold a ref for all rings */
-                if (!(INTEL_INFO(dev)->ring_mask & (1<<i)))
+        for (i = 0; i < I915_NUM_RINGS; i++)
-                        continue;
+                dev_priv->ring[i].default_context = ctx;
-                ring = &dev_priv->ring[i];
-                /* NB: RCS will hold a ref for all rings */
+        DRM_DEBUG_DRIVER("%s context support initialized\n", dev_priv->hw_context_size ? "HW" : "fake");
-                ring->default_context = dev_priv->ring[RCS].default_context;
-        }
-        DRM_DEBUG_DRIVER("HW context support initialized\n");
        return 0;
 }
@@ -441,33 +421,30 @@ void i915_gem_context_fini(struct drm_device *dev)
        struct i915_hw_context *dctx = dev_priv->ring[RCS].default_context;
        int i;
-        if (!HAS_HW_CONTEXTS(dev))
+        if (dctx->obj) {
-                return;
+                /* The only known way to stop the gpu from accessing the hw context is
+                 * to reset it. Do this as the very last operation to avoid confusing
-        /* The only known way to stop the gpu from accessing the hw context is
+                 * other code, leading to spurious errors. */
-         * to reset it. Do this as the very last operation to avoid confusing
+                intel_gpu_reset(dev);
-         * other code, leading to spurious errors. */
-        intel_gpu_reset(dev);
+                /* When default context is created and switched to, base object refcount
+                 * will be 2 (+1 from object creation and +1 from do_switch()).
-        /* When default context is created and switched to, base object refcount
+                 * i915_gem_context_fini() will be called after gpu_idle() has switched
-         * will be 2 (+1 from object creation and +1 from do_switch()).
+                 * to default context. So we need to unreference the base object once
-         * i915_gem_context_fini() will be called after gpu_idle() has switched
+                 * to offset the do_switch part, so that i915_gem_context_unreference()
-         * to default context. So we need to unreference the base object once
+                 * can then free the base object correctly. */
-         * to offset the do_switch part, so that i915_gem_context_unreference()
+                WARN_ON(!dev_priv->ring[RCS].last_context);
-         * can then free the base object correctly. */
+                if (dev_priv->ring[RCS].last_context == dctx) {
-        WARN_ON(!dev_priv->ring[RCS].last_context);
+                        /* Fake switch to NULL context */
-        if (dev_priv->ring[RCS].last_context == dctx) {
+                        WARN_ON(dctx->obj->active);
-                /* Fake switch to NULL context */
+                        i915_gem_object_ggtt_unpin(dctx->obj);
-                WARN_ON(dctx->obj->active);
+                        i915_gem_context_unreference(dctx);
-                i915_gem_object_ggtt_unpin(dctx->obj);
+                        dev_priv->ring[RCS].last_context = NULL;
-                i915_gem_context_unreference(dctx);
+                }
-                dev_priv->ring[RCS].last_context = NULL;
        }
        for (i = 0; i < I915_NUM_RINGS; i++) {
                struct intel_ring_buffer *ring = &dev_priv->ring[i];
-                if (!(INTEL_INFO(dev)->ring_mask & (1<<i)))
-                        continue;
                if (ring->last_context)
                        i915_gem_context_unreference(ring->last_context);
@@ -478,7 +455,6 @@ void i915_gem_context_fini(struct drm_device *dev)
        i915_gem_object_ggtt_unpin(dctx->obj);
        i915_gem_context_unreference(dctx);
-        dev_priv->mm.aliasing_ppgtt = NULL;
 }
 int i915_gem_context_enable(struct drm_i915_private *dev_priv)
@@ -486,9 +462,6 @@ int i915_gem_context_enable(struct drm_i915_private *dev_priv)
        struct intel_ring_buffer *ring;
        int ret, i;
-        if (!HAS_HW_CONTEXTS(dev_priv->dev))
-                return 0;
        /* This is the only place the aliasing PPGTT gets enabled, which means
         * it has to happen before we bail on reset */
        if (dev_priv->mm.aliasing_ppgtt) {
@@ -503,7 +476,7 @@ int i915_gem_context_enable(struct drm_i915_private *dev_priv)
        BUG_ON(!dev_priv->ring[RCS].default_context);
        for_each_ring(ring, dev_priv, i) {
-                ret = do_switch(ring, ring->default_context);
+                ret = i915_switch_context(ring, ring->default_context);
                if (ret)
                        return ret;
        }
@@ -526,19 +499,6 @@ static int context_idr_cleanup(int id, void *p, void *data)
 int i915_gem_context_open(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_file_private *file_priv = file->driver_priv;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        if (!HAS_HW_CONTEXTS(dev)) {
-                /* Cheat for hang stats */
-                file_priv->private_default_ctx =
-                        kzalloc(sizeof(struct i915_hw_context), GFP_KERNEL);
-                if (file_priv->private_default_ctx == NULL)
-                        return -ENOMEM;
-                file_priv->private_default_ctx->vm = &dev_priv->gtt.base;
-                return 0;
-        }
        idr_init(&file_priv->context_idr);
@@ -559,14 +519,10 @@ void i915_gem_context_close(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_file_private *file_priv = file->driver_priv;
-        if (!HAS_HW_CONTEXTS(dev)) {
-                kfree(file_priv->private_default_ctx);
-                return;
-        }
        idr_for_each(&file_priv->context_idr, context_idr_cleanup, NULL);
-        i915_gem_context_unreference(file_priv->private_default_ctx);
        idr_destroy(&file_priv->context_idr);
+        i915_gem_context_unreference(file_priv->private_default_ctx);
 }
 struct i915_hw_context *
@@ -574,9 +530,6 @@ i915_gem_context_get(struct drm_i915_file_private *file_priv, u32 id)
 {
        struct i915_hw_context *ctx;
-        if (!HAS_HW_CONTEXTS(file_priv->dev_priv->dev))
-                return file_priv->private_default_ctx;
        ctx = (struct i915_hw_context *)idr_find(&file_priv->context_idr, id);
        if (!ctx)
                return ERR_PTR(-ENOENT);
@@ -758,7 +711,6 @@ unpin_out:
 /**
 * i915_switch_context() - perform a GPU context switch.
 * @ring: ring for which we'll execute the context switch
- * @file_priv: file_priv associated with the context, may be NULL
 * @to: the context to switch to
 *
 * The context life cycle is simple. The context refcount is incremented and
@@ -767,24 +719,30 @@ unpin_out:
 * object while letting the normal object tracking destroy the backing BO.
 */
 int i915_switch_context(struct intel_ring_buffer *ring,
-                        struct drm_file *file,
                        struct i915_hw_context *to)
 {
        struct drm_i915_private *dev_priv = ring->dev->dev_private;
        WARN_ON(!mutex_is_locked(&dev_priv->dev->struct_mutex));
-        BUG_ON(file && to == NULL);
+        if (to->obj == NULL) { /* We have the fake context */
+                if (to != ring->last_context) {
-        /* We have the fake context */
+                        i915_gem_context_reference(to);
-        if (!HAS_HW_CONTEXTS(ring->dev)) {
+                        if (ring->last_context)
-                ring->last_context = to;
+                                i915_gem_context_unreference(ring->last_context);
+                        ring->last_context = to;
+                }
                return 0;
        }
        return do_switch(ring, to);
 }
+static bool hw_context_enabled(struct drm_device *dev)
+{
+        return to_i915(dev)->hw_context_size;
+}
 int i915_gem_context_create_ioctl(struct drm_device *dev, void *data,
                                  struct drm_file *file)
 {
@@ -793,7 +751,7 @@ int i915_gem_context_create_ioctl(struct drm_device *dev, void *data,
        struct i915_hw_context *ctx;
        int ret;
-        if (!HAS_HW_CONTEXTS(dev))
+        if (!hw_context_enabled(dev))
                return -ENODEV;
        ret = i915_mutex_lock_interruptible(dev);
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 75fca63dc8c1..bbf4b12d842e 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -68,9 +68,9 @@ mark_free(struct i915_vma *vma, struct list_head *unwind)
 int
 i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
                         int min_size, unsigned alignment, unsigned cache_level,
+                         unsigned long start, unsigned long end,
                         unsigned flags)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
        struct list_head eviction_list, unwind_list;
        struct i915_vma *vma;
        int ret = 0;
@@ -102,11 +102,10 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
         */
        INIT_LIST_HEAD(&unwind_list);
-        if (flags & PIN_MAPPABLE) {
+        if (start != 0 || end != vm->total) {
-                BUG_ON(!i915_is_ggtt(vm));
                drm_mm_init_scan_with_range(&vm->mm, min_size,
-                                            alignment, cache_level, 0,
+                                            alignment, cache_level,
-                                            dev_priv->gtt.mappable_end);
+                                            start, end);
        } else
                drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 7447160155a3..20fef6c50267 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -35,6 +35,9 @@
 #define  __EXEC_OBJECT_HAS_PIN (1<<31)
 #define  __EXEC_OBJECT_HAS_FENCE (1<<30)
+#define  __EXEC_OBJECT_NEEDS_BIAS (1<<28)
+#define BATCH_OFFSET_BIAS (256*1024)
 struct eb_vmas {
        struct list_head vmas;
@@ -545,7 +548,7 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
        bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
        bool need_fence;
-        unsigned flags;
+        uint64_t flags;
        int ret;
        flags = 0;
@@ -559,6 +562,8 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        if (entry->flags & EXEC_OBJECT_NEEDS_GTT)
                flags |= PIN_GLOBAL;
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)
+                flags |= BATCH_OFFSET_BIAS | PIN_OFFSET_BIAS;
        ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, flags);
        if (ret)
@@ -592,6 +597,36 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        return 0;
 }
+static bool
+eb_vma_misplaced(struct i915_vma *vma, bool has_fenced_gpu_access)
+{
+        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
+        struct drm_i915_gem_object *obj = vma->obj;
+        bool need_fence, need_mappable;
+        need_fence =
+                has_fenced_gpu_access &&
+                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                obj->tiling_mode != I915_TILING_NONE;
+        need_mappable = need_fence || need_reloc_mappable(vma);
+        WARN_ON((need_mappable || need_fence) &&
+               !i915_is_ggtt(vma->vm));
+        if (entry->alignment &&
+            vma->node.start & (entry->alignment - 1))
+                return true;
+        if (need_mappable && !obj->map_and_fenceable)
+                return true;
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS &&
+            vma->node.start < BATCH_OFFSET_BIAS)
+                return true;
+        return false;
+}
 static int
 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                            struct list_head *vmas,
@@ -653,26 +688,10 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                /* Unbind any ill-fitting objects or pin. */
                list_for_each_entry(vma, vmas, exec_list) {
-                        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
-                        bool need_fence, need_mappable;
-                        obj = vma->obj;
                        if (!drm_mm_node_allocated(&vma->node))
                                continue;
-                        need_fence =
+                        if (eb_vma_misplaced(vma, has_fenced_gpu_access))
-                                has_fenced_gpu_access &&
-                                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
-                                obj->tiling_mode != I915_TILING_NONE;
-                        need_mappable = need_fence || need_reloc_mappable(vma);
-                        WARN_ON((need_mappable || need_fence) &&
-                               !i915_is_ggtt(vma->vm));
-                        if ((entry->alignment &&
-                             vma->node.start & (entry->alignment - 1)) ||
-                            (need_mappable && !obj->map_and_fenceable))
                                ret = i915_vma_unbind(vma);
                        else
                                ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
@@ -773,9 +792,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
                 * relocations were valid.
                 */
                for (j = 0; j < exec[i].relocation_count; j++) {
-                        if (copy_to_user(&user_relocs[j].presumed_offset,
+                        if (__copy_to_user(&user_relocs[j].presumed_offset,
-                                         &invalid_offset,
+                                           &invalid_offset,
-                                         sizeof(invalid_offset))) {
+                                           sizeof(invalid_offset))) {
                                ret = -EFAULT;
                                mutex_lock(&dev->struct_mutex);
                                goto err;
@@ -999,6 +1018,25 @@ i915_reset_gen7_sol_offsets(struct drm_device *dev,
        return 0;
 }
+static struct drm_i915_gem_object *
+eb_get_batch(struct eb_vmas *eb)
+{
+        struct i915_vma *vma = list_entry(eb->vmas.prev, typeof(*vma), exec_list);
+        /*
+         * SNA is doing fancy tricks with compressing batch buffers, which leads
+         * to negative relocation deltas. Usually that works out ok since the
+         * relocate address is still positive, except when the batch is placed
+         * very low in the GTT. Ensure this doesn't happen.
+         *
+         * Note that actual hangs have only been observed on gen7, but for
+         * paranoia do it everywhere.
+         */
+        vma->exec_entry->flags |= __EXEC_OBJECT_NEEDS_BIAS;
+        return vma->obj;
+}
 static int
 i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                       struct drm_file *file,
@@ -1153,7 +1191,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                goto err;
        /* take note of the batch buffer before we might reorder the lists */
-        batch_obj = list_entry(eb->vmas.prev, struct i915_vma, exec_list)->obj;
+        batch_obj = eb_get_batch(eb);
        /* Move the objects en-masse into the GTT, evicting if necessary. */
        need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
@@ -1221,7 +1259,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
        if (ret)
                goto err;
-        ret = i915_switch_context(ring, file, ctx);
+        ret = i915_switch_context(ring, ctx);
        if (ret)
                goto err;
@@ -1355,18 +1393,21 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
        ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
        if (!ret) {
+                struct drm_i915_gem_exec_object __user *user_exec_list =
+                        to_user_ptr(args->buffers_ptr);
                /* Copy the new buffer offsets back to the user's exec list. */
-                for (i = 0; i < args->buffer_count; i++)
+                for (i = 0; i < args->buffer_count; i++) {
-                        exec_list[i].offset = exec2_list[i].offset;
+                        ret = __copy_to_user(&user_exec_list[i].offset,
-                /* ... and back out to userspace */
+                                             &exec2_list[i].offset,
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
+                                             sizeof(user_exec_list[i].offset));
-                                   exec_list,
+                        if (ret) {
-                                   sizeof(*exec_list) * args->buffer_count);
+                                ret = -EFAULT;
-                if (ret) {
+                                DRM_DEBUG("failed to copy %d exec entries "
-                        ret = -EFAULT;
+                                          "back to user (%d)\n",
-                        DRM_DEBUG("failed to copy %d exec entries "
+                                          args->buffer_count, ret);
-                                  "back to user (%d)\n",
+                                break;
-                                  args->buffer_count, ret);
+                        }
                }
        }
@@ -1412,14 +1453,21 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
        ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
        if (!ret) {
                /* Copy the new buffer offsets back to the user's exec list. */
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
+                struct drm_i915_gem_exec_object2 *user_exec_list =
-                                   exec2_list,
+                                   to_user_ptr(args->buffers_ptr);
-                                   sizeof(*exec2_list) * args->buffer_count);
+                int i;
-                if (ret) {
-                        ret = -EFAULT;
+                for (i = 0; i < args->buffer_count; i++) {
-                        DRM_DEBUG("failed to copy %d exec entries "
+                        ret = __copy_to_user(&user_exec_list[i].offset,
-                                  "back to user (%d)\n",
+                                             &exec2_list[i].offset,
-                                  args->buffer_count, ret);
+                                             sizeof(user_exec_list[i].offset));
+                        if (ret) {
+                                ret = -EFAULT;
+                                DRM_DEBUG("failed to copy %d exec entries "
+                                          "back to user\n",
+                                          args->buffer_count);
+                                break;
+                        }
                }
        }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index ab5e93c30aa2..5deb22864c52 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -34,25 +34,35 @@ static void gen8_setup_private_ppat(struct drm_i915_private *dev_priv);
 bool intel_enable_ppgtt(struct drm_device *dev, bool full)
 {
-        if (i915.enable_ppgtt == 0 || !HAS_ALIASING_PPGTT(dev))
+        if (i915.enable_ppgtt == 0)
                return false;
        if (i915.enable_ppgtt == 1 && full)
                return false;
+        return true;
+}
+static int sanitize_enable_ppgtt(struct drm_device *dev, int enable_ppgtt)
+{
+        if (enable_ppgtt == 0 || !HAS_ALIASING_PPGTT(dev))
+                return 0;
+        if (enable_ppgtt == 1)
+                return 1;
+        if (enable_ppgtt == 2 && HAS_PPGTT(dev))
+                return 2;
 #ifdef CONFIG_INTEL_IOMMU
        /* Disable ppgtt on SNB if VT-d is on. */
        if (INTEL_INFO(dev)->gen == 6 && intel_iommu_gfx_mapped) {
                DRM_INFO("Disabling PPGTT because VT-d is on\n");
-                return false;
+                return 0;
        }
 #endif
-        /* Full ppgtt disabled by default for now due to issues. */
+        return HAS_ALIASING_PPGTT(dev) ? 1 : 0;
-        if (full)
-                return false; /* HAS_PPGTT(dev) */
-        else
-                return HAS_ALIASING_PPGTT(dev);
 }
 #define GEN6_PPGTT_PD_ENTRIES 512
@@ -1079,7 +1089,9 @@ alloc:
        if (ret == -ENOSPC && !retried) {
                ret = i915_gem_evict_something(dev, &dev_priv->gtt.base,
                                               GEN6_PD_SIZE, GEN6_PD_ALIGN,
-                                               I915_CACHE_NONE, 0);
+                                               I915_CACHE_NONE,
+                                               0, dev_priv->gtt.base.total,
+                                               0);
                if (ret)
                        return ret;
@@ -2031,6 +2043,14 @@ int i915_gem_gtt_init(struct drm_device *dev)
                 gtt->base.total >> 20);
        DRM_DEBUG_DRIVER("GMADR size = %ldM\n", gtt->mappable_end >> 20);
        DRM_DEBUG_DRIVER("GTT stolen size = %zdM\n", gtt->stolen_size >> 20);
+        /*
+         * i915.enable_ppgtt is read-only, so do an early pass to validate the
+         * user's requested state against the hardware/driver capabilities.  We
+         * do this now so that we can print out any log messages once rather
+         * than every time we check intel_enable_ppgtt().
+         */
+        i915.enable_ppgtt = sanitize_enable_ppgtt(dev, i915.enable_ppgtt);
+        DRM_DEBUG_DRIVER("ppgtt mode: %i\n", i915.enable_ppgtt);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 7753249b3a95..f98ba4e6e70b 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1362,10 +1362,20 @@ static inline void intel_hpd_irq_handler(struct drm_device *dev,
        spin_lock(&dev_priv->irq_lock);
        for (i = 1; i < HPD_NUM_PINS; i++) {
-                WARN_ONCE(hpd[i] & hotplug_trigger &&
+                if (hpd[i] & hotplug_trigger &&
-                          dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED,
+                    dev_priv->hpd_stats[i].hpd_mark == HPD_DISABLED) {
-                          "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
+                        /*
-                          hotplug_trigger, i, hpd[i]);
+                         * On GMCH platforms the interrupt mask bits only
+                         * prevent irq generation, not the setting of the
+                         * hotplug bits itself. So only WARN about unexpected
+                         * interrupts on saner platforms.
+                         */
+                        WARN_ONCE(INTEL_INFO(dev)->gen >= 5 && !IS_VALLEYVIEW(dev),
+                                  "Received HPD interrupt (0x%08x) on pin %d (0x%08x) although disabled\n",
+                                  hotplug_trigger, i, hpd[i]);
+                        continue;
+                }
                if (!(hpd[i] & hotplug_trigger) ||
                    dev_priv->hpd_stats[i].hpd_mark != HPD_ENABLED)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 9f5b18d9d885..c77af69c2d8f 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -827,6 +827,7 @@ enum punit_power_well {
 # define MI_FLUSH_ENABLE                                (1 << 12)
 # define ASYNC_FLIP_PERF_DISABLE                        (1 << 14)
 # define MODE_IDLE                                      (1 << 9)
+# define STOP_RING                                      (1 << 8)
 #define GEN6_GT_MODE    0x20d0
 #define GEN7_GT_MODE    0x7008
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 4867f4cc0938..aff4a113cda3 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -287,6 +287,9 @@ parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
        const struct bdb_lfp_backlight_data *backlight_data;
        const struct bdb_lfp_backlight_data_entry *entry;
+        /* Err to enabling backlight if no backlight block. */
+        dev_priv->vbt.backlight.present = true;
        backlight_data = find_section(bdb, BDB_LVDS_BACKLIGHT);
        if (!backlight_data)
                return;
@@ -299,6 +302,13 @@ parse_lfp_backlight(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
        entry = &backlight_data->data[panel_type];
+        dev_priv->vbt.backlight.present = entry->type == BDB_BACKLIGHT_TYPE_PWM;
+        if (!dev_priv->vbt.backlight.present) {
+                DRM_DEBUG_KMS("PWM backlight not present in VBT (type %u)\n",
+                              entry->type);
+                return;
+        }
        dev_priv->vbt.backlight.pwm_freq_hz = entry->pwm_freq_hz;
        dev_priv->vbt.backlight.active_low_pwm = entry->active_low_pwm;
        DRM_DEBUG_KMS("VBT backlight PWM modulation frequency %u Hz, "
@@ -550,47 +560,71 @@ parse_edp(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
        dev_priv->vbt.edp_pps = *edp_pps;
-        dev_priv->vbt.edp_rate = edp_link_params->rate ? DP_LINK_BW_2_7 :
+        switch (edp_link_params->rate) {
-                DP_LINK_BW_1_62;
+        case EDP_RATE_1_62:
+                dev_priv->vbt.edp_rate = DP_LINK_BW_1_62;
+                break;
+        case EDP_RATE_2_7:
+                dev_priv->vbt.edp_rate = DP_LINK_BW_2_7;
+                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP link rate value %u\n",
+                              edp_link_params->rate);
+                break;
+        }
        switch (edp_link_params->lanes) {
-        case 0:
+        case EDP_LANE_1:
                dev_priv->vbt.edp_lanes = 1;
                break;
-        case 1:
+        case EDP_LANE_2:
                dev_priv->vbt.edp_lanes = 2;
                break;
-        case 3:
+        case EDP_LANE_4:
-        default:
                dev_priv->vbt.edp_lanes = 4;
                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP lane count value %u\n",
+                              edp_link_params->lanes);
+                break;
        }
        switch (edp_link_params->preemphasis) {
-        case 0:
+        case EDP_PREEMPHASIS_NONE:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_0;
                break;
-        case 1:
+        case EDP_PREEMPHASIS_3_5dB:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_3_5;
                break;
-        case 2:
+        case EDP_PREEMPHASIS_6dB:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_6;
                break;
-        case 3:
+        case EDP_PREEMPHASIS_9_5dB:
                dev_priv->vbt.edp_preemphasis = DP_TRAIN_PRE_EMPHASIS_9_5;
                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP pre-emphasis value %u\n",
+                              edp_link_params->preemphasis);
+                break;
        }
        switch (edp_link_params->vswing) {
-        case 0:
+        case EDP_VSWING_0_4V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_400;
                break;
-        case 1:
+        case EDP_VSWING_0_6V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_600;
                break;
-        case 2:
+        case EDP_VSWING_0_8V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_800;
                break;
-        case 3:
+        case EDP_VSWING_1_2V:
                dev_priv->vbt.edp_vswing = DP_TRAIN_VOLTAGE_SWING_1200;
                break;
+        default:
+                DRM_DEBUG_KMS("VBT has unknown eDP voltage swing value %u\n",
+                              edp_link_params->vswing);
+                break;
        }
 }
diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
index 83b7629e4367..f27f7b282465 100644
--- a/drivers/gpu/drm/i915/intel_bios.h
+++ b/drivers/gpu/drm/i915/intel_bios.h
@@ -374,6 +374,9 @@ struct bdb_lvds_lfp_data {
        struct bdb_lvds_lfp_data_entry data[16];
 } __packed;
+#define BDB_BACKLIGHT_TYPE_NONE 0
+#define BDB_BACKLIGHT_TYPE_PWM  2
 struct bdb_lfp_backlight_data_entry {
        u8 type:2;
        u8 active_low_pwm:1;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index dae976f51d83..5b60e25baa32 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7825,14 +7825,12 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                addr = i915_gem_obj_ggtt_offset(obj);
        } else {
                int align = IS_I830(dev) ? 16 * 1024 : 256;
-                ret = i915_gem_attach_phys_object(dev, obj,
+                ret = i915_gem_object_attach_phys(obj, align);
-                                                  (intel_crtc->pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1,
-                                                  align);
                if (ret) {
                        DRM_DEBUG_KMS("failed to attach phys object\n");
                        goto fail_locked;
                }
-                addr = obj->phys_obj->handle->busaddr;
+                addr = obj->phys_handle->busaddr;
        }
        if (IS_GEN2(dev))
@@ -7840,10 +7838,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 finish:
        if (intel_crtc->cursor_bo) {
-                if (INTEL_INFO(dev)->cursor_needs_physical) {
+                if (!INTEL_INFO(dev)->cursor_needs_physical)
-                        if (intel_crtc->cursor_bo != obj)
-                                i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
-                } else
                        i915_gem_object_unpin_from_display_plane(intel_crtc->cursor_bo);
                drm_gem_object_unreference(&intel_crtc->cursor_bo->base);
        }
@@ -9654,11 +9649,22 @@ intel_pipe_config_compare(struct drm_device *dev,
        PIPE_CONF_CHECK_I(pipe_src_w);
        PIPE_CONF_CHECK_I(pipe_src_h);
-        PIPE_CONF_CHECK_I(gmch_pfit.control);
+        /*
-        /* pfit ratios are autocomputed by the hw on gen4+ */
+         * FIXME: BIOS likes to set up a cloned config with lvds+external
-        if (INTEL_INFO(dev)->gen < 4)
+         * screen. Since we don't yet re-compute the pipe config when moving
-                PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
+         * just the lvds port away to another pipe the sw tracking won't match.
-        PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
+         *
+         * Proper atomic modesets with recomputed global state will fix this.
+         * Until then just don't check gmch state for inherited modes.
+         */
+        if (!PIPE_CONF_QUIRK(PIPE_CONFIG_QUIRK_INHERITED_MODE)) {
+                PIPE_CONF_CHECK_I(gmch_pfit.control);
+                /* pfit ratios are autocomputed by the hw on gen4+ */
+                if (INTEL_INFO(dev)->gen < 4)
+                        PIPE_CONF_CHECK_I(gmch_pfit.pgm_ratios);
+                PIPE_CONF_CHECK_I(gmch_pfit.lvds_border_bits);
+        }
        PIPE_CONF_CHECK_I(pch_pfit.enabled);
        if (current_config->pch_pfit.enabled) {
                PIPE_CONF_CHECK_I(pch_pfit.pos);
@@ -11384,15 +11390,6 @@ void intel_modeset_init(struct drm_device *dev)
        }
 }
-static void
-intel_connector_break_all_links(struct intel_connector *connector)
-{
-        connector->base.dpms = DRM_MODE_DPMS_OFF;
-        connector->base.encoder = NULL;
-        connector->encoder->connectors_active = false;
-        connector->encoder->base.crtc = NULL;
-}
 static void intel_enable_pipe_a(struct drm_device *dev)
 {
        struct intel_connector *connector;
@@ -11474,8 +11471,17 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                        if (connector->encoder->base.crtc != &crtc->base)
                                continue;
-                        intel_connector_break_all_links(connector);
+                        connector->base.dpms = DRM_MODE_DPMS_OFF;
+                        connector->base.encoder = NULL;
                }
+                /* multiple connectors may have the same encoder:
+                 *  handle them and break crtc link separately */
+                list_for_each_entry(connector, &dev->mode_config.connector_list,
+                                    base.head)
+                        if (connector->encoder->base.crtc == &crtc->base) {
+                                connector->encoder->base.crtc = NULL;
+                                connector->encoder->connectors_active = false;
+                        }
                WARN_ON(crtc->active);
                crtc->base.enabled = false;
@@ -11557,6 +11563,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
                                      drm_get_encoder_name(&encoder->base));
                        encoder->disable(encoder);
                }
+                encoder->base.crtc = NULL;
+                encoder->connectors_active = false;
                /* Inconsistent output/port/pipe state happens presumably due to
                 * a bug in one of the get_hw_state functions. Or someplace else
@@ -11567,8 +11575,8 @@ static void intel_sanitize_encoder(struct intel_encoder *encoder)
                                    base.head) {
                        if (connector->encoder != encoder)
                                continue;
+                        connector->base.dpms = DRM_MODE_DPMS_OFF;
-                        intel_connector_break_all_links(connector);
+                        connector->base.encoder = NULL;
                }
        }
        /* Enabled encoders without active connectors will be fixed in
@@ -11616,6 +11624,8 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
                            base.head) {
                memset(&crtc->config, 0, sizeof(crtc->config));
+                crtc->config.quirks |= PIPE_CONFIG_QUIRK_INHERITED_MODE;
                crtc->active = dev_priv->display.get_pipe_config(crtc,
                                                                 &crtc->config);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index a0dad1a2f819..2a00cb828d20 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -105,7 +105,8 @@ intel_dp_max_link_bw(struct intel_dp *intel_dp)
        case DP_LINK_BW_2_7:
                break;
        case DP_LINK_BW_5_4: /* 1.2 capable displays may advertise higher bw */
-                if ((IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8) &&
+                if (((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) ||
+                     INTEL_INFO(dev)->gen >= 8) &&
                    intel_dp->dpcd[DP_DPCD_REV] >= 0x12)
                        max_link_bw = DP_LINK_BW_5_4;
                else
@@ -120,6 +121,22 @@ intel_dp_max_link_bw(struct intel_dp *intel_dp)
        return max_link_bw;
 }
+static u8 intel_dp_max_lane_count(struct intel_dp *intel_dp)
+{
+        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+        struct drm_device *dev = intel_dig_port->base.base.dev;
+        u8 source_max, sink_max;
+        source_max = 4;
+        if (HAS_DDI(dev) && intel_dig_port->port == PORT_A &&
+            (intel_dig_port->saved_port_bits & DDI_A_4_LANES) == 0)
+                source_max = 2;
+        sink_max = drm_dp_max_lane_count(intel_dp->dpcd);
+        return min(source_max, sink_max);
+}
 /*
 * The units on the numbers in the next two are... bizarre.  Examples will
 * make it clearer; this one parallels an example in the eDP spec.
@@ -170,7 +187,7 @@ intel_dp_mode_valid(struct drm_connector *connector,
        }
        max_link_clock = drm_dp_bw_code_to_link_rate(intel_dp_max_link_bw(intel_dp));
-        max_lanes = drm_dp_max_lane_count(intel_dp->dpcd);
+        max_lanes = intel_dp_max_lane_count(intel_dp);
        max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
        mode_rate = intel_dp_link_required(target_clock, 18);
@@ -575,7 +592,8 @@ out:
        return ret;
 }
-#define HEADER_SIZE     4
+#define BARE_ADDRESS_SIZE       3
+#define HEADER_SIZE             (BARE_ADDRESS_SIZE + 1)
 static ssize_t
 intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
 {
@@ -592,7 +610,7 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
        switch (msg->request & ~DP_AUX_I2C_MOT) {
        case DP_AUX_NATIVE_WRITE:
        case DP_AUX_I2C_WRITE:
-                txsize = HEADER_SIZE + msg->size;
+                txsize = msg->size ? HEADER_SIZE + msg->size : BARE_ADDRESS_SIZE;
                rxsize = 1;
                if (WARN_ON(txsize > 20))
@@ -611,7 +629,7 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
        case DP_AUX_NATIVE_READ:
        case DP_AUX_I2C_READ:
-                txsize = HEADER_SIZE;
+                txsize = msg->size ? HEADER_SIZE : BARE_ADDRESS_SIZE;
                rxsize = msg->size + 1;
                if (WARN_ON(rxsize > 20))
@@ -749,8 +767,10 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        struct intel_crtc *intel_crtc = encoder->new_crtc;
        struct intel_connector *intel_connector = intel_dp->attached_connector;
        int lane_count, clock;
-        int max_lane_count = drm_dp_max_lane_count(intel_dp->dpcd);
+        int min_lane_count = 1;
+        int max_lane_count = intel_dp_max_lane_count(intel_dp);
        /* Conveniently, the link BW constants become indices with a shift...*/
+        int min_clock = 0;
        int max_clock = intel_dp_max_link_bw(intel_dp) >> 3;
        int bpp, mode_rate;
        static int bws[] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7, DP_LINK_BW_5_4 };
@@ -783,19 +803,38 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        /* Walk through all bpp values. Luckily they're all nicely spaced with 2
         * bpc in between. */
        bpp = pipe_config->pipe_bpp;
-        if (is_edp(intel_dp) && dev_priv->vbt.edp_bpp &&
+        if (is_edp(intel_dp)) {
-            dev_priv->vbt.edp_bpp < bpp) {
+                if (dev_priv->vbt.edp_bpp && dev_priv->vbt.edp_bpp < bpp) {
-                DRM_DEBUG_KMS("clamping bpp for eDP panel to BIOS-provided %i\n",
+                        DRM_DEBUG_KMS("clamping bpp for eDP panel to BIOS-provided %i\n",
-                              dev_priv->vbt.edp_bpp);
+                                      dev_priv->vbt.edp_bpp);
-                bpp = dev_priv->vbt.edp_bpp;
+                        bpp = dev_priv->vbt.edp_bpp;
+                }
+                if (IS_BROADWELL(dev)) {
+                        /* Yes, it's an ugly hack. */
+                        min_lane_count = max_lane_count;
+                        DRM_DEBUG_KMS("forcing lane count to max (%u) on BDW\n",
+                                      min_lane_count);
+                } else if (dev_priv->vbt.edp_lanes) {
+                        min_lane_count = min(dev_priv->vbt.edp_lanes,
+                                             max_lane_count);
+                        DRM_DEBUG_KMS("using min %u lanes per VBT\n",
+                                      min_lane_count);
+                }
+                if (dev_priv->vbt.edp_rate) {
+                        min_clock = min(dev_priv->vbt.edp_rate >> 3, max_clock);
+                        DRM_DEBUG_KMS("using min %02x link bw per VBT\n",
+                                      bws[min_clock]);
+                }
        }
        for (; bpp >= 6*3; bpp -= 2*3) {
                mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock,
                                                   bpp);
-                for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
+                for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
-                        for (clock = 0; clock <= max_clock; clock++) {
+                        for (clock = min_clock; clock <= max_clock; clock++) {
                                link_clock = drm_dp_bw_code_to_link_rate(bws[clock]);
                                link_avail = intel_dp_max_data_rate(link_clock,
                                                                    lane_count);
@@ -3618,7 +3657,8 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
 {
        struct drm_connector *connector = &intel_connector->base;
        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
-        struct drm_device *dev = intel_dig_port->base.base.dev;
+        struct intel_encoder *intel_encoder = &intel_dig_port->base;
+        struct drm_device *dev = intel_encoder->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_display_mode *fixed_mode = NULL;
        bool has_dpcd;
@@ -3628,6 +3668,14 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
        if (!is_edp(intel_dp))
                return true;
+        /* The VDD bit needs a power domain reference, so if the bit is already
+         * enabled when we boot, grab this reference. */
+        if (edp_have_panel_vdd(intel_dp)) {
+                enum intel_display_power_domain power_domain;
+                power_domain = intel_display_port_power_domain(intel_encoder);
+                intel_display_power_get(dev_priv, power_domain);
+        }
        /* Cache DPCD and EDID for edp. */
        intel_edp_panel_vdd_on(intel_dp);
        has_dpcd = intel_dp_get_dpcd(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0542de982260..328b1a70264b 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -236,7 +236,8 @@ struct intel_crtc_config {
         * tracked with quirk flags so that fastboot and state checker can act
         * accordingly.
         */
-#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS (1<<0) /* unreliable sync mode.flags */
+#define PIPE_CONFIG_QUIRK_MODE_SYNC_FLAGS       (1<<0) /* unreliable sync mode.flags */
+#define PIPE_CONFIG_QUIRK_INHERITED_MODE        (1<<1) /* mode inherited from firmware */
        unsigned long quirks;
        /* User requested mode, only valid as a starting point to
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index b4d44e62f0c7..f73ba5e6b7a8 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -132,6 +132,16 @@ static int intelfb_create(struct drm_fb_helper *helper,
        mutex_lock(&dev->struct_mutex);
+        if (intel_fb &&
+            (sizes->fb_width > intel_fb->base.width ||
+             sizes->fb_height > intel_fb->base.height)) {
+                DRM_DEBUG_KMS("BIOS fb too small (%dx%d), we require (%dx%d),"
+                              " releasing it\n",
+                              intel_fb->base.width, intel_fb->base.height,
+                              sizes->fb_width, sizes->fb_height);
+                drm_framebuffer_unreference(&intel_fb->base);
+                intel_fb = ifbdev->fb = NULL;
+        }
        if (!intel_fb || WARN_ON(!intel_fb->obj)) {
                DRM_DEBUG_KMS("no BIOS fb, allocating a new one\n");
                ret = intelfb_alloc(helper, sizes);
@@ -377,6 +387,15 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                                                          height);
                }
+                /* No preferred mode marked by the EDID? Are there any modes? */
+                if (!modes[i] && !list_empty(&connector->modes)) {
+                        DRM_DEBUG_KMS("using first mode listed on connector %s\n",
+                                      drm_get_connector_name(connector));
+                        modes[i] = list_first_entry(&connector->modes,
+                                                    struct drm_display_mode,
+                                                    head);
+                }
                /* last resort: use current mode */
                if (!modes[i]) {
                        /*
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index b0413e190625..157267aa3561 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -821,11 +821,11 @@ static void intel_disable_hdmi(struct intel_encoder *encoder)
        }
 }
-static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
+static int hdmi_portclock_limit(struct intel_hdmi *hdmi, bool respect_dvi_limit)
 {
        struct drm_device *dev = intel_hdmi_to_dev(hdmi);
-        if (!hdmi->has_hdmi_sink || IS_G4X(dev))
+        if ((respect_dvi_limit && !hdmi->has_hdmi_sink) || IS_G4X(dev))
                return 165000;
        else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
                return 300000;
@@ -837,7 +837,8 @@ static enum drm_mode_status
 intel_hdmi_mode_valid(struct drm_connector *connector,
                      struct drm_display_mode *mode)
 {
-        if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector)))
+        if (mode->clock > hdmi_portclock_limit(intel_attached_hdmi(connector),
+                                               true))
                return MODE_CLOCK_HIGH;
        if (mode->clock < 20000)
                return MODE_CLOCK_LOW;
@@ -879,7 +880,7 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
        struct drm_device *dev = encoder->base.dev;
        struct drm_display_mode *adjusted_mode = &pipe_config->adjusted_mode;
        int clock_12bpc = pipe_config->adjusted_mode.crtc_clock * 3 / 2;
-        int portclock_limit = hdmi_portclock_limit(intel_hdmi);
+        int portclock_limit = hdmi_portclock_limit(intel_hdmi, false);
        int desired_bpp;
        if (intel_hdmi->color_range_auto) {
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index d8adc9104dca..129db0c7d835 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -193,7 +193,7 @@ intel_overlay_map_regs(struct intel_overlay *overlay)
        struct overlay_registers __iomem *regs;
        if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_obj->handle->vaddr;
+                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_handle->vaddr;
        else
                regs = io_mapping_map_wc(dev_priv->gtt.mappable,
                                         i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1340,14 +1340,12 @@ void intel_setup_overlay(struct drm_device *dev)
        overlay->reg_bo = reg_bo;
        if (OVERLAY_NEEDS_PHYSICAL(dev)) {
-                ret = i915_gem_attach_phys_object(dev, reg_bo,
+                ret = i915_gem_object_attach_phys(reg_bo, PAGE_SIZE);
-                                                  I915_GEM_PHYS_OVERLAY_REGS,
-                                                  PAGE_SIZE);
                if (ret) {
                        DRM_ERROR("failed to attach phys overlay regs\n");
                        goto out_free_bo;
                }
-                overlay->flip_addr = reg_bo->phys_obj->handle->busaddr;
+                overlay->flip_addr = reg_bo->phys_handle->busaddr;
        } else {
                ret = i915_gem_obj_ggtt_pin(reg_bo, PAGE_SIZE, PIN_MAPPABLE);
                if (ret) {
@@ -1428,7 +1426,7 @@ intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
                /* Cast to make sparse happy, but it's wc memory anyway, so
                 * equivalent to the wc io mapping on X86. */
                regs = (struct overlay_registers __iomem *)
-                        overlay->reg_bo->phys_obj->handle->vaddr;
+                        overlay->reg_bo->phys_handle->vaddr;
        else
                regs = io_mapping_map_atomic_wc(dev_priv->gtt.mappable,
                                                i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1462,7 +1460,7 @@ intel_overlay_capture_error_state(struct drm_device *dev)
        error->dovsta = I915_READ(DOVSTA);
        error->isr = I915_READ(ISR);
        if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                error->base = (__force long)overlay->reg_bo->phys_obj->handle->vaddr;
+                error->base = (__force long)overlay->reg_bo->phys_handle->vaddr;
        else
                error->base = i915_gem_obj_ggtt_offset(overlay->reg_bo);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index cb058408c70e..cb8cfb7e0974 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -492,6 +492,7 @@ void intel_panel_set_backlight(struct intel_connector *connector, u32 level,
        enum pipe pipe = intel_get_pipe_from_connector(connector);
        u32 freq;
        unsigned long flags;
+        u64 n;
        if (!panel->backlight.present || pipe == INVALID_PIPE)
                return;
@@ -502,10 +503,9 @@ void intel_panel_set_backlight(struct intel_connector *connector, u32 level,
        /* scale to hardware max, but be careful to not overflow */
        freq = panel->backlight.max;
-        if (freq < max)
+        n = (u64)level * freq;
-                level = level * freq / max;
+        do_div(n, max);
-        else
+        level = n;
-                level = freq / max * level;
        panel->backlight.level = level;
        if (panel->backlight.device)
@@ -1065,6 +1065,11 @@ int intel_panel_setup_backlight(struct drm_connector *connector)
        unsigned long flags;
        int ret;
+        if (!dev_priv->vbt.backlight.present) {
+                DRM_DEBUG_KMS("native backlight control not available per VBT\n");
+                return 0;
+        }
        /* set level and max in panel struct */
        spin_lock_irqsave(&dev_priv->backlight_lock, flags);
        ret = dev_priv->display.setup_backlight(intel_connector);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 5874716774a7..d93dcf683e8c 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -1545,6 +1545,16 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
        DRM_DEBUG_KMS("FIFO watermarks - A: %d, B: %d\n", planea_wm, planeb_wm);
+        if (IS_I915GM(dev) && enabled) {
+                struct intel_framebuffer *fb;
+                fb = to_intel_framebuffer(enabled->primary->fb);
+                /* self-refresh seems busted with untiled */
+                if (fb->obj->tiling_mode == I915_TILING_NONE)
+                        enabled = NULL;
+        }
        /*
         * Overlay gets an aggressive default since video jitter is bad.
         */
@@ -2085,6 +2095,43 @@ static void intel_print_wm_latency(struct drm_device *dev,
        }
 }
+static bool ilk_increase_wm_latency(struct drm_i915_private *dev_priv,
+                                    uint16_t wm[5], uint16_t min)
+{
+        int level, max_level = ilk_wm_max_level(dev_priv->dev);
+        if (wm[0] >= min)
+                return false;
+        wm[0] = max(wm[0], min);
+        for (level = 1; level <= max_level; level++)
+                wm[level] = max_t(uint16_t, wm[level], DIV_ROUND_UP(min, 5));
+        return true;
+}
+static void snb_wm_latency_quirk(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        bool changed;
+        /*
+         * The BIOS provided WM memory latency values are often
+         * inadequate for high resolution displays. Adjust them.
+         */
+        changed = ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 12) |
+                ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12) |
+                ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12);
+        if (!changed)
+                return;
+        DRM_DEBUG_KMS("WM latency values increased to avoid potential underruns\n");
+        intel_print_wm_latency(dev, "Primary", dev_priv->wm.pri_latency);
+        intel_print_wm_latency(dev, "Sprite", dev_priv->wm.spr_latency);
+        intel_print_wm_latency(dev, "Cursor", dev_priv->wm.cur_latency);
+}
 static void ilk_setup_wm_latency(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -2102,6 +2149,9 @@ static void ilk_setup_wm_latency(struct drm_device *dev)
        intel_print_wm_latency(dev, "Primary", dev_priv->wm.pri_latency);
        intel_print_wm_latency(dev, "Sprite", dev_priv->wm.spr_latency);
        intel_print_wm_latency(dev, "Cursor", dev_priv->wm.cur_latency);
+        if (IS_GEN6(dev))
+                snb_wm_latency_quirk(dev);
 }
 static void ilk_compute_wm_parameters(struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 6bc68bdcf433..79fb4cc2137c 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -437,32 +437,41 @@ static void ring_setup_phys_status_page(struct intel_ring_buffer *ring)
        I915_WRITE(HWS_PGA, addr);
 }
-static int init_ring_common(struct intel_ring_buffer *ring)
+static bool stop_ring(struct intel_ring_buffer *ring)
 {
-        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = to_i915(ring->dev);
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj = ring->obj;
-        int ret = 0;
-        u32 head;
-        gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
+        if (!IS_GEN2(ring->dev)) {
+                I915_WRITE_MODE(ring, _MASKED_BIT_ENABLE(STOP_RING));
+                if (wait_for_atomic((I915_READ_MODE(ring) & MODE_IDLE) != 0, 1000)) {
+                        DRM_ERROR("%s :timed out trying to stop ring\n", ring->name);
+                        return false;
+                }
+        }
-        /* Stop the ring if it's running. */
        I915_WRITE_CTL(ring, 0);
        I915_WRITE_HEAD(ring, 0);
        ring->write_tail(ring, 0);
-        if (wait_for_atomic((I915_READ_MODE(ring) & MODE_IDLE) != 0, 1000))
-                DRM_ERROR("%s :timed out trying to stop ring\n", ring->name);
-        if (I915_NEED_GFX_HWS(dev))
+        if (!IS_GEN2(ring->dev)) {
-                intel_ring_setup_status_page(ring);
+                (void)I915_READ_CTL(ring);
-        else
+                I915_WRITE_MODE(ring, _MASKED_BIT_DISABLE(STOP_RING));
-                ring_setup_phys_status_page(ring);
+        }
-        head = I915_READ_HEAD(ring) & HEAD_ADDR;
+        return (I915_READ_HEAD(ring) & HEAD_ADDR) == 0;
+}
-        /* G45 ring initialization fails to reset head to zero */
+static int init_ring_common(struct intel_ring_buffer *ring)
-        if (head != 0) {
+{
+        struct drm_device *dev = ring->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj = ring->obj;
+        int ret = 0;
+        gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
+        if (!stop_ring(ring)) {
+                /* G45 ring initialization often fails to reset head to zero */
                DRM_DEBUG_KMS("%s head not reset to zero "
                              "ctl %08x head %08x tail %08x start %08x\n",
                              ring->name,
@@ -471,9 +480,7 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                              I915_READ_TAIL(ring),
                              I915_READ_START(ring));
-                I915_WRITE_HEAD(ring, 0);
+                if (!stop_ring(ring)) {
-                if (I915_READ_HEAD(ring) & HEAD_ADDR) {
                        DRM_ERROR("failed to set %s head to zero "
                                  "ctl %08x head %08x tail %08x start %08x\n",
                                  ring->name,
@@ -481,9 +488,16 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                                  I915_READ_HEAD(ring),
                                  I915_READ_TAIL(ring),
                                  I915_READ_START(ring));
+                        ret = -EIO;
+                        goto out;
                }
        }
+        if (I915_NEED_GFX_HWS(dev))
+                intel_ring_setup_status_page(ring);
+        else
+                ring_setup_phys_status_page(ring);
        /* Initialize the ring. This must happen _after_ we've cleared the ring
         * registers with the above sequence (the readback of the HEAD registers
         * also enforces ordering), otherwise the hw might lose the new ring
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 270a6a973438..2b91c4b4d34b 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -34,6 +34,7 @@ struct  intel_hw_status_page {
 #define I915_WRITE_IMR(ring, val) I915_WRITE(RING_IMR((ring)->mmio_base), val)
 #define I915_READ_MODE(ring) I915_READ(RING_MI_MODE((ring)->mmio_base))
+#define I915_WRITE_MODE(ring, val) I915_WRITE(RING_MI_MODE((ring)->mmio_base), val)
 enum intel_ring_hangcheck_action {
        HANGCHECK_IDLE = 0,
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index d27155adf5db..46be00d66df3 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2424,8 +2424,8 @@ intel_sdvo_connector_init(struct intel_sdvo_connector *connector,
        if (ret < 0)
                goto err1;
-        ret = sysfs_create_link(&encoder->ddc.dev.kobj,
+        ret = sysfs_create_link(&drm_connector->kdev->kobj,
-                                &drm_connector->kdev->kobj,
+                                &encoder->ddc.dev.kobj,
                                encoder->ddc.dev.kobj.name);
        if (ret < 0)
                goto err2;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index f729dc71d5be..d0c75779d3f6 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -185,6 +185,8 @@ static void vlv_force_wake_reset(struct drm_i915_private *dev_priv)
 {
        __raw_i915_write32(dev_priv, FORCEWAKE_VLV,
                           _MASKED_BIT_DISABLE(0xffff));
+        __raw_i915_write32(dev_priv, FORCEWAKE_MEDIA_VLV,
+                           _MASKED_BIT_DISABLE(0xffff));
        /* something from same cacheline, but !FORCEWAKE_VLV */
        __raw_posting_read(dev_priv, FORCEWAKE_ACK_VLV);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
index 3e6c0f3ed592..ef9957dbac94 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
@@ -510,9 +510,8 @@ static void update_cursor(struct drm_crtc *crtc)
                                        MDP4_DMA_CURSOR_BLEND_CONFIG_CURSOR_EN);
                } else {
                        /* disable cursor: */
-                        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma), 0);
+                        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BASE(dma),
-                        mdp4_write(mdp4_kms, REG_MDP4_DMA_CURSOR_BLEND_CONFIG(dma),
+                                        mdp4_kms->blank_cursor_iova);
-                                        MDP4_DMA_CURSOR_BLEND_CONFIG_FORMAT(CURSOR_ARGB));
                }
                /* and drop the iova ref + obj rev when done scanning out: */
@@ -574,11 +573,9 @@ static int mdp4_crtc_cursor_set(struct drm_crtc *crtc,
        if (old_bo) {
                /* drop our previous reference: */
-                msm_gem_put_iova(old_bo, mdp4_kms->id);
+                drm_flip_work_queue(&mdp4_crtc->unref_cursor_work, old_bo);
-                drm_gem_object_unreference_unlocked(old_bo);
        }
-        crtc_flush(crtc);
        request_pending(crtc, PENDING_CURSOR);
        return 0;
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
index c740ccd1cc67..8edd531cb621 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
@@ -70,12 +70,12 @@ irqreturn_t mdp4_irq(struct msm_kms *kms)
        VERB("status=%08x", status);
+        mdp_dispatch_irqs(mdp_kms, status);
        for (id = 0; id < priv->num_crtcs; id++)
                if (status & mdp4_crtc_vblank(priv->crtcs[id]))
                        drm_handle_vblank(dev, id);
-        mdp_dispatch_irqs(mdp_kms, status);
        return IRQ_HANDLED;
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c
index 272e707c9487..0bb4faa17523 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c
@@ -144,6 +144,10 @@ static void mdp4_preclose(struct msm_kms *kms, struct drm_file *file)
 static void mdp4_destroy(struct msm_kms *kms)
 {
        struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+        if (mdp4_kms->blank_cursor_iova)
+                msm_gem_put_iova(mdp4_kms->blank_cursor_bo, mdp4_kms->id);
+        if (mdp4_kms->blank_cursor_bo)
+                drm_gem_object_unreference(mdp4_kms->blank_cursor_bo);
        kfree(mdp4_kms);
 }
@@ -372,6 +376,23 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
                goto fail;
        }
+        mutex_lock(&dev->struct_mutex);
+        mdp4_kms->blank_cursor_bo = msm_gem_new(dev, SZ_16K, MSM_BO_WC);
+        mutex_unlock(&dev->struct_mutex);
+        if (IS_ERR(mdp4_kms->blank_cursor_bo)) {
+                ret = PTR_ERR(mdp4_kms->blank_cursor_bo);
+                dev_err(dev->dev, "could not allocate blank-cursor bo: %d\n", ret);
+                mdp4_kms->blank_cursor_bo = NULL;
+                goto fail;
+        }
+        ret = msm_gem_get_iova(mdp4_kms->blank_cursor_bo, mdp4_kms->id,
+                        &mdp4_kms->blank_cursor_iova);
+        if (ret) {
+                dev_err(dev->dev, "could not pin blank-cursor bo: %d\n", ret);
+                goto fail;
+        }
        return kms;
 fail:
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h
index 66a4d31aec80..715520c54cde 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.h
@@ -44,6 +44,10 @@ struct mdp4_kms {
        struct clk *lut_clk;
        struct mdp_irq error_handler;
+        /* empty/blank cursor bo to use when cursor is "disabled" */
+        struct drm_gem_object *blank_cursor_bo;
+        uint32_t blank_cursor_iova;
 };
 #define to_mdp4_kms(x) container_of(x, struct mdp4_kms, base)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
index 353d494a497f..f2b985bc2adf 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
@@ -71,11 +71,11 @@ static void mdp5_irq_mdp(struct mdp_kms *mdp_kms)
        VERB("status=%08x", status);
+        mdp_dispatch_irqs(mdp_kms, status);
        for (id = 0; id < priv->num_crtcs; id++)
                if (status & mdp5_crtc_vblank(priv->crtcs[id]))
                        drm_handle_vblank(dev, id);
-        mdp_dispatch_irqs(mdp_kms, status);
 }
 irqreturn_t mdp5_irq(struct msm_kms *kms)
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index 6c6d7d4c9b4e..a752ab83b810 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -62,11 +62,8 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
        dma_addr_t paddr;
        int ret, size;
-        /* only doing ARGB32 since this is what is needed to alpha-blend
-         * with video overlays:
-         */
        sizes->surface_bpp = 32;
-        sizes->surface_depth = 32;
+        sizes->surface_depth = 24;
        DBG("create fbdev: %dx%d@%d (%dx%d)", sizes->surface_width,
                        sizes->surface_height, sizes->surface_bpp,
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 3da8264d3039..bb8026daebc9 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -118,8 +118,10 @@ static void put_pages(struct drm_gem_object *obj)
                if (iommu_present(&platform_bus_type))
                        drm_gem_put_pages(obj, msm_obj->pages, true, false);
-                else
+                else {
                        drm_mm_remove_node(msm_obj->vram_node);
+                        drm_free_large(msm_obj->pages);
+                }
                msm_obj->pages = NULL;
        }
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
index 7762665ad8fd..876de9ac3793 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nvd0.c
@@ -1009,7 +1009,7 @@ exec_clkcmp(struct nv50_disp_priv *priv, int head, int id,
        }
        if (outp == 8)
-                return false;
+                return conf;
        data = exec_lookup(priv, head, outp, ctrl, dcb, &ver, &hdr, &cnt, &len, &info1);
        if (data == 0x0000)
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c
index 1dc37b1ddbfa..b0d0fb2f4d08 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxgm107.c
@@ -863,7 +863,7 @@ gm107_grctx_generate_mods(struct nvc0_graph_priv *priv, struct nvc0_grctx *info)
 {
        mmio_data(0x003000, 0x0100, NV_MEM_ACCESS_RW | NV_MEM_ACCESS_SYS);
        mmio_data(0x008000, 0x0100, NV_MEM_ACCESS_RW | NV_MEM_ACCESS_SYS);
-        mmio_data(0x060000, 0x1000, NV_MEM_ACCESS_RW);
+        mmio_data(0x200000, 0x1000, NV_MEM_ACCESS_RW);
        mmio_list(0x40800c, 0x00000000,  8, 1);
        mmio_list(0x408010, 0x80000000,  0, 0);
@@ -877,6 +877,8 @@ gm107_grctx_generate_mods(struct nvc0_graph_priv *priv, struct nvc0_grctx *info)
        mmio_list(0x418e24, 0x00000000,  8, 0);
        mmio_list(0x418e28, 0x80000030,  0, 0);
+        mmio_list(0x4064c8, 0x018002c0,  0, 0);
        mmio_list(0x418810, 0x80000000, 12, 2);
        mmio_list(0x419848, 0x10000000, 12, 2);
        mmio_list(0x419c2c, 0x10000000, 12, 2);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
index e9df94f96d78..222e8ebb669d 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
@@ -109,7 +109,7 @@ nouveau_bios_shadow_pramin(struct nouveau_bios *bios)
                        return;
                }
-                addr = (u64)(addr >> 8) << 8;
+                addr = (addr & 0xffffff00) << 8;
                if (!addr) {
                        addr  = (u64)nv_rd32(bios, 0x001700) << 16;
                        addr += 0xf0000;
@@ -168,7 +168,8 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
         */
        i = 16;
        do {
-                if ((nv_rd32(bios, 0x300000) & 0xffff) == 0xaa55)
+                u32 data = le32_to_cpu(nv_rd32(bios, 0x300000)) & 0xffff;
+                if (data == 0xaa55)
                        break;
        } while (i--);
@@ -176,14 +177,15 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
                goto out;
        /* read entire bios image to system memory */
-        bios->size = ((nv_rd32(bios, 0x300000) >> 16) & 0xff) * 512;
+        bios->size = (le32_to_cpu(nv_rd32(bios, 0x300000)) >> 16) & 0xff;
+        bios->size = bios->size * 512;
        if (!bios->size)
                goto out;
        bios->data = kmalloc(bios->size, GFP_KERNEL);
        if (bios->data) {
-                for (i = 0; i < bios->size; i+=4)
+                for (i = 0; i < bios->size; i += 4)
-                        nv_wo32(bios, i, nv_rd32(bios, 0x300000 + i));
+                        ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
        }
        /* check the PCI record header */
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c b/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c
index 43fec17ea540..bbf117be572f 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/nvd0.c
@@ -40,6 +40,7 @@ pwm_info(struct nouveau_therm *therm, int line)
                case 0x00: return 2;
                case 0x19: return 1;
                case 0x1c: return 0;
+                case 0x1e: return 2;
                default:
                        break;
                }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 83face3f608f..279206997e5c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -389,9 +389,6 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev)
        acpi_status status;
        acpi_handle dhandle, rom_handle;
-        if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
-                return false;
        dhandle = ACPI_HANDLE(&pdev->dev);
        if (!dhandle)
                return false;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 3ff030dc1ee3..da764a4ed958 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -764,9 +764,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        }
        ret = nouveau_page_flip_emit(chan, old_bo, new_bo, s, &fence);
-        mutex_unlock(&chan->cli->mutex);
        if (ret)
                goto fail_unreserve;
+        mutex_unlock(&chan->cli->mutex);
        /* Update the crtc struct and cleanup */
        crtc->primary->fb = fb;
diff --git a/drivers/gpu/drm/omapdrm/omap_crtc.c b/drivers/gpu/drm/omapdrm/omap_crtc.c
index 355157e4f78d..e3c47a8005ff 100644
--- a/drivers/gpu/drm/omapdrm/omap_crtc.c
+++ b/drivers/gpu/drm/omapdrm/omap_crtc.c
@@ -33,6 +33,7 @@ struct omap_crtc {
        int pipe;
        enum omap_channel channel;
        struct omap_overlay_manager_info info;
+        struct drm_encoder *current_encoder;
        /*
         * Temporary: eventually this will go away, but it is needed
@@ -120,13 +121,25 @@ static void omap_crtc_start_update(struct omap_overlay_manager *mgr)
 {
 }
+static void set_enabled(struct drm_crtc *crtc, bool enable);
 static int omap_crtc_enable(struct omap_overlay_manager *mgr)
 {
+        struct omap_crtc *omap_crtc = omap_crtcs[mgr->id];
+        dispc_mgr_setup(omap_crtc->channel, &omap_crtc->info);
+        dispc_mgr_set_timings(omap_crtc->channel,
+                        &omap_crtc->timings);
+        set_enabled(&omap_crtc->base, true);
        return 0;
 }
 static void omap_crtc_disable(struct omap_overlay_manager *mgr)
 {
+        struct omap_crtc *omap_crtc = omap_crtcs[mgr->id];
+        set_enabled(&omap_crtc->base, false);
 }
 static void omap_crtc_set_timings(struct omap_overlay_manager *mgr,
@@ -184,7 +197,6 @@ static void omap_crtc_destroy(struct drm_crtc *crtc)
        WARN_ON(omap_crtc->apply_irq.registered);
        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
-        omap_crtc->plane->funcs->destroy(omap_crtc->plane);
        drm_crtc_cleanup(crtc);
        kfree(omap_crtc);
@@ -338,17 +350,23 @@ static int omap_crtc_page_flip_locked(struct drm_crtc *crtc,
        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
        struct drm_plane *primary = crtc->primary;
        struct drm_gem_object *bo;
+        unsigned long flags;
        DBG("%d -> %d (event=%p)", primary->fb ? primary->fb->base.id : -1,
                        fb->base.id, event);
+        spin_lock_irqsave(&dev->event_lock, flags);
        if (omap_crtc->old_fb) {
+                spin_unlock_irqrestore(&dev->event_lock, flags);
                dev_err(dev->dev, "already a pending flip\n");
                return -EINVAL;
        }
        omap_crtc->event = event;
-        primary->fb = fb;
+        omap_crtc->old_fb = primary->fb = fb;
+        spin_unlock_irqrestore(&dev->event_lock, flags);
        /*
         * Hold a reference temporarily until the crtc is updated
@@ -528,38 +546,46 @@ static void set_enabled(struct drm_crtc *crtc, bool enable)
        struct drm_device *dev = crtc->dev;
        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
        enum omap_channel channel = omap_crtc->channel;
-        struct omap_irq_wait *wait = NULL;
+        struct omap_irq_wait *wait;
+        u32 framedone_irq, vsync_irq;
+        int ret;
        if (dispc_mgr_is_enabled(channel) == enable)
                return;
-        /* ignore sync-lost irqs during enable/disable */
+        /*
+         * Digit output produces some sync lost interrupts during the first
+         * frame when enabling, so we need to ignore those.
+         */
        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
-        if (dispc_mgr_get_framedone_irq(channel)) {
+        framedone_irq = dispc_mgr_get_framedone_irq(channel);
-                if (!enable) {
+        vsync_irq = dispc_mgr_get_vsync_irq(channel);
-                        wait = omap_irq_wait_init(dev,
-                                        dispc_mgr_get_framedone_irq(channel), 1);
+        if (enable) {
-                }
+                wait = omap_irq_wait_init(dev, vsync_irq, 1);
        } else {
                /*
-                 * When we disable digit output, we need to wait until fields
+                 * When we disable the digit output, we need to wait for
-                 * are done.  Otherwise the DSS is still working, and turning
+                 * FRAMEDONE to know that DISPC has finished with the output.
-                 * off the clocks prevents DSS from going to OFF mode. And when
+                 *
-                 * enabling, we need to wait for the extra sync losts
+                 * OMAP2/3 does not have FRAMEDONE irq for digit output, and in
+                 * that case we need to use vsync interrupt, and wait for both
+                 * even and odd frames.
                 */
-                wait = omap_irq_wait_init(dev,
-                                dispc_mgr_get_vsync_irq(channel), 2);
+                if (framedone_irq)
+                        wait = omap_irq_wait_init(dev, framedone_irq, 1);
+                else
+                        wait = omap_irq_wait_init(dev, vsync_irq, 2);
        }
        dispc_mgr_enable(channel, enable);
-        if (wait) {
+        ret = omap_irq_wait(dev, wait, msecs_to_jiffies(100));
-                int ret = omap_irq_wait(dev, wait, msecs_to_jiffies(100));
+        if (ret) {
-                if (ret) {
+                dev_err(dev->dev, "%s: timeout waiting for %s\n",
-                        dev_err(dev->dev, "%s: timeout waiting for %s\n",
+                                omap_crtc->name, enable ? "enable" : "disable");
-                                        omap_crtc->name, enable ? "enable" : "disable");
-                }
        }
        omap_irq_register(crtc->dev, &omap_crtc->error_irq);
@@ -586,8 +612,12 @@ static void omap_crtc_pre_apply(struct omap_drm_apply *apply)
                }
        }
+        if (omap_crtc->current_encoder && encoder != omap_crtc->current_encoder)
+                omap_encoder_set_enabled(omap_crtc->current_encoder, false);
+        omap_crtc->current_encoder = encoder;
        if (!omap_crtc->enabled) {
-                set_enabled(&omap_crtc->base, false);
                if (encoder)
                        omap_encoder_set_enabled(encoder, false);
        } else {
@@ -596,13 +626,7 @@ static void omap_crtc_pre_apply(struct omap_drm_apply *apply)
                        omap_encoder_update(encoder, omap_crtc->mgr,
                                        &omap_crtc->timings);
                        omap_encoder_set_enabled(encoder, true);
-                        omap_crtc->full_update = false;
                }
-                dispc_mgr_setup(omap_crtc->channel, &omap_crtc->info);
-                dispc_mgr_set_timings(omap_crtc->channel,
-                                &omap_crtc->timings);
-                set_enabled(&omap_crtc->base, true);
        }
        omap_crtc->full_update = false;
@@ -613,10 +637,30 @@ static void omap_crtc_post_apply(struct omap_drm_apply *apply)
        /* nothing needed for post-apply */
 }
+void omap_crtc_flush(struct drm_crtc *crtc)
+{
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        int loops = 0;
+        while (!list_empty(&omap_crtc->pending_applies) ||
+                !list_empty(&omap_crtc->queued_applies) ||
+                omap_crtc->event || omap_crtc->old_fb) {
+                if (++loops > 10) {
+                        dev_err(crtc->dev->dev,
+                                "omap_crtc_flush() timeout\n");
+                        break;
+                }
+                schedule_timeout_uninterruptible(msecs_to_jiffies(20));
+        }
+}
 static const char *channel_names[] = {
                [OMAP_DSS_CHANNEL_LCD] = "lcd",
                [OMAP_DSS_CHANNEL_DIGIT] = "tv",
                [OMAP_DSS_CHANNEL_LCD2] = "lcd2",
+                [OMAP_DSS_CHANNEL_LCD3] = "lcd3",
 };
 void omap_crtc_pre_init(void)
diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c
index bf39fcc49e0f..c8270e4b26f3 100644
--- a/drivers/gpu/drm/omapdrm/omap_drv.c
+++ b/drivers/gpu/drm/omapdrm/omap_drv.c
@@ -513,12 +513,18 @@ static int dev_load(struct drm_device *dev, unsigned long flags)
 static int dev_unload(struct drm_device *dev)
 {
        struct omap_drm_private *priv = dev->dev_private;
+        int i;
        DBG("unload: dev=%p", dev);
        drm_kms_helper_poll_fini(dev);
        omap_fbdev_free(dev);
+        /* flush crtcs so the fbs get released */
+        for (i = 0; i < priv->num_crtcs; i++)
+                omap_crtc_flush(priv->crtcs[i]);
        omap_modeset_free(dev);
        omap_gem_deinit(dev);
@@ -696,10 +702,11 @@ static int pdev_remove(struct platform_device *device)
 {
        DBG("");
+        drm_put_dev(platform_get_drvdata(device));
        omap_disconnect_dssdevs();
        omap_crtc_pre_uninit();
-        drm_put_dev(platform_get_drvdata(device));
        return 0;
 }
@@ -726,18 +733,33 @@ static struct platform_driver pdev = {
 static int __init omap_drm_init(void)
 {
+        int r;
        DBG("init");
-        if (platform_driver_register(&omap_dmm_driver)) {
-                /* we can continue on without DMM.. so not fatal */
+        r = platform_driver_register(&omap_dmm_driver);
-                dev_err(NULL, "DMM registration failed\n");
+        if (r) {
+                pr_err("DMM driver registration failed\n");
+                return r;
+        }
+        r = platform_driver_register(&pdev);
+        if (r) {
+                pr_err("omapdrm driver registration failed\n");
+                platform_driver_unregister(&omap_dmm_driver);
+                return r;
        }
-        return platform_driver_register(&pdev);
+        return 0;
 }
 static void __exit omap_drm_fini(void)
 {
        DBG("fini");
        platform_driver_unregister(&pdev);
+        platform_driver_unregister(&omap_dmm_driver);
 }
 /* need late_initcall() so we load after dss_driver's are loaded */
diff --git a/drivers/gpu/drm/omapdrm/omap_drv.h b/drivers/gpu/drm/omapdrm/omap_drv.h
index 428b2981fd68..284b80fc3c54 100644
--- a/drivers/gpu/drm/omapdrm/omap_drv.h
+++ b/drivers/gpu/drm/omapdrm/omap_drv.h
@@ -163,6 +163,7 @@ void omap_crtc_pre_init(void);
 void omap_crtc_pre_uninit(void);
 struct drm_crtc *omap_crtc_init(struct drm_device *dev,
                struct drm_plane *plane, enum omap_channel channel, int id);
+void omap_crtc_flush(struct drm_crtc *crtc);
 struct drm_plane *omap_plane_init(struct drm_device *dev,
                int plane_id, bool private_plane);
diff --git a/drivers/gpu/drm/omapdrm/omap_fb.c b/drivers/gpu/drm/omapdrm/omap_fb.c
index d2b8c49bfb4a..8b019602ffe6 100644
--- a/drivers/gpu/drm/omapdrm/omap_fb.c
+++ b/drivers/gpu/drm/omapdrm/omap_fb.c
@@ -218,6 +218,20 @@ void omap_framebuffer_update_scanout(struct drm_framebuffer *fb,
                info->rotation_type = OMAP_DSS_ROT_TILER;
                info->screen_width  = omap_gem_tiled_stride(plane->bo, orient);
        } else {
+                switch (win->rotation & 0xf) {
+                case 0:
+                case BIT(DRM_ROTATE_0):
+                        /* OK */
+                        break;
+                default:
+                        dev_warn(fb->dev->dev,
+                                "rotation '%d' ignored for non-tiled fb\n",
+                                win->rotation);
+                        win->rotation = 0;
+                        break;
+                }
                info->paddr         = get_linear_addr(plane, format, 0, x, y);
                info->rotation_type = OMAP_DSS_ROT_DMA;
                info->screen_width  = plane->pitch;
diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c
index 002988d09021..1388ca7f87e8 100644
--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c
+++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c
@@ -371,6 +371,9 @@ void omap_fbdev_free(struct drm_device *dev)
        fbdev = to_omap_fbdev(priv->fbdev);
+        /* release the ref taken in omap_fbdev_create() */
+        omap_gem_put_paddr(fbdev->bo);
        /* this will free the backing object */
        if (fbdev->fb) {
                drm_framebuffer_unregister_private(fbdev->fb);
diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
index c8d972763889..95dbce286a41 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -980,12 +980,9 @@ int omap_gem_resume(struct device *dev)
 #ifdef CONFIG_DEBUG_FS
 void omap_gem_describe(struct drm_gem_object *obj, struct seq_file *m)
 {
-        struct drm_device *dev = obj->dev;
        struct omap_gem_object *omap_obj = to_omap_bo(obj);
        uint64_t off;
-        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
        off = drm_vma_node_start(&obj->vma_node);
        seq_printf(m, "%08x: %2d (%2d) %08llx %08Zx (%2d) %p %4d",
@@ -1050,10 +1047,10 @@ static inline bool is_waiting(struct omap_gem_sync_waiter *waiter)
 {
        struct omap_gem_object *omap_obj = waiter->omap_obj;
        if ((waiter->op & OMAP_GEM_READ) &&
-                        (omap_obj->sync->read_complete < waiter->read_target))
+                        (omap_obj->sync->write_complete < waiter->write_target))
                return true;
        if ((waiter->op & OMAP_GEM_WRITE) &&
-                        (omap_obj->sync->write_complete < waiter->write_target))
+                        (omap_obj->sync->read_complete < waiter->read_target))
                return true;
        return false;
 }
@@ -1229,6 +1226,8 @@ int omap_gem_op_async(struct drm_gem_object *obj, enum omap_gem_op op,
                }
                spin_unlock(&sync_lock);
+                kfree(waiter);
        }
        /* no waiting.. */
diff --git a/drivers/gpu/drm/omapdrm/omap_plane.c b/drivers/gpu/drm/omapdrm/omap_plane.c
index 046d5e660c04..3cf31ee59aac 100644
--- a/drivers/gpu/drm/omapdrm/omap_plane.c
+++ b/drivers/gpu/drm/omapdrm/omap_plane.c
@@ -225,6 +225,11 @@ int omap_plane_mode_set(struct drm_plane *plane,
                omap_plane->apply_done_cb.arg = arg;
        }
+        if (plane->fb)
+                drm_framebuffer_unreference(plane->fb);
+        drm_framebuffer_reference(fb);
        plane->fb = fb;
        plane->crtc = crtc;
@@ -241,10 +246,13 @@ static int omap_plane_update(struct drm_plane *plane,
        struct omap_plane *omap_plane = to_omap_plane(plane);
        omap_plane->enabled = true;
-        if (plane->fb)
+        /* omap_plane_mode_set() takes adjusted src */
-                drm_framebuffer_unreference(plane->fb);
+        switch (omap_plane->win.rotation & 0xf) {
+        case BIT(DRM_ROTATE_90):
-        drm_framebuffer_reference(fb);
+        case BIT(DRM_ROTATE_270):
+                swap(src_w, src_h);
+                break;
+        }
        return omap_plane_mode_set(plane, crtc, fb,
                        crtc_x, crtc_y, crtc_w, crtc_h,
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index fb187c78978f..c31c12b4e666 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1177,27 +1177,43 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                /* Set NUM_BANKS. */
                if (rdev->family >= CHIP_TAHITI) {
-                        unsigned tileb, index, num_banks, tile_split_bytes;
+                        unsigned index, num_banks;
-                        /* Calculate the macrotile mode index. */
+                        if (rdev->family >= CHIP_BONAIRE) {
-                        tile_split_bytes = 64 << tile_split;
+                                unsigned tileb, tile_split_bytes;
-                        tileb = 8 * 8 * target_fb->bits_per_pixel / 8;
-                        tileb = min(tile_split_bytes, tileb);
-                        for (index = 0; tileb > 64; index++) {
+                                /* Calculate the macrotile mode index. */
-                                tileb >>= 1;
+                                tile_split_bytes = 64 << tile_split;
-                        }
+                                tileb = 8 * 8 * target_fb->bits_per_pixel / 8;
+                                tileb = min(tile_split_bytes, tileb);
-                        if (index >= 16) {
+                                for (index = 0; tileb > 64; index++)
-                                DRM_ERROR("Wrong screen bpp (%u) or tile split (%u)\n",
+                                        tileb >>= 1;
-                                          target_fb->bits_per_pixel, tile_split);
-                                return -EINVAL;
+                                if (index >= 16) {
-                        }
+                                        DRM_ERROR("Wrong screen bpp (%u) or tile split (%u)\n",
+                                                  target_fb->bits_per_pixel, tile_split);
+                                        return -EINVAL;
+                                }
-                        if (rdev->family >= CHIP_BONAIRE)
                                num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
-                        else
+                        } else {
+                                switch (target_fb->bits_per_pixel) {
+                                case 8:
+                                        index = 10;
+                                        break;
+                                case 16:
+                                        index = SI_TILE_MODE_COLOR_2D_SCANOUT_16BPP;
+                                        break;
+                                default:
+                                case 32:
+                                        index = SI_TILE_MODE_COLOR_2D_SCANOUT_32BPP;
+                                        break;
+                                }
                                num_banks = (rdev->config.si.tile_mode_array[index] >> 20) & 0x3;
+                        }
                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(num_banks);
                } else {
                        /* NI and older. */
@@ -1720,8 +1736,9 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                }
                /* otherwise, pick one of the plls */
                if ((rdev->family == CHIP_KAVERI) ||
-                    (rdev->family == CHIP_KABINI)) {
+                    (rdev->family == CHIP_KABINI) ||
-                        /* KB/KV has PPLL1 and PPLL2 */
+                    (rdev->family == CHIP_MULLINS)) {
+                        /* KB/KV/ML has PPLL1 and PPLL2 */
                        pll_in_use = radeon_get_pll_use_mask(crtc);
                        if (!(pll_in_use & (1 << ATOM_PPLL2)))
                                return ATOM_PPLL2;
@@ -1885,6 +1902,9 @@ int atombios_crtc_mode_set(struct drm_crtc *crtc,
            (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT))
                is_tvcv = true;
+        if (!radeon_crtc->adjusted_clock)
+                return -EINVAL;
        atombios_crtc_set_pll(crtc, adjusted_mode);
        if (ASIC_IS_DCE4(rdev))
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 8b0ab170cef9..54e4f52549af 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -142,7 +142,8 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
        return recv_bytes;
 }
-#define HEADER_SIZE 4
+#define BARE_ADDRESS_SIZE 3
+#define HEADER_SIZE (BARE_ADDRESS_SIZE + 1)
 static ssize_t
 radeon_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
@@ -160,13 +161,19 @@ radeon_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
        tx_buf[0] = msg->address & 0xff;
        tx_buf[1] = msg->address >> 8;
        tx_buf[2] = msg->request << 4;
-        tx_buf[3] = msg->size - 1;
+        tx_buf[3] = msg->size ? (msg->size - 1) : 0;
        switch (msg->request & ~DP_AUX_I2C_MOT) {
        case DP_AUX_NATIVE_WRITE:
        case DP_AUX_I2C_WRITE:
+                /* tx_size needs to be 4 even for bare address packets since the atom
+                 * table needs the info in tx_buf[3].
+                 */
                tx_size = HEADER_SIZE + msg->size;
-                tx_buf[3] |= tx_size << 4;
+                if (msg->size == 0)
+                        tx_buf[3] |= BARE_ADDRESS_SIZE << 4;
+                else
+                        tx_buf[3] |= tx_size << 4;
                memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size);
                ret = radeon_process_aux_ch(chan,
                                            tx_buf, tx_size, NULL, 0, delay, &ack);
@@ -176,8 +183,14 @@ radeon_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
                break;
        case DP_AUX_NATIVE_READ:
        case DP_AUX_I2C_READ:
+                /* tx_size needs to be 4 even for bare address packets since the atom
+                 * table needs the info in tx_buf[3].
+                 */
                tx_size = HEADER_SIZE;
-                tx_buf[3] |= tx_size << 4;
+                if (msg->size == 0)
+                        tx_buf[3] |= BARE_ADDRESS_SIZE << 4;
+                else
+                        tx_buf[3] |= tx_size << 4;
                ret = radeon_process_aux_ch(chan,
                                            tx_buf, tx_size, msg->buffer, msg->size, delay, &ack);
                break;
@@ -186,7 +199,7 @@ radeon_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
                break;
        }
-        if (ret > 0)
+        if (ret >= 0)
                msg->reply = ack >> 4;
        return ret;
@@ -194,98 +207,16 @@ radeon_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
 void radeon_dp_aux_init(struct radeon_connector *radeon_connector)
 {
-        struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
-        dig_connector->dp_i2c_bus->aux.dev = radeon_connector->base.kdev;
-        dig_connector->dp_i2c_bus->aux.transfer = radeon_dp_aux_transfer;
-}
-int radeon_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
-                         u8 write_byte, u8 *read_byte)
-{
-        struct i2c_algo_dp_aux_data *algo_data = adapter->algo_data;
-        struct radeon_i2c_chan *auxch = i2c_get_adapdata(adapter);
-        u16 address = algo_data->address;
-        u8 msg[5];
-        u8 reply[2];
-        unsigned retry;
-        int msg_bytes;
-        int reply_bytes = 1;
        int ret;
-        u8 ack;
-        /* Set up the address */
+        radeon_connector->ddc_bus->rec.hpd = radeon_connector->hpd.hpd;
-        msg[0] = address;
+        radeon_connector->ddc_bus->aux.dev = radeon_connector->base.kdev;
-        msg[1] = address >> 8;
+        radeon_connector->ddc_bus->aux.transfer = radeon_dp_aux_transfer;
+        ret = drm_dp_aux_register_i2c_bus(&radeon_connector->ddc_bus->aux);
+        if (!ret)
+                radeon_connector->ddc_bus->has_aux = true;
-        /* Set up the command byte */
+        WARN(ret, "drm_dp_aux_register_i2c_bus() failed with error %d\n", ret);
-        if (mode & MODE_I2C_READ) {
-                msg[2] = DP_AUX_I2C_READ << 4;
-                msg_bytes = 4;
-                msg[3] = msg_bytes << 4;
-        } else {
-                msg[2] = DP_AUX_I2C_WRITE << 4;
-                msg_bytes = 5;
-                msg[3] = msg_bytes << 4;
-                msg[4] = write_byte;
-        }
-        /* special handling for start/stop */
-        if (mode & (MODE_I2C_START | MODE_I2C_STOP))
-                msg[3] = 3 << 4;
-        /* Set MOT bit for all but stop */
-        if ((mode & MODE_I2C_STOP) == 0)
-                msg[2] |= DP_AUX_I2C_MOT << 4;
-        for (retry = 0; retry < 7; retry++) {
-                ret = radeon_process_aux_ch(auxch,
-                                            msg, msg_bytes, reply, reply_bytes, 0, &ack);
-                if (ret == -EBUSY)
-                        continue;
-                else if (ret < 0) {
-                        DRM_DEBUG_KMS("aux_ch failed %d\n", ret);
-                        return ret;
-                }
-                switch ((ack >> 4) & DP_AUX_NATIVE_REPLY_MASK) {
-                case DP_AUX_NATIVE_REPLY_ACK:
-                        /* I2C-over-AUX Reply field is only valid
-                         * when paired with AUX ACK.
-                         */
-                        break;
-                case DP_AUX_NATIVE_REPLY_NACK:
-                        DRM_DEBUG_KMS("aux_ch native nack\n");
-                        return -EREMOTEIO;
-                case DP_AUX_NATIVE_REPLY_DEFER:
-                        DRM_DEBUG_KMS("aux_ch native defer\n");
-                        usleep_range(500, 600);
-                        continue;
-                default:
-                        DRM_ERROR("aux_ch invalid native reply 0x%02x\n", ack);
-                        return -EREMOTEIO;
-                }
-                switch ((ack >> 4) & DP_AUX_I2C_REPLY_MASK) {
-                case DP_AUX_I2C_REPLY_ACK:
-                        if (mode == MODE_I2C_READ)
-                                *read_byte = reply[0];
-                        return ret;
-                case DP_AUX_I2C_REPLY_NACK:
-                        DRM_DEBUG_KMS("aux_i2c nack\n");
-                        return -EREMOTEIO;
-                case DP_AUX_I2C_REPLY_DEFER:
-                        DRM_DEBUG_KMS("aux_i2c defer\n");
-                        usleep_range(400, 500);
-                        break;
-                default:
-                        DRM_ERROR("aux_i2c invalid reply 0x%02x\n", ack);
-                        return -EREMOTEIO;
-                }
-        }
-        DRM_DEBUG_KMS("aux i2c too many retries, giving up\n");
-        return -EREMOTEIO;
 }
 /***** general DP utility functions *****/
@@ -420,12 +351,11 @@ static u8 radeon_dp_encoder_service(struct radeon_device *rdev,
 u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector)
 {
-        struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
        struct drm_device *dev = radeon_connector->base.dev;
        struct radeon_device *rdev = dev->dev_private;
        return radeon_dp_encoder_service(rdev, ATOM_DP_ACTION_GET_SINK_TYPE, 0,
-                                         dig_connector->dp_i2c_bus->rec.i2c_id, 0);
+                                         radeon_connector->ddc_bus->rec.i2c_id, 0);
 }
 static void radeon_dp_probe_oui(struct radeon_connector *radeon_connector)
@@ -436,11 +366,11 @@ static void radeon_dp_probe_oui(struct radeon_connector *radeon_connector)
        if (!(dig_connector->dpcd[DP_DOWN_STREAM_PORT_COUNT] & DP_OUI_SUPPORT))
                return;
-        if (drm_dp_dpcd_read(&dig_connector->dp_i2c_bus->aux, DP_SINK_OUI, buf, 3))
+        if (drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_SINK_OUI, buf, 3) == 3)
                DRM_DEBUG_KMS("Sink OUI: %02hx%02hx%02hx\n",
                              buf[0], buf[1], buf[2]);
-        if (drm_dp_dpcd_read(&dig_connector->dp_i2c_bus->aux, DP_BRANCH_OUI, buf, 3))
+        if (drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_BRANCH_OUI, buf, 3) == 3)
                DRM_DEBUG_KMS("Branch OUI: %02hx%02hx%02hx\n",
                              buf[0], buf[1], buf[2]);
 }
@@ -451,7 +381,7 @@ bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
        u8 msg[DP_DPCD_SIZE];
        int ret, i;
-        ret = drm_dp_dpcd_read(&dig_connector->dp_i2c_bus->aux, DP_DPCD_REV, msg,
+        ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg,
                               DP_DPCD_SIZE);
        if (ret > 0) {
                memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE);
@@ -489,21 +419,23 @@ int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
        if (dp_bridge != ENCODER_OBJECT_ID_NONE) {
                /* DP bridge chips */
-                drm_dp_dpcd_readb(&dig_connector->dp_i2c_bus->aux,
+                if (drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux,
-                                  DP_EDP_CONFIGURATION_CAP, &tmp);
+                                      DP_EDP_CONFIGURATION_CAP, &tmp) == 1) {
-                if (tmp & 1)
+                        if (tmp & 1)
-                        panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+                                panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
-                else if ((dp_bridge == ENCODER_OBJECT_ID_NUTMEG) ||
+                        else if ((dp_bridge == ENCODER_OBJECT_ID_NUTMEG) ||
-                         (dp_bridge == ENCODER_OBJECT_ID_TRAVIS))
+                                 (dp_bridge == ENCODER_OBJECT_ID_TRAVIS))
-                        panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
+                                panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
-                else
+                        else
-                        panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+                                panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+                }
        } else if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
                /* eDP */
-                drm_dp_dpcd_readb(&dig_connector->dp_i2c_bus->aux,
+                if (drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux,
-                                  DP_EDP_CONFIGURATION_CAP, &tmp);
+                                      DP_EDP_CONFIGURATION_CAP, &tmp) == 1) {
-                if (tmp & 1)
+                        if (tmp & 1)
-                        panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+                                panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+                }
        }
        return panel_mode;
@@ -554,7 +486,8 @@ bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector)
        u8 link_status[DP_LINK_STATUS_SIZE];
        struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
-        if (drm_dp_dpcd_read_link_status(&dig->dp_i2c_bus->aux, link_status) <= 0)
+        if (drm_dp_dpcd_read_link_status(&radeon_connector->ddc_bus->aux, link_status)
+            <= 0)
                return false;
        if (drm_dp_channel_eq_ok(link_status, dig->dp_lane_count))
                return false;
@@ -574,7 +507,7 @@ void radeon_dp_set_rx_power_state(struct drm_connector *connector,
        /* power up/down the sink */
        if (dig_connector->dpcd[0] >= 0x11) {
-                drm_dp_dpcd_writeb(&dig_connector->dp_i2c_bus->aux,
+                drm_dp_dpcd_writeb(&radeon_connector->ddc_bus->aux,
                                   DP_SET_POWER, power_state);
                usleep_range(1000, 2000);
        }
@@ -878,11 +811,15 @@ void radeon_dp_link_train(struct drm_encoder *encoder,
        else
                dp_info.enc_id |= ATOM_DP_CONFIG_LINK_A;
-        drm_dp_dpcd_readb(&dig_connector->dp_i2c_bus->aux, DP_MAX_LANE_COUNT, &tmp);
+        if (drm_dp_dpcd_readb(&radeon_connector->ddc_bus->aux, DP_MAX_LANE_COUNT, &tmp)
-        if (ASIC_IS_DCE5(rdev) && (tmp & DP_TPS3_SUPPORTED))
+            == 1) {
-                dp_info.tp3_supported = true;
+                if (ASIC_IS_DCE5(rdev) && (tmp & DP_TPS3_SUPPORTED))
-        else
+                        dp_info.tp3_supported = true;
+                else
+                        dp_info.tp3_supported = false;
+        } else {
                dp_info.tp3_supported = false;
+        }
        memcpy(dp_info.dpcd, dig_connector->dpcd, DP_RECEIVER_CAP_SIZE);
        dp_info.rdev = rdev;
@@ -890,7 +827,7 @@ void radeon_dp_link_train(struct drm_encoder *encoder,
        dp_info.connector = connector;
        dp_info.dp_lane_count = dig_connector->dp_lane_count;
        dp_info.dp_clock = dig_connector->dp_clock;
-        dp_info.aux = &dig_connector->dp_i2c_bus->aux;
+        dp_info.aux = &radeon_connector->ddc_bus->aux;
        if (radeon_dp_link_train_init(&dp_info))
                goto done;
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index cad89a977527..10dae4106c08 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -21,8 +21,10 @@
 *
 */
+#include <linux/firmware.h>
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_ucode.h"
 #include "cikd.h"
 #include "r600_dpm.h"
 #include "ci_dpm.h"
@@ -202,24 +204,29 @@ static void ci_initialize_powertune_defaults(struct radeon_device *rdev)
        struct ci_power_info *pi = ci_get_pi(rdev);
        switch (rdev->pdev->device) {
+        case 0x6649:
        case 0x6650:
+        case 0x6651:
        case 0x6658:
        case 0x665C:
+        case 0x665D:
        default:
                pi->powertune_defaults = &defaults_bonaire_xt;
                break;
-        case 0x6651:
-        case 0x665D:
-                pi->powertune_defaults = &defaults_bonaire_pro;
-                break;
        case 0x6640:
-                pi->powertune_defaults = &defaults_saturn_xt;
-                break;
        case 0x6641:
-                pi->powertune_defaults = &defaults_saturn_pro;
+        case 0x6646:
+        case 0x6647:
+                pi->powertune_defaults = &defaults_saturn_xt;
                break;
        case 0x67B8:
        case 0x67B0:
+                pi->powertune_defaults = &defaults_hawaii_xt;
+                break;
+        case 0x67BA:
+        case 0x67B1:
+                pi->powertune_defaults = &defaults_hawaii_pro;
+                break;
        case 0x67A0:
        case 0x67A1:
        case 0x67A2:
@@ -228,11 +235,7 @@ static void ci_initialize_powertune_defaults(struct radeon_device *rdev)
        case 0x67AA:
        case 0x67B9:
        case 0x67BE:
-                pi->powertune_defaults = &defaults_hawaii_xt;
+                pi->powertune_defaults = &defaults_bonaire_xt;
-                break;
-        case 0x67BA:
-        case 0x67B1:
-                pi->powertune_defaults = &defaults_hawaii_pro;
                break;
        }
@@ -5146,6 +5149,12 @@ int ci_dpm_init(struct radeon_device *rdev)
        pi->mclk_dpm_key_disabled = 0;
        pi->pcie_dpm_key_disabled = 0;
+        /* mclk dpm is unstable on some R7 260X cards with the old mc ucode */
+        if ((rdev->pdev->device == 0x6658) &&
+            (rdev->mc_fw->size == (BONAIRE_MC_UCODE_SIZE * 4))) {
+                pi->mclk_dpm_key_disabled = 1;
+        }
        pi->caps_sclk_ds = true;
        pi->mclk_strobe_mode_threshold = 40000;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 745143c2358f..d2fd98968085 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -38,6 +38,7 @@ MODULE_FIRMWARE("radeon/BONAIRE_me.bin");
 MODULE_FIRMWARE("radeon/BONAIRE_ce.bin");
 MODULE_FIRMWARE("radeon/BONAIRE_mec.bin");
 MODULE_FIRMWARE("radeon/BONAIRE_mc.bin");
+MODULE_FIRMWARE("radeon/BONAIRE_mc2.bin");
 MODULE_FIRMWARE("radeon/BONAIRE_rlc.bin");
 MODULE_FIRMWARE("radeon/BONAIRE_sdma.bin");
 MODULE_FIRMWARE("radeon/BONAIRE_smc.bin");
@@ -46,6 +47,7 @@ MODULE_FIRMWARE("radeon/HAWAII_me.bin");
 MODULE_FIRMWARE("radeon/HAWAII_ce.bin");
 MODULE_FIRMWARE("radeon/HAWAII_mec.bin");
 MODULE_FIRMWARE("radeon/HAWAII_mc.bin");
+MODULE_FIRMWARE("radeon/HAWAII_mc2.bin");
 MODULE_FIRMWARE("radeon/HAWAII_rlc.bin");
 MODULE_FIRMWARE("radeon/HAWAII_sdma.bin");
 MODULE_FIRMWARE("radeon/HAWAII_smc.bin");
@@ -61,6 +63,12 @@ MODULE_FIRMWARE("radeon/KABINI_ce.bin");
 MODULE_FIRMWARE("radeon/KABINI_mec.bin");
 MODULE_FIRMWARE("radeon/KABINI_rlc.bin");
 MODULE_FIRMWARE("radeon/KABINI_sdma.bin");
+MODULE_FIRMWARE("radeon/MULLINS_pfp.bin");
+MODULE_FIRMWARE("radeon/MULLINS_me.bin");
+MODULE_FIRMWARE("radeon/MULLINS_ce.bin");
+MODULE_FIRMWARE("radeon/MULLINS_mec.bin");
+MODULE_FIRMWARE("radeon/MULLINS_rlc.bin");
+MODULE_FIRMWARE("radeon/MULLINS_sdma.bin");
 extern int r600_ih_ring_alloc(struct radeon_device *rdev);
 extern void r600_ih_ring_fini(struct radeon_device *rdev);
@@ -1471,6 +1479,43 @@ static const u32 hawaii_mgcg_cgcg_init[] =
        0xd80c, 0xff000ff0, 0x00000100
 };
+static const u32 godavari_golden_registers[] =
+{
+        0x55e4, 0xff607fff, 0xfc000100,
+        0x6ed8, 0x00010101, 0x00010000,
+        0x9830, 0xffffffff, 0x00000000,
+        0x98302, 0xf00fffff, 0x00000400,
+        0x6130, 0xffffffff, 0x00010000,
+        0x5bb0, 0x000000f0, 0x00000070,
+        0x5bc0, 0xf0311fff, 0x80300000,
+        0x98f8, 0x73773777, 0x12010001,
+        0x98fc, 0xffffffff, 0x00000010,
+        0x8030, 0x00001f0f, 0x0000100a,
+        0x2f48, 0x73773777, 0x12010001,
+        0x2408, 0x000fffff, 0x000c007f,
+        0x8a14, 0xf000003f, 0x00000007,
+        0x8b24, 0xffffffff, 0x00ff0fff,
+        0x30a04, 0x0000ff0f, 0x00000000,
+        0x28a4c, 0x07ffffff, 0x06000000,
+        0x4d8, 0x00000fff, 0x00000100,
+        0xd014, 0x00010000, 0x00810001,
+        0xd814, 0x00010000, 0x00810001,
+        0x3e78, 0x00000001, 0x00000002,
+        0xc768, 0x00000008, 0x00000008,
+        0xc770, 0x00000f00, 0x00000800,
+        0xc774, 0x00000f00, 0x00000800,
+        0xc798, 0x00ffffff, 0x00ff7fbf,
+        0xc79c, 0x00ffffff, 0x00ff7faf,
+        0x8c00, 0x000000ff, 0x00000001,
+        0x214f8, 0x01ff01ff, 0x00000002,
+        0x21498, 0x007ff800, 0x00200000,
+        0x2015c, 0xffffffff, 0x00000f40,
+        0x88c4, 0x001f3ae3, 0x00000082,
+        0x88d4, 0x0000001f, 0x00000010,
+        0x30934, 0xffffffff, 0x00000000
+};
 static void cik_init_golden_registers(struct radeon_device *rdev)
 {
        switch (rdev->family) {
@@ -1502,6 +1547,20 @@ static void cik_init_golden_registers(struct radeon_device *rdev)
                                                 kalindi_golden_spm_registers,
                                                 (const u32)ARRAY_SIZE(kalindi_golden_spm_registers));
                break;
+        case CHIP_MULLINS:
+                radeon_program_register_sequence(rdev,
+                                                 kalindi_mgcg_cgcg_init,
+                                                 (const u32)ARRAY_SIZE(kalindi_mgcg_cgcg_init));
+                radeon_program_register_sequence(rdev,
+                                                 godavari_golden_registers,
+                                                 (const u32)ARRAY_SIZE(godavari_golden_registers));
+                radeon_program_register_sequence(rdev,
+                                                 kalindi_golden_common_registers,
+                                                 (const u32)ARRAY_SIZE(kalindi_golden_common_registers));
+                radeon_program_register_sequence(rdev,
+                                                 kalindi_golden_spm_registers,
+                                                 (const u32)ARRAY_SIZE(kalindi_golden_spm_registers));
+                break;
        case CHIP_KAVERI:
                radeon_program_register_sequence(rdev,
                                                 spectre_mgcg_cgcg_init,
@@ -1703,20 +1762,20 @@ int ci_mc_load_microcode(struct radeon_device *rdev)
        const __be32 *fw_data;
        u32 running, blackout = 0;
        u32 *io_mc_regs;
-        int i, ucode_size, regs_size;
+        int i, regs_size, ucode_size;
        if (!rdev->mc_fw)
                return -EINVAL;
+        ucode_size = rdev->mc_fw->size / 4;
        switch (rdev->family) {
        case CHIP_BONAIRE:
                io_mc_regs = (u32 *)&bonaire_io_mc_regs;
-                ucode_size = CIK_MC_UCODE_SIZE;
                regs_size = BONAIRE_IO_MC_REGS_SIZE;
                break;
        case CHIP_HAWAII:
                io_mc_regs = (u32 *)&hawaii_io_mc_regs;
-                ucode_size = HAWAII_MC_UCODE_SIZE;
                regs_size = HAWAII_IO_MC_REGS_SIZE;
                break;
        default:
@@ -1783,7 +1842,7 @@ static int cik_init_microcode(struct radeon_device *rdev)
        const char *chip_name;
        size_t pfp_req_size, me_req_size, ce_req_size,
                mec_req_size, rlc_req_size, mc_req_size = 0,
-                sdma_req_size, smc_req_size = 0;
+                sdma_req_size, smc_req_size = 0, mc2_req_size = 0;
        char fw_name[30];
        int err;
@@ -1797,7 +1856,8 @@ static int cik_init_microcode(struct radeon_device *rdev)
                ce_req_size = CIK_CE_UCODE_SIZE * 4;
                mec_req_size = CIK_MEC_UCODE_SIZE * 4;
                rlc_req_size = BONAIRE_RLC_UCODE_SIZE * 4;
-                mc_req_size = CIK_MC_UCODE_SIZE * 4;
+                mc_req_size = BONAIRE_MC_UCODE_SIZE * 4;
+                mc2_req_size = BONAIRE_MC2_UCODE_SIZE * 4;
                sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
                smc_req_size = ALIGN(BONAIRE_SMC_UCODE_SIZE, 4);
                break;
@@ -1809,6 +1869,7 @@ static int cik_init_microcode(struct radeon_device *rdev)
                mec_req_size = CIK_MEC_UCODE_SIZE * 4;
                rlc_req_size = BONAIRE_RLC_UCODE_SIZE * 4;
                mc_req_size = HAWAII_MC_UCODE_SIZE * 4;
+                mc2_req_size = HAWAII_MC2_UCODE_SIZE * 4;
                sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
                smc_req_size = ALIGN(HAWAII_SMC_UCODE_SIZE, 4);
                break;
@@ -1830,6 +1891,15 @@ static int cik_init_microcode(struct radeon_device *rdev)
                rlc_req_size = KB_RLC_UCODE_SIZE * 4;
                sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
                break;
+        case CHIP_MULLINS:
+                chip_name = "MULLINS";
+                pfp_req_size = CIK_PFP_UCODE_SIZE * 4;
+                me_req_size = CIK_ME_UCODE_SIZE * 4;
+                ce_req_size = CIK_CE_UCODE_SIZE * 4;
+                mec_req_size = CIK_MEC_UCODE_SIZE * 4;
+                rlc_req_size = ML_RLC_UCODE_SIZE * 4;
+                sdma_req_size = CIK_SDMA_UCODE_SIZE * 4;
+                break;
        default: BUG();
        }
@@ -1904,16 +1974,22 @@ static int cik_init_microcode(struct radeon_device *rdev)
        /* No SMC, MC ucode on APUs */
        if (!(rdev->flags & RADEON_IS_IGP)) {
-                snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
+                snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc2.bin", chip_name);
                err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
-                if (err)
+                if (err) {
-                        goto out;
+                        snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
-                if (rdev->mc_fw->size != mc_req_size) {
+                        err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
+                        if (err)
+                                goto out;
+                }
+                if ((rdev->mc_fw->size != mc_req_size) &&
+                    (rdev->mc_fw->size != mc2_req_size)){
                        printk(KERN_ERR
                               "cik_mc: Bogus length %zu in firmware \"%s\"\n",
                               rdev->mc_fw->size, fw_name);
                        err = -EINVAL;
                }
+                DRM_INFO("%s: %zu bytes\n", fw_name, rdev->mc_fw->size);
                snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
                err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
@@ -3262,6 +3338,7 @@ static void cik_gpu_init(struct radeon_device *rdev)
                gb_addr_config = BONAIRE_GB_ADDR_CONFIG_GOLDEN;
                break;
        case CHIP_KABINI:
+        case CHIP_MULLINS:
        default:
                rdev->config.cik.max_shader_engines = 1;
                rdev->config.cik.max_tile_pipes = 2;
@@ -3692,6 +3769,7 @@ int cik_copy_cpdma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
@@ -5790,6 +5868,9 @@ static int cik_rlc_resume(struct radeon_device *rdev)
        case CHIP_KABINI:
                size = KB_RLC_UCODE_SIZE;
                break;
+        case CHIP_MULLINS:
+                size = ML_RLC_UCODE_SIZE;
+                break;
        }
        cik_rlc_stop(rdev);
@@ -6538,6 +6619,7 @@ void cik_get_csb_buffer(struct radeon_device *rdev, volatile u32 *buffer)
                buffer[count++] = cpu_to_le32(0x00000000);
                break;
        case CHIP_KABINI:
+        case CHIP_MULLINS:
                buffer[count++] = cpu_to_le32(0x00000000); /* XXX */
                buffer[count++] = cpu_to_le32(0x00000000);
                break;
@@ -6683,6 +6765,19 @@ static void cik_disable_interrupt_state(struct radeon_device *rdev)
                WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC4_REGISTER_OFFSET, 0);
                WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, 0);
        }
+        /* pflip */
+        if (rdev->num_crtc >= 2) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
+        }
+        if (rdev->num_crtc >= 4) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, 0);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, 0);
+        }
+        if (rdev->num_crtc >= 6) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, 0);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, 0);
+        }
        /* dac hotplug */
        WREG32(DAC_AUTODETECT_INT_CONTROL, 0);
@@ -7039,6 +7134,25 @@ int cik_irq_set(struct radeon_device *rdev)
                WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, crtc6);
        }
+        if (rdev->num_crtc >= 2) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+        }
+        if (rdev->num_crtc >= 4) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+        }
+        if (rdev->num_crtc >= 6) {
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
+        }
        WREG32(DC_HPD1_INT_CONTROL, hpd1);
        WREG32(DC_HPD2_INT_CONTROL, hpd2);
        WREG32(DC_HPD3_INT_CONTROL, hpd3);
@@ -7075,6 +7189,29 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
        rdev->irq.stat_regs.cik.disp_int_cont5 = RREG32(DISP_INTERRUPT_STATUS_CONTINUE5);
        rdev->irq.stat_regs.cik.disp_int_cont6 = RREG32(DISP_INTERRUPT_STATUS_CONTINUE6);
+        rdev->irq.stat_regs.cik.d1grph_int = RREG32(GRPH_INT_STATUS +
+                EVERGREEN_CRTC0_REGISTER_OFFSET);
+        rdev->irq.stat_regs.cik.d2grph_int = RREG32(GRPH_INT_STATUS +
+                EVERGREEN_CRTC1_REGISTER_OFFSET);
+        if (rdev->num_crtc >= 4) {
+                rdev->irq.stat_regs.cik.d3grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC2_REGISTER_OFFSET);
+                rdev->irq.stat_regs.cik.d4grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC3_REGISTER_OFFSET);
+        }
+        if (rdev->num_crtc >= 6) {
+                rdev->irq.stat_regs.cik.d5grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC4_REGISTER_OFFSET);
+                rdev->irq.stat_regs.cik.d6grph_int = RREG32(GRPH_INT_STATUS +
+                        EVERGREEN_CRTC5_REGISTER_OFFSET);
+        }
+        if (rdev->irq.stat_regs.cik.d1grph_int & GRPH_PFLIP_INT_OCCURRED)
+                WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC0_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_CLEAR);
+        if (rdev->irq.stat_regs.cik.d2grph_int & GRPH_PFLIP_INT_OCCURRED)
+                WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC1_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_CLEAR);
        if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT)
                WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC0_REGISTER_OFFSET, VBLANK_ACK);
        if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT)
@@ -7085,6 +7222,12 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                WREG32(LB_VLINE_STATUS + EVERGREEN_CRTC1_REGISTER_OFFSET, VLINE_ACK);
        if (rdev->num_crtc >= 4) {
+                if (rdev->irq.stat_regs.cik.d3grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC2_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
+                if (rdev->irq.stat_regs.cik.d4grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
                if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT)
                        WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC2_REGISTER_OFFSET, VBLANK_ACK);
                if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT)
@@ -7096,6 +7239,12 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
        }
        if (rdev->num_crtc >= 6) {
+                if (rdev->irq.stat_regs.cik.d5grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC4_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
+                if (rdev->irq.stat_regs.cik.d6grph_int & GRPH_PFLIP_INT_OCCURRED)
+                        WREG32(GRPH_INT_STATUS + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                               GRPH_PFLIP_INT_CLEAR);
                if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT)
                        WREG32(LB_VBLANK_STATUS + EVERGREEN_CRTC4_REGISTER_OFFSET, VBLANK_ACK);
                if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT)
@@ -7447,6 +7596,15 @@ restart_ih:
                                break;
                        }
                        break;
+                case 8: /* D1 page flip */
+                case 10: /* D2 page flip */
+                case 12: /* D3 page flip */
+                case 14: /* D4 page flip */
+                case 16: /* D5 page flip */
+                case 18: /* D6 page flip */
+                        DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
+                        radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
+                        break;
                case 42: /* HPD hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 89b4afa5041c..72e464c79a88 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -562,6 +562,7 @@ int cik_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
@@ -597,7 +598,7 @@ int cik_sdma_ring_test(struct radeon_device *rdev,
        tmp = 0xCAFEDEAD;
        writel(tmp, ptr);
-        r = radeon_ring_lock(rdev, ring, 4);
+        r = radeon_ring_lock(rdev, ring, 5);
        if (r) {
                DRM_ERROR("radeon: dma failed to lock ring %d (%d).\n", ring->idx, r);
                return r;
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index 213873270d5f..dd7926394a8f 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -888,6 +888,15 @@
 #       define DC_HPD6_RX_INTERRUPT                     (1 << 18)
 #define DISP_INTERRUPT_STATUS_CONTINUE6                 0x6780
+/* 0x6858, 0x7458, 0x10058, 0x10c58, 0x11858, 0x12458 */
+#define GRPH_INT_STATUS                                 0x6858
+#       define GRPH_PFLIP_INT_OCCURRED                  (1 << 0)
+#       define GRPH_PFLIP_INT_CLEAR                     (1 << 8)
+/* 0x685c, 0x745c, 0x1005c, 0x10c5c, 0x1185c, 0x1245c */
+#define GRPH_INT_CONTROL                                0x685c
+#       define GRPH_PFLIP_INT_MASK                      (1 << 0)
+#       define GRPH_PFLIP_INT_TYPE                      (1 << 8)
 #define DAC_AUTODETECT_INT_CONTROL                      0x67c8
 #define DC_HPD1_INT_STATUS                              0x601c
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 94e858751994..0a65dc7e93e7 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -309,11 +309,17 @@ int dce6_audio_init(struct radeon_device *rdev)
        rdev->audio.enabled = true;
-        if (ASIC_IS_DCE8(rdev))
+        if (ASIC_IS_DCE81(rdev)) /* KV: 4 streams, 7 endpoints */
+                rdev->audio.num_pins = 7;
+        else if (ASIC_IS_DCE83(rdev)) /* KB: 2 streams, 3 endpoints */
+                rdev->audio.num_pins = 3;
+        else if (ASIC_IS_DCE8(rdev)) /* BN/HW: 6 streams, 7 endpoints */
+                rdev->audio.num_pins = 7;
+        else if (ASIC_IS_DCE61(rdev)) /* TN: 4 streams, 6 endpoints */
                rdev->audio.num_pins = 6;
-        else if (ASIC_IS_DCE61(rdev))
+        else if (ASIC_IS_DCE64(rdev)) /* OL: 2 streams, 2 endpoints */
-                rdev->audio.num_pins = 4;
+                rdev->audio.num_pins = 2;
-        else
+        else /* SI: 6 streams, 6 endpoints */
                rdev->audio.num_pins = 6;
        for (i = 0; i < rdev->audio.num_pins; i++) {
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index b406546440da..0f7a51a3694f 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -4371,7 +4371,6 @@ int evergreen_irq_set(struct radeon_device *rdev)
        u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
        u32 hpd1, hpd2, hpd3, hpd4, hpd5, hpd6;
        u32 grbm_int_cntl = 0;
-        u32 grph1 = 0, grph2 = 0, grph3 = 0, grph4 = 0, grph5 = 0, grph6 = 0;
        u32 afmt1 = 0, afmt2 = 0, afmt3 = 0, afmt4 = 0, afmt5 = 0, afmt6 = 0;
        u32 dma_cntl, dma_cntl1 = 0;
        u32 thermal_int = 0;
@@ -4554,15 +4553,21 @@ int evergreen_irq_set(struct radeon_device *rdev)
                WREG32(INT_MASK + EVERGREEN_CRTC5_REGISTER_OFFSET, crtc6);
        }
-        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, grph1);
+        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
-        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, grph2);
+               GRPH_PFLIP_INT_MASK);
+        WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
+               GRPH_PFLIP_INT_MASK);
        if (rdev->num_crtc >= 4) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, grph3);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, grph4);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (rdev->num_crtc >= 6) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, grph5);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, grph6);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        WREG32(DC_HPD1_INT_CONTROL, hpd1);
@@ -4951,6 +4956,15 @@ restart_ih:
                                break;
                        }
                        break;
+                case 8: /* D1 page flip */
+                case 10: /* D2 page flip */
+                case 12: /* D3 page flip */
+                case 14: /* D4 page flip */
+                case 16: /* D5 page flip */
+                case 18: /* D6 page flip */
+                        DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
+                        radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
+                        break;
                case 42: /* HPD hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/evergreen_dma.c b/drivers/gpu/drm/radeon/evergreen_dma.c
index 287fe966d7de..478caefe0fef 100644
--- a/drivers/gpu/drm/radeon/evergreen_dma.c
+++ b/drivers/gpu/drm/radeon/evergreen_dma.c
@@ -151,6 +151,7 @@ int evergreen_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 16ec9d56a234..3f6e817d97ee 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -546,6 +546,52 @@ static int kv_set_divider_value(struct radeon_device *rdev,
        return 0;
 }
+static u32 kv_convert_vid2_to_vid7(struct radeon_device *rdev,
+                                   struct sumo_vid_mapping_table *vid_mapping_table,
+                                   u32 vid_2bit)
+{
+        struct radeon_clock_voltage_dependency_table *vddc_sclk_table =
+                &rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
+        u32 i;
+        if (vddc_sclk_table && vddc_sclk_table->count) {
+                if (vid_2bit < vddc_sclk_table->count)
+                        return vddc_sclk_table->entries[vid_2bit].v;
+                else
+                        return vddc_sclk_table->entries[vddc_sclk_table->count - 1].v;
+        } else {
+                for (i = 0; i < vid_mapping_table->num_entries; i++) {
+                        if (vid_mapping_table->entries[i].vid_2bit == vid_2bit)
+                                return vid_mapping_table->entries[i].vid_7bit;
+                }
+                return vid_mapping_table->entries[vid_mapping_table->num_entries - 1].vid_7bit;
+        }
+}
+static u32 kv_convert_vid7_to_vid2(struct radeon_device *rdev,
+                                   struct sumo_vid_mapping_table *vid_mapping_table,
+                                   u32 vid_7bit)
+{
+        struct radeon_clock_voltage_dependency_table *vddc_sclk_table =
+                &rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
+        u32 i;
+        if (vddc_sclk_table && vddc_sclk_table->count) {
+                for (i = 0; i < vddc_sclk_table->count; i++) {
+                        if (vddc_sclk_table->entries[i].v == vid_7bit)
+                                return i;
+                }
+                return vddc_sclk_table->count - 1;
+        } else {
+                for (i = 0; i < vid_mapping_table->num_entries; i++) {
+                        if (vid_mapping_table->entries[i].vid_7bit == vid_7bit)
+                                return vid_mapping_table->entries[i].vid_2bit;
+                }
+                return vid_mapping_table->entries[vid_mapping_table->num_entries - 1].vid_2bit;
+        }
+}
 static u16 kv_convert_8bit_index_to_voltage(struct radeon_device *rdev,
                                            u16 voltage)
 {
@@ -556,9 +602,9 @@ static u16 kv_convert_2bit_index_to_voltage(struct radeon_device *rdev,
                                            u32 vid_2bit)
 {
        struct kv_power_info *pi = kv_get_pi(rdev);
-        u32 vid_8bit = sumo_convert_vid2_to_vid7(rdev,
+        u32 vid_8bit = kv_convert_vid2_to_vid7(rdev,
-                                                 &pi->sys_info.vid_mapping_table,
+                                               &pi->sys_info.vid_mapping_table,
-                                                 vid_2bit);
+                                               vid_2bit);
        return kv_convert_8bit_index_to_voltage(rdev, (u16)vid_8bit);
 }
@@ -639,7 +685,7 @@ static int kv_force_lowest_valid(struct radeon_device *rdev)
 static int kv_unforce_levels(struct radeon_device *rdev)
 {
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return kv_notify_message_to_smu(rdev, PPSMC_MSG_NoForcedLevel);
        else
                return kv_set_enabled_levels(rdev);
@@ -1362,13 +1408,20 @@ static int kv_update_uvd_dpm(struct radeon_device *rdev, bool gate)
        struct radeon_uvd_clock_voltage_dependency_table *table =
                &rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table;
        int ret;
+        u32 mask;
        if (!gate) {
-                if (!pi->caps_uvd_dpm || table->count || pi->caps_stable_p_state)
+                if (table->count)
                        pi->uvd_boot_level = table->count - 1;
                else
                        pi->uvd_boot_level = 0;
+                if (!pi->caps_uvd_dpm || pi->caps_stable_p_state) {
+                        mask = 1 << pi->uvd_boot_level;
+                } else {
+                        mask = 0x1f;
+                }
                ret = kv_copy_bytes_to_smc(rdev,
                                           pi->dpm_table_start +
                                           offsetof(SMU7_Fusion_DpmTable, UvdBootLevel),
@@ -1377,11 +1430,9 @@ static int kv_update_uvd_dpm(struct radeon_device *rdev, bool gate)
                if (ret)
                        return ret;
-                if (!pi->caps_uvd_dpm ||
+                kv_send_msg_to_smc_with_parameter(rdev,
-                    pi->caps_stable_p_state)
+                                                  PPSMC_MSG_UVDDPM_SetEnabledMask,
-                        kv_send_msg_to_smc_with_parameter(rdev,
+                                                  mask);
-                                                          PPSMC_MSG_UVDDPM_SetEnabledMask,
-                                                          (1 << pi->uvd_boot_level));
        }
        return kv_enable_uvd_dpm(rdev, !gate);
@@ -1617,7 +1668,7 @@ static void kv_dpm_powergate_acp(struct radeon_device *rdev, bool gate)
        if (pi->acp_power_gated == gate)
                return;
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return;
        pi->acp_power_gated = gate;
@@ -1786,7 +1837,7 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                }
        }
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                if (pi->enable_dpm) {
                        kv_set_valid_clock_range(rdev, new_ps);
                        kv_update_dfs_bypass_settings(rdev, new_ps);
@@ -1812,6 +1863,8 @@ int kv_dpm_set_power_state(struct radeon_device *rdev)
                                return ret;
                        }
                        kv_update_sclk_t(rdev);
+                        if (rdev->family == CHIP_MULLINS)
+                                kv_enable_nb_dpm(rdev);
                }
        } else {
                if (pi->enable_dpm) {
@@ -1862,7 +1915,7 @@ void kv_dpm_reset_asic(struct radeon_device *rdev)
 {
        struct kv_power_info *pi = kv_get_pi(rdev);
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                kv_force_lowest_valid(rdev);
                kv_init_graphics_levels(rdev);
                kv_program_bootup_state(rdev);
@@ -1901,14 +1954,41 @@ static void kv_construct_max_power_limits_table(struct radeon_device *rdev,
 static void kv_patch_voltage_values(struct radeon_device *rdev)
 {
        int i;
-        struct radeon_uvd_clock_voltage_dependency_table *table =
+        struct radeon_uvd_clock_voltage_dependency_table *uvd_table =
                &rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table;
+        struct radeon_vce_clock_voltage_dependency_table *vce_table =
+                &rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table;
+        struct radeon_clock_voltage_dependency_table *samu_table =
+                &rdev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table;
+        struct radeon_clock_voltage_dependency_table *acp_table =
+                &rdev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table;
-        if (table->count) {
+        if (uvd_table->count) {
-                for (i = 0; i < table->count; i++)
+                for (i = 0; i < uvd_table->count; i++)
-                        table->entries[i].v =
+                        uvd_table->entries[i].v =
                                kv_convert_8bit_index_to_voltage(rdev,
-                                                                 table->entries[i].v);
+                                                                 uvd_table->entries[i].v);
+        }
+        if (vce_table->count) {
+                for (i = 0; i < vce_table->count; i++)
+                        vce_table->entries[i].v =
+                                kv_convert_8bit_index_to_voltage(rdev,
+                                                                 vce_table->entries[i].v);
+        }
+        if (samu_table->count) {
+                for (i = 0; i < samu_table->count; i++)
+                        samu_table->entries[i].v =
+                                kv_convert_8bit_index_to_voltage(rdev,
+                                                                 samu_table->entries[i].v);
+        }
+        if (acp_table->count) {
+                for (i = 0; i < acp_table->count; i++)
+                        acp_table->entries[i].v =
+                                kv_convert_8bit_index_to_voltage(rdev,
+                                                                 acp_table->entries[i].v);
        }
 }
@@ -1941,7 +2021,7 @@ static int kv_force_dpm_highest(struct radeon_device *rdev)
                        break;
        }
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
        else
                return kv_set_enabled_level(rdev, i);
@@ -1961,7 +2041,7 @@ static int kv_force_dpm_lowest(struct radeon_device *rdev)
                        break;
        }
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return kv_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_DPM_ForceState, i);
        else
                return kv_set_enabled_level(rdev, i);
@@ -2118,7 +2198,7 @@ static void kv_apply_state_adjust_rules(struct radeon_device *rdev,
        else
                pi->battery_state = false;
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                ps->dpm0_pg_nb_ps_lo = 0x1;
                ps->dpm0_pg_nb_ps_hi = 0x0;
                ps->dpmx_nb_ps_lo = 0x1;
@@ -2179,7 +2259,7 @@ static int kv_calculate_nbps_level_settings(struct radeon_device *rdev)
        if (pi->lowest_valid > pi->highest_valid)
                return -EINVAL;
-        if (rdev->family == CHIP_KABINI) {
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS) {
                for (i = pi->lowest_valid; i <= pi->highest_valid; i++) {
                        pi->graphics_level[i].GnbSlow = 1;
                        pi->graphics_level[i].ForceNbPs1 = 0;
@@ -2253,9 +2333,9 @@ static void kv_init_graphics_levels(struct radeon_device *rdev)
                                break;
                        kv_set_divider_value(rdev, i, table->entries[i].clk);
-                        vid_2bit = sumo_convert_vid7_to_vid2(rdev,
+                        vid_2bit = kv_convert_vid7_to_vid2(rdev,
-                                                             &pi->sys_info.vid_mapping_table,
+                                                           &pi->sys_info.vid_mapping_table,
-                                                             table->entries[i].v);
+                                                           table->entries[i].v);
                        kv_set_vid(rdev, i, vid_2bit);
                        kv_set_at(rdev, i, pi->at[i]);
                        kv_dpm_power_level_enabled_for_throttle(rdev, i, true);
@@ -2324,7 +2404,7 @@ static void kv_program_nbps_index_settings(struct radeon_device *rdev,
        struct kv_power_info *pi = kv_get_pi(rdev);
        u32 nbdpmconfig1;
-        if (rdev->family == CHIP_KABINI)
+        if (rdev->family == CHIP_KABINI || rdev->family == CHIP_MULLINS)
                return;
        if (pi->sys_info.nb_dpm_enable) {
@@ -2631,9 +2711,6 @@ int kv_dpm_init(struct radeon_device *rdev)
        pi->sram_end = SMC_RAM_END;
-        if (rdev->family == CHIP_KABINI)
-                pi->high_voltage_t = 4001;
        pi->enable_nb_dpm = true;
        pi->caps_power_containment = true;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 6e887d004eba..bbc189fd3ddc 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2839,6 +2839,7 @@ int r600_copy_cpdma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
@@ -3505,7 +3506,6 @@ int r600_irq_set(struct radeon_device *rdev)
        u32 hpd1, hpd2, hpd3, hpd4 = 0, hpd5 = 0, hpd6 = 0;
        u32 grbm_int_cntl = 0;
        u32 hdmi0, hdmi1;
-        u32 d1grph = 0, d2grph = 0;
        u32 dma_cntl;
        u32 thermal_int = 0;
@@ -3614,8 +3614,8 @@ int r600_irq_set(struct radeon_device *rdev)
        WREG32(CP_INT_CNTL, cp_int_cntl);
        WREG32(DMA_CNTL, dma_cntl);
        WREG32(DxMODE_INT_MASK, mode_int);
-        WREG32(D1GRPH_INTERRUPT_CONTROL, d1grph);
+        WREG32(D1GRPH_INTERRUPT_CONTROL, DxGRPH_PFLIP_INT_MASK);
-        WREG32(D2GRPH_INTERRUPT_CONTROL, d2grph);
+        WREG32(D2GRPH_INTERRUPT_CONTROL, DxGRPH_PFLIP_INT_MASK);
        WREG32(GRBM_INT_CNTL, grbm_int_cntl);
        if (ASIC_IS_DCE3(rdev)) {
                WREG32(DC_HPD1_INT_CONTROL, hpd1);
@@ -3918,6 +3918,14 @@ restart_ih:
                                break;
                        }
                        break;
+                case 9: /* D1 pflip */
+                        DRM_DEBUG("IH: D1 flip\n");
+                        radeon_crtc_handle_flip(rdev, 0);
+                        break;
+                case 11: /* D2 pflip */
+                        DRM_DEBUG("IH: D2 flip\n");
+                        radeon_crtc_handle_flip(rdev, 1);
+                        break;
                case 19: /* HPD/DAC hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index 53fcb28f5578..4969cef44a19 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -489,6 +489,7 @@ int r600_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index cbf7e3269f84..9c61b74ef441 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -158,16 +158,18 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
        u32 line_time_us, vblank_lines;
        u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                radeon_crtc = to_radeon_crtc(crtc);
+                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
+                        if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-                                radeon_crtc->hw_mode.clock;
+                                line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
-                        vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
+                                        radeon_crtc->hw_mode.clock;
-                                radeon_crtc->hw_mode.crtc_vdisplay +
+                                vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
-                                (radeon_crtc->v_border * 2);
+                                        radeon_crtc->hw_mode.crtc_vdisplay +
-                        vblank_time_us = vblank_lines * line_time_us;
+                                        (radeon_crtc->v_border * 2);
-                        break;
+                                vblank_time_us = vblank_lines * line_time_us;
+                                break;
+                        }
                }
        }
@@ -181,14 +183,15 @@ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
        struct radeon_crtc *radeon_crtc;
        u32 vrefresh = 0;
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                radeon_crtc = to_radeon_crtc(crtc);
+                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        vrefresh = radeon_crtc->hw_mode.vrefresh;
+                        if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-                        break;
+                                vrefresh = radeon_crtc->hw_mode.vrefresh;
+                                break;
+                        }
                }
        }
        return vrefresh;
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index f21db7a0b34d..8149e7cf4303 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -730,6 +730,12 @@ struct cik_irq_stat_regs {
        u32 disp_int_cont4;
        u32 disp_int_cont5;
        u32 disp_int_cont6;
+        u32 d1grph_int;
+        u32 d2grph_int;
+        u32 d3grph_int;
+        u32 d4grph_int;
+        u32 d5grph_int;
+        u32 d6grph_int;
 };
 union radeon_irq_stat_regs {
@@ -739,7 +745,7 @@ union radeon_irq_stat_regs {
        struct cik_irq_stat_regs cik;
 };
-#define RADEON_MAX_HPD_PINS 6
+#define RADEON_MAX_HPD_PINS 7
 #define RADEON_MAX_CRTCS 6
 #define RADEON_MAX_AFMT_BLOCKS 7
@@ -1636,6 +1642,7 @@ struct radeon_vce {
        unsigned                fb_version;
        atomic_t                handles[RADEON_MAX_VCE_HANDLES];
        struct drm_file         *filp[RADEON_MAX_VCE_HANDLES];
+        unsigned                img_size[RADEON_MAX_VCE_HANDLES];
        struct delayed_work     idle_work;
 };
@@ -1649,7 +1656,7 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
                               uint32_t handle, struct radeon_fence **fence);
 void radeon_vce_free_handles(struct radeon_device *rdev, struct drm_file *filp);
 void radeon_vce_note_usage(struct radeon_device *rdev);
-int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi);
+int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi, unsigned size);
 int radeon_vce_cs_parse(struct radeon_cs_parser *p);
 bool radeon_vce_semaphore_emit(struct radeon_device *rdev,
                               struct radeon_ring *ring,
@@ -2321,6 +2328,7 @@ struct radeon_device {
        bool have_disp_power_ref;
 };
+bool radeon_is_px(struct drm_device *dev);
 int radeon_device_init(struct radeon_device *rdev,
                       struct drm_device *ddev,
                       struct pci_dev *pdev,
@@ -2631,6 +2639,10 @@ void r100_pll_errata_after_index(struct radeon_device *rdev);
 #define ASIC_IS_DCE64(rdev) ((rdev->family == CHIP_OLAND))
 #define ASIC_IS_NODCE(rdev) ((rdev->family == CHIP_HAINAN))
 #define ASIC_IS_DCE8(rdev) ((rdev->family >= CHIP_BONAIRE))
+#define ASIC_IS_DCE81(rdev) ((rdev->family == CHIP_KAVERI))
+#define ASIC_IS_DCE82(rdev) ((rdev->family == CHIP_BONAIRE))
+#define ASIC_IS_DCE83(rdev) ((rdev->family == CHIP_KABINI) || \
+                             (rdev->family == CHIP_MULLINS))
 #define ASIC_IS_LOMBOK(rdev) ((rdev->ddev->pdev->device == 0x6849) || \
                              (rdev->ddev->pdev->device == 0x6850) || \
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index b8a24a75d4ff..be20e62dac83 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -2516,6 +2516,7 @@ int radeon_asic_init(struct radeon_device *rdev)
                break;
        case CHIP_KAVERI:
        case CHIP_KABINI:
+        case CHIP_MULLINS:
                rdev->asic = &kv_asic;
                /* set num crtcs */
                if (rdev->family == CHIP_KAVERI) {
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index fa9a9c02751e..a9fb0d016d38 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -59,7 +59,7 @@ struct atpx_mux {
        u16 mux;
 } __packed;
-bool radeon_is_px(void) {
+bool radeon_has_atpx(void) {
        return radeon_atpx_priv.atpx_detected;
 }
@@ -528,6 +528,13 @@ static bool radeon_atpx_detect(void)
                has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
        }
+        /* some newer PX laptops mark the dGPU as a non-VGA display device */
+        while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
+                vga_count++;
+                has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
+        }
        if (has_atpx && vga_count == 2) {
                acpi_get_name(radeon_atpx_priv.atpx.handle, ACPI_FULL_PATHNAME, &buffer);
                printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index b3633d9a5317..9ab30976287d 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -196,6 +196,20 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
                }
        }
+        if (!found) {
+                while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
+                        dhandle = ACPI_HANDLE(&pdev->dev);
+                        if (!dhandle)
+                                continue;
+                        status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
+                        if (!ACPI_FAILURE(status)) {
+                                found = true;
+                                break;
+                        }
+                }
+        }
        if (!found)
                return false;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index c566b486ca08..ea50e0ae7bf7 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1261,21 +1261,6 @@ static const struct drm_connector_funcs radeon_dvi_connector_funcs = {
        .force = radeon_dvi_force,
 };
-static void radeon_dp_connector_destroy(struct drm_connector *connector)
-{
-        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
-        struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
-        if (radeon_connector->edid)
-                kfree(radeon_connector->edid);
-        if (radeon_dig_connector->dp_i2c_bus)
-                radeon_i2c_destroy(radeon_dig_connector->dp_i2c_bus);
-        kfree(radeon_connector->con_priv);
-        drm_sysfs_connector_remove(connector);
-        drm_connector_cleanup(connector);
-        kfree(connector);
-}
 static int radeon_dp_get_modes(struct drm_connector *connector)
 {
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
@@ -1553,7 +1538,7 @@ static const struct drm_connector_funcs radeon_dp_connector_funcs = {
        .detect = radeon_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = radeon_connector_set_property,
-        .destroy = radeon_dp_connector_destroy,
+        .destroy = radeon_connector_destroy,
        .force = radeon_dvi_force,
 };
@@ -1562,7 +1547,7 @@ static const struct drm_connector_funcs radeon_edp_connector_funcs = {
        .detect = radeon_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = radeon_lvds_set_property,
-        .destroy = radeon_dp_connector_destroy,
+        .destroy = radeon_connector_destroy,
        .force = radeon_dvi_force,
 };
@@ -1571,7 +1556,7 @@ static const struct drm_connector_funcs radeon_lvds_bridge_connector_funcs = {
        .detect = radeon_dp_detect,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .set_property = radeon_lvds_set_property,
-        .destroy = radeon_dp_connector_destroy,
+        .destroy = radeon_connector_destroy,
        .force = radeon_dvi_force,
 };
@@ -1668,17 +1653,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                radeon_dig_connector->igp_lane_info = igp_lane_info;
                radeon_connector->con_priv = radeon_dig_connector;
                if (i2c_bus->valid) {
-                        /* add DP i2c bus */
+                        radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
-                        if (connector_type == DRM_MODE_CONNECTOR_eDP)
+                        if (radeon_connector->ddc_bus)
-                                radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "eDP-auxch");
-                        else
-                                radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "DP-auxch");
-                        if (radeon_dig_connector->dp_i2c_bus)
                                has_aux = true;
                        else
-                                DRM_ERROR("DP: Failed to assign dp ddc bus! Check dmesg for i2c errors.\n");
-                        radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
-                        if (!radeon_connector->ddc_bus)
                                DRM_ERROR("DP: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                }
                switch (connector_type) {
@@ -1893,10 +1871,6 @@ radeon_add_atom_connector(struct drm_device *dev,
                        drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
                        drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
                        if (i2c_bus->valid) {
-                                /* add DP i2c bus */
-                                radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "DP-auxch");
-                                if (!radeon_dig_connector->dp_i2c_bus)
-                                        DRM_ERROR("DP: Failed to assign dp ddc bus! Check dmesg for i2c errors.\n");
                                radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                                if (radeon_connector->ddc_bus)
                                        has_aux = true;
@@ -1942,14 +1916,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                        drm_connector_init(dev, &radeon_connector->base, &radeon_edp_connector_funcs, connector_type);
                        drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
                        if (i2c_bus->valid) {
-                                /* add DP i2c bus */
+                                radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
-                                radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "eDP-auxch");
+                                if (radeon_connector->ddc_bus)
-                                if (radeon_dig_connector->dp_i2c_bus)
                                        has_aux = true;
                                else
-                                        DRM_ERROR("DP: Failed to assign dp ddc bus! Check dmesg for i2c errors.\n");
-                                radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
-                                if (!radeon_connector->ddc_bus)
                                        DRM_ERROR("DP: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                        }
                        drm_object_attach_property(&radeon_connector->base.base,
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 2b6e0ebcc13a..41ecf8a60611 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -152,6 +152,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                        uint32_t domain = r->write_domain ?
                                r->write_domain : r->read_domains;
+                        if (domain & RADEON_GEM_DOMAIN_CPU) {
+                                DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid "
+                                          "for command submission\n");
+                                return -EINVAL;
+                        }
                        p->relocs[i].domain = domain;
                        if (domain == RADEON_GEM_DOMAIN_VRAM)
                                domain |= RADEON_GEM_DOMAIN_GTT;
@@ -342,10 +348,17 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                        return -EINVAL;
                /* we only support VM on some SI+ rings */
-                if ((p->rdev->asic->ring[p->ring]->cs_parse == NULL) &&
+                if ((p->cs_flags & RADEON_CS_USE_VM) == 0) {
-                   ((p->cs_flags & RADEON_CS_USE_VM) == 0)) {
+                        if (p->rdev->asic->ring[p->ring]->cs_parse == NULL) {
-                        DRM_ERROR("Ring %d requires VM!\n", p->ring);
+                                DRM_ERROR("Ring %d requires VM!\n", p->ring);
-                        return -EINVAL;
+                                return -EINVAL;
+                        }
+                } else {
+                        if (p->rdev->asic->ring[p->ring]->ib_parse == NULL) {
+                                DRM_ERROR("VM not supported on ring %d!\n",
+                                          p->ring);
+                                return -EINVAL;
+                        }
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 835516d2d257..14671406212f 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -99,14 +99,18 @@ static const char radeon_family_name[][16] = {
        "KAVERI",
        "KABINI",
        "HAWAII",
+        "MULLINS",
        "LAST",
 };
-#if defined(CONFIG_VGA_SWITCHEROO)
+bool radeon_is_px(struct drm_device *dev)
-bool radeon_is_px(void);
+{
-#else
+        struct radeon_device *rdev = dev->dev_private;
-static inline bool radeon_is_px(void) { return false; }
-#endif
+        if (rdev->flags & RADEON_IS_PX)
+                return true;
+        return false;
+}
 /**
 * radeon_program_register_sequence - program an array of registers.
@@ -1082,7 +1086,7 @@ static void radeon_switcheroo_set_state(struct pci_dev *pdev, enum vga_switchero
 {
        struct drm_device *dev = pci_get_drvdata(pdev);
-        if (radeon_is_px() && state == VGA_SWITCHEROO_OFF)
+        if (radeon_is_px(dev) && state == VGA_SWITCHEROO_OFF)
                return;
        if (state == VGA_SWITCHEROO_ON) {
@@ -1301,9 +1305,7 @@ int radeon_device_init(struct radeon_device *rdev,
         * ignore it */
        vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
-        if (radeon_runtime_pm == 1)
+        if (rdev->flags & RADEON_IS_PX)
-                runtime = true;
-        if ((radeon_runtime_pm == -1) && radeon_is_px())
                runtime = true;
        vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
        if (runtime)
@@ -1531,11 +1533,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
        radeon_restore_bios_scratch_regs(rdev);
-        if (fbcon) {
-                radeon_fbdev_set_suspend(rdev, 0);
-                console_unlock();
-        }
        /* init dig PHYs, disp eng pll */
        if (rdev->is_atom_bios) {
                radeon_atom_encoder_init(rdev);
@@ -1560,6 +1557,12 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
        }
        drm_kms_helper_poll_enable(dev);
+        if (fbcon) {
+                radeon_fbdev_set_suspend(rdev, 0);
+                console_unlock();
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 386cfa4c194d..356b733caafe 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -284,6 +284,10 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
        u32 update_pending;
        int vpos, hpos;
+        /* can happen during initialization */
+        if (radeon_crtc == NULL)
+                return;
        spin_lock_irqsave(&rdev->ddev->event_lock, flags);
        work = radeon_crtc->unpin_work;
        if (work == NULL ||
@@ -759,19 +763,18 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
        if (radeon_connector_encoder_get_dp_bridge_encoder_id(&radeon_connector->base) !=
            ENCODER_OBJECT_ID_NONE) {
-                struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
+                if (radeon_connector->ddc_bus->has_aux)
-                if (dig->dp_i2c_bus)
                        radeon_connector->edid = drm_get_edid(&radeon_connector->base,
-                                                              &dig->dp_i2c_bus->adapter);
+                                                              &radeon_connector->ddc_bus->aux.ddc);
        } else if ((radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_DisplayPort) ||
                   (radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_eDP)) {
                struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
                if ((dig->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT ||
-                     dig->dp_sink_type == CONNECTOR_OBJECT_ID_eDP) && dig->dp_i2c_bus)
+                     dig->dp_sink_type == CONNECTOR_OBJECT_ID_eDP) &&
+                    radeon_connector->ddc_bus->has_aux)
                        radeon_connector->edid = drm_get_edid(&radeon_connector->base,
-                                                              &dig->dp_i2c_bus->adapter);
+                                                              &radeon_connector->ddc_bus->aux.ddc);
                else if (radeon_connector->ddc_bus && !radeon_connector->edid)
                        radeon_connector->edid = drm_get_edid(&radeon_connector->base,
                                                              &radeon_connector->ddc_bus->adapter);
@@ -827,20 +830,52 @@ static void avivo_reduce_ratio(unsigned *nom, unsigned *den,
        /* make sure nominator is large enough */
        if (*nom < nom_min) {
-                tmp = (nom_min + *nom - 1) / *nom;
+                tmp = DIV_ROUND_UP(nom_min, *nom);
                *nom *= tmp;
                *den *= tmp;
        }
        /* make sure the denominator is large enough */
        if (*den < den_min) {
-                tmp = (den_min + *den - 1) / *den;
+                tmp = DIV_ROUND_UP(den_min, *den);
                *nom *= tmp;
                *den *= tmp;
        }
 }
 /**
+ * avivo_get_fb_ref_div - feedback and ref divider calculation
+ *
+ * @nom: nominator
+ * @den: denominator
+ * @post_div: post divider
+ * @fb_div_max: feedback divider maximum
+ * @ref_div_max: reference divider maximum
+ * @fb_div: resulting feedback divider
+ * @ref_div: resulting reference divider
+ *
+ * Calculate feedback and reference divider for a given post divider. Makes
+ * sure we stay within the limits.
+ */
+static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
+                                 unsigned fb_div_max, unsigned ref_div_max,
+                                 unsigned *fb_div, unsigned *ref_div)
+{
+        /* limit reference * post divider to a maximum */
+        ref_div_max = max(min(100 / post_div, ref_div_max), 1u);
+        /* get matching reference and feedback divider */
+        *ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
+        *fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den);
+        /* limit fb divider to its maximum */
+        if (*fb_div > fb_div_max) {
+                *ref_div = DIV_ROUND_CLOSEST(*ref_div * fb_div_max, *fb_div);
+                *fb_div = fb_div_max;
+        }
+}
+/**
 * radeon_compute_pll_avivo - compute PLL paramaters
 *
 * @pll: information about the PLL
@@ -861,11 +896,14 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
                              u32 *ref_div_p,
                              u32 *post_div_p)
 {
+        unsigned target_clock = pll->flags & RADEON_PLL_USE_FRAC_FB_DIV ?
+                freq : freq / 10;
        unsigned fb_div_min, fb_div_max, fb_div;
        unsigned post_div_min, post_div_max, post_div;
        unsigned ref_div_min, ref_div_max, ref_div;
        unsigned post_div_best, diff_best;
-        unsigned nom, den, tmp;
+        unsigned nom, den;
        /* determine allowed feedback divider range */
        fb_div_min = pll->min_feedback_div;
@@ -881,14 +919,18 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
                ref_div_min = pll->reference_div;
        else
                ref_div_min = pll->min_ref_div;
-        ref_div_max = pll->max_ref_div;
+        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV &&
+            pll->flags & RADEON_PLL_USE_REF_DIV)
+                ref_div_max = pll->reference_div;
+        else
+                ref_div_max = pll->max_ref_div;
        /* determine allowed post divider range */
        if (pll->flags & RADEON_PLL_USE_POST_DIV) {
                post_div_min = pll->post_div;
                post_div_max = pll->post_div;
        } else {
-                unsigned target_clock = freq / 10;
                unsigned vco_min, vco_max;
                if (pll->flags & RADEON_PLL_IS_LCD) {
@@ -899,6 +941,11 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
                        vco_max = pll->pll_out_max;
                }
+                if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV) {
+                        vco_min *= 10;
+                        vco_max *= 10;
+                }
                post_div_min = vco_min / target_clock;
                if ((target_clock * post_div_min) < vco_min)
                        ++post_div_min;
@@ -913,7 +960,7 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        }
        /* represent the searched ratio as fractional number */
-        nom = pll->flags & RADEON_PLL_USE_FRAC_FB_DIV ? freq : freq / 10;
+        nom = target_clock;
        den = pll->reference_freq;
        /* reduce the numbers to a simpler ratio */
@@ -927,7 +974,12 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        diff_best = ~0;
        for (post_div = post_div_min; post_div <= post_div_max; ++post_div) {
-                unsigned diff = abs(den - den / post_div * post_div);
+                unsigned diff;
+                avivo_get_fb_ref_div(nom, den, post_div, fb_div_max,
+                                     ref_div_max, &fb_div, &ref_div);
+                diff = abs(target_clock - (pll->reference_freq * fb_div) /
+                        (ref_div * post_div));
                if (diff < diff_best || (diff == diff_best &&
                    !(pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP))) {
@@ -937,29 +989,24 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        }
        post_div = post_div_best;
-        /* get matching reference and feedback divider */
+        /* get the feedback and reference divider for the optimal value */
-        ref_div = max(den / post_div, 1u);
+        avivo_get_fb_ref_div(nom, den, post_div, fb_div_max, ref_div_max,
-        fb_div = nom;
+                             &fb_div, &ref_div);
-        /* we're almost done, but reference and feedback
-           divider might be to large now */
-        tmp = ref_div;
-        if (fb_div > fb_div_max) {
-                ref_div = ref_div * fb_div_max / fb_div;
-                fb_div = fb_div_max;
-        }
-        if (ref_div > ref_div_max) {
-                ref_div = ref_div_max;
-                fb_div = nom * ref_div_max / tmp;
-        }
        /* reduce the numbers to a simpler ratio once more */
        /* this also makes sure that the reference divider is large enough */
        avivo_reduce_ratio(&fb_div, &ref_div, fb_div_min, ref_div_min);
+        /* avoid high jitter with small fractional dividers */
+        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV && (fb_div % 10)) {
+                fb_div_min = max(fb_div_min, (9 - (fb_div % 10)) * 20 + 50);
+                if (fb_div < fb_div_min) {
+                        unsigned tmp = DIV_ROUND_UP(fb_div_min, fb_div);
+                        fb_div *= tmp;
+                        ref_div *= tmp;
+                }
+        }
        /* and finally save the result */
        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV) {
                *fb_div_p = fb_div / 10;
@@ -976,7 +1023,7 @@ void radeon_compute_pll_avivo(struct radeon_pll *pll,
        *post_div_p = post_div;
        DRM_DEBUG_KMS("%d - %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
-                      freq, *dot_clock_p, *fb_div_p, *frac_fb_div_p,
+                      freq, *dot_clock_p * 10, *fb_div_p, *frac_fb_div_p,
                      ref_div, post_div);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index d0eba48dd74e..c00a2f585185 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -115,6 +115,7 @@ extern int radeon_get_crtc_scanoutpos(struct drm_device *dev, int crtc,
                                      unsigned int flags,
                                      int *vpos, int *hpos, ktime_t *stime,
                                      ktime_t *etime);
+extern bool radeon_is_px(struct drm_device *dev);
 extern const struct drm_ioctl_desc radeon_ioctls_kms[];
 extern int radeon_max_kms_ioctl;
 int radeon_mmap(struct file *filp, struct vm_area_struct *vma);
@@ -144,11 +145,9 @@ void radeon_debugfs_cleanup(struct drm_minor *minor);
 #if defined(CONFIG_VGA_SWITCHEROO)
 void radeon_register_atpx_handler(void);
 void radeon_unregister_atpx_handler(void);
-bool radeon_is_px(void);
 #else
 static inline void radeon_register_atpx_handler(void) {}
 static inline void radeon_unregister_atpx_handler(void) {}
-static inline bool radeon_is_px(void) { return false; }
 #endif
 int radeon_no_wb;
@@ -186,7 +185,7 @@ module_param_named(dynclks, radeon_dynclks, int, 0444);
 MODULE_PARM_DESC(r4xx_atom, "Enable ATOMBIOS modesetting for R4xx");
 module_param_named(r4xx_atom, radeon_r4xx_atom, int, 0444);
-MODULE_PARM_DESC(vramlimit, "Restrict VRAM for testing");
+MODULE_PARM_DESC(vramlimit, "Restrict VRAM for testing, in megabytes");
 module_param_named(vramlimit, radeon_vram_limit, int, 0600);
 MODULE_PARM_DESC(agpmode, "AGP Mode (-1 == PCI)");
@@ -405,12 +404,7 @@ static int radeon_pmops_runtime_suspend(struct device *dev)
        struct drm_device *drm_dev = pci_get_drvdata(pdev);
        int ret;
-        if (radeon_runtime_pm == 0) {
+        if (!radeon_is_px(drm_dev)) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-        if (radeon_runtime_pm == -1 && !radeon_is_px()) {
                pm_runtime_forbid(dev);
                return -EBUSY;
        }
@@ -434,10 +428,7 @@ static int radeon_pmops_runtime_resume(struct device *dev)
        struct drm_device *drm_dev = pci_get_drvdata(pdev);
        int ret;
-        if (radeon_runtime_pm == 0)
+        if (!radeon_is_px(drm_dev))
-                return -EINVAL;
-        if (radeon_runtime_pm == -1 && !radeon_is_px())
                return -EINVAL;
        drm_dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
@@ -462,14 +453,7 @@ static int radeon_pmops_runtime_idle(struct device *dev)
        struct drm_device *drm_dev = pci_get_drvdata(pdev);
        struct drm_crtc *crtc;
-        if (radeon_runtime_pm == 0) {
+        if (!radeon_is_px(drm_dev)) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-        /* are we PX enabled? */
-        if (radeon_runtime_pm == -1 && !radeon_is_px()) {
-                DRM_DEBUG_DRIVER("failing to power off - not px\n");
                pm_runtime_forbid(dev);
                return -EBUSY;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_family.h b/drivers/gpu/drm/radeon/radeon_family.h
index 614ad549297f..4b7b87f71a63 100644
--- a/drivers/gpu/drm/radeon/radeon_family.h
+++ b/drivers/gpu/drm/radeon/radeon_family.h
@@ -97,6 +97,7 @@ enum radeon_family {
        CHIP_KAVERI,
        CHIP_KABINI,
        CHIP_HAWAII,
+        CHIP_MULLINS,
        CHIP_LAST,
 };
@@ -115,6 +116,7 @@ enum radeon_chip_flags {
        RADEON_NEW_MEMMAP = 0x00400000UL,
        RADEON_IS_PCI = 0x00800000UL,
        RADEON_IS_IGPGART = 0x01000000UL,
+        RADEON_IS_PX = 0x02000000UL,
 };
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index e24ca6ab96de..7b944142a9fd 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -64,8 +64,7 @@ bool radeon_ddc_probe(struct radeon_connector *radeon_connector, bool use_aux)
                radeon_router_select_ddc_port(radeon_connector);
        if (use_aux) {
-                struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
+                ret = i2c_transfer(&radeon_connector->ddc_bus->aux.ddc, msgs, 2);
-                ret = i2c_transfer(&dig->dp_i2c_bus->adapter, msgs, 2);
        } else {
                ret = i2c_transfer(&radeon_connector->ddc_bus->adapter, msgs, 2);
        }
@@ -950,16 +949,16 @@ struct radeon_i2c_chan *radeon_i2c_create(struct drm_device *dev,
                /* set the radeon bit adapter */
                snprintf(i2c->adapter.name, sizeof(i2c->adapter.name),
                         "Radeon i2c bit bus %s", name);
-                i2c->adapter.algo_data = &i2c->algo.bit;
+                i2c->adapter.algo_data = &i2c->bit;
-                i2c->algo.bit.pre_xfer = pre_xfer;
+                i2c->bit.pre_xfer = pre_xfer;
-                i2c->algo.bit.post_xfer = post_xfer;
+                i2c->bit.post_xfer = post_xfer;
-                i2c->algo.bit.setsda = set_data;
+                i2c->bit.setsda = set_data;
-                i2c->algo.bit.setscl = set_clock;
+                i2c->bit.setscl = set_clock;
-                i2c->algo.bit.getsda = get_data;
+                i2c->bit.getsda = get_data;
-                i2c->algo.bit.getscl = get_clock;
+                i2c->bit.getscl = get_clock;
-                i2c->algo.bit.udelay = 10;
+                i2c->bit.udelay = 10;
-                i2c->algo.bit.timeout = usecs_to_jiffies(2200); /* from VESA */
+                i2c->bit.timeout = usecs_to_jiffies(2200);      /* from VESA */
-                i2c->algo.bit.data = i2c;
+                i2c->bit.data = i2c;
                ret = i2c_bit_add_bus(&i2c->adapter);
                if (ret) {
                        DRM_ERROR("Failed to register bit i2c %s\n", name);
@@ -974,46 +973,13 @@ out_free:
 }
-struct radeon_i2c_chan *radeon_i2c_create_dp(struct drm_device *dev,
-                                             struct radeon_i2c_bus_rec *rec,
-                                             const char *name)
-{
-        struct radeon_i2c_chan *i2c;
-        int ret;
-        i2c = kzalloc(sizeof(struct radeon_i2c_chan), GFP_KERNEL);
-        if (i2c == NULL)
-                return NULL;
-        i2c->rec = *rec;
-        i2c->adapter.owner = THIS_MODULE;
-        i2c->adapter.class = I2C_CLASS_DDC;
-        i2c->adapter.dev.parent = &dev->pdev->dev;
-        i2c->dev = dev;
-        snprintf(i2c->adapter.name, sizeof(i2c->adapter.name),
-                 "Radeon aux bus %s", name);
-        i2c_set_adapdata(&i2c->adapter, i2c);
-        i2c->adapter.algo_data = &i2c->algo.dp;
-        i2c->algo.dp.aux_ch = radeon_dp_i2c_aux_ch;
-        i2c->algo.dp.address = 0;
-        ret = i2c_dp_aux_add_bus(&i2c->adapter);
-        if (ret) {
-                DRM_INFO("Failed to register i2c %s\n", name);
-                goto out_free;
-        }
-        return i2c;
-out_free:
-        kfree(i2c);
-        return NULL;
-}
 void radeon_i2c_destroy(struct radeon_i2c_chan *i2c)
 {
        if (!i2c)
                return;
        i2c_del_adapter(&i2c->adapter);
+        if (i2c->has_aux)
+                drm_dp_aux_unregister_i2c_bus(&i2c->aux);
        kfree(i2c);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 3e49342a20e6..eaaedba04675 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -35,9 +35,9 @@
 #include <linux/pm_runtime.h>
 #if defined(CONFIG_VGA_SWITCHEROO)
-bool radeon_is_px(void);
+bool radeon_has_atpx(void);
 #else
-static inline bool radeon_is_px(void) { return false; }
+static inline bool radeon_has_atpx(void) { return false; }
 #endif
 /**
@@ -107,6 +107,11 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
                flags |= RADEON_IS_PCI;
        }
+        if ((radeon_runtime_pm != 0) &&
+            radeon_has_atpx() &&
+            ((flags & RADEON_IS_IGP) == 0))
+                flags |= RADEON_IS_PX;
        /* radeon_device_init should report only fatal error
         * like memory allocation failure or iomapping failure,
         * or memory manager initialization failure, it must
@@ -137,8 +142,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
                                "Error during ACPI methods call\n");
        }
-        if ((radeon_runtime_pm == 1) ||
+        if (radeon_is_px(dev)) {
-            ((radeon_runtime_pm == -1) && radeon_is_px())) {
                pm_runtime_use_autosuspend(dev->dev);
                pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                pm_runtime_set_active(dev->dev);
@@ -568,28 +572,34 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
                }
                r = radeon_vm_init(rdev, &fpriv->vm);
-                if (r)
-                        return r;
-                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
-                if (r)
-                        return r;
-                /* map the ib pool buffer read only into
-                 * virtual address space */
-                bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
-                                         rdev->ring_tmp_bo.bo);
-                r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
-                                          RADEON_VM_PAGE_READABLE |
-                                          RADEON_VM_PAGE_SNOOPED);
-                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
                if (r) {
-                        radeon_vm_fini(rdev, &fpriv->vm);
                        kfree(fpriv);
                        return r;
                }
+                if (rdev->accel_working) {
+                        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                        if (r) {
+                                radeon_vm_fini(rdev, &fpriv->vm);
+                                kfree(fpriv);
+                                return r;
+                        }
+                        /* map the ib pool buffer read only into
+                         * virtual address space */
+                        bo_va = radeon_vm_bo_add(rdev, &fpriv->vm,
+                                                 rdev->ring_tmp_bo.bo);
+                        r = radeon_vm_bo_set_addr(rdev, bo_va, RADEON_VA_IB_OFFSET,
+                                                  RADEON_VM_PAGE_READABLE |
+                                                  RADEON_VM_PAGE_SNOOPED);
+                        radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                        if (r) {
+                                radeon_vm_fini(rdev, &fpriv->vm);
+                                kfree(fpriv);
+                                return r;
+                        }
+                }
                file_priv->driver_priv = fpriv;
        }
@@ -617,13 +627,15 @@ void radeon_driver_postclose_kms(struct drm_device *dev,
                struct radeon_bo_va *bo_va;
                int r;
-                r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+                if (rdev->accel_working) {
-                if (!r) {
+                        r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
-                        bo_va = radeon_vm_bo_find(&fpriv->vm,
+                        if (!r) {
-                                                  rdev->ring_tmp_bo.bo);
+                                bo_va = radeon_vm_bo_find(&fpriv->vm,
-                        if (bo_va)
+                                                          rdev->ring_tmp_bo.bo);
-                                radeon_vm_bo_rmv(rdev, bo_va);
+                                if (bo_va)
-                        radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                                        radeon_vm_bo_rmv(rdev, bo_va);
+                                radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
+                        }
                }
                radeon_vm_fini(rdev, &fpriv->vm);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 832d9fa1a4c4..6ddf31a2d34e 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -187,12 +187,10 @@ struct radeon_pll {
 struct radeon_i2c_chan {
        struct i2c_adapter adapter;
        struct drm_device *dev;
-        union {
+        struct i2c_algo_bit_data bit;
-                struct i2c_algo_bit_data bit;
-                struct i2c_algo_dp_aux_data dp;
-        } algo;
        struct radeon_i2c_bus_rec rec;
        struct drm_dp_aux aux;
+        bool has_aux;
 };
 /* mostly for macs, but really any system without connector tables */
@@ -440,7 +438,6 @@ struct radeon_encoder {
 struct radeon_connector_atom_dig {
        uint32_t igp_lane_info;
        /* displayport */
-        struct radeon_i2c_chan *dp_i2c_bus;
        u8 dpcd[DP_RECEIVER_CAP_SIZE];
        u8 dp_sink_type;
        int dp_clock;
@@ -702,8 +699,6 @@ extern void atombios_dig_transmitter_setup(struct drm_encoder *encoder,
                                           uint8_t lane_set);
 extern void radeon_atom_ext_encoder_setup_ddc(struct drm_encoder *encoder);
 extern struct drm_encoder *radeon_get_external_encoder(struct drm_encoder *encoder);
-extern int radeon_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
-                                u8 write_byte, u8 *read_byte);
 void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le);
 extern void radeon_i2c_init(struct radeon_device *rdev);
@@ -715,9 +710,6 @@ extern void radeon_i2c_add(struct radeon_device *rdev,
                           const char *name);
 extern struct radeon_i2c_chan *radeon_i2c_lookup(struct radeon_device *rdev,
                                                 struct radeon_i2c_bus_rec *i2c_bus);
-extern struct radeon_i2c_chan *radeon_i2c_create_dp(struct drm_device *dev,
-                                                    struct radeon_i2c_bus_rec *rec,
-                                                    const char *name);
 extern struct radeon_i2c_chan *radeon_i2c_create(struct drm_device *dev,
                                                 struct radeon_i2c_bus_rec *rec,
                                                 const char *name);
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 19bec0dbfa38..4faa4d6f9bb4 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -458,7 +458,7 @@ int radeon_bo_list_validate(struct radeon_device *rdev,
                         * into account. We don't want to disallow buffer moves
                         * completely.
                         */
-                        if (current_domain != RADEON_GEM_DOMAIN_CPU &&
+                        if ((lobj->alt_domain & current_domain) != 0 &&
                            (domain & current_domain) == 0 && /* will be moved */
                            bytes_moved > bytes_moved_threshold) {
                                /* don't move it */
@@ -699,22 +699,30 @@ int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo)
        rbo = container_of(bo, struct radeon_bo, tbo);
        radeon_bo_check_tiling(rbo, 0, 0);
        rdev = rbo->rdev;
-        if (bo->mem.mem_type == TTM_PL_VRAM) {
+        if (bo->mem.mem_type != TTM_PL_VRAM)
-                size = bo->mem.num_pages << PAGE_SHIFT;
+                return 0;
-                offset = bo->mem.start << PAGE_SHIFT;
-                if ((offset + size) > rdev->mc.visible_vram_size) {
+        size = bo->mem.num_pages << PAGE_SHIFT;
-                        /* hurrah the memory is not visible ! */
+        offset = bo->mem.start << PAGE_SHIFT;
-                        radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM);
+        if ((offset + size) <= rdev->mc.visible_vram_size)
-                        rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT;
+                return 0;
-                        r = ttm_bo_validate(bo, &rbo->placement, false, false);
-                        if (unlikely(r != 0))
+        /* hurrah the memory is not visible ! */
-                                return r;
+        radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM);
-                        offset = bo->mem.start << PAGE_SHIFT;
+        rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT;
-                        /* this should not happen */
+        r = ttm_bo_validate(bo, &rbo->placement, false, false);
-                        if ((offset + size) > rdev->mc.visible_vram_size)
+        if (unlikely(r == -ENOMEM)) {
-                                return -EINVAL;
+                radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
-                }
+                return ttm_bo_validate(bo, &rbo->placement, false, false);
+        } else if (unlikely(r != 0)) {
+                return r;
        }
+        offset = bo->mem.start << PAGE_SHIFT;
+        /* this should never happen */
+        if ((offset + size) > rdev->mc.visible_vram_size)
+                return -EINVAL;
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index ee738a524639..53d6e1bb48dc 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -361,6 +361,11 @@ static ssize_t radeon_set_pm_profile(struct device *dev,
        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
+        /* Can't set profile when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
        mutex_lock(&rdev->pm.mutex);
        if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                if (strncmp("default", buf, strlen("default")) == 0)
@@ -409,6 +414,13 @@ static ssize_t radeon_set_pm_method(struct device *dev,
        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
+        /* Can't set method when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) {
+                count = -EINVAL;
+                goto fail;
+        }
        /* we don't support the legacy modes with dpm */
        if (rdev->pm.pm_method == PM_METHOD_DPM) {
                count = -EINVAL;
@@ -446,6 +458,10 @@ static ssize_t radeon_get_dpm_state(struct device *dev,
        struct radeon_device *rdev = ddev->dev_private;
        enum radeon_pm_state_type pm = rdev->pm.dpm.user_state;
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return snprintf(buf, PAGE_SIZE, "off\n");
        return snprintf(buf, PAGE_SIZE, "%s\n",
                        (pm == POWER_STATE_TYPE_BATTERY) ? "battery" :
                        (pm == POWER_STATE_TYPE_BALANCED) ? "balanced" : "performance");
@@ -459,6 +475,11 @@ static ssize_t radeon_set_dpm_state(struct device *dev,
        struct drm_device *ddev = dev_get_drvdata(dev);
        struct radeon_device *rdev = ddev->dev_private;
+        /* Can't set dpm state when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
        mutex_lock(&rdev->pm.mutex);
        if (strncmp("battery", buf, strlen("battery")) == 0)
                rdev->pm.dpm.user_state = POWER_STATE_TYPE_BATTERY;
@@ -485,6 +506,10 @@ static ssize_t radeon_get_dpm_forced_performance_level(struct device *dev,
        struct radeon_device *rdev = ddev->dev_private;
        enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level;
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return snprintf(buf, PAGE_SIZE, "off\n");
        return snprintf(buf, PAGE_SIZE, "%s\n",
                        (level == RADEON_DPM_FORCED_LEVEL_AUTO) ? "auto" :
                        (level == RADEON_DPM_FORCED_LEVEL_LOW) ? "low" : "high");
@@ -500,6 +525,11 @@ static ssize_t radeon_set_dpm_forced_performance_level(struct device *dev,
        enum radeon_dpm_forced_level level;
        int ret = 0;
+        /* Can't force performance level when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
        mutex_lock(&rdev->pm.mutex);
        if (strncmp("low", buf, strlen("low")) == 0) {
                level = RADEON_DPM_FORCED_LEVEL_LOW;
@@ -538,8 +568,14 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
                                      char *buf)
 {
        struct radeon_device *rdev = dev_get_drvdata(dev);
+        struct drm_device *ddev = rdev->ddev;
        int temp;
+        /* Can't get temperature when the card is off */
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON))
+                return -EINVAL;
        if (rdev->asic->pm.get_temperature)
                temp = radeon_get_temperature(rdev);
        else
@@ -603,7 +639,6 @@ static const struct attribute_group *hwmon_groups[] = {
 static int radeon_hwmon_init(struct radeon_device *rdev)
 {
        int err = 0;
-        struct device *hwmon_dev;
        switch (rdev->pm.int_thermal_type) {
        case THERMAL_TYPE_RV6XX:
@@ -616,11 +651,11 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
        case THERMAL_TYPE_KV:
                if (rdev->asic->pm.get_temperature == NULL)
                        return err;
-                hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
+                rdev->pm.int_hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
-                                                              "radeon", rdev,
+                                                                           "radeon", rdev,
-                                                              hwmon_groups);
+                                                                           hwmon_groups);
-                if (IS_ERR(hwmon_dev)) {
+                if (IS_ERR(rdev->pm.int_hwmon_dev)) {
-                        err = PTR_ERR(hwmon_dev);
+                        err = PTR_ERR(rdev->pm.int_hwmon_dev);
                        dev_err(rdev->dev,
                                "Unable to register hwmon device: %d\n", err);
                }
@@ -632,6 +667,12 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
        return err;
 }
+static void radeon_hwmon_fini(struct radeon_device *rdev)
+{
+        if (rdev->pm.int_hwmon_dev)
+                hwmon_device_unregister(rdev->pm.int_hwmon_dev);
+}
 static void radeon_dpm_thermal_work_handler(struct work_struct *work)
 {
        struct radeon_device *rdev =
@@ -1257,6 +1298,7 @@ int radeon_pm_init(struct radeon_device *rdev)
        case CHIP_RV670:
        case CHIP_RS780:
        case CHIP_RS880:
+        case CHIP_RV770:
        case CHIP_BARTS:
        case CHIP_TURKS:
        case CHIP_CAICOS:
@@ -1273,7 +1315,6 @@ int radeon_pm_init(struct radeon_device *rdev)
                else
                        rdev->pm.pm_method = PM_METHOD_PROFILE;
                break;
-        case CHIP_RV770:
        case CHIP_RV730:
        case CHIP_RV710:
        case CHIP_RV740:
@@ -1295,6 +1336,7 @@ int radeon_pm_init(struct radeon_device *rdev)
        case CHIP_KABINI:
        case CHIP_KAVERI:
        case CHIP_HAWAII:
+        case CHIP_MULLINS:
                /* DPM requires the RLC, RV770+ dGPU requires SMC */
                if (!rdev->rlc_fw)
                        rdev->pm.pm_method = PM_METHOD_PROFILE;
@@ -1353,6 +1395,8 @@ static void radeon_pm_fini_old(struct radeon_device *rdev)
                device_remove_file(rdev->dev, &dev_attr_power_method);
        }
+        radeon_hwmon_fini(rdev);
        if (rdev->pm.power_state)
                kfree(rdev->pm.power_state);
 }
@@ -1372,6 +1416,8 @@ static void radeon_pm_fini_dpm(struct radeon_device *rdev)
        }
        radeon_dpm_fini(rdev);
+        radeon_hwmon_fini(rdev);
        if (rdev->pm.power_state)
                kfree(rdev->pm.power_state);
 }
@@ -1397,12 +1443,14 @@ static void radeon_pm_compute_clocks_old(struct radeon_device *rdev)
        rdev->pm.active_crtcs = 0;
        rdev->pm.active_crtc_count = 0;
-        list_for_each_entry(crtc,
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                &ddev->mode_config.crtc_list, head) {
+                list_for_each_entry(crtc,
-                radeon_crtc = to_radeon_crtc(crtc);
+                                    &ddev->mode_config.crtc_list, head) {
-                if (radeon_crtc->enabled) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        rdev->pm.active_crtcs |= (1 << radeon_crtc->crtc_id);
+                        if (radeon_crtc->enabled) {
-                        rdev->pm.active_crtc_count++;
+                                rdev->pm.active_crtcs |= (1 << radeon_crtc->crtc_id);
+                                rdev->pm.active_crtc_count++;
+                        }
                }
        }
@@ -1469,12 +1517,14 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
        /* update active crtc counts */
        rdev->pm.dpm.new_active_crtcs = 0;
        rdev->pm.dpm.new_active_crtc_count = 0;
-        list_for_each_entry(crtc,
+        if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
-                &ddev->mode_config.crtc_list, head) {
+                list_for_each_entry(crtc,
-                radeon_crtc = to_radeon_crtc(crtc);
+                                    &ddev->mode_config.crtc_list, head) {
-                if (crtc->enabled) {
+                        radeon_crtc = to_radeon_crtc(crtc);
-                        rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id);
+                        if (crtc->enabled) {
-                        rdev->pm.dpm.new_active_crtc_count++;
+                                rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id);
+                                rdev->pm.dpm.new_active_crtc_count++;
+                        }
                }
        }
@@ -1600,8 +1650,12 @@ static int radeon_debugfs_pm_info(struct seq_file *m, void *data)
        struct drm_info_node *node = (struct drm_info_node *) m->private;
        struct drm_device *dev = node->minor->dev;
        struct radeon_device *rdev = dev->dev_private;
+        struct drm_device *ddev = rdev->ddev;
-        if (rdev->pm.dpm_enabled) {
+        if  ((rdev->flags & RADEON_IS_PX) &&
+             (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) {
+                seq_printf(m, "PX asic powered off\n");
+        } else if (rdev->pm.dpm_enabled) {
                mutex_lock(&rdev->pm.mutex);
                if (rdev->asic->dpm.debugfs_print_current_performance_level)
                        radeon_dpm_debugfs_print_current_performance_level(rdev, m);
diff --git a/drivers/gpu/drm/radeon/radeon_ucode.h b/drivers/gpu/drm/radeon/radeon_ucode.h
index a77cd274dfc3..4e7c3269b183 100644
--- a/drivers/gpu/drm/radeon/radeon_ucode.h
+++ b/drivers/gpu/drm/radeon/radeon_ucode.h
@@ -52,14 +52,20 @@
 #define BONAIRE_RLC_UCODE_SIZE       2048
 #define KB_RLC_UCODE_SIZE            2560
 #define KV_RLC_UCODE_SIZE            2560
+#define ML_RLC_UCODE_SIZE            2560
 /* MC */
 #define BTC_MC_UCODE_SIZE            6024
 #define CAYMAN_MC_UCODE_SIZE         6037
 #define SI_MC_UCODE_SIZE             7769
+#define TAHITI_MC_UCODE_SIZE         7808
+#define PITCAIRN_MC_UCODE_SIZE       7775
+#define VERDE_MC_UCODE_SIZE          7875
 #define OLAND_MC_UCODE_SIZE          7863
-#define CIK_MC_UCODE_SIZE            7866
+#define BONAIRE_MC_UCODE_SIZE        7866
+#define BONAIRE_MC2_UCODE_SIZE       7948
 #define HAWAII_MC_UCODE_SIZE         7933
+#define HAWAII_MC2_UCODE_SIZE        8091
 /* SDMA */
 #define CIK_SDMA_UCODE_SIZE          1050
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 5748bdaeacce..1b65ae2433cd 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -99,6 +99,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
        case CHIP_KABINI:
        case CHIP_KAVERI:
        case CHIP_HAWAII:
+        case CHIP_MULLINS:
                fw_name = FIRMWARE_BONAIRE;
                break;
@@ -465,6 +466,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
        cmd = radeon_get_ib_value(p, p->idx) >> 1;
        if (cmd < 0x4) {
+                if (end <= start) {
+                        DRM_ERROR("invalid reloc offset %X!\n", offset);
+                        return -EINVAL;
+                }
                if ((end - start) < buf_sizes[cmd]) {
                        DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd,
                                  (unsigned)(end - start), buf_sizes[cmd]);
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index 76e9904bc537..3971d968af6c 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -66,6 +66,7 @@ int radeon_vce_init(struct radeon_device *rdev)
        case CHIP_BONAIRE:
        case CHIP_KAVERI:
        case CHIP_KABINI:
+        case CHIP_MULLINS:
                fw_name = FIRMWARE_BONAIRE;
                break;
@@ -442,13 +443,16 @@ int radeon_vce_get_destroy_msg(struct radeon_device *rdev, int ring,
 * @p: parser context
 * @lo: address of lower dword
 * @hi: address of higher dword
+ * @size: size of checker for relocation buffer
 *
 * Patch relocation inside command stream with real buffer address
 */
-int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi)
+int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi,
+                        unsigned size)
 {
        struct radeon_cs_chunk *relocs_chunk;
-        uint64_t offset;
+        struct radeon_cs_reloc *reloc;
+        uint64_t start, end, offset;
        unsigned idx;
        relocs_chunk = &p->chunks[p->chunk_relocs_idx];
@@ -461,15 +465,60 @@ int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi)
                return -EINVAL;
        }
-        offset += p->relocs_ptr[(idx / 4)]->gpu_offset;
+        reloc = p->relocs_ptr[(idx / 4)];
+        start = reloc->gpu_offset;
+        end = start + radeon_bo_size(reloc->robj);
+        start += offset;
-        p->ib.ptr[lo] = offset & 0xFFFFFFFF;
+        p->ib.ptr[lo] = start & 0xFFFFFFFF;
-        p->ib.ptr[hi] = offset >> 32;
+        p->ib.ptr[hi] = start >> 32;
+        if (end <= start) {
+                DRM_ERROR("invalid reloc offset %llX!\n", offset);
+                return -EINVAL;
+        }
+        if ((end - start) < size) {
+                DRM_ERROR("buffer to small (%d / %d)!\n",
+                        (unsigned)(end - start), size);
+                return -EINVAL;
+        }
        return 0;
 }
 /**
+ * radeon_vce_validate_handle - validate stream handle
+ *
+ * @p: parser context
+ * @handle: handle to validate
+ *
+ * Validates the handle and return the found session index or -EINVAL
+ * we we don't have another free session index.
+ */
+int radeon_vce_validate_handle(struct radeon_cs_parser *p, uint32_t handle)
+{
+        unsigned i;
+        /* validate the handle */
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                if (atomic_read(&p->rdev->vce.handles[i]) == handle)
+                        return i;
+        }
+        /* handle not found try to alloc a new one */
+        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
+                if (!atomic_cmpxchg(&p->rdev->vce.handles[i], 0, handle)) {
+                        p->rdev->vce.filp[i] = p->filp;
+                        p->rdev->vce.img_size[i] = 0;
+                        return i;
+                }
+        }
+        DRM_ERROR("No more free VCE handles!\n");
+        return -EINVAL;
+}
+/**
 * radeon_vce_cs_parse - parse and validate the command stream
 *
 * @p: parser context
@@ -477,8 +526,10 @@ int radeon_vce_cs_reloc(struct radeon_cs_parser *p, int lo, int hi)
 */
 int radeon_vce_cs_parse(struct radeon_cs_parser *p)
 {
-        uint32_t handle = 0;
+        int session_idx = -1;
-        bool destroy = false;
+        bool destroyed = false;
+        uint32_t tmp, handle = 0;
+        uint32_t *size = &tmp;
        int i, r;
        while (p->idx < p->chunks[p->chunk_ib_idx].length_dw) {
@@ -490,13 +541,29 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
                        return -EINVAL;
                }
+                if (destroyed) {
+                        DRM_ERROR("No other command allowed after destroy!\n");
+                        return -EINVAL;
+                }
                switch (cmd) {
                case 0x00000001: // session
                        handle = radeon_get_ib_value(p, p->idx + 2);
+                        session_idx = radeon_vce_validate_handle(p, handle);
+                        if (session_idx < 0)
+                                return session_idx;
+                        size = &p->rdev->vce.img_size[session_idx];
                        break;
                case 0x00000002: // task info
+                        break;
                case 0x01000001: // create
+                        *size = radeon_get_ib_value(p, p->idx + 8) *
+                                radeon_get_ib_value(p, p->idx + 10) *
+                                8 * 3 / 2;
+                        break;
                case 0x04000001: // config extension
                case 0x04000002: // pic control
                case 0x04000005: // rate control
@@ -505,23 +572,39 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
                        break;
                case 0x03000001: // encode
-                        r = radeon_vce_cs_reloc(p, p->idx + 10, p->idx + 9);
+                        r = radeon_vce_cs_reloc(p, p->idx + 10, p->idx + 9,
+                                                *size);
                        if (r)
                                return r;
-                        r = radeon_vce_cs_reloc(p, p->idx + 12, p->idx + 11);
+                        r = radeon_vce_cs_reloc(p, p->idx + 12, p->idx + 11,
+                                                *size / 3);
                        if (r)
                                return r;
                        break;
                case 0x02000001: // destroy
-                        destroy = true;
+                        destroyed = true;
                        break;
                case 0x05000001: // context buffer
+                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+                                                *size * 2);
+                        if (r)
+                                return r;
+                        break;
                case 0x05000004: // video bitstream buffer
+                        tmp = radeon_get_ib_value(p, p->idx + 4);
+                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+                                                tmp);
+                        if (r)
+                                return r;
+                        break;
                case 0x05000005: // feedback buffer
-                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2);
+                        r = radeon_vce_cs_reloc(p, p->idx + 3, p->idx + 2,
+                                                4096);
                        if (r)
                                return r;
                        break;
@@ -531,33 +614,21 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
                        return -EINVAL;
                }
+                if (session_idx == -1) {
+                        DRM_ERROR("no session command at start of IB\n");
+                        return -EINVAL;
+                }
                p->idx += len / 4;
        }
-        if (destroy) {
+        if (destroyed) {
                /* IB contains a destroy msg, free the handle */
                for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i)
                        atomic_cmpxchg(&p->rdev->vce.handles[i], handle, 0);
-                return 0;
-        }
-        /* create or encode, validate the handle */
-        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
-                if (atomic_read(&p->rdev->vce.handles[i]) == handle)
-                        return 0;
        }
-        /* handle not found try to alloc a new one */
+        return 0;
-        for (i = 0; i < RADEON_MAX_VCE_HANDLES; ++i) {
-                if (!atomic_cmpxchg(&p->rdev->vce.handles[i], 0, handle)) {
-                        p->rdev->vce.filp[i] = p->filp;
-                        return 0;
-                }
-        }
-        DRM_ERROR("No more free VCE handles!\n");
-        return -EINVAL;
 }
 /**
@@ -613,7 +684,7 @@ void radeon_vce_fence_emit(struct radeon_device *rdev,
                           struct radeon_fence *fence)
 {
        struct radeon_ring *ring = &rdev->ring[fence->ring];
-        uint32_t addr = rdev->fence_drv[fence->ring].gpu_addr;
+        uint64_t addr = rdev->fence_drv[fence->ring].gpu_addr;
        radeon_ring_write(ring, VCE_CMD_FENCE);
        radeon_ring_write(ring, addr);
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index 2aae6ce49d32..1f426696de36 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -130,10 +130,10 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
                                          struct list_head *head)
 {
        struct radeon_cs_reloc *list;
-        unsigned i, idx, size;
+        unsigned i, idx;
-        size = (radeon_vm_num_pdes(rdev) + 1) * sizeof(struct radeon_cs_reloc);
+        list = kmalloc_array(vm->max_pde_used + 1,
-        list = kmalloc(size, GFP_KERNEL);
+                             sizeof(struct radeon_cs_reloc), GFP_KERNEL);
        if (!list)
                return NULL;
@@ -595,7 +595,7 @@ int radeon_vm_update_page_directory(struct radeon_device *rdev,
        ndw = 64;
        /* assume the worst case */
-        ndw += vm->max_pde_used * 12;
+        ndw += vm->max_pde_used * 16;
        /* update too big for an IB */
        if (ndw > 0xfffff)
diff --git a/drivers/gpu/drm/radeon/rv770_dma.c b/drivers/gpu/drm/radeon/rv770_dma.c
index aca8cbe8a335..bbf2e076ee45 100644
--- a/drivers/gpu/drm/radeon/rv770_dma.c
+++ b/drivers/gpu/drm/radeon/rv770_dma.c
@@ -86,6 +86,7 @@ int rv770_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index d589475fe9e6..22a63c98ba14 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -39,30 +39,35 @@ MODULE_FIRMWARE("radeon/TAHITI_pfp.bin");
 MODULE_FIRMWARE("radeon/TAHITI_me.bin");
 MODULE_FIRMWARE("radeon/TAHITI_ce.bin");
 MODULE_FIRMWARE("radeon/TAHITI_mc.bin");
+MODULE_FIRMWARE("radeon/TAHITI_mc2.bin");
 MODULE_FIRMWARE("radeon/TAHITI_rlc.bin");
 MODULE_FIRMWARE("radeon/TAHITI_smc.bin");
 MODULE_FIRMWARE("radeon/PITCAIRN_pfp.bin");
 MODULE_FIRMWARE("radeon/PITCAIRN_me.bin");
 MODULE_FIRMWARE("radeon/PITCAIRN_ce.bin");
 MODULE_FIRMWARE("radeon/PITCAIRN_mc.bin");
+MODULE_FIRMWARE("radeon/PITCAIRN_mc2.bin");
 MODULE_FIRMWARE("radeon/PITCAIRN_rlc.bin");
 MODULE_FIRMWARE("radeon/PITCAIRN_smc.bin");
 MODULE_FIRMWARE("radeon/VERDE_pfp.bin");
 MODULE_FIRMWARE("radeon/VERDE_me.bin");
 MODULE_FIRMWARE("radeon/VERDE_ce.bin");
 MODULE_FIRMWARE("radeon/VERDE_mc.bin");
+MODULE_FIRMWARE("radeon/VERDE_mc2.bin");
 MODULE_FIRMWARE("radeon/VERDE_rlc.bin");
 MODULE_FIRMWARE("radeon/VERDE_smc.bin");
 MODULE_FIRMWARE("radeon/OLAND_pfp.bin");
 MODULE_FIRMWARE("radeon/OLAND_me.bin");
 MODULE_FIRMWARE("radeon/OLAND_ce.bin");
 MODULE_FIRMWARE("radeon/OLAND_mc.bin");
+MODULE_FIRMWARE("radeon/OLAND_mc2.bin");
 MODULE_FIRMWARE("radeon/OLAND_rlc.bin");
 MODULE_FIRMWARE("radeon/OLAND_smc.bin");
 MODULE_FIRMWARE("radeon/HAINAN_pfp.bin");
 MODULE_FIRMWARE("radeon/HAINAN_me.bin");
 MODULE_FIRMWARE("radeon/HAINAN_ce.bin");
 MODULE_FIRMWARE("radeon/HAINAN_mc.bin");
+MODULE_FIRMWARE("radeon/HAINAN_mc2.bin");
 MODULE_FIRMWARE("radeon/HAINAN_rlc.bin");
 MODULE_FIRMWARE("radeon/HAINAN_smc.bin");
@@ -1467,36 +1472,33 @@ int si_mc_load_microcode(struct radeon_device *rdev)
        const __be32 *fw_data;
        u32 running, blackout = 0;
        u32 *io_mc_regs;
-        int i, ucode_size, regs_size;
+        int i, regs_size, ucode_size;
        if (!rdev->mc_fw)
                return -EINVAL;
+        ucode_size = rdev->mc_fw->size / 4;
        switch (rdev->family) {
        case CHIP_TAHITI:
                io_mc_regs = (u32 *)&tahiti_io_mc_regs;
-                ucode_size = SI_MC_UCODE_SIZE;
                regs_size = TAHITI_IO_MC_REGS_SIZE;
                break;
        case CHIP_PITCAIRN:
                io_mc_regs = (u32 *)&pitcairn_io_mc_regs;
-                ucode_size = SI_MC_UCODE_SIZE;
                regs_size = TAHITI_IO_MC_REGS_SIZE;
                break;
        case CHIP_VERDE:
        default:
                io_mc_regs = (u32 *)&verde_io_mc_regs;
-                ucode_size = SI_MC_UCODE_SIZE;
                regs_size = TAHITI_IO_MC_REGS_SIZE;
                break;
        case CHIP_OLAND:
                io_mc_regs = (u32 *)&oland_io_mc_regs;
-                ucode_size = OLAND_MC_UCODE_SIZE;
                regs_size = TAHITI_IO_MC_REGS_SIZE;
                break;
        case CHIP_HAINAN:
                io_mc_regs = (u32 *)&hainan_io_mc_regs;
-                ucode_size = OLAND_MC_UCODE_SIZE;
                regs_size = TAHITI_IO_MC_REGS_SIZE;
                break;
        }
@@ -1552,7 +1554,7 @@ static int si_init_microcode(struct radeon_device *rdev)
        const char *chip_name;
        const char *rlc_chip_name;
        size_t pfp_req_size, me_req_size, ce_req_size, rlc_req_size, mc_req_size;
-        size_t smc_req_size;
+        size_t smc_req_size, mc2_req_size;
        char fw_name[30];
        int err;
@@ -1567,6 +1569,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                ce_req_size = SI_CE_UCODE_SIZE * 4;
                rlc_req_size = SI_RLC_UCODE_SIZE * 4;
                mc_req_size = SI_MC_UCODE_SIZE * 4;
+                mc2_req_size = TAHITI_MC_UCODE_SIZE * 4;
                smc_req_size = ALIGN(TAHITI_SMC_UCODE_SIZE, 4);
                break;
        case CHIP_PITCAIRN:
@@ -1577,6 +1580,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                ce_req_size = SI_CE_UCODE_SIZE * 4;
                rlc_req_size = SI_RLC_UCODE_SIZE * 4;
                mc_req_size = SI_MC_UCODE_SIZE * 4;
+                mc2_req_size = PITCAIRN_MC_UCODE_SIZE * 4;
                smc_req_size = ALIGN(PITCAIRN_SMC_UCODE_SIZE, 4);
                break;
        case CHIP_VERDE:
@@ -1587,6 +1591,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                ce_req_size = SI_CE_UCODE_SIZE * 4;
                rlc_req_size = SI_RLC_UCODE_SIZE * 4;
                mc_req_size = SI_MC_UCODE_SIZE * 4;
+                mc2_req_size = VERDE_MC_UCODE_SIZE * 4;
                smc_req_size = ALIGN(VERDE_SMC_UCODE_SIZE, 4);
                break;
        case CHIP_OLAND:
@@ -1596,7 +1601,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                me_req_size = SI_PM4_UCODE_SIZE * 4;
                ce_req_size = SI_CE_UCODE_SIZE * 4;
                rlc_req_size = SI_RLC_UCODE_SIZE * 4;
-                mc_req_size = OLAND_MC_UCODE_SIZE * 4;
+                mc_req_size = mc2_req_size = OLAND_MC_UCODE_SIZE * 4;
                smc_req_size = ALIGN(OLAND_SMC_UCODE_SIZE, 4);
                break;
        case CHIP_HAINAN:
@@ -1606,7 +1611,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                me_req_size = SI_PM4_UCODE_SIZE * 4;
                ce_req_size = SI_CE_UCODE_SIZE * 4;
                rlc_req_size = SI_RLC_UCODE_SIZE * 4;
-                mc_req_size = OLAND_MC_UCODE_SIZE * 4;
+                mc_req_size = mc2_req_size = OLAND_MC_UCODE_SIZE * 4;
                smc_req_size = ALIGN(HAINAN_SMC_UCODE_SIZE, 4);
                break;
        default: BUG();
@@ -1659,16 +1664,22 @@ static int si_init_microcode(struct radeon_device *rdev)
                err = -EINVAL;
        }
-        snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
+        snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc2.bin", chip_name);
        err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
-        if (err)
+        if (err) {
-                goto out;
+                snprintf(fw_name, sizeof(fw_name), "radeon/%s_mc.bin", chip_name);
-        if (rdev->mc_fw->size != mc_req_size) {
+                err = request_firmware(&rdev->mc_fw, fw_name, rdev->dev);
+                if (err)
+                        goto out;
+        }
+        if ((rdev->mc_fw->size != mc_req_size) &&
+            (rdev->mc_fw->size != mc2_req_size)) {
                printk(KERN_ERR
                       "si_mc: Bogus length %zu in firmware \"%s\"\n",
                       rdev->mc_fw->size, fw_name);
                err = -EINVAL;
        }
+        DRM_INFO("%s: %zu bytes\n", fw_name, rdev->mc_fw->size);
        snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
        err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
@@ -5769,7 +5780,6 @@ int si_irq_set(struct radeon_device *rdev)
        u32 crtc1 = 0, crtc2 = 0, crtc3 = 0, crtc4 = 0, crtc5 = 0, crtc6 = 0;
        u32 hpd1 = 0, hpd2 = 0, hpd3 = 0, hpd4 = 0, hpd5 = 0, hpd6 = 0;
        u32 grbm_int_cntl = 0;
-        u32 grph1 = 0, grph2 = 0, grph3 = 0, grph4 = 0, grph5 = 0, grph6 = 0;
        u32 dma_cntl, dma_cntl1;
        u32 thermal_int = 0;
@@ -5908,16 +5918,22 @@ int si_irq_set(struct radeon_device *rdev)
        }
        if (rdev->num_crtc >= 2) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET, grph1);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET, grph2);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC1_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (rdev->num_crtc >= 4) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET, grph3);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC2_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET, grph4);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC3_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (rdev->num_crtc >= 6) {
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, grph5);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET,
-                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, grph6);
+                       GRPH_PFLIP_INT_MASK);
+                WREG32(GRPH_INT_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET,
+                       GRPH_PFLIP_INT_MASK);
        }
        if (!ASIC_IS_NODCE(rdev)) {
@@ -6281,6 +6297,15 @@ restart_ih:
                                break;
                        }
                        break;
+                case 8: /* D1 page flip */
+                case 10: /* D2 page flip */
+                case 12: /* D3 page flip */
+                case 14: /* D4 page flip */
+                case 16: /* D5 page flip */
+                case 18: /* D6 page flip */
+                        DRM_DEBUG("IH: D%d flip\n", ((src_id - 8) >> 1) + 1);
+                        radeon_crtc_handle_flip(rdev, (src_id - 8) >> 1);
+                        break;
                case 42: /* HPD hotplug */
                        switch (src_data) {
                        case 0:
diff --git a/drivers/gpu/drm/radeon/si_dma.c b/drivers/gpu/drm/radeon/si_dma.c
index cf0fdad8c278..de0ca070122f 100644
--- a/drivers/gpu/drm/radeon/si_dma.c
+++ b/drivers/gpu/drm/radeon/si_dma.c
@@ -213,6 +213,7 @@ int si_copy_dma(struct radeon_device *rdev,
        r = radeon_fence_emit(rdev, fence, ring->idx);
        if (r) {
                radeon_ring_unlock_undo(rdev, ring);
+                radeon_semaphore_free(rdev, &sem, NULL);
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 683532f84931..7321283602ce 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -107,8 +107,8 @@
 #define         SPLL_CHG_STATUS                         (1 << 1)
 #define SPLL_CNTL_MODE                                  0x618
 #define         SPLL_SW_DIR_CONTROL                     (1 << 0)
-#       define SPLL_REFCLK_SEL(x)                       ((x) << 8)
+#       define SPLL_REFCLK_SEL(x)                       ((x) << 26)
-#       define SPLL_REFCLK_SEL_MASK                     0xFF00
+#       define SPLL_REFCLK_SEL_MASK                     (3 << 26)
 #define CG_SPLL_SPREAD_SPECTRUM                         0x620
 #define         SSEN                                    (1 << 0)
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index 0a243f0e5d68..be42c8125203 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -83,7 +83,10 @@ int uvd_v1_0_init(struct radeon_device *rdev)
        int r;
        /* raise clocks while booting up the VCPU */
-        radeon_set_uvd_clocks(rdev, 53300, 40000);
+        if (rdev->family < CHIP_RV740)
+                radeon_set_uvd_clocks(rdev, 10000, 10000);
+        else
+                radeon_set_uvd_clocks(rdev, 53300, 40000);
        r = uvd_v1_0_start(rdev);
        if (r)
@@ -407,7 +410,10 @@ int uvd_v1_0_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
        struct radeon_fence *fence = NULL;
        int r;
-        r = radeon_set_uvd_clocks(rdev, 53300, 40000);
+        if (rdev->family < CHIP_RV740)
+                r = radeon_set_uvd_clocks(rdev, 10000, 10000);
+        else
+                r = radeon_set_uvd_clocks(rdev, 53300, 40000);
        if (r) {
                DRM_ERROR("radeon: failed to raise UVD clocks (%d).\n", r);
                return r;
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 36c717af6cf9..edb871d7d395 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -312,7 +312,7 @@ static void tegra_crtc_disable(struct drm_crtc *crtc)
        struct drm_device *drm = crtc->dev;
        struct drm_plane *plane;
-        list_for_each_entry(plane, &drm->mode_config.plane_list, head) {
+        drm_for_each_legacy_plane(plane, &drm->mode_config.plane_list) {
                if (plane->crtc == crtc) {
                        tegra_plane_disable(plane);
                        plane->crtc = NULL;
diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
index d536ed381fbd..005c19bd92df 100644
--- a/drivers/gpu/drm/tegra/dpaux.c
+++ b/drivers/gpu/drm/tegra/dpaux.c
@@ -99,55 +99,73 @@ static void tegra_dpaux_read_fifo(struct tegra_dpaux *dpaux, u8 *buffer,
 static ssize_t tegra_dpaux_transfer(struct drm_dp_aux *aux,
                                    struct drm_dp_aux_msg *msg)
 {
-        unsigned long value = DPAUX_DP_AUXCTL_TRANSACTREQ;
        unsigned long timeout = msecs_to_jiffies(250);
        struct tegra_dpaux *dpaux = to_dpaux(aux);
        unsigned long status;
        ssize_t ret = 0;
+        u32 value;
-        if (msg->size < 1 || msg->size > 16)
+        /* Tegra has 4x4 byte DP AUX transmit and receive FIFOs. */
+        if (msg->size > 16)
                return -EINVAL;
-        tegra_dpaux_writel(dpaux, msg->address, DPAUX_DP_AUXADDR);
+        /*
+         * Allow zero-sized messages only for I2C, in which case they specify
+         * address-only transactions.
+         */
+        if (msg->size < 1) {
+                switch (msg->request & ~DP_AUX_I2C_MOT) {
+                case DP_AUX_I2C_WRITE:
+                case DP_AUX_I2C_READ:
+                        value = DPAUX_DP_AUXCTL_CMD_ADDRESS_ONLY;
+                        break;
+                default:
+                        return -EINVAL;
+                }
+        } else {
+                /* For non-zero-sized messages, set the CMDLEN field. */
+                value = DPAUX_DP_AUXCTL_CMDLEN(msg->size - 1);
+        }
        switch (msg->request & ~DP_AUX_I2C_MOT) {
        case DP_AUX_I2C_WRITE:
                if (msg->request & DP_AUX_I2C_MOT)
-                        value = DPAUX_DP_AUXCTL_CMD_MOT_WR;
+                        value |= DPAUX_DP_AUXCTL_CMD_MOT_WR;
                else
-                        value = DPAUX_DP_AUXCTL_CMD_I2C_WR;
+                        value |= DPAUX_DP_AUXCTL_CMD_I2C_WR;
                break;
        case DP_AUX_I2C_READ:
                if (msg->request & DP_AUX_I2C_MOT)
-                        value = DPAUX_DP_AUXCTL_CMD_MOT_RD;
+                        value |= DPAUX_DP_AUXCTL_CMD_MOT_RD;
                else
-                        value = DPAUX_DP_AUXCTL_CMD_I2C_RD;
+                        value |= DPAUX_DP_AUXCTL_CMD_I2C_RD;
                break;
        case DP_AUX_I2C_STATUS:
                if (msg->request & DP_AUX_I2C_MOT)
-                        value = DPAUX_DP_AUXCTL_CMD_MOT_RQ;
+                        value |= DPAUX_DP_AUXCTL_CMD_MOT_RQ;
                else
-                        value = DPAUX_DP_AUXCTL_CMD_I2C_RQ;
+                        value |= DPAUX_DP_AUXCTL_CMD_I2C_RQ;
                break;
        case DP_AUX_NATIVE_WRITE:
-                value = DPAUX_DP_AUXCTL_CMD_AUX_WR;
+                value |= DPAUX_DP_AUXCTL_CMD_AUX_WR;
                break;
        case DP_AUX_NATIVE_READ:
-                value = DPAUX_DP_AUXCTL_CMD_AUX_RD;
+                value |= DPAUX_DP_AUXCTL_CMD_AUX_RD;
                break;
        default:
                return -EINVAL;
        }
-        value |= DPAUX_DP_AUXCTL_CMDLEN(msg->size - 1);
+        tegra_dpaux_writel(dpaux, msg->address, DPAUX_DP_AUXADDR);
        tegra_dpaux_writel(dpaux, value, DPAUX_DP_AUXCTL);
        if ((msg->request & DP_AUX_I2C_READ) == 0) {
@@ -198,7 +216,7 @@ static ssize_t tegra_dpaux_transfer(struct drm_dp_aux *aux,
                break;
        }
-        if (msg->reply == DP_AUX_NATIVE_REPLY_ACK) {
+        if ((msg->size > 0) && (msg->reply == DP_AUX_NATIVE_REPLY_ACK)) {
                if (msg->request & DP_AUX_I2C_READ) {
                        size_t count = value & DPAUX_DP_AUXSTAT_REPLY_MASK;
diff --git a/drivers/gpu/drm/tegra/dpaux.h b/drivers/gpu/drm/tegra/dpaux.h
index 4f5bf10fdff9..806e245ca787 100644
--- a/drivers/gpu/drm/tegra/dpaux.h
+++ b/drivers/gpu/drm/tegra/dpaux.h
@@ -32,6 +32,7 @@
 #define DPAUX_DP_AUXCTL_CMD_I2C_RQ (2 << 12)
 #define DPAUX_DP_AUXCTL_CMD_I2C_RD (1 << 12)
 #define DPAUX_DP_AUXCTL_CMD_I2C_WR (0 << 12)
+#define DPAUX_DP_AUXCTL_CMD_ADDRESS_ONLY (1 << 8)
 #define DPAUX_DP_AUXCTL_CMDLEN(x) ((x) & 0xff)
 #define DPAUX_DP_AUXSTAT 0x31
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 931490b9cfed..87df0b3674fd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1214,14 +1214,36 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
                SVGA3dCmdSurfaceDMA dma;
        } *cmd;
        int ret;
+        SVGA3dCmdSurfaceDMASuffix *suffix;
+        uint32_t bo_size;
        cmd = container_of(header, struct vmw_dma_cmd, header);
+        suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
+                                               header->size - sizeof(*suffix));
+        /* Make sure device and verifier stays in sync. */
+        if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
+                DRM_ERROR("Invalid DMA suffix size.\n");
+                return -EINVAL;
+        }
        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
                                      &cmd->dma.guest.ptr,
                                      &vmw_bo);
        if (unlikely(ret != 0))
                return ret;
+        /* Make sure DMA doesn't cross BO boundaries. */
+        bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
+        if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
+                DRM_ERROR("Invalid DMA offset.\n");
+                return -EINVAL;
+        }
+        bo_size -= cmd->dma.guest.ptr.offset;
+        if (unlikely(suffix->maximumOffset > bo_size))
+                suffix->maximumOffset = bo_size;
        ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
                                user_surface_converter, &cmd->dma.host.sid,
                                NULL);
diff --git a/drivers/gpu/host1x/hw/intr_hw.c b/drivers/gpu/host1x/hw/intr_hw.c
index db9017adfe2b..498b37e39058 100644
--- a/drivers/gpu/host1x/hw/intr_hw.c
+++ b/drivers/gpu/host1x/hw/intr_hw.c
@@ -47,7 +47,7 @@ static irqreturn_t syncpt_thresh_isr(int irq, void *dev_id)
        unsigned long reg;
        int i, id;
-        for (i = 0; i <= BIT_WORD(host->info->nb_pts); i++) {
+        for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); i++) {
                reg = host1x_sync_readl(host,
                        HOST1X_SYNC_SYNCPT_THRESH_CPU0_INT_STATUS(i));
                for_each_set_bit(id, &reg, BITS_PER_LONG) {
@@ -64,7 +64,7 @@ static void _host1x_intr_disable_all_syncpt_intrs(struct host1x *host)
 {
        u32 i;
-        for (i = 0; i <= BIT_WORD(host->info->nb_pts); ++i) {
+        for (i = 0; i < DIV_ROUND_UP(host->info->nb_pts, 32); ++i) {
                host1x_sync_writel(host, 0xffffffffu,
                        HOST1X_SYNC_SYNCPT_THRESH_INT_DISABLE(i));
                host1x_sync_writel(host, 0xffffffffu,
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 9e8064205bc7..da52279de939 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -718,6 +718,9 @@ static int hid_scan_main(struct hid_parser *parser, struct hid_item *item)
        case HID_MAIN_ITEM_TAG_END_COLLECTION:
                break;
        case HID_MAIN_ITEM_TAG_INPUT:
+                /* ignore constant inputs, they will be ignored by hid-input */
+                if (data & HID_MAIN_ITEM_CONSTANT)
+                        break;
                for (i = 0; i < parser->local.usage_index; i++)
                        hid_scan_input_usage(parser, parser->local.usage[i]);
                break;
@@ -1250,7 +1253,8 @@ EXPORT_SYMBOL_GPL(hid_output_report);
 static int hid_report_len(struct hid_report *report)
 {
-        return ((report->size - 1) >> 3) + 1 + (report->id > 0) + 7;
+        /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
+        return ((report->size - 1) >> 3) + 1 + (report->id > 0);
 }
 /*
@@ -1263,7 +1267,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
         * of implement() working on 8 byte chunks
         */
-        int len = hid_report_len(report);
+        int len = hid_report_len(report) + 7;
        return kmalloc(len, flags);
 }
@@ -1821,8 +1825,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_OFFICE_KB) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index bd221263c739..34bb2205d2ea 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -301,6 +301,9 @@
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
+#define USB_VENDOR_ID_ELITEGROUP        0x03fc
+#define USB_DEVICE_ID_ELITEGROUP_05D8   0x05d8
 #define USB_VENDOR_ID_ELO               0x04E7
 #define USB_DEVICE_ID_ELO_TS2515        0x0022
 #define USB_DEVICE_ID_ELO_TS2700        0x0020
@@ -455,7 +458,8 @@
 #define USB_VENDOR_ID_INTEL_0           0x8086
 #define USB_VENDOR_ID_INTEL_1           0x8087
-#define USB_DEVICE_ID_INTEL_HID_SENSOR  0x09fa
+#define USB_DEVICE_ID_INTEL_HID_SENSOR_0        0x09fa
+#define USB_DEVICE_ID_INTEL_HID_SENSOR_1        0x0a04
 #define USB_VENDOR_ID_STM_0             0x0483
 #define USB_DEVICE_ID_STM_HID_SENSOR    0x91d1
@@ -629,8 +633,6 @@
 #define USB_DEVICE_ID_MS_PRESENTER_8K_USB       0x0713
 #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K       0x0730
 #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500     0x076c
-#define USB_DEVICE_ID_MS_TOUCH_COVER_2  0x07a7
-#define USB_DEVICE_ID_MS_TYPE_COVER_2   0x07a9
 #define USB_VENDOR_ID_MOJO              0x8282
 #define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
@@ -835,6 +837,10 @@
 #define USB_DEVICE_ID_SYNAPTICS_LTS2    0x1d10
 #define USB_DEVICE_ID_SYNAPTICS_HD      0x0ac3
 #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
+#define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+#define USB_VENDOR_ID_TEXAS_INSTRUMENTS 0x2047
+#define USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA     0x0855
 #define USB_VENDOR_ID_THINGM            0x27b8
 #define USB_DEVICE_ID_BLINK1            0x01ed
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index 6fd58175a291..8ba17a946f2a 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -274,10 +274,6 @@ static const struct hid_device_id ms_devices[] = {
                .driver_data = MS_NOGET },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
                .driver_data = MS_DUPLICATE_USAGES },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2),
-                .driver_data = 0 },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2),
-                .driver_data = 0 },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
                .driver_data = MS_PRESENTER },
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 35278e43c7a4..51e25b9407f2 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1155,6 +1155,11 @@ static const struct hid_device_id mt_devices[] = {
                MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
                        USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+        /* Elitegroup panel */
+        { .driver_data = MT_CLS_SERIAL,
+                MT_USB_DEVICE(USB_VENDOR_ID_ELITEGROUP,
+                        USB_DEVICE_ID_ELITEGROUP_05D8) },
        /* Flatfrog Panels */
        { .driver_data = MT_CLS_FLATFROG,
                MT_USB_DEVICE(USB_VENDOR_ID_FLATFROG,
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 5182031f7b52..be14b5690e94 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -697,14 +697,20 @@ static void sensor_hub_remove(struct hid_device *hdev)
 static const struct hid_device_id sensor_hub_devices[] = {
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_INTEL_0,
-                        USB_DEVICE_ID_INTEL_HID_SENSOR),
+                        USB_DEVICE_ID_INTEL_HID_SENSOR_0),
                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_INTEL_1,
-                        USB_DEVICE_ID_INTEL_HID_SENSOR),
+                        USB_DEVICE_ID_INTEL_HID_SENSOR_0),
+                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
+        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_INTEL_1,
+                        USB_DEVICE_ID_INTEL_HID_SENSOR_1),
                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_STM_0,
                        USB_DEVICE_ID_STM_HID_SENSOR),
                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
+        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_TEXAS_INSTRUMENTS,
+                        USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA),
+                        .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, HID_ANY_ID,
                     HID_ANY_ID) },
        { }
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 69204afea7a4..908de2789219 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -1721,8 +1721,6 @@ static void sony_remove(struct hid_device *hdev)
        if (sc->quirks & SONY_LED_SUPPORT)
                sony_leds_remove(hdev);
-        if (sc->worker_initialized)
-                cancel_work_sync(&sc->state_worker);
        if (sc->quirks & SONY_BATTERY_SUPPORT) {
                hid_hw_close(hdev);
                sony_battery_remove(sc);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index dbd83878ff99..8e4ddb369883 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -119,6 +119,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
        { 0, 0 }
 };
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index f2d7bf90c9fe..2e7801af466e 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -55,6 +55,9 @@ static __u32 vmbus_get_next_version(__u32 current_version)
        case (VERSION_WIN8):
                return VERSION_WIN7;
+        case (VERSION_WIN8_1):
+                return VERSION_WIN8;
        case (VERSION_WS2008):
        default:
                return VERSION_INVAL;
@@ -77,7 +80,7 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo,
        msg->interrupt_page = virt_to_phys(vmbus_connection.int_page);
        msg->monitor_page1 = virt_to_phys(vmbus_connection.monitor_pages[0]);
        msg->monitor_page2 = virt_to_phys(vmbus_connection.monitor_pages[1]);
-        if (version == VERSION_WIN8)
+        if (version == VERSION_WIN8_1)
                msg->target_vcpu = hv_context.vp_index[smp_processor_id()];
        /*
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index bc196f49ec53..4af0da96c2e2 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1053,7 +1053,7 @@ config SENSORS_PC87427
 config SENSORS_NTC_THERMISTOR
        tristate "NTC thermistor support"
-        depends on (!OF && !IIO) || (OF && IIO)
+        depends on !OF || IIO=n || IIO
        help
          This driver supports NTC thermistors sensor reading and its
          interpretation. The driver can also monitor the temperature and
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 6d02e3b06375..d76f0b70c6e0 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -365,12 +365,12 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
                if (cpu_has_tjmax(c))
                        dev_warn(dev, "Unable to read TjMax from CPU %u\n", id);
        } else {
-                val = (eax >> 16) & 0x7f;
+                val = (eax >> 16) & 0xff;
                /*
                 * If the TjMax is not plausible, an assumption
                 * will be used
                 */
-                if (val >= 85) {
+                if (val) {
                        dev_dbg(dev, "TjMax is %d degrees C\n", val);
                        return val * 1000;
                }
diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
index 90ec1173b8a1..01723f04fe45 100644
--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -163,7 +163,7 @@ static ssize_t store_hyst(struct device *dev,
        if (retval < 0)
                goto fail;
-        hyst = val - retval * 1000;
+        hyst = retval * 1000 - val;
        hyst = DIV_ROUND_CLOSEST(hyst, 1000);
        if (hyst < 0 || hyst > 255) {
                retval = -ERANGE;
@@ -330,7 +330,7 @@ static int emc1403_detect(struct i2c_client *client,
        }
        id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
-        if (id != 0x01)
+        if (id < 0x01 || id > 0x04)
                return -ENODEV;
        return 0;
@@ -355,9 +355,9 @@ static int emc1403_probe(struct i2c_client *client,
        if (id->driver_data)
                data->groups[1] = &emc1404_group;
-        hwmon_dev = hwmon_device_register_with_groups(&client->dev,
+        hwmon_dev = devm_hwmon_device_register_with_groups(&client->dev,
-                                                      client->name, data,
+                                                           client->name, data,
-                                                      data->groups);
+                                                           data->groups);
        if (IS_ERR(hwmon_dev))
                return PTR_ERR(hwmon_dev);
diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c
index c104cc32989d..c9cddf5f056b 100644
--- a/drivers/hwmon/ltc2945.c
+++ b/drivers/hwmon/ltc2945.c
@@ -1,4 +1,4 @@
-/*
+    /*
 * Driver for Linear Technology LTC2945 I2C Power Monitor
 *
 * Copyright (c) 2014 Guenter Roeck
@@ -314,8 +314,8 @@ static ssize_t ltc2945_reset_history(struct device *dev,
                reg = LTC2945_MAX_ADIN_H;
                break;
        default:
-                BUG();
+                WARN_ONCE(1, "Bad register: 0x%x\n", reg);
-                break;
+                return -EINVAL;
        }
        /* Reset maximum */
        ret = regmap_bulk_write(regmap, reg, buf_max, num_regs);
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index 8a17f01e8672..e76feb86a1d4 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -44,6 +44,7 @@ struct ntc_compensation {
        unsigned int    ohm;
 };
+/* Order matters, ntc_match references the entries by index */
 static const struct platform_device_id ntc_thermistor_id[] = {
        { "ncp15wb473", TYPE_NCPXXWB473 },
        { "ncp18wb473", TYPE_NCPXXWB473 },
@@ -141,7 +142,7 @@ struct ntc_data {
        char name[PLATFORM_NAME_SIZE];
 };
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && IS_ENABLED(CONFIG_IIO)
 static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 {
        struct iio_channel *channel = pdata->chan;
@@ -163,15 +164,15 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 static const struct of_device_id ntc_match[] = {
        { .compatible = "ntc,ncp15wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[0] },
        { .compatible = "ntc,ncp18wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[1] },
        { .compatible = "ntc,ncp21wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[2] },
        { .compatible = "ntc,ncp03wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[3] },
        { .compatible = "ntc,ncp15wl333",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWL333] },
+                .data = &ntc_thermistor_id[4] },
        { },
 };
 MODULE_DEVICE_TABLE(of, ntc_match);
@@ -223,6 +224,8 @@ ntc_thermistor_parse_dt(struct platform_device *pdev)
        return NULL;
 }
+#define ntc_match       NULL
 static void ntc_iio_channel_release(struct ntc_thermistor_platform_data *pdata)
 { }
 #endif
diff --git a/drivers/hwmon/vexpress.c b/drivers/hwmon/vexpress.c
index d867e6bb2be1..8242b75d96c8 100644
--- a/drivers/hwmon/vexpress.c
+++ b/drivers/hwmon/vexpress.c
@@ -27,15 +27,15 @@
 struct vexpress_hwmon_data {
        struct device *hwmon_dev;
        struct vexpress_config_func *func;
+        const char *name;
 };
 static ssize_t vexpress_hwmon_name_show(struct device *dev,
                struct device_attribute *dev_attr, char *buffer)
 {
-        const char *compatible = of_get_property(dev->of_node, "compatible",
+        struct vexpress_hwmon_data *data = dev_get_drvdata(dev);
-                        NULL);
-        return sprintf(buffer, "%s\n", compatible);
+        return sprintf(buffer, "%s\n", data->name);
 }
 static ssize_t vexpress_hwmon_label_show(struct device *dev,
@@ -43,9 +43,6 @@ static ssize_t vexpress_hwmon_label_show(struct device *dev,
 {
        const char *label = of_get_property(dev->of_node, "label", NULL);
-        if (!label)
-                return -ENOENT;
        return snprintf(buffer, PAGE_SIZE, "%s\n", label);
 }
@@ -84,6 +81,20 @@ static ssize_t vexpress_hwmon_u64_show(struct device *dev,
                        to_sensor_dev_attr(dev_attr)->index));
 }
+static umode_t vexpress_hwmon_attr_is_visible(struct kobject *kobj,
+                struct attribute *attr, int index)
+{
+        struct device *dev = kobj_to_dev(kobj);
+        struct device_attribute *dev_attr = container_of(attr,
+                                struct device_attribute, attr);
+        if (dev_attr->show == vexpress_hwmon_label_show &&
+                        !of_get_property(dev->of_node, "label", NULL))
+                return 0;
+        return attr->mode;
+}
 static DEVICE_ATTR(name, S_IRUGO, vexpress_hwmon_name_show, NULL);
 #define VEXPRESS_HWMON_ATTRS(_name, _label_attr, _input_attr)   \
@@ -94,14 +105,27 @@ struct attribute *vexpress_hwmon_attrs_##_name[] = {		\
        NULL                                                    \
 }
+struct vexpress_hwmon_type {
+        const char *name;
+        const struct attribute_group **attr_groups;
+};
 #if !defined(CONFIG_REGULATOR_VEXPRESS)
 static DEVICE_ATTR(in1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1000);
 static VEXPRESS_HWMON_ATTRS(volt, in1_label, in1_input);
 static struct attribute_group vexpress_hwmon_group_volt = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_volt,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_volt = {
+        .name = "vexpress_volt",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_volt,
+                NULL,
+        },
+};
 #endif
 static DEVICE_ATTR(curr1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
@@ -109,52 +133,84 @@ static SENSOR_DEVICE_ATTR(curr1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1000);
 static VEXPRESS_HWMON_ATTRS(amp, curr1_label, curr1_input);
 static struct attribute_group vexpress_hwmon_group_amp = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_amp,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_amp = {
+        .name = "vexpress_amp",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_amp,
+                NULL
+        },
+};
 static DEVICE_ATTR(temp1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1000);
 static VEXPRESS_HWMON_ATTRS(temp, temp1_label, temp1_input);
 static struct attribute_group vexpress_hwmon_group_temp = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_temp,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_temp = {
+        .name = "vexpress_temp",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_temp,
+                NULL
+        },
+};
 static DEVICE_ATTR(power1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, vexpress_hwmon_u32_show,
                NULL, 1);
 static VEXPRESS_HWMON_ATTRS(power, power1_label, power1_input);
 static struct attribute_group vexpress_hwmon_group_power = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_power,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_power = {
+        .name = "vexpress_power",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_power,
+                NULL
+        },
+};
 static DEVICE_ATTR(energy1_label, S_IRUGO, vexpress_hwmon_label_show, NULL);
 static SENSOR_DEVICE_ATTR(energy1_input, S_IRUGO, vexpress_hwmon_u64_show,
                NULL, 1);
 static VEXPRESS_HWMON_ATTRS(energy, energy1_label, energy1_input);
 static struct attribute_group vexpress_hwmon_group_energy = {
+        .is_visible = vexpress_hwmon_attr_is_visible,
        .attrs = vexpress_hwmon_attrs_energy,
 };
+static struct vexpress_hwmon_type vexpress_hwmon_energy = {
+        .name = "vexpress_energy",
+        .attr_groups = (const struct attribute_group *[]) {
+                &vexpress_hwmon_group_energy,
+                NULL
+        },
+};
 static struct of_device_id vexpress_hwmon_of_match[] = {
 #if !defined(CONFIG_REGULATOR_VEXPRESS)
        {
                .compatible = "arm,vexpress-volt",
-                .data = &vexpress_hwmon_group_volt,
+                .data = &vexpress_hwmon_volt,
        },
 #endif
        {
                .compatible = "arm,vexpress-amp",
-                .data = &vexpress_hwmon_group_amp,
+                .data = &vexpress_hwmon_amp,
        }, {
                .compatible = "arm,vexpress-temp",
-                .data = &vexpress_hwmon_group_temp,
+                .data = &vexpress_hwmon_temp,
        }, {
                .compatible = "arm,vexpress-power",
-                .data = &vexpress_hwmon_group_power,
+                .data = &vexpress_hwmon_power,
        }, {
                .compatible = "arm,vexpress-energy",
-                .data = &vexpress_hwmon_group_energy,
+                .data = &vexpress_hwmon_energy,
        },
        {}
 };
@@ -165,6 +221,7 @@ static int vexpress_hwmon_probe(struct platform_device *pdev)
        int err;
        const struct of_device_id *match;
        struct vexpress_hwmon_data *data;
+        const struct vexpress_hwmon_type *type;
        data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
        if (!data)
@@ -174,12 +231,14 @@ static int vexpress_hwmon_probe(struct platform_device *pdev)
        match = of_match_device(vexpress_hwmon_of_match, &pdev->dev);
        if (!match)
                return -ENODEV;
+        type = match->data;
+        data->name = type->name;
        data->func = vexpress_config_func_get_by_dev(&pdev->dev);
        if (!data->func)
                return -ENODEV;
-        err = sysfs_create_group(&pdev->dev.kobj, match->data);
+        err = sysfs_create_groups(&pdev->dev.kobj, type->attr_groups);
        if (err)
                goto error;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 22e92c3d3d07..3c20e4bd6dd1 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -422,6 +422,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
         */
        dw_writel(dev, msgs[dev->msg_write_idx].addr | ic_tar, DW_IC_TAR);
+        /* enforce disabled interrupts (due to HW issues) */
+        i2c_dw_disable_int(dev);
        /* Enable the adapter */
        __i2c_dw_enable(dev, true);
diff --git a/drivers/i2c/busses/i2c-nomadik.c b/drivers/i2c/busses/i2c-nomadik.c
index 28cbe1b2a2ec..32c85e9ecdae 100644
--- a/drivers/i2c/busses/i2c-nomadik.c
+++ b/drivers/i2c/busses/i2c-nomadik.c
@@ -999,7 +999,7 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id)
        dev->virtbase = devm_ioremap(&adev->dev, adev->res.start,
                                resource_size(&adev->res));
-        if (IS_ERR(dev->virtbase)) {
+        if (!dev->virtbase) {
                ret = -ENOMEM;
                goto err_no_mem;
        }
diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
index 1b4cf14f1106..2a5efb5b487c 100644
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -479,7 +479,7 @@ static int qup_i2c_xfer(struct i2c_adapter *adap,
        int ret, idx;
        ret = pm_runtime_get_sync(qup->dev);
-        if (ret)
+        if (ret < 0)
                goto out;
        writel(1, qup->base + QUP_SW_RESET);
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index d4fa8eba6e9d..06d47aafbb79 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -561,6 +561,12 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
        ret = -EINVAL;
        for (i = 0; i < num; i++) {
+                /* This HW can't send STOP after address phase */
+                if (msgs[i].len == 0) {
+                        ret = -EOPNOTSUPP;
+                        break;
+                }
                /*-------------- spin lock -----------------*/
                spin_lock_irqsave(&priv->lock, flags);
@@ -625,7 +631,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 static u32 rcar_i2c_func(struct i2c_adapter *adap)
 {
-        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+        /* This HW can't do SMBUS_QUICK and NOSTART */
+        return I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK);
 }
 static const struct i2c_algorithm rcar_i2c_algo = {
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index ae4491062e41..bb3a9964f7e0 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1276,10 +1276,10 @@ static int s3c24xx_i2c_resume(struct device *dev)
        struct platform_device *pdev = to_platform_device(dev);
        struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
-        i2c->suspended = 0;
        clk_prepare_enable(i2c->clk);
        s3c24xx_i2c_init(i2c);
        clk_disable_unprepare(i2c->clk);
+        i2c->suspended = 0;
        return 0;
 }
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index a43220c2e3d9..4d140bbbe100 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -750,9 +750,10 @@ void intel_idle_state_table_update(void)
                        if (package_num + 1 > num_sockets) {
                                num_sockets = package_num + 1;
-                                if (num_sockets > 4)
+                                if (num_sockets > 4) {
                                        cpuidle_state_table = ivt_cstates_8s;
                                        return;
+                                }
                        }
                }
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index d86196cfe4b4..24c28e3f93a3 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -106,7 +106,7 @@ config AT91_ADC
          Say yes here to build support for Atmel AT91 ADC.
 config EXYNOS_ADC
-        bool "Exynos ADC driver support"
+        tristate "Exynos ADC driver support"
        depends on OF
        help
          Core support for the ADC block found in the Samsung EXYNOS series
@@ -114,7 +114,7 @@ config EXYNOS_ADC
          this resource.
 config LP8788_ADC
-        bool "LP8788 ADC driver"
+        tristate "LP8788 ADC driver"
        depends on MFD_LP8788
        help
          Say yes here to build support for TI LP8788 ADC.
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 5b1aa027c034..89777ed9abd8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -765,14 +765,17 @@ static int at91_adc_probe_pdata(struct at91_adc_state *st,
        if (!pdata)
                return -EINVAL;
+        st->caps = (struct at91_adc_caps *)
+                        platform_get_device_id(pdev)->driver_data;
        st->use_external = pdata->use_external_triggers;
        st->vref_mv = pdata->vref;
        st->channels_mask = pdata->channels_used;
-        st->num_channels = pdata->num_channels;
+        st->num_channels = st->caps->num_channels;
        st->startup_time = pdata->startup_time;
        st->trigger_number = pdata->trigger_number;
        st->trigger_list = pdata->trigger_list;
-        st->registers = pdata->registers;
+        st->registers = &st->caps->registers;
        return 0;
 }
@@ -1004,8 +1007,11 @@ static int at91_adc_probe(struct platform_device *pdev)
         * the best converted final value between two channels selection
         * The formula thus is : Sample and Hold Time = (shtim + 1) / ADCClock
         */
-        shtim = round_up((st->sample_hold_time * adc_clk_khz /
+        if (st->sample_hold_time > 0)
-                          1000) - 1, 1);
+                shtim = round_up((st->sample_hold_time * adc_clk_khz / 1000)
+                                 - 1, 1);
+        else
+                shtim = 0;
        reg = AT91_ADC_PRESCAL_(prsc) & st->registers->mr_prescal_mask;
        reg |= AT91_ADC_STARTUP_(ticks) & st->registers->mr_startup_mask;
@@ -1101,7 +1107,6 @@ static int at91_adc_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_OF
 static struct at91_adc_caps at91sam9260_caps = {
        .calc_startup_ticks = calc_startup_ticks_9260,
        .num_channels = 4,
@@ -1154,11 +1159,27 @@ static const struct of_device_id at91_adc_dt_ids[] = {
        {},
 };
 MODULE_DEVICE_TABLE(of, at91_adc_dt_ids);
-#endif
+static const struct platform_device_id at91_adc_ids[] = {
+        {
+                .name = "at91sam9260-adc",
+                .driver_data = (unsigned long)&at91sam9260_caps,
+        }, {
+                .name = "at91sam9g45-adc",
+                .driver_data = (unsigned long)&at91sam9g45_caps,
+        }, {
+                .name = "at91sam9x5-adc",
+                .driver_data = (unsigned long)&at91sam9x5_caps,
+        }, {
+                /* terminator */
+        }
+};
+MODULE_DEVICE_TABLE(platform, at91_adc_ids);
 static struct platform_driver at91_adc_driver = {
        .probe = at91_adc_probe,
        .remove = at91_adc_remove,
+        .id_table = at91_adc_ids,
        .driver = {
                   .name = DRIVER_NAME,
                   .of_match_table = of_match_ptr(at91_adc_dt_ids),
diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c
index d25b262193a7..affa93f51789 100644
--- a/drivers/iio/adc/exynos_adc.c
+++ b/drivers/iio/adc/exynos_adc.c
@@ -344,7 +344,7 @@ static int exynos_adc_probe(struct platform_device *pdev)
        exynos_adc_hw_init(info);
-        ret = of_platform_populate(np, exynos_adc_match, NULL, &pdev->dev);
+        ret = of_platform_populate(np, exynos_adc_match, NULL, &indio_dev->dev);
        if (ret < 0) {
                dev_err(&pdev->dev, "failed adding child nodes\n");
                goto err_of_populate;
@@ -353,7 +353,7 @@ static int exynos_adc_probe(struct platform_device *pdev)
        return 0;
 err_of_populate:
-        device_for_each_child(&pdev->dev, NULL,
+        device_for_each_child(&indio_dev->dev, NULL,
                                exynos_adc_remove_devices);
        regulator_disable(info->vdd);
        clk_disable_unprepare(info->clk);
@@ -369,7 +369,7 @@ static int exynos_adc_remove(struct platform_device *pdev)
        struct iio_dev *indio_dev = platform_get_drvdata(pdev);
        struct exynos_adc *info = iio_priv(indio_dev);
-        device_for_each_child(&pdev->dev, NULL,
+        device_for_each_child(&indio_dev->dev, NULL,
                                exynos_adc_remove_devices);
        regulator_disable(info->vdd);
        clk_disable_unprepare(info->clk);
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index cb9f96b446a5..d8ad606c7cd0 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -660,6 +660,7 @@ static int inv_mpu_probe(struct i2c_client *client,
 {
        struct inv_mpu6050_state *st;
        struct iio_dev *indio_dev;
+        struct inv_mpu6050_platform_data *pdata;
        int result;
        if (!i2c_check_functionality(client->adapter,
@@ -672,8 +673,10 @@ static int inv_mpu_probe(struct i2c_client *client,
        st = iio_priv(indio_dev);
        st->client = client;
-        st->plat_data = *(struct inv_mpu6050_platform_data
+        pdata = (struct inv_mpu6050_platform_data
-                                *)dev_get_platdata(&client->dev);
+                        *)dev_get_platdata(&client->dev);
+        if (pdata)
+                st->plat_data = *pdata;
        /* power is turned on inside check chip type*/
        result = inv_check_and_setup_chip(st, id);
        if (result)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index e108f2a9d827..e472cff6eeae 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -165,7 +165,8 @@ static ssize_t iio_scan_el_show(struct device *dev,
        int ret;
        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-        ret = test_bit(to_iio_dev_attr(attr)->address,
+        /* Ensure ret is 0 or 1. */
+        ret = !!test_bit(to_iio_dev_attr(attr)->address,
                       indio_dev->buffer->scan_mask);
        return sprintf(buf, "%d\n", ret);
@@ -862,7 +863,8 @@ int iio_scan_mask_query(struct iio_dev *indio_dev,
        if (!buffer->scan_mask)
                return 0;
-        return test_bit(bit, buffer->scan_mask);
+        /* Ensure return value is 0 or 1. */
+        return !!test_bit(bit, buffer->scan_mask);
 };
 EXPORT_SYMBOL_GPL(iio_scan_mask_query);
diff --git a/drivers/iio/light/cm32181.c b/drivers/iio/light/cm32181.c
index 47a6dbac2d0c..d976e6ce60db 100644
--- a/drivers/iio/light/cm32181.c
+++ b/drivers/iio/light/cm32181.c
@@ -221,6 +221,7 @@ static int cm32181_read_raw(struct iio_dev *indio_dev,
                *val = cm32181->calibscale;
                return IIO_VAL_INT;
        case IIO_CHAN_INFO_INT_TIME:
+                *val = 0;
                ret = cm32181_read_als_it(cm32181, val2);
                return ret;
        }
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index a45e07492db3..39fc67e82138 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -652,7 +652,19 @@ static int cm36651_probe(struct i2c_client *client,
        cm36651->client = client;
        cm36651->ps_client = i2c_new_dummy(client->adapter,
                                                     CM36651_I2C_ADDR_PS);
+        if (!cm36651->ps_client) {
+                dev_err(&client->dev, "%s: new i2c device failed\n", __func__);
+                ret = -ENODEV;
+                goto error_disable_reg;
+        }
        cm36651->ara_client = i2c_new_dummy(client->adapter, CM36651_ARA);
+        if (!cm36651->ara_client) {
+                dev_err(&client->dev, "%s: new i2c device failed\n", __func__);
+                ret = -ENODEV;
+                goto error_i2c_unregister_ps;
+        }
        mutex_init(&cm36651->lock);
        indio_dev->dev.parent = &client->dev;
        indio_dev->channels = cm36651_channels;
@@ -664,7 +676,7 @@ static int cm36651_probe(struct i2c_client *client,
        ret = cm36651_setup_reg(cm36651);
        if (ret) {
                dev_err(&client->dev, "%s: register setup failed\n", __func__);
-                goto error_disable_reg;
+                goto error_i2c_unregister_ara;
        }
        ret = request_threaded_irq(client->irq, NULL, cm36651_irq_handler,
@@ -672,7 +684,7 @@ static int cm36651_probe(struct i2c_client *client,
                                                        "cm36651", indio_dev);
        if (ret) {
                dev_err(&client->dev, "%s: request irq failed\n", __func__);
-                goto error_disable_reg;
+                goto error_i2c_unregister_ara;
        }
        ret = iio_device_register(indio_dev);
@@ -685,6 +697,10 @@ static int cm36651_probe(struct i2c_client *client,
 error_free_irq:
        free_irq(client->irq, indio_dev);
+error_i2c_unregister_ara:
+        i2c_unregister_device(cm36651->ara_client);
+error_i2c_unregister_ps:
+        i2c_unregister_device(cm36651->ps_client);
 error_disable_reg:
        regulator_disable(cm36651->vled_reg);
        return ret;
@@ -698,6 +714,8 @@ static int cm36651_remove(struct i2c_client *client)
        iio_device_unregister(indio_dev);
        regulator_disable(cm36651->vled_reg);
        free_irq(client->irq, indio_dev);
+        i2c_unregister_device(cm36651->ps_client);
+        i2c_unregister_device(cm36651->ara_client);
        return 0;
 }
diff --git a/drivers/infiniband/hw/cxgb4/Kconfig b/drivers/infiniband/hw/cxgb4/Kconfig
index d4e8983fba53..23f38cf2c5cd 100644
--- a/drivers/infiniband/hw/cxgb4/Kconfig
+++ b/drivers/infiniband/hw/cxgb4/Kconfig
@@ -1,10 +1,10 @@
 config INFINIBAND_CXGB4
-        tristate "Chelsio T4 RDMA Driver"
+        tristate "Chelsio T4/T5 RDMA Driver"
        depends on CHELSIO_T4 && INET && (IPV6 || IPV6=n)
        select GENERIC_ALLOCATOR
        ---help---
-          This is an iWARP/RDMA driver for the Chelsio T4 1GbE and
+          This is an iWARP/RDMA driver for the Chelsio T4 and T5
-          10GbE adapters.
+          1GbE, 10GbE adapters and T5 40GbE adapter.
          For general information about Chelsio and our products, visit
          our website at <http://www.chelsio.com>.
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 02436d5d0dab..1f863a96a480 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -173,12 +173,15 @@ static void start_ep_timer(struct c4iw_ep *ep)
        add_timer(&ep->timer);
 }
-static void stop_ep_timer(struct c4iw_ep *ep)
+static int stop_ep_timer(struct c4iw_ep *ep)
 {
        PDBG("%s ep %p stopping\n", __func__, ep);
        del_timer_sync(&ep->timer);
-        if (!test_and_set_bit(TIMEOUT, &ep->com.flags))
+        if (!test_and_set_bit(TIMEOUT, &ep->com.flags)) {
                c4iw_put_ep(&ep->com);
+                return 0;
+        }
+        return 1;
 }
 static int c4iw_l2t_send(struct c4iw_rdev *rdev, struct sk_buff *skb,
@@ -584,6 +587,10 @@ static int send_connect(struct c4iw_ep *ep)
                opt2 |= SACK_EN(1);
        if (wscale && enable_tcp_window_scaling)
                opt2 |= WND_SCALE_EN(1);
+        if (is_t5(ep->com.dev->rdev.lldi.adapter_type)) {
+                opt2 |= T5_OPT_2_VALID;
+                opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
+        }
        t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
        if (is_t4(ep->com.dev->rdev.lldi.adapter_type)) {
@@ -993,7 +1000,7 @@ static void close_complete_upcall(struct c4iw_ep *ep, int status)
 static int abort_connection(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
 {
        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
-        state_set(&ep->com, ABORTING);
+        __state_set(&ep->com, ABORTING);
        set_bit(ABORT_CONN, &ep->com.history);
        return send_abort(ep, skb, gfp);
 }
@@ -1151,7 +1158,7 @@ static int update_rx_credits(struct c4iw_ep *ep, u32 credits)
        return credits;
 }
-static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
+static int process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
 {
        struct mpa_message *mpa;
        struct mpa_v2_conn_params *mpa_v2_params;
@@ -1161,17 +1168,17 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
        struct c4iw_qp_attributes attrs;
        enum c4iw_qp_attr_mask mask;
        int err;
+        int disconnect = 0;
        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
        /*
-         * Stop mpa timer.  If it expired, then the state has
+         * Stop mpa timer.  If it expired, then
-         * changed and we bail since ep_timeout already aborted
+         * we ignore the MPA reply.  process_timeout()
-         * the connection.
+         * will abort the connection.
         */
-        stop_ep_timer(ep);
+        if (stop_ep_timer(ep))
-        if (ep->com.state != MPA_REQ_SENT)
+                return 0;
-                return;
        /*
         * If we get more than the supported amount of private data
@@ -1193,7 +1200,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
         * if we don't even have the mpa message, then bail.
         */
        if (ep->mpa_pkt_len < sizeof(*mpa))
-                return;
+                return 0;
        mpa = (struct mpa_message *) ep->mpa_pkt;
        /* Validate MPA header. */
@@ -1233,7 +1240,7 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
         * We'll continue process when more data arrives.
         */
        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
-                return;
+                return 0;
        if (mpa->flags & MPA_REJECT) {
                err = -ECONNREFUSED;
@@ -1335,9 +1342,11 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
                attrs.layer_etype = LAYER_MPA | DDP_LLP;
                attrs.ecode = MPA_NOMATCH_RTR;
                attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                attrs.send_term = 1;
                err = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
                err = -ENOMEM;
+                disconnect = 1;
                goto out;
        }
@@ -1353,9 +1362,11 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
                attrs.layer_etype = LAYER_MPA | DDP_LLP;
                attrs.ecode = MPA_INSUFF_IRD;
                attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                attrs.send_term = 1;
                err = c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                                C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
                err = -ENOMEM;
+                disconnect = 1;
                goto out;
        }
        goto out;
@@ -1364,7 +1375,7 @@ err:
        send_abort(ep, skb, GFP_KERNEL);
 out:
        connect_reply_upcall(ep, err);
-        return;
+        return disconnect;
 }
 static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
@@ -1375,15 +1386,12 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
-        if (ep->com.state != MPA_REQ_WAIT)
-                return;
        /*
         * If we get more than the supported amount of private data
         * then we must fail this connection.
         */
        if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                abort_connection(ep, skb, GFP_KERNEL);
                return;
        }
@@ -1413,13 +1421,13 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
        if (mpa->revision > mpa_rev) {
                printk(KERN_ERR MOD "%s MPA version mismatch. Local = %d,"
                       " Received = %d\n", __func__, mpa_rev, mpa->revision);
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                abort_connection(ep, skb, GFP_KERNEL);
                return;
        }
        if (memcmp(mpa->key, MPA_KEY_REQ, sizeof(mpa->key))) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                abort_connection(ep, skb, GFP_KERNEL);
                return;
        }
@@ -1430,7 +1438,7 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
         * Fail if there's too much private data.
         */
        if (plen > MPA_MAX_PRIVATE_DATA) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                abort_connection(ep, skb, GFP_KERNEL);
                return;
        }
@@ -1439,7 +1447,7 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
         * If plen does not account for pkt size
         */
        if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                abort_connection(ep, skb, GFP_KERNEL);
                return;
        }
@@ -1496,18 +1504,24 @@ static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
             ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version,
             ep->mpa_attr.p2p_type);
-        __state_set(&ep->com, MPA_REQ_RCVD);
+        /*
-        stop_ep_timer(ep);
+         * If the endpoint timer already expired, then we ignore
+         * the start request.  process_timeout() will abort
-        /* drive upcall */
+         * the connection.
-        mutex_lock(&ep->parent_ep->com.mutex);
+         */
-        if (ep->parent_ep->com.state != DEAD) {
+        if (!stop_ep_timer(ep)) {
-                if (connect_request_upcall(ep))
+                __state_set(&ep->com, MPA_REQ_RCVD);
+                /* drive upcall */
+                mutex_lock(&ep->parent_ep->com.mutex);
+                if (ep->parent_ep->com.state != DEAD) {
+                        if (connect_request_upcall(ep))
+                                abort_connection(ep, skb, GFP_KERNEL);
+                } else {
                        abort_connection(ep, skb, GFP_KERNEL);
-        } else {
+                }
-                abort_connection(ep, skb, GFP_KERNEL);
+                mutex_unlock(&ep->parent_ep->com.mutex);
        }
-        mutex_unlock(&ep->parent_ep->com.mutex);
        return;
 }
@@ -1519,6 +1533,7 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
        unsigned int tid = GET_TID(hdr);
        struct tid_info *t = dev->rdev.lldi.tids;
        __u8 status = hdr->status;
+        int disconnect = 0;
        ep = lookup_tid(t, tid);
        if (!ep)
@@ -1534,7 +1549,7 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
        switch (ep->com.state) {
        case MPA_REQ_SENT:
                ep->rcv_seq += dlen;
-                process_mpa_reply(ep, skb);
+                disconnect = process_mpa_reply(ep, skb);
                break;
        case MPA_REQ_WAIT:
                ep->rcv_seq += dlen;
@@ -1550,13 +1565,16 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
                               ep->com.state, ep->hwtid, status);
                attrs.next_state = C4IW_QP_STATE_TERMINATE;
                c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+                disconnect = 1;
                break;
        }
        default:
                break;
        }
        mutex_unlock(&ep->com.mutex);
+        if (disconnect)
+                c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
        return 0;
 }
@@ -2004,6 +2022,10 @@ static void accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
                if (tcph->ece && tcph->cwr)
                        opt2 |= CCTRL_ECN(1);
        }
+        if (is_t5(ep->com.dev->rdev.lldi.adapter_type)) {
+                opt2 |= T5_OPT_2_VALID;
+                opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
+        }
        rpl = cplhdr(skb);
        INIT_TP_WR(rpl, ep->hwtid);
@@ -2265,7 +2287,7 @@ static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
                disconnect = 0;
                break;
        case MORIBUND:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                if (ep->com.cm_id && ep->com.qp) {
                        attrs.next_state = C4IW_QP_STATE_IDLE;
                        c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
@@ -2325,10 +2347,10 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
        case CONNECTING:
                break;
        case MPA_REQ_WAIT:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                break;
        case MPA_REQ_SENT:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1))
                        connect_reply_upcall(ep, -ECONNRESET);
                else {
@@ -2433,7 +2455,7 @@ static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
                __state_set(&ep->com, MORIBUND);
                break;
        case MORIBUND:
-                stop_ep_timer(ep);
+                (void)stop_ep_timer(ep);
                if ((ep->com.cm_id) && (ep->com.qp)) {
                        attrs.next_state = C4IW_QP_STATE_IDLE;
                        c4iw_modify_qp(ep->com.qp->rhp,
@@ -3028,7 +3050,7 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
                if (!test_and_set_bit(CLOSE_SENT, &ep->com.flags)) {
                        close = 1;
                        if (abrupt) {
-                                stop_ep_timer(ep);
+                                (void)stop_ep_timer(ep);
                                ep->com.state = ABORTING;
                        } else
                                ep->com.state = MORIBUND;
@@ -3462,14 +3484,24 @@ static void process_timeout(struct c4iw_ep *ep)
                __state_set(&ep->com, ABORTING);
                close_complete_upcall(ep, -ETIMEDOUT);
                break;
+        case ABORTING:
+        case DEAD:
+                /*
+                 * These states are expected if the ep timed out at the same
+                 * time as another thread was calling stop_ep_timer().
+                 * So we silently do nothing for these states.
+                 */
+                abort = 0;
+                break;
        default:
                WARN(1, "%s unexpected state ep %p tid %u state %u\n",
                        __func__, ep, ep->hwtid, ep->com.state);
                abort = 0;
        }
-        mutex_unlock(&ep->com.mutex);
        if (abort)
                abort_connection(ep, NULL, GFP_KERNEL);
+        mutex_unlock(&ep->com.mutex);
        c4iw_put_ep(&ep->com);
 }
@@ -3483,6 +3515,8 @@ static void process_timedout_eps(void)
                tmp = timeout_list.next;
                list_del(tmp);
+                tmp->next = NULL;
+                tmp->prev = NULL;
                spin_unlock_irq(&timeout_lock);
                ep = list_entry(tmp, struct c4iw_ep, entry);
                process_timeout(ep);
@@ -3499,6 +3533,7 @@ static void process_work(struct work_struct *work)
        unsigned int opcode;
        int ret;
+        process_timedout_eps();
        while ((skb = skb_dequeue(&rxq))) {
                rpl = cplhdr(skb);
                dev = *((struct c4iw_dev **) (skb->cb + sizeof(void *)));
@@ -3508,8 +3543,8 @@ static void process_work(struct work_struct *work)
                ret = work_handlers[opcode](dev, skb);
                if (!ret)
                        kfree_skb(skb);
+                process_timedout_eps();
        }
-        process_timedout_eps();
 }
 static DECLARE_WORK(skb_work, process_work);
@@ -3521,8 +3556,13 @@ static void ep_timeout(unsigned long arg)
        spin_lock(&timeout_lock);
        if (!test_and_set_bit(TIMEOUT, &ep->com.flags)) {
-                list_add_tail(&ep->entry, &timeout_list);
+                /*
-                kickit = 1;
+                 * Only insert if it is not already on the list.
+                 */
+                if (!ep->entry.next) {
+                        list_add_tail(&ep->entry, &timeout_list);
+                        kickit = 1;
+                }
        }
        spin_unlock(&timeout_lock);
        if (kickit)
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index ce468e542428..cfaa56ada189 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -235,27 +235,21 @@ int c4iw_flush_sq(struct c4iw_qp *qhp)
        struct t4_cq *cq = &chp->cq;
        int idx;
        struct t4_swsqe *swsqe;
-        int error = (qhp->attr.state != C4IW_QP_STATE_CLOSING &&
-                        qhp->attr.state != C4IW_QP_STATE_IDLE);
        if (wq->sq.flush_cidx == -1)
                wq->sq.flush_cidx = wq->sq.cidx;
        idx = wq->sq.flush_cidx;
        BUG_ON(idx >= wq->sq.size);
        while (idx != wq->sq.pidx) {
-                if (error) {
+                swsqe = &wq->sq.sw_sq[idx];
-                        swsqe = &wq->sq.sw_sq[idx];
+                BUG_ON(swsqe->flushed);
-                        BUG_ON(swsqe->flushed);
+                swsqe->flushed = 1;
-                        swsqe->flushed = 1;
+                insert_sq_cqe(wq, cq, swsqe);
-                        insert_sq_cqe(wq, cq, swsqe);
+                if (wq->sq.oldest_read == swsqe) {
-                        if (wq->sq.oldest_read == swsqe) {
+                        BUG_ON(swsqe->opcode != FW_RI_READ_REQ);
-                                BUG_ON(swsqe->opcode != FW_RI_READ_REQ);
+                        advance_oldest_read(wq);
-                                advance_oldest_read(wq);
-                        }
-                        flushed++;
-                } else {
-                        t4_sq_consume(wq);
                }
+                flushed++;
                if (++idx == wq->sq.size)
                        idx = 0;
        }
@@ -678,7 +672,7 @@ skip_cqe:
 static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
 {
        struct c4iw_qp *qhp = NULL;
-        struct t4_cqe cqe = {0, 0}, *rd_cqe;
+        struct t4_cqe uninitialized_var(cqe), *rd_cqe;
        struct t4_wq *wq;
        u32 credit = 0;
        u8 cqe_flushed;
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 9489a388376c..f4fa50a609e2 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -682,7 +682,10 @@ static void c4iw_dealloc(struct uld_ctx *ctx)
        idr_destroy(&ctx->dev->hwtid_idr);
        idr_destroy(&ctx->dev->stid_idr);
        idr_destroy(&ctx->dev->atid_idr);
-        iounmap(ctx->dev->rdev.oc_mw_kva);
+        if (ctx->dev->rdev.bar2_kva)
+                iounmap(ctx->dev->rdev.bar2_kva);
+        if (ctx->dev->rdev.oc_mw_kva)
+                iounmap(ctx->dev->rdev.oc_mw_kva);
        ib_dealloc_device(&ctx->dev->ibdev);
        ctx->dev = NULL;
 }
@@ -722,11 +725,31 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
        }
        devp->rdev.lldi = *infop;
-        devp->rdev.oc_mw_pa = pci_resource_start(devp->rdev.lldi.pdev, 2) +
+        /*
-                (pci_resource_len(devp->rdev.lldi.pdev, 2) -
+         * For T5 devices, we map all of BAR2 with WC.
-                 roundup_pow_of_two(devp->rdev.lldi.vr->ocq.size));
+         * For T4 devices with onchip qp mem, we map only that part
-        devp->rdev.oc_mw_kva = ioremap_wc(devp->rdev.oc_mw_pa,
+         * of BAR2 with WC.
-                                               devp->rdev.lldi.vr->ocq.size);
+         */
+        devp->rdev.bar2_pa = pci_resource_start(devp->rdev.lldi.pdev, 2);
+        if (is_t5(devp->rdev.lldi.adapter_type)) {
+                devp->rdev.bar2_kva = ioremap_wc(devp->rdev.bar2_pa,
+                        pci_resource_len(devp->rdev.lldi.pdev, 2));
+                if (!devp->rdev.bar2_kva) {
+                        pr_err(MOD "Unable to ioremap BAR2\n");
+                        return ERR_PTR(-EINVAL);
+                }
+        } else if (ocqp_supported(infop)) {
+                devp->rdev.oc_mw_pa =
+                        pci_resource_start(devp->rdev.lldi.pdev, 2) +
+                        pci_resource_len(devp->rdev.lldi.pdev, 2) -
+                        roundup_pow_of_two(devp->rdev.lldi.vr->ocq.size);
+                devp->rdev.oc_mw_kva = ioremap_wc(devp->rdev.oc_mw_pa,
+                        devp->rdev.lldi.vr->ocq.size);
+                if (!devp->rdev.oc_mw_kva) {
+                        pr_err(MOD "Unable to ioremap onchip mem\n");
+                        return ERR_PTR(-EINVAL);
+                }
+        }
        PDBG(KERN_INFO MOD "ocq memory: "
               "hw_start 0x%x size %u mw_pa 0x%lx mw_kva %p\n",
@@ -1003,9 +1026,11 @@ static int enable_qp_db(int id, void *p, void *data)
 static void resume_rc_qp(struct c4iw_qp *qp)
 {
        spin_lock(&qp->lock);
-        t4_ring_sq_db(&qp->wq, qp->wq.sq.wq_pidx_inc);
+        t4_ring_sq_db(&qp->wq, qp->wq.sq.wq_pidx_inc,
+                      is_t5(qp->rhp->rdev.lldi.adapter_type), NULL);
        qp->wq.sq.wq_pidx_inc = 0;
-        t4_ring_rq_db(&qp->wq, qp->wq.rq.wq_pidx_inc);
+        t4_ring_rq_db(&qp->wq, qp->wq.rq.wq_pidx_inc,
+                      is_t5(qp->rhp->rdev.lldi.adapter_type), NULL);
        qp->wq.rq.wq_pidx_inc = 0;
        spin_unlock(&qp->lock);
 }
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index e872203c5424..7474b490760a 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -149,6 +149,8 @@ struct c4iw_rdev {
        struct gen_pool *ocqp_pool;
        u32 flags;
        struct cxgb4_lld_info lldi;
+        unsigned long bar2_pa;
+        void __iomem *bar2_kva;
        unsigned long oc_mw_pa;
        void __iomem *oc_mw_kva;
        struct c4iw_stats stats;
@@ -433,6 +435,7 @@ struct c4iw_qp_attributes {
        u8 ecode;
        u16 sq_db_inc;
        u16 rq_db_inc;
+        u8 send_term;
 };
 struct c4iw_qp {
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index f9ca072a99ed..ec7a2988a703 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -259,8 +259,12 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
        if ((!reset_tpt_entry) && (*stag == T4_STAG_UNSET)) {
                stag_idx = c4iw_get_resource(&rdev->resource.tpt_table);
-                if (!stag_idx)
+                if (!stag_idx) {
+                        mutex_lock(&rdev->stats.lock);
+                        rdev->stats.stag.fail++;
+                        mutex_unlock(&rdev->stats.lock);
                        return -ENOMEM;
+                }
                mutex_lock(&rdev->stats.lock);
                rdev->stats.stag.cur += 32;
                if (rdev->stats.stag.cur > rdev->stats.stag.max)
diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c
index 79429256023a..a94a3e12c349 100644
--- a/drivers/infiniband/hw/cxgb4/provider.c
+++ b/drivers/infiniband/hw/cxgb4/provider.c
@@ -328,7 +328,7 @@ static int c4iw_query_device(struct ib_device *ibdev,
        props->max_mr = c4iw_num_stags(&dev->rdev);
        props->max_pd = T4_MAX_NUM_PD;
        props->local_ca_ack_delay = 0;
-        props->max_fast_reg_page_list_len = T4_MAX_FR_DEPTH;
+        props->max_fast_reg_page_list_len = t4_max_fr_depth(use_dsgl);
        return 0;
 }
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index cb76eb5eee1f..086f62f5dc9e 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -212,13 +212,23 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
        wq->db = rdev->lldi.db_reg;
        wq->gts = rdev->lldi.gts_reg;
-        if (user) {
+        if (user || is_t5(rdev->lldi.adapter_type)) {
-                wq->sq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                u32 off;
-                                        (wq->sq.qid << rdev->qpshift);
-                wq->sq.udb &= PAGE_MASK;
+                off = (wq->sq.qid << rdev->qpshift) & PAGE_MASK;
-                wq->rq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                if (user) {
-                                        (wq->rq.qid << rdev->qpshift);
+                        wq->sq.udb = (u64 __iomem *)(rdev->bar2_pa + off);
-                wq->rq.udb &= PAGE_MASK;
+                } else {
+                        off += 128 * (wq->sq.qid & rdev->qpmask) + 8;
+                        wq->sq.udb = (u64 __iomem *)(rdev->bar2_kva + off);
+                }
+                off = (wq->rq.qid << rdev->qpshift) & PAGE_MASK;
+                if (user) {
+                        wq->rq.udb = (u64 __iomem *)(rdev->bar2_pa + off);
+                } else {
+                        off += 128 * (wq->rq.qid & rdev->qpmask) + 8;
+                        wq->rq.udb = (u64 __iomem *)(rdev->bar2_kva + off);
+                }
        }
        wq->rdev = rdev;
        wq->rq.msn = 1;
@@ -299,9 +309,10 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
        if (ret)
                goto free_dma;
-        PDBG("%s sqid 0x%x rqid 0x%x kdb 0x%p squdb 0x%llx rqudb 0x%llx\n",
+        PDBG("%s sqid 0x%x rqid 0x%x kdb 0x%p squdb 0x%lx rqudb 0x%lx\n",
             __func__, wq->sq.qid, wq->rq.qid, wq->db,
-             (unsigned long long)wq->sq.udb, (unsigned long long)wq->rq.udb);
+             (__force unsigned long) wq->sq.udb,
+             (__force unsigned long) wq->rq.udb);
        return 0;
 free_dma:
@@ -425,6 +436,8 @@ static int build_rdma_send(struct t4_sq *sq, union t4_wr *wqe,
        default:
                return -EINVAL;
        }
+        wqe->send.r3 = 0;
+        wqe->send.r4 = 0;
        plen = 0;
        if (wr->num_sge) {
@@ -555,7 +568,8 @@ static int build_fastreg(struct t4_sq *sq, union t4_wr *wqe,
        int pbllen = roundup(wr->wr.fast_reg.page_list_len * sizeof(u64), 32);
        int rem;
-        if (wr->wr.fast_reg.page_list_len > T4_MAX_FR_DEPTH)
+        if (wr->wr.fast_reg.page_list_len >
+            t4_max_fr_depth(use_dsgl))
                return -EINVAL;
        wqe->fr.qpbinde_to_dcacpu = 0;
@@ -650,9 +664,10 @@ static int ring_kernel_sq_db(struct c4iw_qp *qhp, u16 inc)
        spin_lock_irqsave(&qhp->rhp->lock, flags);
        spin_lock(&qhp->lock);
-        if (qhp->rhp->db_state == NORMAL) {
+        if (qhp->rhp->db_state == NORMAL)
-                t4_ring_sq_db(&qhp->wq, inc);
+                t4_ring_sq_db(&qhp->wq, inc,
-        } else {
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), NULL);
+        else {
                add_to_fc_list(&qhp->rhp->db_fc_list, &qhp->db_fc_entry);
                qhp->wq.sq.wq_pidx_inc += inc;
        }
@@ -667,9 +682,10 @@ static int ring_kernel_rq_db(struct c4iw_qp *qhp, u16 inc)
        spin_lock_irqsave(&qhp->rhp->lock, flags);
        spin_lock(&qhp->lock);
-        if (qhp->rhp->db_state == NORMAL) {
+        if (qhp->rhp->db_state == NORMAL)
-                t4_ring_rq_db(&qhp->wq, inc);
+                t4_ring_rq_db(&qhp->wq, inc,
-        } else {
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), NULL);
+        else {
                add_to_fc_list(&qhp->rhp->db_fc_list, &qhp->db_fc_entry);
                qhp->wq.rq.wq_pidx_inc += inc;
        }
@@ -686,7 +702,7 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
        enum fw_wr_opcodes fw_opcode = 0;
        enum fw_ri_wr_flags fw_flags;
        struct c4iw_qp *qhp;
-        union t4_wr *wqe;
+        union t4_wr *wqe = NULL;
        u32 num_wrs;
        struct t4_swsqe *swsqe;
        unsigned long flag;
@@ -792,7 +808,8 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                idx += DIV_ROUND_UP(len16*16, T4_EQ_ENTRY_SIZE);
        }
        if (!qhp->rhp->rdev.status_page->db_off) {
-                t4_ring_sq_db(&qhp->wq, idx);
+                t4_ring_sq_db(&qhp->wq, idx,
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), wqe);
                spin_unlock_irqrestore(&qhp->lock, flag);
        } else {
                spin_unlock_irqrestore(&qhp->lock, flag);
@@ -806,7 +823,7 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 {
        int err = 0;
        struct c4iw_qp *qhp;
-        union t4_recv_wr *wqe;
+        union t4_recv_wr *wqe = NULL;
        u32 num_wrs;
        u8 len16 = 0;
        unsigned long flag;
@@ -858,7 +875,8 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                num_wrs--;
        }
        if (!qhp->rhp->rdev.status_page->db_off) {
-                t4_ring_rq_db(&qhp->wq, idx);
+                t4_ring_rq_db(&qhp->wq, idx,
+                              is_t5(qhp->rhp->rdev.lldi.adapter_type), wqe);
                spin_unlock_irqrestore(&qhp->lock, flag);
        } else {
                spin_unlock_irqrestore(&qhp->lock, flag);
@@ -1352,6 +1370,7 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                switch (attrs->next_state) {
                case C4IW_QP_STATE_CLOSING:
                        BUG_ON(atomic_read(&qhp->ep->com.kref.refcount) < 2);
+                        t4_set_wq_in_error(&qhp->wq);
                        set_state(qhp, C4IW_QP_STATE_CLOSING);
                        ep = qhp->ep;
                        if (!internal) {
@@ -1359,30 +1378,30 @@ int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
                                disconnect = 1;
                                c4iw_get_ep(&qhp->ep->com);
                        }
-                        t4_set_wq_in_error(&qhp->wq);
                        ret = rdma_fini(rhp, qhp, ep);
                        if (ret)
                                goto err;
                        break;
                case C4IW_QP_STATE_TERMINATE:
+                        t4_set_wq_in_error(&qhp->wq);
                        set_state(qhp, C4IW_QP_STATE_TERMINATE);
                        qhp->attr.layer_etype = attrs->layer_etype;
                        qhp->attr.ecode = attrs->ecode;
-                        t4_set_wq_in_error(&qhp->wq);
                        ep = qhp->ep;
-                        disconnect = 1;
+                        if (!internal) {
-                        if (!internal)
+                                c4iw_get_ep(&qhp->ep->com);
                                terminate = 1;
-                        else {
+                                disconnect = 1;
+                        } else {
+                                terminate = qhp->attr.send_term;
                                ret = rdma_fini(rhp, qhp, ep);
                                if (ret)
                                        goto err;
                        }
-                        c4iw_get_ep(&qhp->ep->com);
                        break;
                case C4IW_QP_STATE_ERROR:
-                        set_state(qhp, C4IW_QP_STATE_ERROR);
                        t4_set_wq_in_error(&qhp->wq);
+                        set_state(qhp, C4IW_QP_STATE_ERROR);
                        if (!internal) {
                                abort = 1;
                                disconnect = 1;
@@ -1677,11 +1696,11 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                mm2->len = PAGE_ALIGN(qhp->wq.rq.memsize);
                insert_mmap(ucontext, mm2);
                mm3->key = uresp.sq_db_gts_key;
-                mm3->addr = qhp->wq.sq.udb;
+                mm3->addr = (__force unsigned long) qhp->wq.sq.udb;
                mm3->len = PAGE_SIZE;
                insert_mmap(ucontext, mm3);
                mm4->key = uresp.rq_db_gts_key;
-                mm4->addr = qhp->wq.rq.udb;
+                mm4->addr = (__force unsigned long) qhp->wq.rq.udb;
                mm4->len = PAGE_SIZE;
                insert_mmap(ucontext, mm4);
                if (mm5) {
@@ -1758,11 +1777,15 @@ int c4iw_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        /*
         * Use SQ_PSN and RQ_PSN to pass in IDX_INC values for
         * ringing the queue db when we're in DB_FULL mode.
+         * Only allow this on T4 devices.
         */
        attrs.sq_db_inc = attr->sq_psn;
        attrs.rq_db_inc = attr->rq_psn;
        mask |= (attr_mask & IB_QP_SQ_PSN) ? C4IW_QP_ATTR_SQ_DB : 0;
        mask |= (attr_mask & IB_QP_RQ_PSN) ? C4IW_QP_ATTR_RQ_DB : 0;
+        if (is_t5(to_c4iw_qp(ibqp)->rhp->rdev.lldi.adapter_type) &&
+            (mask & (C4IW_QP_ATTR_SQ_DB|C4IW_QP_ATTR_RQ_DB)))
+                return -EINVAL;
        return c4iw_modify_qp(rhp, qhp, mask, &attrs, 0);
 }
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
index cdef4d7fb6d8..67df71a7012e 100644
--- a/drivers/infiniband/hw/cxgb4/resource.c
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -179,8 +179,12 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
                kfree(entry);
        } else {
                qid = c4iw_get_resource(&rdev->resource.qid_table);
-                if (!qid)
+                if (!qid) {
+                        mutex_lock(&rdev->stats.lock);
+                        rdev->stats.qid.fail++;
+                        mutex_unlock(&rdev->stats.lock);
                        goto out;
+                }
                mutex_lock(&rdev->stats.lock);
                rdev->stats.qid.cur += rdev->qpmask + 1;
                mutex_unlock(&rdev->stats.lock);
@@ -322,8 +326,8 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
        unsigned long addr = gen_pool_alloc(rdev->rqt_pool, size << 6);
        PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size << 6);
        if (!addr)
-                printk_ratelimited(KERN_WARNING MOD "%s: Out of RQT memory\n",
+                pr_warn_ratelimited(MOD "%s: Out of RQT memory\n",
-                       pci_name(rdev->lldi.pdev));
+                                    pci_name(rdev->lldi.pdev));
        mutex_lock(&rdev->stats.lock);
        if (addr) {
                rdev->stats.rqt.cur += roundup(size << 6, 1 << MIN_RQT_SHIFT);
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index eeca8b1e6376..2178f3198410 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -84,7 +84,14 @@ struct t4_status_page {
                        sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
 #define T4_MAX_FR_IMMD ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_fr_nsmr_wr) - \
                        sizeof(struct fw_ri_immd)) & ~31UL)
-#define T4_MAX_FR_DEPTH (1024 / sizeof(u64))
+#define T4_MAX_FR_IMMD_DEPTH (T4_MAX_FR_IMMD / sizeof(u64))
+#define T4_MAX_FR_DSGL 1024
+#define T4_MAX_FR_DSGL_DEPTH (T4_MAX_FR_DSGL / sizeof(u64))
+static inline int t4_max_fr_depth(int use_dsgl)
+{
+        return use_dsgl ? T4_MAX_FR_DSGL_DEPTH : T4_MAX_FR_IMMD_DEPTH;
+}
 #define T4_RQ_NUM_SLOTS 2
 #define T4_RQ_NUM_BYTES (T4_EQ_ENTRY_SIZE * T4_RQ_NUM_SLOTS)
@@ -292,7 +299,7 @@ struct t4_sq {
        unsigned long phys_addr;
        struct t4_swsqe *sw_sq;
        struct t4_swsqe *oldest_read;
-        u64 udb;
+        u64 __iomem *udb;
        size_t memsize;
        u32 qid;
        u16 in_use;
@@ -314,7 +321,7 @@ struct t4_rq {
        dma_addr_t dma_addr;
        DEFINE_DMA_UNMAP_ADDR(mapping);
        struct t4_swrqe *sw_rq;
-        u64 udb;
+        u64 __iomem *udb;
        size_t memsize;
        u32 qid;
        u32 msn;
@@ -435,15 +442,67 @@ static inline u16 t4_sq_wq_size(struct t4_wq *wq)
                return wq->sq.size * T4_SQ_NUM_SLOTS;
 }
-static inline void t4_ring_sq_db(struct t4_wq *wq, u16 inc)
+/* This function copies 64 byte coalesced work request to memory
+ * mapped BAR2 space. For coalesced WRs, the SGE fetches data
+ * from the FIFO instead of from Host.
+ */
+static inline void pio_copy(u64 __iomem *dst, u64 *src)
+{
+        int count = 8;
+        while (count) {
+                writeq(*src, dst);
+                src++;
+                dst++;
+                count--;
+        }
+}
+static inline void t4_ring_sq_db(struct t4_wq *wq, u16 inc, u8 t5,
+                                 union t4_wr *wqe)
 {
+        /* Flush host queue memory writes. */
        wmb();
+        if (t5) {
+                if (inc == 1 && wqe) {
+                        PDBG("%s: WC wq->sq.pidx = %d\n",
+                             __func__, wq->sq.pidx);
+                        pio_copy(wq->sq.udb + 7, (void *)wqe);
+                } else {
+                        PDBG("%s: DB wq->sq.pidx = %d\n",
+                             __func__, wq->sq.pidx);
+                        writel(PIDX_T5(inc), wq->sq.udb);
+                }
+                /* Flush user doorbell area writes. */
+                wmb();
+                return;
+        }
        writel(QID(wq->sq.qid) | PIDX(inc), wq->db);
 }
-static inline void t4_ring_rq_db(struct t4_wq *wq, u16 inc)
+static inline void t4_ring_rq_db(struct t4_wq *wq, u16 inc, u8 t5,
+                                 union t4_recv_wr *wqe)
 {
+        /* Flush host queue memory writes. */
        wmb();
+        if (t5) {
+                if (inc == 1 && wqe) {
+                        PDBG("%s: WC wq->rq.pidx = %d\n",
+                             __func__, wq->rq.pidx);
+                        pio_copy(wq->rq.udb + 7, (void *)wqe);
+                } else {
+                        PDBG("%s: DB wq->rq.pidx = %d\n",
+                             __func__, wq->rq.pidx);
+                        writel(PIDX_T5(inc), wq->rq.udb);
+                }
+                /* Flush user doorbell area writes. */
+                wmb();
+                return;
+        }
        writel(QID(wq->rq.qid) | PIDX(inc), wq->db);
 }
@@ -568,6 +627,9 @@ static inline int t4_next_hw_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
                printk(KERN_ERR MOD "cq overflow cqid %u\n", cq->cqid);
                BUG_ON(1);
        } else if (t4_valid_cqe(cq, &cq->queue[cq->cidx])) {
+                /* Ensure CQE is flushed to memory */
+                rmb();
                *cqe = &cq->queue[cq->cidx];
                ret = 0;
        } else
diff --git a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
index dc193c292671..6121ca08fe58 100644
--- a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
+++ b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
@@ -836,4 +836,18 @@ struct ulptx_idata {
 #define V_RX_DACK_CHANGE(x) ((x) << S_RX_DACK_CHANGE)
 #define F_RX_DACK_CHANGE    V_RX_DACK_CHANGE(1U)
+enum {                     /* TCP congestion control algorithms */
+        CONG_ALG_RENO,
+        CONG_ALG_TAHOE,
+        CONG_ALG_NEWRENO,
+        CONG_ALG_HIGHSPEED
+};
+#define S_CONG_CNTRL    14
+#define M_CONG_CNTRL    0x3
+#define V_CONG_CNTRL(x) ((x) << S_CONG_CNTRL)
+#define G_CONG_CNTRL(x) (((x) >> S_CONG_CNTRL) & M_CONG_CNTRL)
+#define T5_OPT_2_VALID       (1 << 31)
 #endif /* _T4FW_RI_API_H_ */
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 1b6dbe156a37..199c7896f081 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -48,6 +48,7 @@
 #include <linux/mlx4/driver.h>
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/qp.h>
 #include "mlx4_ib.h"
 #include "user.h"
@@ -1614,6 +1615,53 @@ static int mlx4_ib_inet6_event(struct notifier_block *this, unsigned long event,
 }
 #endif
+#define MLX4_IB_INVALID_MAC     ((u64)-1)
+static void mlx4_ib_update_qps(struct mlx4_ib_dev *ibdev,
+                               struct net_device *dev,
+                               int port)
+{
+        u64 new_smac = 0;
+        u64 release_mac = MLX4_IB_INVALID_MAC;
+        struct mlx4_ib_qp *qp;
+        read_lock(&dev_base_lock);
+        new_smac = mlx4_mac_to_u64(dev->dev_addr);
+        read_unlock(&dev_base_lock);
+        mutex_lock(&ibdev->qp1_proxy_lock[port - 1]);
+        qp = ibdev->qp1_proxy[port - 1];
+        if (qp) {
+                int new_smac_index;
+                u64 old_smac = qp->pri.smac;
+                struct mlx4_update_qp_params update_params;
+                if (new_smac == old_smac)
+                        goto unlock;
+                new_smac_index = mlx4_register_mac(ibdev->dev, port, new_smac);
+                if (new_smac_index < 0)
+                        goto unlock;
+                update_params.smac_index = new_smac_index;
+                if (mlx4_update_qp(ibdev->dev, &qp->mqp, MLX4_UPDATE_QP_SMAC,
+                                   &update_params)) {
+                        release_mac = new_smac;
+                        goto unlock;
+                }
+                qp->pri.smac = new_smac;
+                qp->pri.smac_index = new_smac_index;
+                release_mac = old_smac;
+        }
+unlock:
+        mutex_unlock(&ibdev->qp1_proxy_lock[port - 1]);
+        if (release_mac != MLX4_IB_INVALID_MAC)
+                mlx4_unregister_mac(ibdev->dev, port, release_mac);
+}
 static void mlx4_ib_get_dev_addr(struct net_device *dev,
                                 struct mlx4_ib_dev *ibdev, u8 port)
 {
@@ -1689,9 +1737,13 @@ static int mlx4_ib_init_gid_table(struct mlx4_ib_dev *ibdev)
        return 0;
 }
-static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev)
+static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev,
+                                 struct net_device *dev,
+                                 unsigned long event)
 {
        struct mlx4_ib_iboe *iboe;
+        int update_qps_port = -1;
        int port;
        iboe = &ibdev->iboe;
@@ -1719,6 +1771,11 @@ static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev)
                }
                curr_master = iboe->masters[port - 1];
+                if (dev == iboe->netdevs[port - 1] &&
+                    (event == NETDEV_CHANGEADDR || event == NETDEV_REGISTER ||
+                     event == NETDEV_UP || event == NETDEV_CHANGE))
+                        update_qps_port = port;
                if (curr_netdev) {
                        port_state = (netif_running(curr_netdev) && netif_carrier_ok(curr_netdev)) ?
                                                IB_PORT_ACTIVE : IB_PORT_DOWN;
@@ -1752,6 +1809,9 @@ static void mlx4_ib_scan_netdevs(struct mlx4_ib_dev *ibdev)
        }
        spin_unlock(&iboe->lock);
+        if (update_qps_port > 0)
+                mlx4_ib_update_qps(ibdev, dev, update_qps_port);
 }
 static int mlx4_ib_netdev_event(struct notifier_block *this,
@@ -1764,7 +1824,7 @@ static int mlx4_ib_netdev_event(struct notifier_block *this,
                return NOTIFY_DONE;
        ibdev = container_of(this, struct mlx4_ib_dev, iboe.nb);
-        mlx4_ib_scan_netdevs(ibdev);
+        mlx4_ib_scan_netdevs(ibdev, dev, event);
        return NOTIFY_DONE;
 }
@@ -2043,6 +2103,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                goto err_map;
        for (i = 0; i < ibdev->num_ports; ++i) {
+                mutex_init(&ibdev->qp1_proxy_lock[i]);
                if (mlx4_ib_port_link_layer(&ibdev->ib_dev, i + 1) ==
                                                IB_LINK_LAYER_ETHERNET) {
                        err = mlx4_counter_alloc(ibdev->dev, &ibdev->counters[i]);
@@ -2126,7 +2187,7 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                for (i = 1 ; i <= ibdev->num_ports ; ++i)
                        reset_gid_table(ibdev, i);
                rtnl_lock();
-                mlx4_ib_scan_netdevs(ibdev);
+                mlx4_ib_scan_netdevs(ibdev, NULL, 0);
                rtnl_unlock();
                mlx4_ib_init_gid_table(ibdev);
        }
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index f589522fddfd..66b0b7dbd9f4 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -522,6 +522,9 @@ struct mlx4_ib_dev {
        int steer_qpn_count;
        int steer_qpn_base;
        int steering_support;
+        struct mlx4_ib_qp      *qp1_proxy[MLX4_MAX_PORTS];
+        /* lock when destroying qp1_proxy and getting netdev events */
+        struct mutex            qp1_proxy_lock[MLX4_MAX_PORTS];
 };
 struct ib_event_work {
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 41308af4163c..dc57482ae7af 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1132,6 +1132,12 @@ int mlx4_ib_destroy_qp(struct ib_qp *qp)
        if (is_qp0(dev, mqp))
                mlx4_CLOSE_PORT(dev->dev, mqp->port);
+        if (dev->qp1_proxy[mqp->port - 1] == mqp) {
+                mutex_lock(&dev->qp1_proxy_lock[mqp->port - 1]);
+                dev->qp1_proxy[mqp->port - 1] = NULL;
+                mutex_unlock(&dev->qp1_proxy_lock[mqp->port - 1]);
+        }
        pd = get_pd(mqp);
        destroy_qp_common(dev, mqp, !!pd->ibpd.uobject);
@@ -1646,6 +1652,8 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
                                err = handle_eth_ud_smac_index(dev, qp, (u8 *)attr->smac, context);
                                if (err)
                                        return -EINVAL;
+                                if (qp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI)
+                                        dev->qp1_proxy[qp->port - 1] = qp;
                        }
                }
        }
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index fa6dc870adae..364d4b6937f5 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -282,6 +282,8 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
                props->sig_guard_cap = IB_GUARD_T10DIF_CRC |
                                       IB_GUARD_T10DIF_CSUM;
        }
+        if (flags & MLX5_DEV_CAP_FLAG_BLOCK_MCAST)
+                props->device_cap_flags |= IB_DEVICE_BLOCK_MULTICAST_LOOPBACK;
        props->vendor_id           = be32_to_cpup((__be32 *)(out_mad->data + 36)) &
                0xffffff;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index ae788d27b93f..dc930ed21eca 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -807,6 +807,15 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
        spin_lock_init(&qp->sq.lock);
        spin_lock_init(&qp->rq.lock);
+        if (init_attr->create_flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK) {
+                if (!(dev->mdev.caps.flags & MLX5_DEV_CAP_FLAG_BLOCK_MCAST)) {
+                        mlx5_ib_dbg(dev, "block multicast loopback isn't supported\n");
+                        return -EINVAL;
+                } else {
+                        qp->flags |= MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK;
+                }
+        }
        if (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR)
                qp->sq_signal_bits = MLX5_WQE_CTRL_CQ_UPDATE;
@@ -878,6 +887,9 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
        if (qp->wq_sig)
                in->ctx.flags_pd |= cpu_to_be32(MLX5_QP_ENABLE_SIG);
+        if (qp->flags & MLX5_IB_QP_BLOCK_MULTICAST_LOOPBACK)
+                in->ctx.flags_pd |= cpu_to_be32(MLX5_QP_BLOCK_MCAST);
        if (qp->scat_cqe && is_connected(init_attr->qp_type)) {
                int rcqe_sz;
                int scqe_sz;
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 87897b95666d..ded76c101dde 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -858,13 +858,9 @@ static int mthca_enable_msi_x(struct mthca_dev *mdev)
        entries[1].entry = 1;
        entries[2].entry = 2;
-        err = pci_enable_msix(mdev->pdev, entries, ARRAY_SIZE(entries));
+        err = pci_enable_msix_exact(mdev->pdev, entries, ARRAY_SIZE(entries));
-        if (err) {
+        if (err)
-                if (err > 0)
-                        mthca_info(mdev, "Only %d MSI-X vectors available, "
-                                   "not using MSI-X\n", err);
                return err;
-        }
        mdev->eq_table.eq[MTHCA_EQ_COMP ].msi_x_vector = entries[0].vector;
        mdev->eq_table.eq[MTHCA_EQ_ASYNC].msi_x_vector = entries[1].vector;
diff --git a/drivers/infiniband/hw/qib/qib_pcie.c b/drivers/infiniband/hw/qib/qib_pcie.c
index c8d9c4ab142b..61a0046efb76 100644
--- a/drivers/infiniband/hw/qib/qib_pcie.c
+++ b/drivers/infiniband/hw/qib/qib_pcie.c
@@ -197,46 +197,47 @@ static void qib_msix_setup(struct qib_devdata *dd, int pos, u32 *msixcnt,
                           struct qib_msix_entry *qib_msix_entry)
 {
        int ret;
-        u32 tabsize = 0;
+        int nvec = *msixcnt;
-        u16 msix_flags;
        struct msix_entry *msix_entry;
        int i;
+        ret = pci_msix_vec_count(dd->pcidev);
+        if (ret < 0)
+                goto do_intx;
+        nvec = min(nvec, ret);
        /* We can't pass qib_msix_entry array to qib_msix_setup
         * so use a dummy msix_entry array and copy the allocated
         * irq back to the qib_msix_entry array. */
-        msix_entry = kmalloc(*msixcnt * sizeof(*msix_entry), GFP_KERNEL);
+        msix_entry = kmalloc(nvec * sizeof(*msix_entry), GFP_KERNEL);
-        if (!msix_entry) {
+        if (!msix_entry)
-                ret = -ENOMEM;
                goto do_intx;
-        }
-        for (i = 0; i < *msixcnt; i++)
+        for (i = 0; i < nvec; i++)
                msix_entry[i] = qib_msix_entry[i].msix;
-        pci_read_config_word(dd->pcidev, pos + PCI_MSIX_FLAGS, &msix_flags);
+        ret = pci_enable_msix_range(dd->pcidev, msix_entry, 1, nvec);
-        tabsize = 1 + (msix_flags & PCI_MSIX_FLAGS_QSIZE);
+        if (ret < 0)
-        if (tabsize > *msixcnt)
+                goto free_msix_entry;
-                tabsize = *msixcnt;
+        else
-        ret = pci_enable_msix(dd->pcidev, msix_entry, tabsize);
+                nvec = ret;
-        if (ret > 0) {
-                tabsize = ret;
+        for (i = 0; i < nvec; i++)
-                ret = pci_enable_msix(dd->pcidev, msix_entry, tabsize);
-        }
-do_intx:
-        if (ret) {
-                qib_dev_err(dd,
-                        "pci_enable_msix %d vectors failed: %d, falling back to INTx\n",
-                        tabsize, ret);
-                tabsize = 0;
-        }
-        for (i = 0; i < tabsize; i++)
                qib_msix_entry[i].msix = msix_entry[i];
        kfree(msix_entry);
-        *msixcnt = tabsize;
+        *msixcnt = nvec;
+        return;
-        if (ret)
+free_msix_entry:
-                qib_enable_intx(dd->pcidev);
+        kfree(msix_entry);
+do_intx:
+        qib_dev_err(dd, "pci_enable_msix_range %d vectors failed: %d, "
+                        "falling back to INTx\n", nvec, ret);
+        *msixcnt = 0;
+        qib_enable_intx(dd->pcidev);
 }
 /**
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index c98fdb185931..a1710465faaf 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -28,6 +28,7 @@
 #include <target/target_core_base.h>
 #include <target/target_core_fabric.h>
 #include <target/iscsi/iscsi_transport.h>
+#include <linux/semaphore.h>
 #include "isert_proto.h"
 #include "ib_isert.h"
@@ -561,7 +562,15 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
        struct isert_device *device;
        struct ib_device *ib_dev = cma_id->device;
        int ret = 0;
-        u8 pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
+        u8 pi_support;
+        spin_lock_bh(&np->np_thread_lock);
+        if (!np->enabled) {
+                spin_unlock_bh(&np->np_thread_lock);
+                pr_debug("iscsi_np is not enabled, reject connect request\n");
+                return rdma_reject(cma_id, NULL, 0);
+        }
+        spin_unlock_bh(&np->np_thread_lock);
        pr_debug("Entering isert_connect_request cma_id: %p, context: %p\n",
                 cma_id, cma_id->context);
@@ -652,6 +661,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                goto out_mr;
        }
+        pi_support = np->tpg_np->tpg->tpg_attrib.t10_pi;
        if (pi_support && !device->pi_capable) {
                pr_err("Protection information requested but not supported\n");
                ret = -EINVAL;
@@ -663,11 +673,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                goto out_conn_dev;
        mutex_lock(&isert_np->np_accept_mutex);
-        list_add_tail(&isert_np->np_accept_list, &isert_conn->conn_accept_node);
+        list_add_tail(&isert_conn->conn_accept_node, &isert_np->np_accept_list);
        mutex_unlock(&isert_np->np_accept_mutex);
-        pr_debug("isert_connect_request() waking up np_accept_wq: %p\n", np);
+        pr_debug("isert_connect_request() up np_sem np: %p\n", np);
-        wake_up(&isert_np->np_accept_wq);
+        up(&isert_np->np_sem);
        return 0;
 out_conn_dev:
@@ -2999,7 +3009,7 @@ isert_setup_np(struct iscsi_np *np,
                pr_err("Unable to allocate struct isert_np\n");
                return -ENOMEM;
        }
-        init_waitqueue_head(&isert_np->np_accept_wq);
+        sema_init(&isert_np->np_sem, 0);
        mutex_init(&isert_np->np_accept_mutex);
        INIT_LIST_HEAD(&isert_np->np_accept_list);
        init_completion(&isert_np->np_login_comp);
@@ -3048,18 +3058,6 @@ out:
 }
 static int
-isert_check_accept_queue(struct isert_np *isert_np)
-{
-        int empty;
-        mutex_lock(&isert_np->np_accept_mutex);
-        empty = list_empty(&isert_np->np_accept_list);
-        mutex_unlock(&isert_np->np_accept_mutex);
-        return empty;
-}
-static int
 isert_rdma_accept(struct isert_conn *isert_conn)
 {
        struct rdma_cm_id *cm_id = isert_conn->conn_cm_id;
@@ -3151,16 +3149,14 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
        int max_accept = 0, ret;
 accept_wait:
-        ret = wait_event_interruptible(isert_np->np_accept_wq,
+        ret = down_interruptible(&isert_np->np_sem);
-                        !isert_check_accept_queue(isert_np) ||
-                        np->np_thread_state == ISCSI_NP_THREAD_RESET);
        if (max_accept > 5)
                return -ENODEV;
        spin_lock_bh(&np->np_thread_lock);
        if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                spin_unlock_bh(&np->np_thread_lock);
-                pr_err("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
+                pr_debug("ISCSI_NP_THREAD_RESET for isert_accept_np\n");
                return -ENODEV;
        }
        spin_unlock_bh(&np->np_thread_lock);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 4c072ae34c01..da6612e68000 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -182,7 +182,7 @@ struct isert_device {
 };
 struct isert_np {
-        wait_queue_head_t       np_accept_wq;
+        struct semaphore        np_sem;
        struct rdma_cm_id       *np_cm_id;
        struct mutex            np_accept_mutex;
        struct list_head        np_accept_list;
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 76842d7dc2e3..ffc7ad3a2c88 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -71,7 +71,7 @@ config KEYBOARD_ATKBD
        default y
        select SERIO
        select SERIO_LIBPS2
-        select SERIO_I8042 if X86
+        select SERIO_I8042 if ARCH_MIGHT_HAVE_PC_SERIO
        select SERIO_GSCPS2 if GSC
        help
          Say Y here if you want to use a standard AT or PS/2 keyboard. Usually
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 2626773ff29b..2dd1d0dd4f7d 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -243,6 +243,12 @@ static void (*atkbd_platform_fixup)(struct atkbd *, const void *data);
 static void *atkbd_platform_fixup_data;
 static unsigned int (*atkbd_platform_scancode_fixup)(struct atkbd *, unsigned int);
+/*
+ * Certain keyboards to not like ATKBD_CMD_RESET_DIS and stop responding
+ * to many commands until full reset (ATKBD_CMD_RESET_BAT) is performed.
+ */
+static bool atkbd_skip_deactivate;
 static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
                                ssize_t (*handler)(struct atkbd *, char *));
 static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t count,
@@ -768,7 +774,8 @@ static int atkbd_probe(struct atkbd *atkbd)
 * Make sure nothing is coming from the keyboard and disturbs our
 * internal state.
 */
-        atkbd_deactivate(atkbd);
+        if (!atkbd_skip_deactivate)
+                atkbd_deactivate(atkbd);
        return 0;
 }
@@ -1638,6 +1645,12 @@ static int __init atkbd_setup_scancode_fixup(const struct dmi_system_id *id)
        return 1;
 }
+static int __init atkbd_deactivate_fixup(const struct dmi_system_id *id)
+{
+        atkbd_skip_deactivate = true;
+        return 1;
+}
 static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
        {
                .matches = {
@@ -1775,6 +1788,20 @@ static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
                .callback = atkbd_setup_scancode_fixup,
                .driver_data = atkbd_oqo_01plus_scancode_fixup,
        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"),
+                },
+                .callback = atkbd_deactivate_fixup,
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"),
+                },
+                .callback = atkbd_deactivate_fixup,
+        },
        { }
 };
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index d8241ba0afa0..a15063bea700 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -111,6 +111,8 @@ struct pxa27x_keypad {
        unsigned short keycodes[MAX_KEYPAD_KEYS];
        int rotary_rel_code[2];
+        unsigned int row_shift;
        /* state row bits of each column scan */
        uint32_t matrix_key_state[MAX_MATRIX_KEY_COLS];
        uint32_t direct_key_state;
@@ -467,7 +469,8 @@ scan:
                        if ((bits_changed & (1 << row)) == 0)
                                continue;
-                        code = MATRIX_SCAN_CODE(row, col, MATRIX_ROW_SHIFT);
+                        code = MATRIX_SCAN_CODE(row, col, keypad->row_shift);
                        input_event(input_dev, EV_MSC, MSC_SCAN, code);
                        input_report_key(input_dev, keypad->keycodes[code],
                                         new_state[col] & (1 << row));
@@ -802,6 +805,8 @@ static int pxa27x_keypad_probe(struct platform_device *pdev)
                goto failed_put_clk;
        }
+        keypad->row_shift = get_count_order(pdata->matrix_key_cols);
        if ((pdata->enable_rotary0 && keypad->rotary_rel_code[0] != -1) ||
            (pdata->enable_rotary1 && keypad->rotary_rel_code[1] != -1)) {
                input_dev->evbit[0] |= BIT_MASK(EV_REL);
diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c
index 55c15304ddbc..4e491c1762cf 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -392,6 +392,13 @@ static const struct of_device_id tca8418_dt_ids[] = {
        { }
 };
 MODULE_DEVICE_TABLE(of, tca8418_dt_ids);
+/*
+ * The device tree based i2c loader looks for
+ * "i2c:" + second_component_of(property("compatible"))
+ * and therefore we need an alias to be found.
+ */
+MODULE_ALIAS("i2c:tca8418");
 #endif
 static struct i2c_driver tca8418_keypad_driver = {
diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c
index 52d3a9b28f0b..b36831c828d3 100644
--- a/drivers/input/misc/bma150.c
+++ b/drivers/input/misc/bma150.c
@@ -70,6 +70,7 @@
 #define BMA150_CFG_5_REG        0x11
 #define BMA150_CHIP_ID          2
+#define BMA180_CHIP_ID          3
 #define BMA150_CHIP_ID_REG      BMA150_DATA_0_REG
 #define BMA150_ACC_X_LSB_REG    BMA150_DATA_2_REG
@@ -539,7 +540,7 @@ static int bma150_probe(struct i2c_client *client,
        }
        chip_id = i2c_smbus_read_byte_data(client, BMA150_CHIP_ID_REG);
-        if (chip_id != BMA150_CHIP_ID) {
+        if (chip_id != BMA150_CHIP_ID && chip_id != BMA180_CHIP_ID) {
                dev_err(&client->dev, "BMA150 chip id error: %d\n", chip_id);
                return -EINVAL;
        }
@@ -643,6 +644,7 @@ static UNIVERSAL_DEV_PM_OPS(bma150_pm, bma150_suspend, bma150_resume, NULL);
 static const struct i2c_device_id bma150_id[] = {
        { "bma150", 0 },
+        { "bma180", 0 },
        { "smb380", 0 },
        { "bma023", 0 },
        { }
diff --git a/drivers/input/misc/da9055_onkey.c b/drivers/input/misc/da9055_onkey.c
index 4b11ede34950..4765799fef74 100644
--- a/drivers/input/misc/da9055_onkey.c
+++ b/drivers/input/misc/da9055_onkey.c
@@ -109,7 +109,6 @@ static int da9055_onkey_probe(struct platform_device *pdev)
        INIT_DELAYED_WORK(&onkey->work, da9055_onkey_work);
-        irq = regmap_irq_get_virq(da9055->irq_data, irq);
        err = request_threaded_irq(irq, NULL, da9055_onkey_irq,
                                   IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
                                   "ONKEY", onkey);
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index 08ead2aaede5..20c80f543d5e 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -169,6 +169,7 @@ static int soc_button_pnp_probe(struct pnp_dev *pdev,
                                soc_button_remove(pdev);
                                return error;
                        }
+                        continue;
                }
                priv->children[i] = pd;
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index effa9c5f2c5c..6b8441f7bc32 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -17,7 +17,7 @@ config MOUSE_PS2
        default y
        select SERIO
        select SERIO_LIBPS2
-        select SERIO_I8042 if X86
+        select SERIO_I8042 if ARCH_MIGHT_HAVE_PC_SERIO
        select SERIO_GSCPS2 if GSC
        help
          Say Y here if you have a PS/2 mouse connected to your system. This
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index ef1cf52f8bb9..b96e978a37b7 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -11,6 +11,7 @@
 */
 #include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/input.h>
@@ -831,7 +832,11 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
                break;
        case 3:
-                etd->reg_10 = 0x0b;
+                if (etd->set_hw_resolution)
+                        etd->reg_10 = 0x0b;
+                else
+                        etd->reg_10 = 0x03;
                if (elantech_write_reg(psmouse, 0x10, etd->reg_10))
                        rc = -1;
@@ -1331,6 +1336,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
 }
 /*
+ * Some hw_version 3 models go into error state when we try to set bit 3 of r10
+ */
+static const struct dmi_system_id no_hw_res_dmi_table[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Gigabyte U2442 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "U2442"),
+                },
+        },
+#endif
+        { }
+};
+/*
 * determine hardware version and set some properties according to it.
 */
 static int elantech_set_properties(struct elantech_data *etd)
@@ -1353,6 +1374,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                case 6:
                case 7:
                case 8:
+                case 9:
                        etd->hw_version = 4;
                        break;
                default:
@@ -1389,6 +1411,9 @@ static int elantech_set_properties(struct elantech_data *etd)
         */
        etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
+        /* Enable real hardware resolution on hw_version 3 ? */
+        etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
        return 0;
 }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index 036a04abaef7..9e0e2a1f340d 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -130,6 +130,7 @@ struct elantech_data {
        bool jumpy_cursor;
        bool reports_pressure;
        bool crc_enabled;
+        bool set_hw_resolution;
        unsigned char hw_version;
        unsigned int fw_version;
        unsigned int single_finger_reports;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index d8d49d10f9bb..c5ec703c727e 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -117,6 +117,81 @@ void synaptics_reset(struct psmouse *psmouse)
 }
 #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
+struct min_max_quirk {
+        const char * const *pnp_ids;
+        int x_min, x_max, y_min, y_max;
+};
+static const struct min_max_quirk min_max_pnpid_table[] = {
+        {
+                (const char * const []){"LEN0033", NULL},
+                1024, 5052, 2258, 4832
+        },
+        {
+                (const char * const []){"LEN0035", "LEN0042", NULL},
+                1232, 5710, 1156, 4696
+        },
+        {
+                (const char * const []){"LEN0034", "LEN0036", "LEN2004", NULL},
+                1024, 5112, 2024, 4832
+        },
+        {
+                (const char * const []){"LEN2001", NULL},
+                1024, 5022, 2508, 4832
+        },
+        { }
+};
+/* This list has been kindly provided by Synaptics. */
+static const char * const topbuttonpad_pnp_ids[] = {
+        "LEN0017",
+        "LEN0018",
+        "LEN0019",
+        "LEN0023",
+        "LEN002A",
+        "LEN002B",
+        "LEN002C",
+        "LEN002D",
+        "LEN002E",
+        "LEN0033", /* Helix */
+        "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
+        "LEN0035", /* X240 */
+        "LEN0036", /* T440 */
+        "LEN0037",
+        "LEN0038",
+        "LEN0041",
+        "LEN0042", /* Yoga */
+        "LEN0045",
+        "LEN0046",
+        "LEN0047",
+        "LEN0048",
+        "LEN0049",
+        "LEN2000",
+        "LEN2001", /* Edge E431 */
+        "LEN2002",
+        "LEN2003",
+        "LEN2004", /* L440 */
+        "LEN2005",
+        "LEN2006",
+        "LEN2007",
+        "LEN2008",
+        "LEN2009",
+        "LEN200A",
+        "LEN200B",
+        NULL
+};
+static bool matches_pnp_id(struct psmouse *psmouse, const char * const ids[])
+{
+        int i;
+        if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4))
+                for (i = 0; ids[i]; i++)
+                        if (strstr(psmouse->ps2dev.serio->firmware_id, ids[i]))
+                                return true;
+        return false;
+}
 /*****************************************************************************
 *      Synaptics communications functions
@@ -266,20 +341,20 @@ static int synaptics_identify(struct psmouse *psmouse)
 * Resolution is left zero if touchpad does not support the query
 */
-static const int *quirk_min_max;
 static int synaptics_resolution(struct psmouse *psmouse)
 {
        struct synaptics_data *priv = psmouse->private;
        unsigned char resp[3];
+        int i;
-        if (quirk_min_max) {
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++)
-                priv->x_min = quirk_min_max[0];
+                if (matches_pnp_id(psmouse, min_max_pnpid_table[i].pnp_ids)) {
-                priv->x_max = quirk_min_max[1];
+                        priv->x_min = min_max_pnpid_table[i].x_min;
-                priv->y_min = quirk_min_max[2];
+                        priv->x_max = min_max_pnpid_table[i].x_max;
-                priv->y_max = quirk_min_max[3];
+                        priv->y_min = min_max_pnpid_table[i].y_min;
-                return 0;
+                        priv->y_max = min_max_pnpid_table[i].y_max;
-        }
+                        return 0;
+                }
        if (SYN_ID_MAJOR(priv->identity) < 4)
                return 0;
@@ -1255,8 +1330,10 @@ static void set_abs_position_params(struct input_dev *dev,
        input_abs_set_res(dev, y_code, priv->y_res);
 }
-static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
+static void set_input_params(struct psmouse *psmouse,
+                             struct synaptics_data *priv)
 {
+        struct input_dev *dev = psmouse->dev;
        int i;
        /* Things that apply to both modes */
@@ -1325,6 +1402,8 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
+                if (matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
+                        __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
                /* Clickpads report only left button */
                __clear_bit(BTN_RIGHT, dev->keybit);
                __clear_bit(BTN_MIDDLE, dev->keybit);
@@ -1496,54 +1575,10 @@ static const struct dmi_system_id olpc_dmi_table[] __initconst = {
        { }
 };
-static const struct dmi_system_id min_max_dmi_table[] __initconst = {
-#if defined(CONFIG_DMI)
-        {
-                /* Lenovo ThinkPad Helix */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"),
-                },
-                .driver_data = (int []){1024, 5052, 2258, 4832},
-        },
-        {
-                /* Lenovo ThinkPad X240 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"),
-                },
-                .driver_data = (int []){1232, 5710, 1156, 4696},
-        },
-        {
-                /* Lenovo ThinkPad T440s */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo ThinkPad T540p */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"),
-                },
-                .driver_data = (int []){1024, 5056, 2058, 4832},
-        },
-#endif
-        { }
-};
 void __init synaptics_module_init(void)
 {
-        const struct dmi_system_id *min_max_dmi;
        impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table);
        broken_olpc_ec = dmi_check_system(olpc_dmi_table);
-        min_max_dmi = dmi_first_match(min_max_dmi_table);
-        if (min_max_dmi)
-                quirk_min_max = min_max_dmi->driver_data;
 }
 static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
@@ -1593,7 +1628,7 @@ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
                     priv->capabilities, priv->ext_cap, priv->ext_cap_0c,
                     priv->board_id, priv->firmware_id);
-        set_input_params(psmouse->dev, priv);
+        set_input_params(psmouse, priv);
        /*
         * Encode touchpad model so that it can be used to set
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index 762b08432de0..8b748d99b934 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -79,7 +79,8 @@ static int amba_kmi_open(struct serio *io)
        writeb(divisor, KMICLKDIV);
        writeb(KMICR_EN, KMICR);
-        ret = request_irq(kmi->irq, amba_kmi_int, 0, "kmi-pl050", kmi);
+        ret = request_irq(kmi->irq, amba_kmi_int, IRQF_SHARED, "kmi-pl050",
+                          kmi);
        if (ret) {
                printk(KERN_ERR "kmi: failed to claim IRQ%d\n", kmi->irq);
                writeb(0, KMICR);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 0ec9abbe31fe..381b20d4c561 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -702,6 +702,17 @@ static int i8042_pnp_aux_irq;
 static char i8042_pnp_kbd_name[32];
 static char i8042_pnp_aux_name[32];
+static void i8042_pnp_id_to_string(struct pnp_id *id, char *dst, int dst_size)
+{
+        strlcpy(dst, "PNP:", dst_size);
+        while (id) {
+                strlcat(dst, " ", dst_size);
+                strlcat(dst, id->id, dst_size);
+                id = id->next;
+        }
+}
 static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *did)
 {
        if (pnp_port_valid(dev, 0) && pnp_port_len(dev, 0) == 1)
@@ -718,6 +729,8 @@ static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *
                strlcat(i8042_pnp_kbd_name, ":", sizeof(i8042_pnp_kbd_name));
                strlcat(i8042_pnp_kbd_name, pnp_dev_name(dev), sizeof(i8042_pnp_kbd_name));
        }
+        i8042_pnp_id_to_string(dev->id, i8042_kbd_firmware_id,
+                               sizeof(i8042_kbd_firmware_id));
        /* Keyboard ports are always supposed to be wakeup-enabled */
        device_set_wakeup_enable(&dev->dev, true);
@@ -742,6 +755,8 @@ static int i8042_pnp_aux_probe(struct pnp_dev *dev, const struct pnp_device_id *
                strlcat(i8042_pnp_aux_name, ":", sizeof(i8042_pnp_aux_name));
                strlcat(i8042_pnp_aux_name, pnp_dev_name(dev), sizeof(i8042_pnp_aux_name));
        }
+        i8042_pnp_id_to_string(dev->id, i8042_aux_firmware_id,
+                               sizeof(i8042_aux_firmware_id));
        i8042_pnp_aux_devices++;
        return 0;
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 020053fa5aaa..3807c3e971cc 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -87,6 +87,8 @@ MODULE_PARM_DESC(debug, "Turn i8042 debugging mode on and off");
 #endif
 static bool i8042_bypass_aux_irq_test;
+static char i8042_kbd_firmware_id[128];
+static char i8042_aux_firmware_id[128];
 #include "i8042.h"
@@ -1218,6 +1220,8 @@ static int __init i8042_create_kbd_port(void)
        serio->dev.parent       = &i8042_platform_device->dev;
        strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
        strlcpy(serio->phys, I8042_KBD_PHYS_DESC, sizeof(serio->phys));
+        strlcpy(serio->firmware_id, i8042_kbd_firmware_id,
+                sizeof(serio->firmware_id));
        port->serio = serio;
        port->irq = I8042_KBD_IRQ;
@@ -1244,6 +1248,8 @@ static int __init i8042_create_aux_port(int idx)
        if (idx < 0) {
                strlcpy(serio->name, "i8042 AUX port", sizeof(serio->name));
                strlcpy(serio->phys, I8042_AUX_PHYS_DESC, sizeof(serio->phys));
+                strlcpy(serio->firmware_id, i8042_aux_firmware_id,
+                        sizeof(serio->firmware_id));
                serio->close = i8042_port_close;
        } else {
                snprintf(serio->name, sizeof(serio->name), "i8042 AUX%d port", idx);
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 8f4c4ab04bc2..b29134de983b 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -451,6 +451,13 @@ static ssize_t serio_set_bind_mode(struct device *dev, struct device_attribute *
        return retval;
 }
+static ssize_t firmware_id_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct serio *serio = to_serio_port(dev);
+        return sprintf(buf, "%s\n", serio->firmware_id);
+}
 static DEVICE_ATTR_RO(type);
 static DEVICE_ATTR_RO(proto);
 static DEVICE_ATTR_RO(id);
@@ -473,12 +480,14 @@ static DEVICE_ATTR_RO(modalias);
 static DEVICE_ATTR_WO(drvctl);
 static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
 static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
+static DEVICE_ATTR_RO(firmware_id);
 static struct attribute *serio_device_attrs[] = {
        &dev_attr_modalias.attr,
        &dev_attr_description.attr,
        &dev_attr_drvctl.attr,
        &dev_attr_bind_mode.attr,
+        &dev_attr_firmware_id.attr,
        NULL
 };
@@ -921,9 +930,14 @@ static int serio_uevent(struct device *dev, struct kobj_uevent_env *env)
        SERIO_ADD_UEVENT_VAR("SERIO_PROTO=%02x", serio->id.proto);
        SERIO_ADD_UEVENT_VAR("SERIO_ID=%02x", serio->id.id);
        SERIO_ADD_UEVENT_VAR("SERIO_EXTRA=%02x", serio->id.extra);
        SERIO_ADD_UEVENT_VAR("MODALIAS=serio:ty%02Xpr%02Xid%02Xex%02X",
                                serio->id.type, serio->id.proto, serio->id.id, serio->id.extra);
+        if (serio->firmware_id[0])
+                SERIO_ADD_UEVENT_VAR("SERIO_FIRMWARE_ID=%s",
+                                     serio->firmware_id);
        return 0;
 }
 #undef SERIO_ADD_UEVENT_VAR
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index b16ebef5b911..611fc3905d00 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -22,23 +22,18 @@
 #define HID_USAGE_PAGE_DIGITIZER        0x0d
 #define HID_USAGE_PAGE_DESKTOP          0x01
 #define HID_USAGE                       0x09
-#define HID_USAGE_X                     0x30
+#define HID_USAGE_X                     ((HID_USAGE_PAGE_DESKTOP << 16) | 0x30)
-#define HID_USAGE_Y                     0x31
+#define HID_USAGE_Y                     ((HID_USAGE_PAGE_DESKTOP << 16) | 0x31)
-#define HID_USAGE_X_TILT                0x3d
+#define HID_USAGE_PRESSURE              ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x30)
-#define HID_USAGE_Y_TILT                0x3e
+#define HID_USAGE_X_TILT                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x3d)
-#define HID_USAGE_FINGER                0x22
+#define HID_USAGE_Y_TILT                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x3e)
-#define HID_USAGE_STYLUS                0x20
+#define HID_USAGE_FINGER                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x22)
-#define HID_USAGE_CONTACTMAX            0x55
+#define HID_USAGE_STYLUS                ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x20)
+#define HID_USAGE_CONTACTMAX            ((HID_USAGE_PAGE_DIGITIZER << 16) | 0x55)
 #define HID_COLLECTION                  0xa1
 #define HID_COLLECTION_LOGICAL          0x02
 #define HID_COLLECTION_END              0xc0
-enum {
-        WCM_UNDEFINED = 0,
-        WCM_DESKTOP,
-        WCM_DIGITIZER,
-};
 struct hid_descriptor {
        struct usb_descriptor_header header;
        __le16   bcdHID;
@@ -305,7 +300,7 @@ static int wacom_parse_hid(struct usb_interface *intf,
        char limit = 0;
        /* result has to be defined as int for some devices */
        int result = 0, touch_max = 0;
-        int i = 0, usage = WCM_UNDEFINED, finger = 0, pen = 0;
+        int i = 0, page = 0, finger = 0, pen = 0;
        unsigned char *report;
        report = kzalloc(hid_desc->wDescriptorLength, GFP_KERNEL);
@@ -332,134 +327,121 @@ static int wacom_parse_hid(struct usb_interface *intf,
                switch (report[i]) {
                case HID_USAGE_PAGE:
-                        switch (report[i + 1]) {
+                        page = report[i + 1];
-                        case HID_USAGE_PAGE_DIGITIZER:
+                        i++;
-                                usage = WCM_DIGITIZER;
-                                i++;
-                                break;
-                        case HID_USAGE_PAGE_DESKTOP:
-                                usage = WCM_DESKTOP;
-                                i++;
-                                break;
-                        }
                        break;
                case HID_USAGE:
-                        switch (report[i + 1]) {
+                        switch (page << 16 | report[i + 1]) {
                        case HID_USAGE_X:
-                                if (usage == WCM_DESKTOP) {
+                                if (finger) {
-                                        if (finger) {
+                                        features->device_type = BTN_TOOL_FINGER;
-                                                features->device_type = BTN_TOOL_FINGER;
+                                        /* touch device at least supports one touch point */
-                                                /* touch device at least supports one touch point */
+                                        touch_max = 1;
-                                                touch_max = 1;
+                                        switch (features->type) {
-                                                switch (features->type) {
+                                        case TABLETPC2FG:
-                                                case TABLETPC2FG:
+                                                features->pktlen = WACOM_PKGLEN_TPC2FG;
-                                                        features->pktlen = WACOM_PKGLEN_TPC2FG;
+                                                break;
-                                                        break;
+                                        case MTSCREEN:
-                                                case MTSCREEN:
+                                        case WACOM_24HDT:
-                                                case WACOM_24HDT:
+                                                features->pktlen = WACOM_PKGLEN_MTOUCH;
-                                                        features->pktlen = WACOM_PKGLEN_MTOUCH;
+                                                break;
-                                                        break;
+                                        case MTTPC:
-                                                case MTTPC:
+                                                features->pktlen = WACOM_PKGLEN_MTTPC;
-                                                        features->pktlen = WACOM_PKGLEN_MTTPC;
+                                                break;
-                                                        break;
+                                        case BAMBOO_PT:
-                                                case BAMBOO_PT:
+                                                features->pktlen = WACOM_PKGLEN_BBTOUCH;
-                                                        features->pktlen = WACOM_PKGLEN_BBTOUCH;
+                                                break;
-                                                        break;
+                                        default:
-                                                default:
+                                                features->pktlen = WACOM_PKGLEN_GRAPHIRE;
-                                                        features->pktlen = WACOM_PKGLEN_GRAPHIRE;
+                                                break;
-                                                        break;
+                                        }
-                                                }
+                                        switch (features->type) {
-                                                switch (features->type) {
+                                        case BAMBOO_PT:
-                                                case BAMBOO_PT:
+                                                features->x_phy =
-                                                        features->x_phy =
+                                                        get_unaligned_le16(&report[i + 5]);
-                                                                get_unaligned_le16(&report[i + 5]);
+                                                features->x_max =
-                                                        features->x_max =
+                                                        get_unaligned_le16(&report[i + 8]);
-                                                                get_unaligned_le16(&report[i + 8]);
+                                                i += 15;
-                                                        i += 15;
+                                                break;
-                                                        break;
+                                        case WACOM_24HDT:
-                                                case WACOM_24HDT:
-                                                        features->x_max =
-                                                                get_unaligned_le16(&report[i + 3]);
-                                                        features->x_phy =
-                                                                get_unaligned_le16(&report[i + 8]);
-                                                        features->unit = report[i - 1];
-                                                        features->unitExpo = report[i - 3];
-                                                        i += 12;
-                                                        break;
-                                                default:
-                                                        features->x_max =
-                                                                get_unaligned_le16(&report[i + 3]);
-                                                        features->x_phy =
-                                                                get_unaligned_le16(&report[i + 6]);
-                                                        features->unit = report[i + 9];
-                                                        features->unitExpo = report[i + 11];
-                                                        i += 12;
-                                                        break;
-                                                }
-                                        } else if (pen) {
-                                                /* penabled only accepts exact bytes of data */
-                                                if (features->type >= TABLETPC)
-                                                        features->pktlen = WACOM_PKGLEN_GRAPHIRE;
-                                                features->device_type = BTN_TOOL_PEN;
                                                features->x_max =
                                                        get_unaligned_le16(&report[i + 3]);
-                                                i += 4;
+                                                features->x_phy =
+                                                        get_unaligned_le16(&report[i + 8]);
+                                                features->unit = report[i - 1];
+                                                features->unitExpo = report[i - 3];
+                                                i += 12;
+                                                break;
+                                        default:
+                                                features->x_max =
+                                                        get_unaligned_le16(&report[i + 3]);
+                                                features->x_phy =
+                                                        get_unaligned_le16(&report[i + 6]);
+                                                features->unit = report[i + 9];
+                                                features->unitExpo = report[i + 11];
+                                                i += 12;
+                                                break;
                                        }
+                                } else if (pen) {
+                                        /* penabled only accepts exact bytes of data */
+                                        if (features->type >= TABLETPC)
+                                                features->pktlen = WACOM_PKGLEN_GRAPHIRE;
+                                        features->device_type = BTN_TOOL_PEN;
+                                        features->x_max =
+                                                get_unaligned_le16(&report[i + 3]);
+                                        i += 4;
                                }
                                break;
                        case HID_USAGE_Y:
-                                if (usage == WCM_DESKTOP) {
+                                if (finger) {
-                                        if (finger) {
+                                        switch (features->type) {
-                                                switch (features->type) {
+                                        case TABLETPC2FG:
-                                                case TABLETPC2FG:
+                                        case MTSCREEN:
-                                                case MTSCREEN:
+                                        case MTTPC:
-                                                case MTTPC:
+                                                features->y_max =
-                                                        features->y_max =
+                                                        get_unaligned_le16(&report[i + 3]);
-                                                                get_unaligned_le16(&report[i + 3]);
+                                                features->y_phy =
-                                                        features->y_phy =
+                                                        get_unaligned_le16(&report[i + 6]);
-                                                                get_unaligned_le16(&report[i + 6]);
+                                                i += 7;
-                                                        i += 7;
+                                                break;
-                                                        break;
+                                        case WACOM_24HDT:
-                                                case WACOM_24HDT:
+                                                features->y_max =
-                                                        features->y_max =
+                                                        get_unaligned_le16(&report[i + 3]);
-                                                                get_unaligned_le16(&report[i + 3]);
+                                                features->y_phy =
-                                                        features->y_phy =
+                                                        get_unaligned_le16(&report[i - 2]);
-                                                                get_unaligned_le16(&report[i - 2]);
+                                                i += 7;
-                                                        i += 7;
+                                                break;
-                                                        break;
+                                        case BAMBOO_PT:
-                                                case BAMBOO_PT:
+                                                features->y_phy =
-                                                        features->y_phy =
+                                                        get_unaligned_le16(&report[i + 3]);
-                                                                get_unaligned_le16(&report[i + 3]);
+                                                features->y_max =
-                                                        features->y_max =
+                                                        get_unaligned_le16(&report[i + 6]);
-                                                                get_unaligned_le16(&report[i + 6]);
+                                                i += 12;
-                                                        i += 12;
+                                                break;
-                                                        break;
+                                        default:
-                                                default:
-                                                        features->y_max =
-                                                                features->x_max;
-                                                        features->y_phy =
-                                                                get_unaligned_le16(&report[i + 3]);
-                                                        i += 4;
-                                                        break;
-                                                }
-                                        } else if (pen) {
                                                features->y_max =
+                                                        features->x_max;
+                                                features->y_phy =
                                                        get_unaligned_le16(&report[i + 3]);
                                                i += 4;
+                                                break;
                                        }
+                                } else if (pen) {
+                                        features->y_max =
+                                                get_unaligned_le16(&report[i + 3]);
+                                        i += 4;
                                }
                                break;
@@ -484,12 +466,20 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                        wacom_retrieve_report_data(intf, features);
                                i++;
                                break;
+                        case HID_USAGE_PRESSURE:
+                                if (pen) {
+                                        features->pressure_max =
+                                                get_unaligned_le16(&report[i + 3]);
+                                        i += 4;
+                                }
+                                break;
                        }
                        break;
                case HID_COLLECTION_END:
                        /* reset UsagePage and Finger */
-                        finger = usage = 0;
+                        finger = page = 0;
                        break;
                case HID_COLLECTION:
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 05f371df6c40..4822c57a3756 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -178,10 +178,9 @@ static int wacom_ptu_irq(struct wacom_wac *wacom)
 static int wacom_dtu_irq(struct wacom_wac *wacom)
 {
-        struct wacom_features *features = &wacom->features;
+        unsigned char *data = wacom->data;
-        char *data = wacom->data;
        struct input_dev *input = wacom->input;
-        int prox = data[1] & 0x20, pressure;
+        int prox = data[1] & 0x20;
        dev_dbg(input->dev.parent,
                "%s: received report #%d", __func__, data[0]);
@@ -198,10 +197,7 @@ static int wacom_dtu_irq(struct wacom_wac *wacom)
        input_report_key(input, BTN_STYLUS2, data[1] & 0x10);
        input_report_abs(input, ABS_X, le16_to_cpup((__le16 *)&data[2]));
        input_report_abs(input, ABS_Y, le16_to_cpup((__le16 *)&data[4]));
-        pressure = ((data[7] & 0x01) << 8) | data[6];
+        input_report_abs(input, ABS_PRESSURE, ((data[7] & 0x01) << 8) | data[6]);
-        if (pressure < 0)
-                pressure = features->pressure_max + pressure + 1;
-        input_report_abs(input, ABS_PRESSURE, pressure);
        input_report_key(input, BTN_TOUCH, data[1] & 0x05);
        if (!prox) /* out-prox */
                wacom->id[0] = 0;
@@ -906,7 +902,7 @@ static int int_dist(int x1, int y1, int x2, int y2)
 static int wacom_24hdt_irq(struct wacom_wac *wacom)
 {
        struct input_dev *input = wacom->input;
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        int i;
        int current_num_contacts = data[61];
        int contacts_to_send = 0;
@@ -959,7 +955,7 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
 static int wacom_mt_touch(struct wacom_wac *wacom)
 {
        struct input_dev *input = wacom->input;
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        int i;
        int current_num_contacts = data[2];
        int contacts_to_send = 0;
@@ -1038,7 +1034,7 @@ static int wacom_tpc_mt_touch(struct wacom_wac *wacom)
 static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 {
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        struct input_dev *input = wacom->input;
        bool prox;
        int x = 0, y = 0;
@@ -1074,10 +1070,8 @@ static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 static int wacom_tpc_pen(struct wacom_wac *wacom)
 {
-        struct wacom_features *features = &wacom->features;
+        unsigned char *data = wacom->data;
-        char *data = wacom->data;
        struct input_dev *input = wacom->input;
-        int pressure;
        bool prox = data[1] & 0x20;
        if (!wacom->shared->stylus_in_proximity) /* first in prox */
@@ -1093,10 +1087,7 @@ static int wacom_tpc_pen(struct wacom_wac *wacom)
                input_report_key(input, BTN_STYLUS2, data[1] & 0x10);
                input_report_abs(input, ABS_X, le16_to_cpup((__le16 *)&data[2]));
                input_report_abs(input, ABS_Y, le16_to_cpup((__le16 *)&data[4]));
-                pressure = ((data[7] & 0x01) << 8) | data[6];
+                input_report_abs(input, ABS_PRESSURE, ((data[7] & 0x03) << 8) | data[6]);
-                if (pressure < 0)
-                        pressure = features->pressure_max + pressure + 1;
-                input_report_abs(input, ABS_PRESSURE, pressure);
                input_report_key(input, BTN_TOUCH, data[1] & 0x05);
                input_report_key(input, wacom->tool[0], prox);
                return 1;
@@ -1107,7 +1098,7 @@ static int wacom_tpc_pen(struct wacom_wac *wacom)
 static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
 {
-        char *data = wacom->data;
+        unsigned char *data = wacom->data;
        dev_dbg(wacom->input->dev.parent,
                "%s: received report #%d\n", __func__, data[0]);
@@ -1838,7 +1829,7 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
        case DTU:
                if (features->type == DTUS) {
                        input_set_capability(input_dev, EV_MSC, MSC_SERIAL);
-                        for (i = 0; i < 3; i++)
+                        for (i = 0; i < 4; i++)
                                __set_bit(BTN_0 + i, input_dev->keybit);
                }
                __set_bit(BTN_TOOL_PEN, input_dev->keybit);
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 68edc9db2c64..b845e9370871 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -640,7 +640,7 @@ config TOUCHSCREEN_WM9713
 config TOUCHSCREEN_WM97XX_ATMEL
        tristate "WM97xx Atmel accelerated touch"
-        depends on TOUCHSCREEN_WM97XX && (AVR32 || ARCH_AT91)
+        depends on TOUCHSCREEN_WM97XX && AVR32
        help
          Say Y here for support for streaming mode with WM97xx touchscreens
          on Atmel AT91 or AVR32 systems with an AC97C module.
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 45a06e495ed2..7f8aa981500d 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -425,7 +425,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
 name ## _show(struct device *dev, struct device_attribute *attr, char *buf) \
 { \
        struct ads7846 *ts = dev_get_drvdata(dev); \
-        ssize_t v = ads7846_read12_ser(dev, \
+        ssize_t v = ads7846_read12_ser(&ts->spi->dev, \
                        READ_12BIT_SER(var)); \
        if (v < 0) \
                return v; \
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index c949520bd196..57068e8035b5 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3999,7 +3999,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
        iommu_flush_dte(iommu, devid);
        if (devid != alias) {
                irq_lookup_table[alias] = table;
-                set_dte_irq_entry(devid, table);
+                set_dte_irq_entry(alias, table);
                iommu_flush_dte(iommu, alias);
        }
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index b76c58dbe30c..0e08545d7298 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -788,7 +788,7 @@ static void __init set_device_exclusion_range(u16 devid, struct ivmd_header *m)
                 * per device. But we can enable the exclusion range per
                 * device. This is done here
                 */
-                set_dev_entry_bit(m->devid, DEV_ENTRY_EX);
+                set_dev_entry_bit(devid, DEV_ENTRY_EX);
                iommu->exclusion_start = m->range_start;
                iommu->exclusion_length = m->range_length;
        }
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index 5208828792e6..203b2e6a91cf 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -504,8 +504,10 @@ static void do_fault(struct work_struct *work)
        write = !!(fault->flags & PPR_FAULT_WRITE);
+        down_read(&fault->state->mm->mmap_sem);
        npages = get_user_pages(fault->state->task, fault->state->mm,
                                fault->address, 1, write, 0, &page, NULL);
+        up_read(&fault->state->mm->mmap_sem);
        if (npages == 1) {
                put_page(page);
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 8b89e33a89fe..647c3c7fd742 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1381,7 +1381,7 @@ static int arm_smmu_alloc_init_pmd(struct arm_smmu_device *smmu, pud_t *pud,
        do {
                next = pmd_addr_end(addr, end);
-                ret = arm_smmu_alloc_init_pte(smmu, pmd, addr, end, pfn,
+                ret = arm_smmu_alloc_init_pte(smmu, pmd, addr, next, pfn,
                                              prot, stage);
                phys += next - addr;
        } while (pmd++, addr = next, addr < end);
@@ -1499,7 +1499,7 @@ static size_t arm_smmu_unmap(struct iommu_domain *domain, unsigned long iova,
        ret = arm_smmu_handle_mapping(smmu_domain, iova, 0, size, 0);
        arm_smmu_tlb_inv_context(&smmu_domain->root_cfg);
-        return ret ? ret : size;
+        return ret ? 0 : size;
 }
 static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index f445c10df8df..39f8b717fe84 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -152,7 +152,8 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event)
        info->seg = pci_domain_nr(dev->bus);
        info->level = level;
        if (event == BUS_NOTIFY_ADD_DEVICE) {
-                for (tmp = dev, level--; tmp; tmp = tmp->bus->self) {
+                for (tmp = dev; tmp; tmp = tmp->bus->self) {
+                        level--;
                        info->path[level].device = PCI_SLOT(tmp->devfn);
                        info->path[level].function = PCI_FUNC(tmp->devfn);
                        if (pci_is_root_bus(tmp->bus))
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 69fa7da5e48b..f256ffc02e29 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1009,11 +1009,13 @@ static struct page *dma_pte_list_pagetables(struct dmar_domain *domain,
        if (level == 1)
                return freelist;
-        for (pte = page_address(pg); !first_pte_in_page(pte); pte++) {
+        pte = page_address(pg);
+        do {
                if (dma_pte_present(pte) && !dma_pte_superpage(pte))
                        freelist = dma_pte_list_pagetables(domain, level - 1,
                                                           pte, freelist);
-        }
+                pte++;
+        } while (!first_pte_in_page(pte));
        return freelist;
 }
@@ -2235,7 +2237,9 @@ static struct dmar_domain *get_domain_for_dev(struct device *dev, int gaw)
                                bridge_devfn = dev_tmp->devfn;
                        }
                        spin_lock_irqsave(&device_domain_lock, flags);
-                        info = dmar_search_domain_by_dev_info(segment, bus, devfn);
+                        info = dmar_search_domain_by_dev_info(segment,
+                                                              bridge_bus,
+                                                              bridge_devfn);
                        if (info) {
                                iommu = info->iommu;
                                domain = info->domain;
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 41be897df8d5..3899ba7821c5 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -41,6 +41,7 @@
 #define ARMADA_370_XP_INT_SET_ENABLE_OFFS       (0x30)
 #define ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS     (0x34)
 #define ARMADA_370_XP_INT_SOURCE_CTL(irq)       (0x100 + irq*4)
+#define ARMADA_370_XP_INT_SOURCE_CPU_MASK       0xF
 #define ARMADA_370_XP_CPU_INTACK_OFFS           (0x44)
 #define ARMADA_375_PPI_CAUSE                    (0x10)
@@ -132,8 +133,7 @@ static int armada_370_xp_setup_msi_irq(struct msi_chip *chip,
                                       struct msi_desc *desc)
 {
        struct msi_msg msg;
-        irq_hw_number_t hwirq;
+        int virq, hwirq;
-        int virq;
        hwirq = armada_370_xp_alloc_msi();
        if (hwirq < 0)
@@ -159,8 +159,19 @@ static void armada_370_xp_teardown_msi_irq(struct msi_chip *chip,
                                           unsigned int irq)
 {
        struct irq_data *d = irq_get_irq_data(irq);
+        unsigned long hwirq = d->hwirq;
        irq_dispose_mapping(irq);
-        armada_370_xp_free_msi(d->hwirq);
+        armada_370_xp_free_msi(hwirq);
+}
+static int armada_370_xp_check_msi_device(struct msi_chip *chip, struct pci_dev *dev,
+                                          int nvec, int type)
+{
+        /* We support MSI, but not MSI-X */
+        if (type == PCI_CAP_ID_MSI)
+                return 0;
+        return -EINVAL;
 }
 static struct irq_chip armada_370_xp_msi_irq_chip = {
@@ -201,6 +212,7 @@ static int armada_370_xp_msi_init(struct device_node *node,
        msi_chip->setup_irq = armada_370_xp_setup_msi_irq;
        msi_chip->teardown_irq = armada_370_xp_teardown_msi_irq;
+        msi_chip->check_device = armada_370_xp_check_msi_device;
        msi_chip->of_node = node;
        armada_370_xp_msi_domain =
@@ -244,35 +256,18 @@ static DEFINE_RAW_SPINLOCK(irq_controller_lock);
 static int armada_xp_set_affinity(struct irq_data *d,
                                  const struct cpumask *mask_val, bool force)
 {
-        unsigned long reg;
-        unsigned long new_mask = 0;
-        unsigned long online_mask = 0;
-        unsigned long count = 0;
        irq_hw_number_t hwirq = irqd_to_hwirq(d);
+        unsigned long reg, mask;
        int cpu;
-        for_each_cpu(cpu, mask_val) {
+        /* Select a single core from the affinity mask which is online */
-                new_mask |= 1 << cpu_logical_map(cpu);
+        cpu = cpumask_any_and(mask_val, cpu_online_mask);
-                count++;
+        mask = 1UL << cpu_logical_map(cpu);
-        }
-        /*
-         * Forbid mutlicore interrupt affinity
-         * This is required since the MPIC HW doesn't limit
-         * several CPUs from acknowledging the same interrupt.
-         */
-        if (count > 1)
-                return -EINVAL;
-        for_each_cpu(cpu, cpu_online_mask)
-                online_mask |= 1 << cpu_logical_map(cpu);
        raw_spin_lock(&irq_controller_lock);
        reg = readl(main_int_base + ARMADA_370_XP_INT_SOURCE_CTL(hwirq));
-        reg = (reg & (~online_mask)) | new_mask;
+        reg = (reg & (~ARMADA_370_XP_INT_SOURCE_CPU_MASK)) | mask;
        writel(reg, main_int_base + ARMADA_370_XP_INT_SOURCE_CTL(hwirq));
        raw_spin_unlock(&irq_controller_lock);
        return 0;
@@ -494,15 +489,6 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
 #ifdef CONFIG_SMP
        armada_xp_mpic_smp_cpu_init();
-        /*
-         * Set the default affinity from all CPUs to the boot cpu.
-         * This is required since the MPIC doesn't limit several CPUs
-         * from acknowledging the same interrupt.
-         */
-        cpumask_clear(irq_default_affinity);
-        cpumask_set_cpu(smp_processor_id(), irq_default_affinity);
 #endif
        armada_370_xp_msi_init(node, main_int_res.start);
diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index fc817d28d1fe..3d15d16a7088 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -107,7 +107,7 @@ static int __init crossbar_of_init(struct device_node *node)
        int i, size, max, reserved = 0, entry;
        const __be32 *irqsr;
-        cb = kzalloc(sizeof(struct cb_device *), GFP_KERNEL);
+        cb = kzalloc(sizeof(*cb), GFP_KERNEL);
        if (!cb)
                return -ENOMEM;
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 4300b6606f5e..57d165e026f4 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -246,10 +246,14 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                            bool force)
 {
        void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
-        unsigned int shift = (gic_irq(d) % 4) * 8;
+        unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
        u32 val, mask, bit;
+        if (!force)
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        else
+                cpu = cpumask_first(mask_val);
        if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
                return -EINVAL;
diff --git a/drivers/irqchip/irq-vic.c b/drivers/irqchip/irq-vic.c
index 37dab0b472cd..7d35287f9e90 100644
--- a/drivers/irqchip/irq-vic.c
+++ b/drivers/irqchip/irq-vic.c
@@ -24,6 +24,7 @@
 #include <linux/list.h>
 #include <linux/io.h>
 #include <linux/irq.h>
+#include <linux/irqchip/chained_irq.h>
 #include <linux/irqdomain.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
@@ -228,12 +229,17 @@ static int handle_one_vic(struct vic_device *vic, struct pt_regs *regs)
 static void vic_handle_irq_cascaded(unsigned int irq, struct irq_desc *desc)
 {
        u32 stat, hwirq;
+        struct irq_chip *host_chip = irq_desc_get_chip(desc);
        struct vic_device *vic = irq_desc_get_handler_data(desc);
+        chained_irq_enter(host_chip, desc);
        while ((stat = readl_relaxed(vic->base + VIC_IRQ_STATUS))) {
                hwirq = ffs(stat) - 1;
                generic_handle_irq(irq_find_mapping(vic->domain, hwirq));
        }
+        chained_irq_exit(host_chip, desc);
 }
 /*
diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
index 8527743b5cef..3fdda3a40269 100644
--- a/drivers/irqchip/spear-shirq.c
+++ b/drivers/irqchip/spear-shirq.c
@@ -5,7 +5,7 @@
 * Viresh Kumar <viresh.linux@gmail.com>
 *
 * Copyright (C) 2012 ST Microelectronics
- * Shiraz Hashim <shiraz.hashim@st.com>
+ * Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/isdn/hisax/icc.c b/drivers/isdn/hisax/icc.c
index 51dae9167238..96d1df05044f 100644
--- a/drivers/isdn/hisax/icc.c
+++ b/drivers/isdn/hisax/icc.c
@@ -425,7 +425,7 @@ afterXPR:
                                if (cs->debug & L1_DEB_MONITOR)
                                        debugl1(cs, "ICC %02x -> MOX1", cs->dc.icc.mon_tx[cs->dc.icc.mon_txp - 1]);
                        }
-                AfterMOX1:
+                AfterMOX1: ;
 #endif
                }
        }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 53d487f0c79d..6a7447c304ac 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1155,7 +1155,7 @@ icn_command(isdn_ctrl *c, icn_card *card)
        ulong a;
        ulong flags;
        int i;
-        char cbuf[60];
+        char cbuf[80];
        isdn_ctrl cmd;
        icn_cdef cdef;
        char __user *arg;
@@ -1309,7 +1309,6 @@ icn_command(isdn_ctrl *c, icn_card *card)
                        break;
                if ((c->arg & 255) < ICN_BCH) {
                        char *p;
-                        char dial[50];
                        char dcode[4];
                        a = c->arg;
@@ -1321,10 +1320,10 @@ icn_command(isdn_ctrl *c, icn_card *card)
                        } else
                                /* Normal Dial */
                                strcpy(dcode, "CAL");
-                        strcpy(dial, p);
+                        snprintf(cbuf, sizeof(cbuf),
-                        sprintf(cbuf, "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1),
+                                 "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1),
-                                dcode, dial, c->parm.setup.si1,
+                                 dcode, p, c->parm.setup.si1,
-                                c->parm.setup.si2, c->parm.setup.eazmsn);
+                                 c->parm.setup.si2, c->parm.setup.eazmsn);
                        i = icn_writecmd(cbuf, strlen(cbuf), 0, card);
                }
                break;
diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index d1278b5f3028..004926955263 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -141,6 +141,7 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
                default:
                        pr_err("Invalid chameleon descriptor type 0x%x\n",
                                dtype);
+                        kfree(header);
                        return -EINVAL;
                }
                num_cells++;
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1bf4a71919ec..5f054c44b485 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2178,6 +2178,8 @@ static int cache_create(struct cache_args *ca, struct cache **result)
        ti->num_discard_bios = 1;
        ti->discards_supported = true;
        ti->discard_zeroes_data_unsupported = true;
+        /* Discard bios must be split on a block boundary */
+        ti->split_discard_bios = true;
        cache->features = ca->features;
        ti->per_bio_data_size = get_per_bio_data_size(cache);
@@ -2488,6 +2490,7 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
                } else {
                        inc_hit_counter(cache, bio);
+                        pb->all_io_entry = dm_deferred_entry_inc(cache->all_io_ds);
                        if (bio_data_dir(bio) == WRITE && writethrough_mode(&cache->features) &&
                            !is_dirty(cache, lookup_result.cblock))
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 784695d22fde..53b213226c01 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -19,7 +19,6 @@
 #include <linux/crypto.h>
 #include <linux/workqueue.h>
 #include <linux/backing-dev.h>
-#include <linux/percpu.h>
 #include <linux/atomic.h>
 #include <linux/scatterlist.h>
 #include <asm/page.h>
@@ -43,6 +42,7 @@ struct convert_context {
        struct bvec_iter iter_out;
        sector_t cc_sector;
        atomic_t cc_pending;
+        struct ablkcipher_request *req;
 };
 /*
@@ -111,15 +111,7 @@ struct iv_tcw_private {
 enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID };
 /*
- * Duplicated per-CPU state for cipher.
+ * The fields in here must be read only after initialization.
- */
-struct crypt_cpu {
-        struct ablkcipher_request *req;
-};
-/*
- * The fields in here must be read only after initialization,
- * changing state should be in crypt_cpu.
 */
 struct crypt_config {
        struct dm_dev *dev;
@@ -150,12 +142,6 @@ struct crypt_config {
        sector_t iv_offset;
        unsigned int iv_size;
-        /*
-         * Duplicated per cpu state. Access through
-         * per_cpu_ptr() only.
-         */
-        struct crypt_cpu __percpu *cpu;
        /* ESSIV: struct crypto_cipher *essiv_tfm */
        void *iv_private;
        struct crypto_ablkcipher **tfms;
@@ -192,11 +178,6 @@ static void clone_init(struct dm_crypt_io *, struct bio *);
 static void kcryptd_queue_crypt(struct dm_crypt_io *io);
 static u8 *iv_of_dmreq(struct crypt_config *cc, struct dm_crypt_request *dmreq);
-static struct crypt_cpu *this_crypt_config(struct crypt_config *cc)
-{
-        return this_cpu_ptr(cc->cpu);
-}
 /*
 * Use this to access cipher attributes that are the same for each CPU.
 */
@@ -903,16 +884,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
 static void crypt_alloc_req(struct crypt_config *cc,
                            struct convert_context *ctx)
 {
-        struct crypt_cpu *this_cc = this_crypt_config(cc);
        unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1);
-        if (!this_cc->req)
+        if (!ctx->req)
-                this_cc->req = mempool_alloc(cc->req_pool, GFP_NOIO);
+                ctx->req = mempool_alloc(cc->req_pool, GFP_NOIO);
-        ablkcipher_request_set_tfm(this_cc->req, cc->tfms[key_index]);
+        ablkcipher_request_set_tfm(ctx->req, cc->tfms[key_index]);
-        ablkcipher_request_set_callback(this_cc->req,
+        ablkcipher_request_set_callback(ctx->req,
            CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
-            kcryptd_async_done, dmreq_of_req(cc, this_cc->req));
+            kcryptd_async_done, dmreq_of_req(cc, ctx->req));
 }
 /*
@@ -921,7 +901,6 @@ static void crypt_alloc_req(struct crypt_config *cc,
 static int crypt_convert(struct crypt_config *cc,
                         struct convert_context *ctx)
 {
-        struct crypt_cpu *this_cc = this_crypt_config(cc);
        int r;
        atomic_set(&ctx->cc_pending, 1);
@@ -932,7 +911,7 @@ static int crypt_convert(struct crypt_config *cc,
                atomic_inc(&ctx->cc_pending);
-                r = crypt_convert_block(cc, ctx, this_cc->req);
+                r = crypt_convert_block(cc, ctx, ctx->req);
                switch (r) {
                /* async */
@@ -941,7 +920,7 @@ static int crypt_convert(struct crypt_config *cc,
                        reinit_completion(&ctx->restart);
                        /* fall through*/
                case -EINPROGRESS:
-                        this_cc->req = NULL;
+                        ctx->req = NULL;
                        ctx->cc_sector++;
                        continue;
@@ -1040,6 +1019,7 @@ static struct dm_crypt_io *crypt_io_alloc(struct crypt_config *cc,
        io->sector = sector;
        io->error = 0;
        io->base_io = NULL;
+        io->ctx.req = NULL;
        atomic_set(&io->io_pending, 0);
        return io;
@@ -1065,6 +1045,8 @@ static void crypt_dec_pending(struct dm_crypt_io *io)
        if (!atomic_dec_and_test(&io->io_pending))
                return;
+        if (io->ctx.req)
+                mempool_free(io->ctx.req, cc->req_pool);
        mempool_free(io, cc->io_pool);
        if (likely(!base_io))
@@ -1492,8 +1474,6 @@ static int crypt_wipe_key(struct crypt_config *cc)
 static void crypt_dtr(struct dm_target *ti)
 {
        struct crypt_config *cc = ti->private;
-        struct crypt_cpu *cpu_cc;
-        int cpu;
        ti->private = NULL;
@@ -1505,13 +1485,6 @@ static void crypt_dtr(struct dm_target *ti)
        if (cc->crypt_queue)
                destroy_workqueue(cc->crypt_queue);
-        if (cc->cpu)
-                for_each_possible_cpu(cpu) {
-                        cpu_cc = per_cpu_ptr(cc->cpu, cpu);
-                        if (cpu_cc->req)
-                                mempool_free(cpu_cc->req, cc->req_pool);
-                }
        crypt_free_tfms(cc);
        if (cc->bs)
@@ -1530,9 +1503,6 @@ static void crypt_dtr(struct dm_target *ti)
        if (cc->dev)
                dm_put_device(ti, cc->dev);
-        if (cc->cpu)
-                free_percpu(cc->cpu);
        kzfree(cc->cipher);
        kzfree(cc->cipher_string);
@@ -1588,13 +1558,6 @@ static int crypt_ctr_cipher(struct dm_target *ti,
        if (tmp)
                DMWARN("Ignoring unexpected additional cipher options");
-        cc->cpu = __alloc_percpu(sizeof(*(cc->cpu)),
-                                 __alignof__(struct crypt_cpu));
-        if (!cc->cpu) {
-                ti->error = "Cannot allocate per cpu state";
-                goto bad_mem;
-        }
        /*
         * For compatibility with the original dm-crypt mapping format, if
         * only the cipher name is supplied, use cbc-plain.
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index aa009e865871..ebfa411d1a7d 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -445,11 +445,11 @@ static int queue_if_no_path(struct multipath *m, unsigned queue_if_no_path,
        else
                m->saved_queue_if_no_path = queue_if_no_path;
        m->queue_if_no_path = queue_if_no_path;
-        if (!m->queue_if_no_path)
-                dm_table_run_md_queue_async(m->ti->table);
        spin_unlock_irqrestore(&m->lock, flags);
+        if (!queue_if_no_path)
+                dm_table_run_md_queue_async(m->ti->table);
        return 0;
 }
@@ -954,7 +954,7 @@ out:
 */
 static int reinstate_path(struct pgpath *pgpath)
 {
-        int r = 0;
+        int r = 0, run_queue = 0;
        unsigned long flags;
        struct multipath *m = pgpath->pg->m;
@@ -978,7 +978,7 @@ static int reinstate_path(struct pgpath *pgpath)
        if (!m->nr_valid_paths++) {
                m->current_pgpath = NULL;
-                dm_table_run_md_queue_async(m->ti->table);
+                run_queue = 1;
        } else if (m->hw_handler_name && (m->current_pg == pgpath->pg)) {
                if (queue_work(kmpath_handlerd, &pgpath->activate_path.work))
                        m->pg_init_in_progress++;
@@ -991,6 +991,8 @@ static int reinstate_path(struct pgpath *pgpath)
 out:
        spin_unlock_irqrestore(&m->lock, flags);
+        if (run_queue)
+                dm_table_run_md_queue_async(m->ti->table);
        return r;
 }
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 53728be84dee..242ac2ea5f29 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -27,6 +27,9 @@
 #define MAPPING_POOL_SIZE 1024
 #define PRISON_CELLS 1024
 #define COMMIT_PERIOD HZ
+#define NO_SPACE_TIMEOUT_SECS 60
+static unsigned no_space_timeout_secs = NO_SPACE_TIMEOUT_SECS;
 DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
                "A percentage of time allocated for copy on write");
@@ -175,6 +178,7 @@ struct pool {
        struct workqueue_struct *wq;
        struct work_struct worker;
        struct delayed_work waker;
+        struct delayed_work no_space_timeout;
        unsigned long last_commit_jiffies;
        unsigned ref_count;
@@ -232,6 +236,13 @@ struct thin_c {
        struct bio_list deferred_bio_list;
        struct bio_list retry_on_resume_list;
        struct rb_root sort_bio_list; /* sorted list of deferred bios */
+        /*
+         * Ensures the thin is not destroyed until the worker has finished
+         * iterating the active_thins list.
+         */
+        atomic_t refcount;
+        struct completion can_destroy;
 };
 /*----------------------------------------------------------------*/
@@ -928,7 +939,7 @@ static int commit(struct pool *pool)
 {
        int r;
-        if (get_pool_mode(pool) != PM_WRITE)
+        if (get_pool_mode(pool) >= PM_READ_ONLY)
                return -EINVAL;
        r = dm_pool_commit_metadata(pool->pmd);
@@ -1486,6 +1497,45 @@ static void process_thin_deferred_bios(struct thin_c *tc)
        blk_finish_plug(&plug);
 }
+static void thin_get(struct thin_c *tc);
+static void thin_put(struct thin_c *tc);
+/*
+ * We can't hold rcu_read_lock() around code that can block.  So we
+ * find a thin with the rcu lock held; bump a refcount; then drop
+ * the lock.
+ */
+static struct thin_c *get_first_thin(struct pool *pool)
+{
+        struct thin_c *tc = NULL;
+        rcu_read_lock();
+        if (!list_empty(&pool->active_thins)) {
+                tc = list_entry_rcu(pool->active_thins.next, struct thin_c, list);
+                thin_get(tc);
+        }
+        rcu_read_unlock();
+        return tc;
+}
+static struct thin_c *get_next_thin(struct pool *pool, struct thin_c *tc)
+{
+        struct thin_c *old_tc = tc;
+        rcu_read_lock();
+        list_for_each_entry_continue_rcu(tc, &pool->active_thins, list) {
+                thin_get(tc);
+                thin_put(old_tc);
+                rcu_read_unlock();
+                return tc;
+        }
+        thin_put(old_tc);
+        rcu_read_unlock();
+        return NULL;
+}
 static void process_deferred_bios(struct pool *pool)
 {
        unsigned long flags;
@@ -1493,10 +1543,11 @@ static void process_deferred_bios(struct pool *pool)
        struct bio_list bios;
        struct thin_c *tc;
-        rcu_read_lock();
+        tc = get_first_thin(pool);
-        list_for_each_entry_rcu(tc, &pool->active_thins, list)
+        while (tc) {
                process_thin_deferred_bios(tc);
-        rcu_read_unlock();
+                tc = get_next_thin(pool, tc);
+        }
        /*
         * If there are any deferred flush bios, we must commit
@@ -1543,6 +1594,20 @@ static void do_waker(struct work_struct *ws)
        queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
 }
+/*
+ * We're holding onto IO to allow userland time to react.  After the
+ * timeout either the pool will have been resized (and thus back in
+ * PM_WRITE mode), or we degrade to PM_READ_ONLY and start erroring IO.
+ */
+static void do_no_space_timeout(struct work_struct *ws)
+{
+        struct pool *pool = container_of(to_delayed_work(ws), struct pool,
+                                         no_space_timeout);
+        if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space)
+                set_pool_mode(pool, PM_READ_ONLY);
+}
 /*----------------------------------------------------------------*/
 struct noflush_work {
@@ -1578,7 +1643,7 @@ static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
 {
        struct noflush_work w;
-        INIT_WORK(&w.worker, fn);
+        INIT_WORK_ONSTACK(&w.worker, fn);
        w.tc = tc;
        atomic_set(&w.complete, 0);
        init_waitqueue_head(&w.wait);
@@ -1607,6 +1672,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
        struct pool_c *pt = pool->ti->private;
        bool needs_check = dm_pool_metadata_needs_check(pool->pmd);
        enum pool_mode old_mode = get_pool_mode(pool);
+        unsigned long no_space_timeout = ACCESS_ONCE(no_space_timeout_secs) * HZ;
        /*
         * Never allow the pool to transition to PM_WRITE mode if user
@@ -1668,6 +1734,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                pool->process_discard = process_discard;
                pool->process_prepared_mapping = process_prepared_mapping;
                pool->process_prepared_discard = process_prepared_discard_passdown;
+                if (!pool->pf.error_if_no_space && no_space_timeout)
+                        queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
                break;
        case PM_WRITE:
@@ -2053,6 +2122,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
        INIT_WORK(&pool->worker, do_worker);
        INIT_DELAYED_WORK(&pool->waker, do_waker);
+        INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
        spin_lock_init(&pool->lock);
        bio_list_init(&pool->deferred_flush_bios);
        INIT_LIST_HEAD(&pool->prepared_mappings);
@@ -2615,6 +2685,7 @@ static void pool_postsuspend(struct dm_target *ti)
        struct pool *pool = pt->pool;
        cancel_delayed_work(&pool->waker);
+        cancel_delayed_work(&pool->no_space_timeout);
        flush_workqueue(pool->wq);
        (void) commit(pool);
 }
@@ -3061,11 +3132,25 @@ static struct target_type pool_target = {
 /*----------------------------------------------------------------
 * Thin target methods
 *--------------------------------------------------------------*/
+static void thin_get(struct thin_c *tc)
+{
+        atomic_inc(&tc->refcount);
+}
+static void thin_put(struct thin_c *tc)
+{
+        if (atomic_dec_and_test(&tc->refcount))
+                complete(&tc->can_destroy);
+}
 static void thin_dtr(struct dm_target *ti)
 {
        struct thin_c *tc = ti->private;
        unsigned long flags;
+        thin_put(tc);
+        wait_for_completion(&tc->can_destroy);
        spin_lock_irqsave(&tc->pool->lock, flags);
        list_del_rcu(&tc->list);
        spin_unlock_irqrestore(&tc->pool->lock, flags);
@@ -3101,6 +3186,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        struct thin_c *tc;
        struct dm_dev *pool_dev, *origin_dev;
        struct mapped_device *pool_md;
+        unsigned long flags;
        mutex_lock(&dm_thin_pool_table.mutex);
@@ -3191,9 +3277,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        mutex_unlock(&dm_thin_pool_table.mutex);
-        spin_lock(&tc->pool->lock);
+        atomic_set(&tc->refcount, 1);
+        init_completion(&tc->can_destroy);
+        spin_lock_irqsave(&tc->pool->lock, flags);
        list_add_tail_rcu(&tc->list, &tc->pool->active_thins);
-        spin_unlock(&tc->pool->lock);
+        spin_unlock_irqrestore(&tc->pool->lock, flags);
        /*
         * This synchronize_rcu() call is needed here otherwise we risk a
         * wake_worker() call finding no bios to process (because the newly
@@ -3422,6 +3511,9 @@ static void dm_thin_exit(void)
 module_init(dm_thin_init);
 module_exit(dm_thin_exit);
+module_param_named(no_space_timeout, no_space_timeout_secs, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(no_space_timeout, "Out of data space queue IO timeout in seconds");
 MODULE_DESCRIPTION(DM_NAME " thin provisioning target");
 MODULE_AUTHOR("Joe Thornber <dm-devel@redhat.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
index 796007a5e0e1..7a7bab8947ae 100644
--- a/drivers/md/dm-verity.c
+++ b/drivers/md/dm-verity.c
@@ -330,15 +330,17 @@ test_block_hash:
                                return r;
                        }
                }
                todo = 1 << v->data_dev_block_bits;
-                while (io->iter.bi_size) {
+                do {
                        u8 *page;
+                        unsigned len;
                        struct bio_vec bv = bio_iter_iovec(bio, io->iter);
                        page = kmap_atomic(bv.bv_page);
-                        r = crypto_shash_update(desc, page + bv.bv_offset,
+                        len = bv.bv_len;
-                                                bv.bv_len);
+                        if (likely(len >= todo))
+                                len = todo;
+                        r = crypto_shash_update(desc, page + bv.bv_offset, len);
                        kunmap_atomic(page);
                        if (r < 0) {
@@ -346,8 +348,9 @@ test_block_hash:
                                return r;
                        }
-                        bio_advance_iter(bio, &io->iter, bv.bv_len);
+                        bio_advance_iter(bio, &io->iter, len);
-                }
+                        todo -= len;
+                } while (todo);
                if (!v->version) {
                        r = crypto_shash_update(desc, v->salt, v->salt_size);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8fda38d23e38..237b7e0ddc7a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8516,7 +8516,8 @@ static int md_notify_reboot(struct notifier_block *this,
                if (mddev_trylock(mddev)) {
                        if (mddev->pers)
                                __md_stop_writes(mddev);
-                        mddev->safemode = 2;
+                        if (mddev->persistent)
+                                mddev->safemode = 2;
                        mddev_unlock(mddev);
                }
                need_delay = 1;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 33fc408e5eac..cb882aae9e20 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1172,6 +1172,13 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
        int max_sectors;
        int sectors;
+        /*
+         * Register the new request and wait if the reconstruction
+         * thread has put up a bar for new requests.
+         * Continue immediately if no resync is active currently.
+         */
+        wait_barrier(conf);
        sectors = bio_sectors(bio);
        while (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
            bio->bi_iter.bi_sector < conf->reshape_progress &&
@@ -1552,12 +1559,6 @@ static void make_request(struct mddev *mddev, struct bio *bio)
        md_write_start(mddev, bio);
-        /*
-         * Register the new request and wait if the reconstruction
-         * thread has put up a bar for new requests.
-         * Continue immediately if no resync is active currently.
-         */
-        wait_barrier(conf);
        do {
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 25247a852912..ad1b9bea446e 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4370,8 +4370,7 @@ static struct stripe_head *__get_priority_stripe(struct r5conf *conf, int group)
                sh->group = NULL;
        }
        list_del_init(&sh->lru);
-        atomic_inc(&sh->count);
+        BUG_ON(atomic_inc_return(&sh->count) != 1);
-        BUG_ON(atomic_read(&sh->count) != 1);
        return sh;
 }
diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
index e8a1ce204036..cdd7c1b7259b 100644
--- a/drivers/media/i2c/ov7670.c
+++ b/drivers/media/i2c/ov7670.c
@@ -1109,7 +1109,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev *sd,
         * windows that fall outside that.
         */
        for (i = 0; i < n_win_sizes; i++) {
-                struct ov7670_win_size *win = &info->devtype->win_sizes[index];
+                struct ov7670_win_size *win = &info->devtype->win_sizes[i];
                if (info->min_width && win->width < info->min_width)
                        continue;
                if (info->min_height && win->height < info->min_height)
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index a4459301b5f8..ee0f57e01b56 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -1616,7 +1616,7 @@ static int s5c73m3_get_platform_data(struct s5c73m3 *state)
        if (ret < 0)
                return -EINVAL;
-        node_ep = v4l2_of_get_next_endpoint(node, NULL);
+        node_ep = of_graph_get_next_endpoint(node, NULL);
        if (!node_ep) {
                dev_warn(dev, "no endpoint defined for node: %s\n",
                                                node->full_name);
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index d5a7a135f75d..703560fa5e73 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev,
        struct media_entity *ent;
        struct media_entity_desc u_ent;
+        memset(&u_ent, 0, sizeof(u_ent));
        if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
                return -EFAULT;
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index c137abfa0c54..20f1655e6d75 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -56,7 +56,7 @@ config VIDEO_VIU
 config VIDEO_TIMBERDALE
        tristate "Support for timberdale Video In/LogiWIN"
-        depends on VIDEO_V4L2 && I2C && DMADEVICES
+        depends on MFD_TIMBERDALE && VIDEO_V4L2 && I2C && DMADEVICES
        select DMA_ENGINE
        select TIMB_DMA
        select VIDEO_ADV7180
diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
index b4f12d00be05..656708252962 100644
--- a/drivers/media/platform/davinci/vpbe_display.c
+++ b/drivers/media/platform/davinci/vpbe_display.c
@@ -372,18 +372,32 @@ static int vpbe_stop_streaming(struct vb2_queue *vq)
 {
        struct vpbe_fh *fh = vb2_get_drv_priv(vq);
        struct vpbe_layer *layer = fh->layer;
+        struct vpbe_display *disp = fh->disp_dev;
+        unsigned long flags;
        if (!vb2_is_streaming(vq))
                return 0;
        /* release all active buffers */
+        spin_lock_irqsave(&disp->dma_queue_lock, flags);
+        if (layer->cur_frm == layer->next_frm) {
+                vb2_buffer_done(&layer->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (layer->cur_frm != NULL)
+                        vb2_buffer_done(&layer->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (layer->next_frm != NULL)
+                        vb2_buffer_done(&layer->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&layer->dma_queue)) {
                layer->next_frm = list_entry(layer->dma_queue.next,
                                                struct vpbe_disp_buffer, list);
                list_del(&layer->next_frm->list);
                vb2_buffer_done(&layer->next_frm->vb, VB2_BUF_STATE_ERROR);
        }
+        spin_unlock_irqrestore(&disp->dma_queue_lock, flags);
        return 0;
 }
diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
index d762246eabf5..0379cb9f9a9c 100644
--- a/drivers/media/platform/davinci/vpfe_capture.c
+++ b/drivers/media/platform/davinci/vpfe_capture.c
@@ -734,6 +734,8 @@ static int vpfe_release(struct file *file)
                }
                vpfe_dev->io_usrs = 0;
                vpfe_dev->numbuffers = config_params.numbuffers;
+                videobuf_stop(&vpfe_dev->buffer_queue);
+                videobuf_mmap_free(&vpfe_dev->buffer_queue);
        }
        /* Decrement device usrs counter */
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index 756da78bac23..8dea0b84a3ad 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -358,8 +358,31 @@ static int vpif_stop_streaming(struct vb2_queue *vq)
        common = &ch->common[VPIF_VIDEO_INDEX];
+        /* Disable channel as per its device type and channel id */
+        if (VPIF_CHANNEL0_VIDEO == ch->channel_id) {
+                enable_channel0(0);
+                channel0_intr_enable(0);
+        }
+        if ((VPIF_CHANNEL1_VIDEO == ch->channel_id) ||
+                (2 == common->started)) {
+                enable_channel1(0);
+                channel1_intr_enable(0);
+        }
+        common->started = 0;
        /* release all active buffers */
        spin_lock_irqsave(&common->irqlock, flags);
+        if (common->cur_frm == common->next_frm) {
+                vb2_buffer_done(&common->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (common->cur_frm != NULL)
+                        vb2_buffer_done(&common->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (common->next_frm != NULL)
+                        vb2_buffer_done(&common->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&common->dma_queue)) {
                common->next_frm = list_entry(common->dma_queue.next,
                                                struct vpif_cap_buffer, list);
@@ -933,17 +956,6 @@ static int vpif_release(struct file *filep)
        if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                /* Reset io_usrs member of channel object */
                common->io_usrs = 0;
-                /* Disable channel as per its device type and channel id */
-                if (VPIF_CHANNEL0_VIDEO == ch->channel_id) {
-                        enable_channel0(0);
-                        channel0_intr_enable(0);
-                }
-                if ((VPIF_CHANNEL1_VIDEO == ch->channel_id) ||
-                    (2 == common->started)) {
-                        enable_channel1(0);
-                        channel1_intr_enable(0);
-                }
-                common->started = 0;
                /* Free buffers allocated */
                vb2_queue_release(&common->buffer_queue);
                vb2_dma_contig_cleanup_ctx(common->alloc_ctx);
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index 0ac841e35aa4..aed41edd0501 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -320,8 +320,31 @@ static int vpif_stop_streaming(struct vb2_queue *vq)
        common = &ch->common[VPIF_VIDEO_INDEX];
+        /* Disable channel */
+        if (VPIF_CHANNEL2_VIDEO == ch->channel_id) {
+                enable_channel2(0);
+                channel2_intr_enable(0);
+        }
+        if ((VPIF_CHANNEL3_VIDEO == ch->channel_id) ||
+                (2 == common->started)) {
+                enable_channel3(0);
+                channel3_intr_enable(0);
+        }
+        common->started = 0;
        /* release all active buffers */
        spin_lock_irqsave(&common->irqlock, flags);
+        if (common->cur_frm == common->next_frm) {
+                vb2_buffer_done(&common->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (common->cur_frm != NULL)
+                        vb2_buffer_done(&common->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (common->next_frm != NULL)
+                        vb2_buffer_done(&common->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&common->dma_queue)) {
                common->next_frm = list_entry(common->dma_queue.next,
                                                struct vpif_disp_buffer, list);
@@ -773,18 +796,6 @@ static int vpif_release(struct file *filep)
        if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                /* Reset io_usrs member of channel object */
                common->io_usrs = 0;
-                /* Disable channel */
-                if (VPIF_CHANNEL2_VIDEO == ch->channel_id) {
-                        enable_channel2(0);
-                        channel2_intr_enable(0);
-                }
-                if ((VPIF_CHANNEL3_VIDEO == ch->channel_id) ||
-                    (2 == common->started)) {
-                        enable_channel3(0);
-                        channel3_intr_enable(0);
-                }
-                common->started = 0;
                /* Free buffers allocated */
                vb2_queue_release(&common->buffer_queue);
                vb2_dma_contig_cleanup_ctx(common->alloc_ctx);
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index da2fc86cc524..25dbf5b05a96 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -122,7 +122,7 @@ static struct fimc_fmt fimc_formats[] = {
        }, {
                .name           = "YUV 4:2:2 planar, Y/Cb/Cr",
                .fourcc         = V4L2_PIX_FMT_YUV422P,
-                .depth          = { 12 },
+                .depth          = { 16 },
                .color          = FIMC_FMT_YCBYCR422,
                .memplanes      = 1,
                .colplanes      = 3,
diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
index 3aecaf465094..f0c9c42867de 100644
--- a/drivers/media/tuners/fc2580.c
+++ b/drivers/media/tuners/fc2580.c
@@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_frontend *fe)
        f_ref = 2UL * priv->cfg->clock / r_val;
        n_val = div_u64_rem(f_vco, f_ref, &k_val);
-        k_val_reg = 1UL * k_val * (1 << 20) / f_ref;
+        k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref);
        ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff));
        if (ret < 0)
@@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_frontend *fe)
        if (ret < 0)
                goto err;
-        ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \
+        ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock *
-                        fc2580_if_filter_lut[i].mul / 1000000000);
+                        fc2580_if_filter_lut[i].mul, 1000000000));
        if (ret < 0)
                goto err;
diff --git a/drivers/media/tuners/fc2580_priv.h b/drivers/media/tuners/fc2580_priv.h
index be38a9e637e0..646c99452136 100644
--- a/drivers/media/tuners/fc2580_priv.h
+++ b/drivers/media/tuners/fc2580_priv.h
@@ -22,6 +22,7 @@
 #define FC2580_PRIV_H
 #include "fc2580.h"
+#include <linux/math64.h>
 struct fc2580_reg_val {
        u8 reg;
diff --git a/drivers/media/usb/dvb-usb-v2/Makefile b/drivers/media/usb/dvb-usb-v2/Makefile
index 7407b8338ccf..bc38f03394cd 100644
--- a/drivers/media/usb/dvb-usb-v2/Makefile
+++ b/drivers/media/usb/dvb-usb-v2/Makefile
@@ -41,4 +41,3 @@ ccflags-y += -I$(srctree)/drivers/media/dvb-core
 ccflags-y += -I$(srctree)/drivers/media/dvb-frontends
 ccflags-y += -I$(srctree)/drivers/media/tuners
 ccflags-y += -I$(srctree)/drivers/media/common
-ccflags-y += -I$(srctree)/drivers/staging/media/rtl2832u_sdr
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 61d196e8b3ab..dcbd392e6efc 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -24,7 +24,6 @@
 #include "rtl2830.h"
 #include "rtl2832.h"
-#include "rtl2832_sdr.h"
 #include "qt1010.h"
 #include "mt2060.h"
@@ -36,6 +35,45 @@
 #include "tua9001.h"
 #include "r820t.h"
+/*
+ * RTL2832_SDR module is in staging. That logic is added in order to avoid any
+ * hard dependency to drivers/staging/ directory as we want compile mainline
+ * driver even whole staging directory is missing.
+ */
+#include <media/v4l2-subdev.h>
+#if IS_ENABLED(CONFIG_DVB_RTL2832_SDR)
+struct dvb_frontend *rtl2832_sdr_attach(struct dvb_frontend *fe,
+        struct i2c_adapter *i2c, const struct rtl2832_config *cfg,
+        struct v4l2_subdev *sd);
+#else
+static inline struct dvb_frontend *rtl2832_sdr_attach(struct dvb_frontend *fe,
+        struct i2c_adapter *i2c, const struct rtl2832_config *cfg,
+        struct v4l2_subdev *sd)
+{
+        return NULL;
+}
+#endif
+#ifdef CONFIG_MEDIA_ATTACH
+#define dvb_attach_sdr(FUNCTION, ARGS...) ({ \
+        void *__r = NULL; \
+        typeof(&FUNCTION) __a = symbol_request(FUNCTION); \
+        if (__a) { \
+                __r = (void *) __a(ARGS); \
+                if (__r == NULL) \
+                        symbol_put(FUNCTION); \
+        } \
+        __r; \
+})
+#else
+#define dvb_attach_sdr(FUNCTION, ARGS...) ({ \
+        FUNCTION(ARGS); \
+})
+#endif
 static int rtl28xxu_disable_rc;
 module_param_named(disable_rc, rtl28xxu_disable_rc, int, 0644);
 MODULE_PARM_DESC(disable_rc, "disable RTL2832U remote controller");
@@ -908,7 +946,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                adap->fe[0]->ops.tuner_ops.get_rf_strength;
                /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                &rtl28xxu_rtl2832_fc0012_config, NULL);
                break;
        case TUNER_RTL2832_FC0013:
@@ -920,7 +958,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                adap->fe[0]->ops.tuner_ops.get_rf_strength;
                /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                &rtl28xxu_rtl2832_fc0013_config, NULL);
                break;
        case TUNER_RTL2832_E4000: {
@@ -951,7 +989,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                        i2c_set_adapdata(i2c_adap_internal, d);
                        /* attach SDR */
-                        dvb_attach(rtl2832_sdr_attach, adap->fe[0],
+                        dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0],
                                        i2c_adap_internal,
                                        &rtl28xxu_rtl2832_e4000_config, sd);
                }
@@ -982,7 +1020,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                adap->fe[0]->ops.tuner_ops.get_rf_strength;
                /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                &rtl28xxu_rtl2832_r820t_config, NULL);
                break;
        case TUNER_RTL2832_R828D:
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 7277dbd2afcd..ecbcb39feb71 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -1430,10 +1430,8 @@ static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x0c45, 0x600d), SB(PAS106, 101)},
        {USB_DEVICE(0x0c45, 0x6011), SB(OV6650, 101)},
        {USB_DEVICE(0x0c45, 0x6019), SB(OV7630, 101)},
-#if !IS_ENABLED(CONFIG_USB_SN9C102)
        {USB_DEVICE(0x0c45, 0x6024), SB(TAS5130CXX, 102)},
        {USB_DEVICE(0x0c45, 0x6025), SB(TAS5130CXX, 102)},
-#endif
        {USB_DEVICE(0x0c45, 0x6027), SB(OV7630, 101)}, /* Genius Eye 310 */
        {USB_DEVICE(0x0c45, 0x6028), SB(PAS202, 102)},
        {USB_DEVICE(0x0c45, 0x6029), SB(PAS106, 102)},
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 04b2daf567be..7e2411c36419 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
 static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
 {
+        if (get_user(kp->type, &up->type))
+                return -EFAULT;
        switch (kp->type) {
        case V4L2_BUF_TYPE_VIDEO_CAPTURE:
        case V4L2_BUF_TYPE_VIDEO_OUTPUT:
@@ -204,17 +207,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
 static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
+        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
-                        get_user(kp->type, &up->type))
+                return -EFAULT;
-                        return -EFAULT;
        return __get_v4l2_format32(kp, up);
 }
 static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
 {
        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
-            copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt)))
+            copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
-                        return -EFAULT;
+                return -EFAULT;
        return __get_v4l2_format32(&kp->format, &up->format);
 }
diff --git a/drivers/memory/mvebu-devbus.c b/drivers/memory/mvebu-devbus.c
index 110c03627051..b59a17fb7c3e 100644
--- a/drivers/memory/mvebu-devbus.c
+++ b/drivers/memory/mvebu-devbus.c
@@ -108,8 +108,19 @@ static int devbus_set_timing_params(struct devbus *devbus,
                        node->full_name);
                return err;
        }
-        /* Convert bit width to byte width */
-        r.bus_width /= 8;
+        /*
+         * The bus width is encoded into the register as 0 for 8 bits,
+         * and 1 for 16 bits, so we do the necessary conversion here.
+         */
+        if (r.bus_width == 8)
+                r.bus_width = 0;
+        else if (r.bus_width == 16)
+                r.bus_width = 1;
+        else {
+                dev_err(devbus->dev, "invalid bus width %d\n", r.bus_width);
+                return -EINVAL;
+        }
        err = get_timing_param_ps(devbus, node, "devbus,badr-skew-ps",
                                 &r.badr_skew);
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index c9de3d598ea5..1d15735f9ef9 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -338,28 +338,58 @@ int rtsx_pci_transfer_data(struct rtsx_pcr *pcr, struct scatterlist *sglist,
                int num_sg, bool read, int timeout)
 {
        struct completion trans_done;
-        int err = 0, count;
+        u8 dir;
+        int err = 0, i, count;
        long timeleft;
        unsigned long flags;
+        struct scatterlist *sg;
+        enum dma_data_direction dma_dir;
+        u32 val;
+        dma_addr_t addr;
+        unsigned int len;
+        dev_dbg(&(pcr->pci->dev), "--> %s: num_sg = %d\n", __func__, num_sg);
+        /* don't transfer data during abort processing */
+        if (pcr->remove_pci)
+                return -EINVAL;
+        if ((sglist == NULL) || (num_sg <= 0))
+                return -EINVAL;
-        count = rtsx_pci_dma_map_sg(pcr, sglist, num_sg, read);
+        if (read) {
+                dir = DEVICE_TO_HOST;
+                dma_dir = DMA_FROM_DEVICE;
+        } else {
+                dir = HOST_TO_DEVICE;
+                dma_dir = DMA_TO_DEVICE;
+        }
+        count = dma_map_sg(&(pcr->pci->dev), sglist, num_sg, dma_dir);
        if (count < 1) {
                dev_err(&(pcr->pci->dev), "scatterlist map failed\n");
                return -EINVAL;
        }
        dev_dbg(&(pcr->pci->dev), "DMA mapping count: %d\n", count);
+        val = ((u32)(dir & 0x01) << 29) | TRIG_DMA | ADMA_MODE;
+        pcr->sgi = 0;
+        for_each_sg(sglist, sg, count, i) {
+                addr = sg_dma_address(sg);
+                len = sg_dma_len(sg);
+                rtsx_pci_add_sg_tbl(pcr, addr, len, i == count - 1);
+        }
        spin_lock_irqsave(&pcr->lock, flags);
        pcr->done = &trans_done;
        pcr->trans_result = TRANS_NOT_READY;
        init_completion(&trans_done);
+        rtsx_pci_writel(pcr, RTSX_HDBAR, pcr->host_sg_tbl_addr);
+        rtsx_pci_writel(pcr, RTSX_HDBCTLR, val);
        spin_unlock_irqrestore(&pcr->lock, flags);
-        rtsx_pci_dma_transfer(pcr, sglist, count, read);
        timeleft = wait_for_completion_interruptible_timeout(
                        &trans_done, msecs_to_jiffies(timeout));
        if (timeleft <= 0) {
@@ -383,7 +413,7 @@ out:
        pcr->done = NULL;
        spin_unlock_irqrestore(&pcr->lock, flags);
-        rtsx_pci_dma_unmap_sg(pcr, sglist, num_sg, read);
+        dma_unmap_sg(&(pcr->pci->dev), sglist, num_sg, dma_dir);
        if ((err < 0) && (err != -ENODEV))
                rtsx_pci_stop_cmd(pcr);
@@ -395,73 +425,6 @@ out:
 }
 EXPORT_SYMBOL_GPL(rtsx_pci_transfer_data);
-int rtsx_pci_dma_map_sg(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int num_sg, bool read)
-{
-        enum dma_data_direction dir = read ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
-        if (pcr->remove_pci)
-                return -EINVAL;
-        if ((sglist == NULL) || num_sg < 1)
-                return -EINVAL;
-        return dma_map_sg(&(pcr->pci->dev), sglist, num_sg, dir);
-}
-EXPORT_SYMBOL_GPL(rtsx_pci_dma_map_sg);
-int rtsx_pci_dma_unmap_sg(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int num_sg, bool read)
-{
-        enum dma_data_direction dir = read ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
-        if (pcr->remove_pci)
-                return -EINVAL;
-        if (sglist == NULL || num_sg < 1)
-                return -EINVAL;
-        dma_unmap_sg(&(pcr->pci->dev), sglist, num_sg, dir);
-        return num_sg;
-}
-EXPORT_SYMBOL_GPL(rtsx_pci_dma_unmap_sg);
-int rtsx_pci_dma_transfer(struct rtsx_pcr *pcr, struct scatterlist *sglist,
-                int sg_count, bool read)
-{
-        struct scatterlist *sg;
-        dma_addr_t addr;
-        unsigned int len;
-        int i;
-        u32 val;
-        u8 dir = read ? DEVICE_TO_HOST : HOST_TO_DEVICE;
-        unsigned long flags;
-        if (pcr->remove_pci)
-                return -EINVAL;
-        if ((sglist == NULL) || (sg_count < 1))
-                return -EINVAL;
-        val = ((u32)(dir & 0x01) << 29) | TRIG_DMA | ADMA_MODE;
-        pcr->sgi = 0;
-        for_each_sg(sglist, sg, sg_count, i) {
-                addr = sg_dma_address(sg);
-                len = sg_dma_len(sg);
-                rtsx_pci_add_sg_tbl(pcr, addr, len, i == sg_count - 1);
-        }
-        spin_lock_irqsave(&pcr->lock, flags);
-        rtsx_pci_writel(pcr, RTSX_HDBAR, pcr->host_sg_tbl_addr);
-        rtsx_pci_writel(pcr, RTSX_HDBCTLR, val);
-        spin_unlock_irqrestore(&pcr->lock, flags);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rtsx_pci_dma_transfer);
 int rtsx_pci_read_ppbuf(struct rtsx_pcr *pcr, u8 *buf, int buf_len)
 {
        int err;
@@ -873,8 +836,6 @@ static irqreturn_t rtsx_pci_isr(int irq, void *dev_id)
        int_reg = rtsx_pci_readl(pcr, RTSX_BIPR);
        /* Clear interrupt flag */
        rtsx_pci_writel(pcr, RTSX_BIPR, int_reg);
-        dev_dbg(&pcr->pci->dev, "=========== BIPR 0x%8x ==========\n", int_reg);
        if ((int_reg & pcr->bier) == 0) {
                spin_unlock(&pcr->lock);
                return IRQ_NONE;
@@ -905,28 +866,17 @@ static irqreturn_t rtsx_pci_isr(int irq, void *dev_id)
        }
        if (int_reg & (NEED_COMPLETE_INT | DELINK_INT)) {
-                if (int_reg & (TRANS_FAIL_INT | DELINK_INT))
+                if (int_reg & (TRANS_FAIL_INT | DELINK_INT)) {
                        pcr->trans_result = TRANS_RESULT_FAIL;
-                else if (int_reg & TRANS_OK_INT)
+                        if (pcr->done)
+                                complete(pcr->done);
+                } else if (int_reg & TRANS_OK_INT) {
                        pcr->trans_result = TRANS_RESULT_OK;
+                        if (pcr->done)
-                if (pcr->done)
+                                complete(pcr->done);
-                        complete(pcr->done);
-                if (int_reg & SD_EXIST) {
-                        struct rtsx_slot *slot = &pcr->slots[RTSX_SD_CARD];
-                        if (slot && slot->done_transfer)
-                                slot->done_transfer(slot->p_dev);
-                }
-                if (int_reg & MS_EXIST) {
-                        struct rtsx_slot *slot = &pcr->slots[RTSX_SD_CARD];
-                        if (slot && slot->done_transfer)
-                                slot->done_transfer(slot->p_dev);
                }
        }
        if (pcr->card_inserted || pcr->card_removed)
                schedule_delayed_work(&pcr->carddet_work,
                                msecs_to_jiffies(200));
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 1cb74085e410..8baff0effc7d 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -300,8 +300,8 @@ config SGI_GRU_DEBUG
        depends on SGI_GRU
        default n
        ---help---
-        This option enables addition debugging code for the SGI GRU driver. If
+        This option enables additional debugging code for the SGI GRU driver.
-        you are unsure, say N.
+        If you are unsure, say N.
 config APDS9802ALS
        tristate "Medfield Avago APDS9802 ALS Sensor module"
diff --git a/drivers/misc/genwqe/card_base.h b/drivers/misc/genwqe/card_base.h
index 5e4dbd21f89a..0e608a288603 100644
--- a/drivers/misc/genwqe/card_base.h
+++ b/drivers/misc/genwqe/card_base.h
@@ -337,6 +337,44 @@ enum genwqe_requ_state {
 };
 /**
+ * struct genwqe_sgl - Scatter gather list describing user-space memory
+ * @sgl:            scatter gather list needs to be 128 byte aligned
+ * @sgl_dma_addr:   dma address of sgl
+ * @sgl_size:       size of area used for sgl
+ * @user_addr:      user-space address of memory area
+ * @user_size:      size of user-space memory area
+ * @page:           buffer for partial pages if needed
+ * @page_dma_addr:  dma address partial pages
+ */
+struct genwqe_sgl {
+        dma_addr_t sgl_dma_addr;
+        struct sg_entry *sgl;
+        size_t sgl_size;        /* size of sgl */
+        void __user *user_addr; /* user-space base-address */
+        size_t user_size;       /* size of memory area */
+        unsigned long nr_pages;
+        unsigned long fpage_offs;
+        size_t fpage_size;
+        size_t lpage_size;
+        void *fpage;
+        dma_addr_t fpage_dma_addr;
+        void *lpage;
+        dma_addr_t lpage_dma_addr;
+};
+int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+                          void __user *user_addr, size_t user_size);
+int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+                     dma_addr_t *dma_list);
+int genwqe_free_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl);
+/**
 * struct ddcb_requ - Kernel internal representation of the DDCB request
 * @cmd:          User space representation of the DDCB execution request
 */
@@ -347,9 +385,7 @@ struct ddcb_requ {
        struct ddcb_queue *queue;         /* associated queue */
        struct dma_mapping  dma_mappings[DDCB_FIXUPS];
-        struct sg_entry     *sgl[DDCB_FIXUPS];
+        struct genwqe_sgl sgls[DDCB_FIXUPS];
-        dma_addr_t          sgl_dma_addr[DDCB_FIXUPS];
-        size_t              sgl_size[DDCB_FIXUPS];
        /* kernel/user shared content */
        struct genwqe_ddcb_cmd cmd;     /* ddcb_no for this request */
@@ -453,22 +489,6 @@ int  genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m,
 int  genwqe_user_vunmap(struct genwqe_dev *cd, struct dma_mapping *m,
                        struct ddcb_requ *req);
-struct sg_entry *genwqe_alloc_sgl(struct genwqe_dev *cd, int num_pages,
-                                 dma_addr_t *dma_addr, size_t *sgl_size);
-void genwqe_free_sgl(struct genwqe_dev *cd, struct sg_entry *sg_list,
-                    dma_addr_t dma_addr, size_t size);
-int genwqe_setup_sgl(struct genwqe_dev *cd,
-                    unsigned long offs,
-                    unsigned long size,
-                    struct sg_entry *sgl, /* genwqe sgl */
-                    dma_addr_t dma_addr, size_t sgl_size,
-                    dma_addr_t *dma_list, int page_offs, int num_pages);
-int genwqe_check_sgl(struct genwqe_dev *cd, struct sg_entry *sg_list,
-                     int size);
 static inline bool dma_mapping_used(struct dma_mapping *m)
 {
        if (!m)
diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
index 6f1acc0ccf88..c8046db2d5a2 100644
--- a/drivers/misc/genwqe/card_ddcb.c
+++ b/drivers/misc/genwqe/card_ddcb.c
@@ -305,6 +305,8 @@ static int enqueue_ddcb(struct genwqe_dev *cd, struct ddcb_queue *queue,
                        break;
                new = (old | DDCB_NEXT_BE32);
+                wmb();
                icrc_hsi_shi = cmpxchg(&prev_ddcb->icrc_hsi_shi_32, old, new);
                if (icrc_hsi_shi == old)
@@ -314,6 +316,8 @@ static int enqueue_ddcb(struct genwqe_dev *cd, struct ddcb_queue *queue,
        /* Queue must be re-started by updating QUEUE_OFFSET */
        ddcb_mark_tapped(pddcb);
        num = (u64)ddcb_no << 8;
+        wmb();
        __genwqe_writeq(cd, queue->IO_QUEUE_OFFSET, num); /* start queue */
        return RET_DDCB_TAPPED;
@@ -1306,7 +1310,7 @@ static int queue_wake_up_all(struct genwqe_dev *cd)
 */
 int genwqe_finish_queue(struct genwqe_dev *cd)
 {
-        int i, rc, in_flight;
+        int i, rc = 0, in_flight;
        int waitmax = genwqe_ddcb_software_timeout;
        struct pci_dev *pci_dev = cd->pci_dev;
        struct ddcb_queue *queue = &cd->queue;
diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
index 2c2c9cc75231..1d2f163a1906 100644
--- a/drivers/misc/genwqe/card_dev.c
+++ b/drivers/misc/genwqe/card_dev.c
@@ -531,7 +531,9 @@ static int do_flash_update(struct genwqe_file *cfile,
        case '1':
                cmdopts = 0x1C;
                break;          /* download/erase_first/part_1 */
-        case 'v':               /* cmdopts = 0x0c (VPD) */
+        case 'v':
+                cmdopts = 0x0C;
+                break;          /* download/erase_first/vpd */
        default:
                return -EINVAL;
        }
@@ -665,6 +667,8 @@ static int do_flash_read(struct genwqe_file *cfile,
                cmdopts = 0x1A;
                break;          /* upload/part_1 */
        case 'v':
+                cmdopts = 0x0A;
+                break;          /* upload/vpd */
        default:
                return -EINVAL;
        }
@@ -836,15 +840,8 @@ static int ddcb_cmd_cleanup(struct genwqe_file *cfile, struct ddcb_requ *req)
                        __genwqe_del_mapping(cfile, dma_map);
                        genwqe_user_vunmap(cd, dma_map, req);
                }
-                if (req->sgl[i] != NULL) {
+                if (req->sgls[i].sgl != NULL)
-                        genwqe_free_sgl(cd, req->sgl[i],
+                        genwqe_free_sync_sgl(cd, &req->sgls[i]);
-                                       req->sgl_dma_addr[i],
-                                       req->sgl_size[i]);
-                        req->sgl[i] = NULL;
-                        req->sgl_dma_addr[i] = 0x0;
-                        req->sgl_size[i] = 0;
-                }
        }
        return 0;
 }
@@ -913,7 +910,7 @@ static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req)
                case ATS_TYPE_SGL_RDWR:
                case ATS_TYPE_SGL_RD: {
-                        int page_offs, nr_pages, offs;
+                        int page_offs;
                        u_addr = be64_to_cpu(*((__be64 *)
                                               &cmd->asiv[asiv_offs]));
@@ -951,27 +948,18 @@ static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req)
                                page_offs = 0;
                        }
-                        offs = offset_in_page(u_addr);
-                        nr_pages = DIV_ROUND_UP(offs + u_size, PAGE_SIZE);
                        /* create genwqe style scatter gather list */
-                        req->sgl[i] = genwqe_alloc_sgl(cd, m->nr_pages,
+                        rc = genwqe_alloc_sync_sgl(cd, &req->sgls[i],
-                                                      &req->sgl_dma_addr[i],
+                                                   (void __user *)u_addr,
-                                                      &req->sgl_size[i]);
+                                                   u_size);
-                        if (req->sgl[i] == NULL) {
+                        if (rc != 0)
-                                rc = -ENOMEM;
                                goto err_out;
-                        }
-                        genwqe_setup_sgl(cd, offs, u_size,
+                        genwqe_setup_sgl(cd, &req->sgls[i],
-                                        req->sgl[i],
+                                         &m->dma_list[page_offs]);
-                                        req->sgl_dma_addr[i],
-                                        req->sgl_size[i],
-                                        m->dma_list,
-                                        page_offs,
-                                        nr_pages);
                        *((__be64 *)&cmd->asiv[asiv_offs]) =
-                                cpu_to_be64(req->sgl_dma_addr[i]);
+                                cpu_to_be64(req->sgls[i].sgl_dma_addr);
                        break;
                }
diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
index 6b1a6ef9f1a8..d049d271699c 100644
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
@@ -275,67 +275,107 @@ static int genwqe_sgl_size(int num_pages)
        return roundup(len, PAGE_SIZE);
 }
-struct sg_entry *genwqe_alloc_sgl(struct genwqe_dev *cd, int num_pages,
+/**
-                                  dma_addr_t *dma_addr, size_t *sgl_size)
+ * genwqe_alloc_sync_sgl() - Allocate memory for sgl and overlapping pages
+ *
+ * Allocates memory for sgl and overlapping pages. Pages which might
+ * overlap other user-space memory blocks are being cached for DMAs,
+ * such that we do not run into syncronization issues. Data is copied
+ * from user-space into the cached pages.
+ */
+int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+                          void __user *user_addr, size_t user_size)
 {
+        int rc;
        struct pci_dev *pci_dev = cd->pci_dev;
-        struct sg_entry *sgl;
-        *sgl_size = genwqe_sgl_size(num_pages);
+        sgl->fpage_offs = offset_in_page((unsigned long)user_addr);
-        if (get_order(*sgl_size) > MAX_ORDER) {
+        sgl->fpage_size = min_t(size_t, PAGE_SIZE-sgl->fpage_offs, user_size);
+        sgl->nr_pages = DIV_ROUND_UP(sgl->fpage_offs + user_size, PAGE_SIZE);
+        sgl->lpage_size = (user_size - sgl->fpage_size) % PAGE_SIZE;
+        dev_dbg(&pci_dev->dev, "[%s] uaddr=%p usize=%8ld nr_pages=%ld "
+                "fpage_offs=%lx fpage_size=%ld lpage_size=%ld\n",
+                __func__, user_addr, user_size, sgl->nr_pages,
+                sgl->fpage_offs, sgl->fpage_size, sgl->lpage_size);
+        sgl->user_addr = user_addr;
+        sgl->user_size = user_size;
+        sgl->sgl_size = genwqe_sgl_size(sgl->nr_pages);
+        if (get_order(sgl->sgl_size) > MAX_ORDER) {
                dev_err(&pci_dev->dev,
                        "[%s] err: too much memory requested!\n", __func__);
-                return NULL;
+                return -ENOMEM;
        }
-        sgl = __genwqe_alloc_consistent(cd, *sgl_size, dma_addr);
+        sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size,
-        if (sgl == NULL) {
+                                             &sgl->sgl_dma_addr);
+        if (sgl->sgl == NULL) {
                dev_err(&pci_dev->dev,
                        "[%s] err: no memory available!\n", __func__);
-                return NULL;
+                return -ENOMEM;
        }
-        return sgl;
+        /* Only use buffering on incomplete pages */
+        if ((sgl->fpage_size != 0) && (sgl->fpage_size != PAGE_SIZE)) {
+                sgl->fpage = __genwqe_alloc_consistent(cd, PAGE_SIZE,
+                                                       &sgl->fpage_dma_addr);
+                if (sgl->fpage == NULL)
+                        goto err_out;
+                /* Sync with user memory */
+                if (copy_from_user(sgl->fpage + sgl->fpage_offs,
+                                   user_addr, sgl->fpage_size)) {
+                        rc = -EFAULT;
+                        goto err_out;
+                }
+        }
+        if (sgl->lpage_size != 0) {
+                sgl->lpage = __genwqe_alloc_consistent(cd, PAGE_SIZE,
+                                                       &sgl->lpage_dma_addr);
+                if (sgl->lpage == NULL)
+                        goto err_out1;
+                /* Sync with user memory */
+                if (copy_from_user(sgl->lpage, user_addr + user_size -
+                                   sgl->lpage_size, sgl->lpage_size)) {
+                        rc = -EFAULT;
+                        goto err_out1;
+                }
+        }
+        return 0;
+ err_out1:
+        __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage,
+                                 sgl->fpage_dma_addr);
+ err_out:
+        __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl,
+                                 sgl->sgl_dma_addr);
+        return -ENOMEM;
 }
-int genwqe_setup_sgl(struct genwqe_dev *cd,
+int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
-                     unsigned long offs,
+                     dma_addr_t *dma_list)
-                     unsigned long size,
-                     struct sg_entry *sgl,
-                     dma_addr_t dma_addr, size_t sgl_size,
-                     dma_addr_t *dma_list, int page_offs, int num_pages)
 {
        int i = 0, j = 0, p;
        unsigned long dma_offs, map_offs;
-        struct pci_dev *pci_dev = cd->pci_dev;
        dma_addr_t prev_daddr = 0;
        struct sg_entry *s, *last_s = NULL;
+        size_t size = sgl->user_size;
-        /* sanity checks */
-        if (offs > PAGE_SIZE) {
-                dev_err(&pci_dev->dev,
-                        "[%s] too large start offs %08lx\n", __func__, offs);
-                return -EFAULT;
-        }
-        if (sgl_size < genwqe_sgl_size(num_pages)) {
-                dev_err(&pci_dev->dev,
-                        "[%s] sgl_size too small %08lx for %d pages\n",
-                        __func__, sgl_size, num_pages);
-                return -EFAULT;
-        }
        dma_offs = 128;         /* next block if needed/dma_offset */
-        map_offs = offs;        /* offset in first page */
+        map_offs = sgl->fpage_offs; /* offset in first page */
-        s = &sgl[0];            /* first set of 8 entries */
+        s = &sgl->sgl[0];       /* first set of 8 entries */
        p = 0;                  /* page */
-        while (p < num_pages) {
+        while (p < sgl->nr_pages) {
                dma_addr_t daddr;
                unsigned int size_to_map;
                /* always write the chaining entry, cleanup is done later */
                j = 0;
-                s[j].target_addr = cpu_to_be64(dma_addr + dma_offs);
+                s[j].target_addr = cpu_to_be64(sgl->sgl_dma_addr + dma_offs);
                s[j].len         = cpu_to_be32(128);
                s[j].flags       = cpu_to_be32(SG_CHAINED);
                j++;
@@ -343,7 +383,17 @@ int genwqe_setup_sgl(struct genwqe_dev *cd,
                while (j < 8) {
                        /* DMA mapping for requested page, offs, size */
                        size_to_map = min(size, PAGE_SIZE - map_offs);
-                        daddr = dma_list[page_offs + p] + map_offs;
+                        if ((p == 0) && (sgl->fpage != NULL)) {
+                                daddr = sgl->fpage_dma_addr + map_offs;
+                        } else if ((p == sgl->nr_pages - 1) &&
+                                   (sgl->lpage != NULL)) {
+                                daddr = sgl->lpage_dma_addr;
+                        } else {
+                                daddr = dma_list[p] + map_offs;
+                        }
                        size -= size_to_map;
                        map_offs = 0;
@@ -358,7 +408,7 @@ int genwqe_setup_sgl(struct genwqe_dev *cd,
                                                          size_to_map);
                                p++; /* process next page */
-                                if (p == num_pages)
+                                if (p == sgl->nr_pages)
                                        goto fixup;  /* nothing to do */
                                prev_daddr = daddr + size_to_map;
@@ -374,7 +424,7 @@ int genwqe_setup_sgl(struct genwqe_dev *cd,
                        j++;
                        p++;    /* process next page */
-                        if (p == num_pages)
+                        if (p == sgl->nr_pages)
                                goto fixup;  /* nothing to do */
                }
                dma_offs += 128;
@@ -395,10 +445,50 @@ int genwqe_setup_sgl(struct genwqe_dev *cd,
        return 0;
 }
-void genwqe_free_sgl(struct genwqe_dev *cd, struct sg_entry *sg_list,
+/**
-                    dma_addr_t dma_addr, size_t size)
+ * genwqe_free_sync_sgl() - Free memory for sgl and overlapping pages
+ *
+ * After the DMA transfer has been completed we free the memory for
+ * the sgl and the cached pages. Data is being transfered from cached
+ * pages into user-space buffers.
+ */
+int genwqe_free_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl)
 {
-        __genwqe_free_consistent(cd, size, sg_list, dma_addr);
+        int rc;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (sgl->fpage) {
+                if (copy_to_user(sgl->user_addr, sgl->fpage + sgl->fpage_offs,
+                                 sgl->fpage_size)) {
+                        dev_err(&pci_dev->dev, "[%s] err: copying fpage!\n",
+                                __func__);
+                        rc = -EFAULT;
+                }
+                __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage,
+                                         sgl->fpage_dma_addr);
+                sgl->fpage = NULL;
+                sgl->fpage_dma_addr = 0;
+        }
+        if (sgl->lpage) {
+                if (copy_to_user(sgl->user_addr + sgl->user_size -
+                                 sgl->lpage_size, sgl->lpage,
+                                 sgl->lpage_size)) {
+                        dev_err(&pci_dev->dev, "[%s] err: copying lpage!\n",
+                                __func__);
+                        rc = -EFAULT;
+                }
+                __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage,
+                                         sgl->lpage_dma_addr);
+                sgl->lpage = NULL;
+                sgl->lpage_dma_addr = 0;
+        }
+        __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl,
+                                 sgl->sgl_dma_addr);
+        sgl->sgl = NULL;
+        sgl->sgl_dma_addr = 0x0;
+        sgl->sgl_size = 0;
+        return rc;
 }
 /**
diff --git a/drivers/misc/genwqe/genwqe_driver.h b/drivers/misc/genwqe/genwqe_driver.h
index 46e916b36c70..cd5263163a6e 100644
--- a/drivers/misc/genwqe/genwqe_driver.h
+++ b/drivers/misc/genwqe/genwqe_driver.h
@@ -36,7 +36,7 @@
 #include <asm/byteorder.h>
 #include <linux/genwqe/genwqe_card.h>
-#define DRV_VERS_STRING         "2.0.0"
+#define DRV_VERS_STRING         "2.0.15"
 /*
 * Static minor number assignement, until we decide/implement
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 66f411a6e8ea..cabc04383685 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -115,6 +115,11 @@
 #define MEI_DEV_ID_LPT_HR     0x8CBA  /* Lynx Point H Refresh */
 #define MEI_DEV_ID_WPT_LP     0x9CBA  /* Wildcat Point LP */
+/* Host Firmware Status Registers in PCI Config Space */
+#define PCI_CFG_HFS_1         0x40
+#define PCI_CFG_HFS_2         0x48
 /*
 * MEI HW Section
 */
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 29b5af8efb71..4e3cba6da3f5 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -455,8 +455,7 @@ int mei_irq_write_handler(struct mei_device *dev, struct mei_cl_cb *cmpl_list)
                cl->status = 0;
                list_del(&cb->list);
-                if (MEI_WRITING == cl->writing_state &&
+                if (cb->fop_type == MEI_FOP_WRITE &&
-                    cb->fop_type == MEI_FOP_WRITE &&
                    cl != &dev->iamthif_cl) {
                        cl_dbg(dev, cl, "MEI WRITE COMPLETE\n");
                        cl->writing_state = MEI_WRITE_COMPLETE;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index b35594dbf52f..147413145c97 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -644,8 +644,7 @@ static unsigned int mei_poll(struct file *file, poll_table *wait)
                goto out;
        }
-        if (MEI_WRITE_COMPLETE == cl->writing_state)
+        mask |= (POLLIN | POLLRDNORM);
-                mask |= (POLLIN | POLLRDNORM);
 out:
        mutex_unlock(&dev->device_lock);
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 1c8fd3a3e135..95889e2e31ff 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -97,15 +97,31 @@ static bool mei_me_quirk_probe(struct pci_dev *pdev,
                                const struct pci_device_id *ent)
 {
        u32 reg;
-        if (ent->device == MEI_DEV_ID_PBG_1) {
+        /* Cougar Point || Patsburg */
-                pci_read_config_dword(pdev, 0x48, &reg);
+        if (ent->device == MEI_DEV_ID_CPT_1 ||
-                /* make sure that bit 9 is up and bit 10 is down */
+            ent->device == MEI_DEV_ID_PBG_1) {
-                if ((reg & 0x600) == 0x200) {
+                pci_read_config_dword(pdev, PCI_CFG_HFS_2, &reg);
-                        dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
+                /* make sure that bit 9 (NM) is up and bit 10 (DM) is down */
-                        return false;
+                if ((reg & 0x600) == 0x200)
-                }
+                        goto no_mei;
        }
+        /* Lynx Point */
+        if (ent->device == MEI_DEV_ID_LPT_H  ||
+            ent->device == MEI_DEV_ID_LPT_W  ||
+            ent->device == MEI_DEV_ID_LPT_HR) {
+                /* Read ME FW Status check for SPS Firmware */
+                pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+                /* if bits [19:16] = 15, running SPS Firmware */
+                if ((reg & 0xf0000) == 0xf0000)
+                        goto no_mei;
+        }
        return true;
+no_mei:
+        dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
+        return false;
 }
 /**
 * mei_probe - Device Initialization Routine
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index 5fb994f9a653..0b9ded13a3ae 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -31,28 +31,14 @@
 #include <linux/mfd/rtsx_pci.h>
 #include <asm/unaligned.h>
-struct realtek_next {
-        unsigned int    sg_count;
-        s32             cookie;
-};
 struct realtek_pci_sdmmc {
        struct platform_device  *pdev;
        struct rtsx_pcr         *pcr;
        struct mmc_host         *mmc;
        struct mmc_request      *mrq;
-        struct mmc_command      *cmd;
-        struct mmc_data         *data;
+        struct mutex            host_mutex;
-        spinlock_t              lock;
-        struct timer_list       timer;
-        struct tasklet_struct   cmd_tasklet;
-        struct tasklet_struct   data_tasklet;
-        struct tasklet_struct   finish_tasklet;
-        u8                      rsp_type;
-        u8                      rsp_len;
-        int                     sg_count;
        u8                      ssc_depth;
        unsigned int            clock;
        bool                    vpclk;
@@ -62,13 +48,8 @@ struct realtek_pci_sdmmc {
        int                     power_state;
 #define SDMMC_POWER_ON          1
 #define SDMMC_POWER_OFF         0
-        struct realtek_next     next_data;
 };
-static int sd_start_multi_rw(struct realtek_pci_sdmmc *host,
-                struct mmc_request *mrq);
 static inline struct device *sdmmc_dev(struct realtek_pci_sdmmc *host)
 {
        return &(host->pdev->dev);
@@ -105,95 +86,6 @@ static void sd_print_debug_regs(struct realtek_pci_sdmmc *host)
 #define sd_print_debug_regs(host)
 #endif /* DEBUG */
-static void sd_isr_done_transfer(struct platform_device *pdev)
-{
-        struct realtek_pci_sdmmc *host = platform_get_drvdata(pdev);
-        spin_lock(&host->lock);
-        if (host->cmd)
-                tasklet_schedule(&host->cmd_tasklet);
-        if (host->data)
-                tasklet_schedule(&host->data_tasklet);
-        spin_unlock(&host->lock);
-}
-static void sd_request_timeout(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        unsigned long flags;
-        spin_lock_irqsave(&host->lock, flags);
-        if (!host->mrq) {
-                dev_err(sdmmc_dev(host), "error: no request exist\n");
-                goto out;
-        }
-        if (host->cmd)
-                host->cmd->error = -ETIMEDOUT;
-        if (host->data)
-                host->data->error = -ETIMEDOUT;
-        dev_dbg(sdmmc_dev(host), "timeout for request\n");
-out:
-        tasklet_schedule(&host->finish_tasklet);
-        spin_unlock_irqrestore(&host->lock, flags);
-}
-static void sd_finish_request(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_request *mrq;
-        struct mmc_command *cmd;
-        struct mmc_data *data;
-        unsigned long flags;
-        bool any_error;
-        spin_lock_irqsave(&host->lock, flags);
-        del_timer(&host->timer);
-        mrq = host->mrq;
-        if (!mrq) {
-                dev_err(sdmmc_dev(host), "error: no request need finish\n");
-                goto out;
-        }
-        cmd = mrq->cmd;
-        data = mrq->data;
-        any_error = (mrq->sbc && mrq->sbc->error) ||
-                (mrq->stop && mrq->stop->error) ||
-                (cmd && cmd->error) || (data && data->error);
-        if (any_error) {
-                rtsx_pci_stop_cmd(pcr);
-                sd_clear_error(host);
-        }
-        if (data) {
-                if (any_error)
-                        data->bytes_xfered = 0;
-                else
-                        data->bytes_xfered = data->blocks * data->blksz;
-                if (!data->host_cookie)
-                        rtsx_pci_dma_unmap_sg(pcr, data->sg, data->sg_len,
-                                        data->flags & MMC_DATA_READ);
-        }
-        host->mrq = NULL;
-        host->cmd = NULL;
-        host->data = NULL;
-out:
-        spin_unlock_irqrestore(&host->lock, flags);
-        mutex_unlock(&pcr->pcr_mutex);
-        mmc_request_done(host->mmc, mrq);
-}
 static int sd_read_data(struct realtek_pci_sdmmc *host, u8 *cmd, u16 byte_cnt,
                u8 *buf, int buf_len, int timeout)
 {
@@ -311,7 +203,8 @@ static int sd_write_data(struct realtek_pci_sdmmc *host, u8 *cmd, u16 byte_cnt,
        return 0;
 }
-static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
+static void sd_send_cmd_get_rsp(struct realtek_pci_sdmmc *host,
+                struct mmc_command *cmd)
 {
        struct rtsx_pcr *pcr = host->pcr;
        u8 cmd_idx = (u8)cmd->opcode;
@@ -319,14 +212,11 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
        int err = 0;
        int timeout = 100;
        int i;
+        u8 *ptr;
+        int stat_idx = 0;
        u8 rsp_type;
        int rsp_len = 5;
-        unsigned long flags;
+        bool clock_toggled = false;
-        if (host->cmd)
-                dev_err(sdmmc_dev(host), "error: cmd already exist\n");
-        host->cmd = cmd;
        dev_dbg(sdmmc_dev(host), "%s: SD/MMC CMD %d, arg = 0x%08x\n",
                        __func__, cmd_idx, arg);
@@ -361,8 +251,6 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
                err = -EINVAL;
                goto out;
        }
-        host->rsp_type = rsp_type;
-        host->rsp_len = rsp_len;
        if (rsp_type == SD_RSP_TYPE_R1b)
                timeout = 3000;
@@ -372,6 +260,8 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
                                0xFF, SD_CLK_TOGGLE_EN);
                if (err < 0)
                        goto out;
+                clock_toggled = true;
        }
        rtsx_pci_init_cmd(pcr);
@@ -395,60 +285,25 @@ static void sd_send_cmd(struct realtek_pci_sdmmc *host, struct mmc_command *cmd)
                /* Read data from ping-pong buffer */
                for (i = PPBUF_BASE2; i < PPBUF_BASE2 + 16; i++)
                        rtsx_pci_add_cmd(pcr, READ_REG_CMD, (u16)i, 0, 0);
+                stat_idx = 16;
        } else if (rsp_type != SD_RSP_TYPE_R0) {
                /* Read data from SD_CMDx registers */
                for (i = SD_CMD0; i <= SD_CMD4; i++)
                        rtsx_pci_add_cmd(pcr, READ_REG_CMD, (u16)i, 0, 0);
+                stat_idx = 5;
        }
        rtsx_pci_add_cmd(pcr, READ_REG_CMD, SD_STAT1, 0, 0);
-        mod_timer(&host->timer, jiffies + msecs_to_jiffies(timeout));
+        err = rtsx_pci_send_cmd(pcr, timeout);
+        if (err < 0) {
-        spin_lock_irqsave(&pcr->lock, flags);
+                sd_print_debug_regs(host);
-        pcr->trans_result = TRANS_NOT_READY;
+                sd_clear_error(host);
-        rtsx_pci_send_cmd_no_wait(pcr);
+                dev_dbg(sdmmc_dev(host),
-        spin_unlock_irqrestore(&pcr->lock, flags);
+                        "rtsx_pci_send_cmd error (err = %d)\n", err);
-        return;
-out:
-        cmd->error = err;
-        tasklet_schedule(&host->finish_tasklet);
-}
-static void sd_get_rsp(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_command *cmd;
-        int i, err = 0, stat_idx;
-        u8 *ptr, rsp_type;
-        unsigned long flags;
-        spin_lock_irqsave(&host->lock, flags);
-        cmd = host->cmd;
-        host->cmd = NULL;
-        if (!cmd) {
-                dev_err(sdmmc_dev(host), "error: cmd not exist\n");
                goto out;
        }
-        spin_lock(&pcr->lock);
-        if (pcr->trans_result == TRANS_NO_DEVICE)
-                err = -ENODEV;
-        else if (pcr->trans_result != TRANS_RESULT_OK)
-                err = -EINVAL;
-        spin_unlock(&pcr->lock);
-        if (err < 0)
-                goto out;
-        rsp_type = host->rsp_type;
-        stat_idx = host->rsp_len;
        if (rsp_type == SD_RSP_TYPE_R0) {
                err = 0;
                goto out;
@@ -485,106 +340,26 @@ static void sd_get_rsp(unsigned long host_addr)
                                cmd->resp[0]);
        }
-        if (cmd == host->mrq->sbc) {
-                sd_send_cmd(host, host->mrq->cmd);
-                spin_unlock_irqrestore(&host->lock, flags);
-                return;
-        }
-        if (cmd == host->mrq->stop)
-                goto out;
-        if (cmd->data) {
-                sd_start_multi_rw(host, host->mrq);
-                spin_unlock_irqrestore(&host->lock, flags);
-                return;
-        }
 out:
        cmd->error = err;
-        tasklet_schedule(&host->finish_tasklet);
+        if (err && clock_toggled)
-        spin_unlock_irqrestore(&host->lock, flags);
+                rtsx_pci_write_register(pcr, SD_BUS_STAT,
-}
+                                SD_CLK_TOGGLE_EN | SD_CLK_FORCE_STOP, 0);
-static int sd_pre_dma_transfer(struct realtek_pci_sdmmc *host,
-                        struct mmc_data *data, struct realtek_next *next)
-{
-        struct rtsx_pcr *pcr = host->pcr;
-        int read = data->flags & MMC_DATA_READ;
-        int sg_count = 0;
-        if (!next && data->host_cookie &&
-                data->host_cookie != host->next_data.cookie) {
-                dev_err(sdmmc_dev(host),
-                        "error: invalid cookie data[%d] host[%d]\n",
-                        data->host_cookie, host->next_data.cookie);
-                data->host_cookie = 0;
-        }
-        if (next || (!next && data->host_cookie != host->next_data.cookie))
-                sg_count = rtsx_pci_dma_map_sg(pcr,
-                                data->sg, data->sg_len, read);
-        else
-                sg_count = host->next_data.sg_count;
-        if (next) {
-                next->sg_count = sg_count;
-                if (++next->cookie < 0)
-                        next->cookie = 1;
-                data->host_cookie = next->cookie;
-        }
-        return sg_count;
-}
-static void sdmmc_pre_req(struct mmc_host *mmc, struct mmc_request *mrq,
-                bool is_first_req)
-{
-        struct realtek_pci_sdmmc *host = mmc_priv(mmc);
-        struct mmc_data *data = mrq->data;
-        if (data->host_cookie) {
-                dev_err(sdmmc_dev(host),
-                        "error: descard already cookie data[%d]\n",
-                        data->host_cookie);
-                data->host_cookie = 0;
-        }
-        dev_dbg(sdmmc_dev(host), "dma sg prepared: %d\n",
-                sd_pre_dma_transfer(host, data, &host->next_data));
-}
-static void sdmmc_post_req(struct mmc_host *mmc, struct mmc_request *mrq,
-                int err)
-{
-        struct realtek_pci_sdmmc *host = mmc_priv(mmc);
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_data *data = mrq->data;
-        int read = data->flags & MMC_DATA_READ;
-        rtsx_pci_dma_unmap_sg(pcr, data->sg, data->sg_len, read);
-        data->host_cookie = 0;
 }
-static int sd_start_multi_rw(struct realtek_pci_sdmmc *host,
+static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
-                struct mmc_request *mrq)
 {
        struct rtsx_pcr *pcr = host->pcr;
        struct mmc_host *mmc = host->mmc;
        struct mmc_card *card = mmc->card;
        struct mmc_data *data = mrq->data;
        int uhs = mmc_card_uhs(card);
-        int read = data->flags & MMC_DATA_READ;
+        int read = (data->flags & MMC_DATA_READ) ? 1 : 0;
        u8 cfg2, trans_mode;
        int err;
        size_t data_len = data->blksz * data->blocks;
-        if (host->data)
-                dev_err(sdmmc_dev(host), "error: data already exist\n");
-        host->data = data;
        if (read) {
                cfg2 = SD_CALCULATE_CRC7 | SD_CHECK_CRC16 |
                        SD_NO_WAIT_BUSY_END | SD_CHECK_CRC7 | SD_RSP_LEN_0;
@@ -635,54 +410,15 @@ static int sd_start_multi_rw(struct realtek_pci_sdmmc *host,
        rtsx_pci_add_cmd(pcr, CHECK_REG_CMD, SD_TRANSFER,
                        SD_TRANSFER_END, SD_TRANSFER_END);
-        mod_timer(&host->timer, jiffies + 10 * HZ);
        rtsx_pci_send_cmd_no_wait(pcr);
-        err = rtsx_pci_dma_transfer(pcr, data->sg, host->sg_count, read);
+        err = rtsx_pci_transfer_data(pcr, data->sg, data->sg_len, read, 10000);
-        if (err < 0) {
-                data->error = err;
-                tasklet_schedule(&host->finish_tasklet);
-        }
-        return 0;
-}
-static void sd_finish_multi_rw(unsigned long host_addr)
-{
-        struct realtek_pci_sdmmc *host = (struct realtek_pci_sdmmc *)host_addr;
-        struct rtsx_pcr *pcr = host->pcr;
-        struct mmc_data *data;
-        int err = 0;
-        unsigned long flags;
-        spin_lock_irqsave(&host->lock, flags);
-        if (!host->data) {
-                dev_err(sdmmc_dev(host), "error: no data exist\n");
-                goto out;
-        }
-        data = host->data;
-        host->data = NULL;
-        if (pcr->trans_result == TRANS_NO_DEVICE)
-                err = -ENODEV;
-        else if (pcr->trans_result != TRANS_RESULT_OK)
-                err = -EINVAL;
        if (err < 0) {
-                data->error = err;
+                sd_clear_error(host);
-                goto out;
+                return err;
-        }
-        if (!host->mrq->sbc && data->stop) {
-                sd_send_cmd(host, data->stop);
-                spin_unlock_irqrestore(&host->lock, flags);
-                return;
        }
-out:
+        return 0;
-        tasklet_schedule(&host->finish_tasklet);
-        spin_unlock_irqrestore(&host->lock, flags);
 }
 static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host)
@@ -901,13 +637,6 @@ static int sd_tuning_rx(struct realtek_pci_sdmmc *host, u8 opcode)
        return 0;
 }
-static inline bool sd_use_muti_rw(struct mmc_command *cmd)
-{
-        return mmc_op_multi(cmd->opcode) ||
-                (cmd->opcode == MMC_READ_SINGLE_BLOCK) ||
-                (cmd->opcode == MMC_WRITE_BLOCK);
-}
 static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
 {
        struct realtek_pci_sdmmc *host = mmc_priv(mmc);
@@ -916,14 +645,6 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
        struct mmc_data *data = mrq->data;
        unsigned int data_size = 0;
        int err;
-        unsigned long flags;
-        mutex_lock(&pcr->pcr_mutex);
-        spin_lock_irqsave(&host->lock, flags);
-        if (host->mrq)
-                dev_err(sdmmc_dev(host), "error: request already exist\n");
-        host->mrq = mrq;
        if (host->eject) {
                cmd->error = -ENOMEDIUM;
@@ -936,6 +657,8 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
                goto finish;
        }
+        mutex_lock(&pcr->pcr_mutex);
        rtsx_pci_start_run(pcr);
        rtsx_pci_switch_clock(pcr, host->clock, host->ssc_depth,
@@ -944,28 +667,46 @@ static void sdmmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
        rtsx_pci_write_register(pcr, CARD_SHARE_MODE,
                        CARD_SHARE_MASK, CARD_SHARE_48_SD);
+        mutex_lock(&host->host_mutex);
+        host->mrq = mrq;
+        mutex_unlock(&host->host_mutex);
        if (mrq->data)
                data_size = data->blocks * data->blksz;
-        if (sd_use_muti_rw(cmd))
+        if (!data_size || mmc_op_multi(cmd->opcode) ||
-                host->sg_count = sd_pre_dma_transfer(host, data, NULL);
+                        (cmd->opcode == MMC_READ_SINGLE_BLOCK) ||
+                        (cmd->opcode == MMC_WRITE_BLOCK)) {
+                sd_send_cmd_get_rsp(host, cmd);
-        if (!data_size || sd_use_muti_rw(cmd)) {
+                if (!cmd->error && data_size) {
-                if (mrq->sbc)
+                        sd_rw_multi(host, mrq);
-                        sd_send_cmd(host, mrq->sbc);
-                else
+                        if (mmc_op_multi(cmd->opcode) && mrq->stop)
-                        sd_send_cmd(host, cmd);
+                                sd_send_cmd_get_rsp(host, mrq->stop);
-                spin_unlock_irqrestore(&host->lock, flags);
+                }
        } else {
-                spin_unlock_irqrestore(&host->lock, flags);
                sd_normal_rw(host, mrq);
-                tasklet_schedule(&host->finish_tasklet);
        }
-        return;
+        if (mrq->data) {
+                if (cmd->error || data->error)
+                        data->bytes_xfered = 0;
+                else
+                        data->bytes_xfered = data->blocks * data->blksz;
+        }
+        mutex_unlock(&pcr->pcr_mutex);
 finish:
-        tasklet_schedule(&host->finish_tasklet);
+        if (cmd->error)
-        spin_unlock_irqrestore(&host->lock, flags);
+                dev_dbg(sdmmc_dev(host), "cmd->error = %d\n", cmd->error);
+        mutex_lock(&host->host_mutex);
+        host->mrq = NULL;
+        mutex_unlock(&host->host_mutex);
+        mmc_request_done(mmc, mrq);
 }
 static int sd_set_bus_width(struct realtek_pci_sdmmc *host,
@@ -1400,8 +1141,6 @@ out:
 }
 static const struct mmc_host_ops realtek_pci_sdmmc_ops = {
-        .pre_req = sdmmc_pre_req,
-        .post_req = sdmmc_post_req,
        .request = sdmmc_request,
        .set_ios = sdmmc_set_ios,
        .get_ro = sdmmc_get_ro,
@@ -1465,7 +1204,6 @@ static int rtsx_pci_sdmmc_drv_probe(struct platform_device *pdev)
        struct realtek_pci_sdmmc *host;
        struct rtsx_pcr *pcr;
        struct pcr_handle *handle = pdev->dev.platform_data;
-        unsigned long host_addr;
        if (!handle)
                return -ENXIO;
@@ -1489,15 +1227,8 @@ static int rtsx_pci_sdmmc_drv_probe(struct platform_device *pdev)
        pcr->slots[RTSX_SD_CARD].p_dev = pdev;
        pcr->slots[RTSX_SD_CARD].card_event = rtsx_pci_sdmmc_card_event;
-        host_addr = (unsigned long)host;
+        mutex_init(&host->host_mutex);
-        host->next_data.cookie = 1;
-        setup_timer(&host->timer, sd_request_timeout, host_addr);
-        tasklet_init(&host->cmd_tasklet, sd_get_rsp, host_addr);
-        tasklet_init(&host->data_tasklet, sd_finish_multi_rw, host_addr);
-        tasklet_init(&host->finish_tasklet, sd_finish_request, host_addr);
-        spin_lock_init(&host->lock);
-        pcr->slots[RTSX_SD_CARD].done_transfer = sd_isr_done_transfer;
        realtek_init_host(host);
        mmc_add_host(mmc);
@@ -1510,8 +1241,6 @@ static int rtsx_pci_sdmmc_drv_remove(struct platform_device *pdev)
        struct realtek_pci_sdmmc *host = platform_get_drvdata(pdev);
        struct rtsx_pcr *pcr;
        struct mmc_host *mmc;
-        struct mmc_request *mrq;
-        unsigned long flags;
        if (!host)
                return 0;
@@ -1519,33 +1248,22 @@ static int rtsx_pci_sdmmc_drv_remove(struct platform_device *pdev)
        pcr = host->pcr;
        pcr->slots[RTSX_SD_CARD].p_dev = NULL;
        pcr->slots[RTSX_SD_CARD].card_event = NULL;
-        pcr->slots[RTSX_SD_CARD].done_transfer = NULL;
        mmc = host->mmc;
-        mrq = host->mrq;
-        spin_lock_irqsave(&host->lock, flags);
+        mutex_lock(&host->host_mutex);
        if (host->mrq) {
                dev_dbg(&(pdev->dev),
                        "%s: Controller removed during transfer\n",
                        mmc_hostname(mmc));
-                if (mrq->sbc)
+                rtsx_pci_complete_unfinished_transfer(pcr);
-                        mrq->sbc->error = -ENOMEDIUM;
-                if (mrq->cmd)
-                        mrq->cmd->error = -ENOMEDIUM;
-                if (mrq->stop)
-                        mrq->stop->error = -ENOMEDIUM;
-                if (mrq->data)
-                        mrq->data->error = -ENOMEDIUM;
-                tasklet_schedule(&host->finish_tasklet);
+                host->mrq->cmd->error = -ENOMEDIUM;
+                if (host->mrq->stop)
+                        host->mrq->stop->error = -ENOMEDIUM;
+                mmc_request_done(mmc, host->mrq);
        }
-        spin_unlock_irqrestore(&host->lock, flags);
+        mutex_unlock(&host->host_mutex);
-        del_timer_sync(&host->timer);
-        tasklet_kill(&host->cmd_tasklet);
-        tasklet_kill(&host->data_tasklet);
-        tasklet_kill(&host->finish_tasklet);
        mmc_remove_host(mmc);
        host->eject = true;
diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c
index 363da96e6891..c4176b0f382d 100644
--- a/drivers/mtd/devices/spear_smi.c
+++ b/drivers/mtd/devices/spear_smi.c
@@ -6,7 +6,7 @@
 *
 * Copyright © 2010 STMicroelectronics.
 * Ashish Priyadarshi
- * Shiraz Hashim <shiraz.hashim@st.com>
+ * Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -1089,5 +1089,5 @@ static struct platform_driver spear_smi_driver = {
 module_platform_driver(spear_smi_driver);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Ashish Priyadarshi, Shiraz Hashim <shiraz.hashim@st.com>");
+MODULE_AUTHOR("Ashish Priyadarshi, Shiraz Hashim <shiraz.linux.kernel@gmail.com>");
 MODULE_DESCRIPTION("MTD SMI driver for serial nor flash chips");
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 4615d79fc93f..b922c8efcf40 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -523,6 +523,7 @@ static struct nand_ecclayout hwecc4_2048 = {
 #if defined(CONFIG_OF)
 static const struct of_device_id davinci_nand_of_match[] = {
        {.compatible = "ti,davinci-nand", },
+        {.compatible = "ti,keystone-nand", },
        {},
 };
 MODULE_DEVICE_TABLE(of, davinci_nand_of_match);
@@ -581,6 +582,11 @@ static struct davinci_nand_pdata
                    of_property_read_bool(pdev->dev.of_node,
                        "ti,davinci-nand-use-bbt"))
                        pdata->bbt_options = NAND_BBT_USE_FLASH;
+                if (of_device_is_compatible(pdev->dev.of_node,
+                                            "ti,keystone-nand")) {
+                        pdata->options |= NAND_NO_SUBPAGE_WRITE;
+                }
        }
        return dev_get_platdata(&pdev->dev);
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index 7ff473c871a9..8d659e6a1b4c 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -431,7 +431,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
         * Create one workqueue per volume (per registered block device).
         * Rembember workqueues are cheap, they're not threads.
         */
-        dev->wq = alloc_workqueue(gd->disk_name, 0, 0);
+        dev->wq = alloc_workqueue("%s", 0, 0, gd->disk_name);
        if (!dev->wq)
                goto out_free_queue;
        INIT_WORK(&dev->work, ubiblock_do_work);
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 02317c1c0238..0f3425dac910 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -671,6 +671,8 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)
        e = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF);
        self_check_in_wl_tree(ubi, e, &ubi->free);
+        ubi->free_count--;
+        ubi_assert(ubi->free_count >= 0);
        rb_erase(&e->u.rb, &ubi->free);
        return e;
@@ -684,6 +686,9 @@ int ubi_wl_get_peb(struct ubi_device *ubi)
        peb = __wl_get_peb(ubi);
        spin_unlock(&ubi->wl_lock);
+        if (peb < 0)
+                return peb;
        err = ubi_self_check_all_ff(ubi, peb, ubi->vid_hdr_aloffset,
                                    ubi->peb_size - ubi->vid_hdr_aloffset);
        if (err) {
@@ -1068,6 +1073,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                        /* Give the unused PEB back */
                        wl_tree_add(e2, &ubi->free);
+                        ubi->free_count++;
                        goto out_cancel;
                }
                self_check_in_wl_tree(ubi, e1, &ubi->used);
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 9f69e818b000..93580a47cc54 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -82,7 +82,8 @@ static inline struct arp_pkt *arp_pkt(const struct sk_buff *skb)
 }
 /* Forward declaration */
-static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[]);
+static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[],
+                                      bool strict_match);
 static void rlb_purge_src_ip(struct bonding *bond, struct arp_pkt *arp);
 static void rlb_src_unlink(struct bonding *bond, u32 index);
 static void rlb_src_link(struct bonding *bond, u32 ip_src_hash,
@@ -459,7 +460,7 @@ static void rlb_teach_disabled_mac_on_primary(struct bonding *bond, u8 addr[])
        bond->alb_info.rlb_promisc_timeout_counter = 0;
-        alb_send_learning_packets(bond->curr_active_slave, addr);
+        alb_send_learning_packets(bond->curr_active_slave, addr, true);
 }
 /* slave being removed should not be active at this point
@@ -995,7 +996,7 @@ static void rlb_clear_vlan(struct bonding *bond, unsigned short vlan_id)
 /*********************** tlb/rlb shared functions *********************/
 static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[],
-                            u16 vid)
+                            __be16 vlan_proto, u16 vid)
 {
        struct learning_pkt pkt;
        struct sk_buff *skb;
@@ -1021,7 +1022,7 @@ static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[],
        skb->dev = slave->dev;
        if (vid) {
-                skb = vlan_put_tag(skb, htons(ETH_P_8021Q), vid);
+                skb = vlan_put_tag(skb, vlan_proto, vid);
                if (!skb) {
                        pr_err("%s: Error: failed to insert VLAN tag\n",
                               slave->bond->dev->name);
@@ -1032,22 +1033,32 @@ static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[],
        dev_queue_xmit(skb);
 }
+static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[],
-static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
+                                      bool strict_match)
 {
        struct bonding *bond = bond_get_bond_by_slave(slave);
        struct net_device *upper;
        struct list_head *iter;
        /* send untagged */
-        alb_send_lp_vid(slave, mac_addr, 0);
+        alb_send_lp_vid(slave, mac_addr, 0, 0);
        /* loop through vlans and send one packet for each */
        rcu_read_lock();
        netdev_for_each_all_upper_dev_rcu(bond->dev, upper, iter) {
-                if (upper->priv_flags & IFF_802_1Q_VLAN)
+                if (is_vlan_dev(upper) && vlan_get_encap_level(upper) == 0) {
-                        alb_send_lp_vid(slave, mac_addr,
+                        if (strict_match &&
-                                        vlan_dev_vlan_id(upper));
+                            ether_addr_equal_64bits(mac_addr,
+                                                    upper->dev_addr)) {
+                                alb_send_lp_vid(slave, mac_addr,
+                                                vlan_dev_vlan_proto(upper),
+                                                vlan_dev_vlan_id(upper));
+                        } else if (!strict_match) {
+                                alb_send_lp_vid(slave, upper->dev_addr,
+                                                vlan_dev_vlan_proto(upper),
+                                                vlan_dev_vlan_id(upper));
+                        }
+                }
        }
        rcu_read_unlock();
 }
@@ -1107,7 +1118,7 @@ static void alb_fasten_mac_swap(struct bonding *bond, struct slave *slave1,
        /* fasten the change in the switch */
        if (SLAVE_IS_OK(slave1)) {
-                alb_send_learning_packets(slave1, slave1->dev->dev_addr);
+                alb_send_learning_packets(slave1, slave1->dev->dev_addr, false);
                if (bond->alb_info.rlb_enabled) {
                        /* inform the clients that the mac address
                         * has changed
@@ -1119,7 +1130,7 @@ static void alb_fasten_mac_swap(struct bonding *bond, struct slave *slave1,
        }
        if (SLAVE_IS_OK(slave2)) {
-                alb_send_learning_packets(slave2, slave2->dev->dev_addr);
+                alb_send_learning_packets(slave2, slave2->dev->dev_addr, false);
                if (bond->alb_info.rlb_enabled) {
                        /* inform the clients that the mac address
                         * has changed
@@ -1490,6 +1501,8 @@ void bond_alb_monitor(struct work_struct *work)
        /* send learning packets */
        if (bond_info->lp_counter >= BOND_ALB_LP_TICKS(bond)) {
+                bool strict_match;
                /* change of curr_active_slave involves swapping of mac addresses.
                 * in order to avoid this swapping from happening while
                 * sending the learning packets, the curr_slave_lock must be held for
@@ -1497,8 +1510,15 @@ void bond_alb_monitor(struct work_struct *work)
                 */
                read_lock(&bond->curr_slave_lock);
-                bond_for_each_slave_rcu(bond, slave, iter)
+                bond_for_each_slave_rcu(bond, slave, iter) {
-                        alb_send_learning_packets(slave, slave->dev->dev_addr);
+                        /* If updating current_active, use all currently
+                         * user mac addreses (!strict_match).  Otherwise, only
+                         * use mac of the slave device.
+                         */
+                        strict_match = (slave != bond->curr_active_slave);
+                        alb_send_learning_packets(slave, slave->dev->dev_addr,
+                                                  strict_match);
+                }
                read_unlock(&bond->curr_slave_lock);
@@ -1721,7 +1741,8 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
        } else {
                /* set the new_slave to the bond mac address */
                alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr);
-                alb_send_learning_packets(new_slave, bond->dev->dev_addr);
+                alb_send_learning_packets(new_slave, bond->dev->dev_addr,
+                                          false);
        }
        write_lock_bh(&bond->curr_slave_lock);
@@ -1764,7 +1785,8 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr);
                read_lock(&bond->lock);
-                alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
+                alb_send_learning_packets(bond->curr_active_slave,
+                                          bond_dev->dev_addr, false);
                if (bond->alb_info.rlb_enabled) {
                        /* inform clients mac address has changed */
                        rlb_req_update_slave_clients(bond, bond->curr_active_slave);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 69aff72c8957..d3a67896d435 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2126,10 +2126,10 @@ static bool bond_has_this_ip(struct bonding *bond, __be32 ip)
 */
 static void bond_arp_send(struct net_device *slave_dev, int arp_op,
                          __be32 dest_ip, __be32 src_ip,
-                          struct bond_vlan_tag *inner,
+                          struct bond_vlan_tag *tags)
-                          struct bond_vlan_tag *outer)
 {
        struct sk_buff *skb;
+        int i;
        pr_debug("arp %d on slave %s: dst %pI4 src %pI4\n",
                 arp_op, slave_dev->name, &dest_ip, &src_ip);
@@ -2141,21 +2141,26 @@ static void bond_arp_send(struct net_device *slave_dev, int arp_op,
                net_err_ratelimited("ARP packet allocation failed\n");
                return;
        }
-        if (outer->vlan_id) {
-                if (inner->vlan_id) {
-                        pr_debug("inner tag: proto %X vid %X\n",
-                                 ntohs(inner->vlan_proto), inner->vlan_id);
-                        skb = __vlan_put_tag(skb, inner->vlan_proto,
-                                             inner->vlan_id);
-                        if (!skb) {
-                                net_err_ratelimited("failed to insert inner VLAN tag\n");
-                                return;
-                        }
-                }
-                pr_debug("outer reg: proto %X vid %X\n",
+        /* Go through all the tags backwards and add them to the packet */
-                         ntohs(outer->vlan_proto), outer->vlan_id);
+        for (i = BOND_MAX_VLAN_ENCAP - 1; i > 0; i--) {
-                skb = vlan_put_tag(skb, outer->vlan_proto, outer->vlan_id);
+                if (!tags[i].vlan_id)
+                        continue;
+                pr_debug("inner tag: proto %X vid %X\n",
+                         ntohs(tags[i].vlan_proto), tags[i].vlan_id);
+                skb = __vlan_put_tag(skb, tags[i].vlan_proto,
+                                     tags[i].vlan_id);
+                if (!skb) {
+                        net_err_ratelimited("failed to insert inner VLAN tag\n");
+                        return;
+                }
+        }
+        /* Set the outer tag */
+        if (tags[0].vlan_id) {
+                pr_debug("outer tag: proto %X vid %X\n",
+                         ntohs(tags[0].vlan_proto), tags[0].vlan_id);
+                skb = vlan_put_tag(skb, tags[0].vlan_proto, tags[0].vlan_id);
                if (!skb) {
                        net_err_ratelimited("failed to insert outer VLAN tag\n");
                        return;
@@ -2164,22 +2169,52 @@ static void bond_arp_send(struct net_device *slave_dev, int arp_op,
        arp_xmit(skb);
 }
+/* Validate the device path between the @start_dev and the @end_dev.
+ * The path is valid if the @end_dev is reachable through device
+ * stacking.
+ * When the path is validated, collect any vlan information in the
+ * path.
+ */
+static bool bond_verify_device_path(struct net_device *start_dev,
+                                    struct net_device *end_dev,
+                                    struct bond_vlan_tag *tags)
+{
+        struct net_device *upper;
+        struct list_head  *iter;
+        int  idx;
+        if (start_dev == end_dev)
+                return true;
+        netdev_for_each_upper_dev_rcu(start_dev, upper, iter) {
+                if (bond_verify_device_path(upper, end_dev, tags)) {
+                        if (is_vlan_dev(upper)) {
+                                idx = vlan_get_encap_level(upper);
+                                if (idx >= BOND_MAX_VLAN_ENCAP)
+                                        return false;
+                                tags[idx].vlan_proto =
+                                                    vlan_dev_vlan_proto(upper);
+                                tags[idx].vlan_id = vlan_dev_vlan_id(upper);
+                        }
+                        return true;
+                }
+        }
+        return false;
+}
 static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
 {
-        struct net_device *upper, *vlan_upper;
-        struct list_head *iter, *vlan_iter;
        struct rtable *rt;
-        struct bond_vlan_tag inner, outer;
+        struct bond_vlan_tag tags[BOND_MAX_VLAN_ENCAP];
        __be32 *targets = bond->params.arp_targets, addr;
        int i;
+        bool ret;
        for (i = 0; i < BOND_MAX_ARP_TARGETS && targets[i]; i++) {
                pr_debug("basa: target %pI4\n", &targets[i]);
-                inner.vlan_proto = 0;
+                memset(tags, 0, sizeof(tags));
-                inner.vlan_id = 0;
-                outer.vlan_proto = 0;
-                outer.vlan_id = 0;
                /* Find out through which dev should the packet go */
                rt = ip_route_output(dev_net(bond->dev), targets[i], 0,
@@ -2192,7 +2227,8 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                                net_warn_ratelimited("%s: no route to arp_ip_target %pI4 and arp_validate is set\n",
                                                     bond->dev->name,
                                                     &targets[i]);
-                        bond_arp_send(slave->dev, ARPOP_REQUEST, targets[i], 0, &inner, &outer);
+                        bond_arp_send(slave->dev, ARPOP_REQUEST, targets[i],
+                                      0, tags);
                        continue;
                }
@@ -2201,52 +2237,12 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                        goto found;
                rcu_read_lock();
-                /* first we search only for vlan devices. for every vlan
+                ret = bond_verify_device_path(bond->dev, rt->dst.dev, tags);
-                 * found we verify its upper dev list, searching for the
-                 * rt->dst.dev. If found we save the tag of the vlan and
-                 * proceed to send the packet.
-                 */
-                netdev_for_each_all_upper_dev_rcu(bond->dev, vlan_upper,
-                                                  vlan_iter) {
-                        if (!is_vlan_dev(vlan_upper))
-                                continue;
-                        if (vlan_upper == rt->dst.dev) {
-                                outer.vlan_proto = vlan_dev_vlan_proto(vlan_upper);
-                                outer.vlan_id = vlan_dev_vlan_id(vlan_upper);
-                                rcu_read_unlock();
-                                goto found;
-                        }
-                        netdev_for_each_all_upper_dev_rcu(vlan_upper, upper,
-                                                          iter) {
-                                if (upper == rt->dst.dev) {
-                                        /* If the upper dev is a vlan dev too,
-                                         *  set the vlan tag to inner tag.
-                                         */
-                                        if (is_vlan_dev(upper)) {
-                                                inner.vlan_proto = vlan_dev_vlan_proto(upper);
-                                                inner.vlan_id = vlan_dev_vlan_id(upper);
-                                        }
-                                        outer.vlan_proto = vlan_dev_vlan_proto(vlan_upper);
-                                        outer.vlan_id = vlan_dev_vlan_id(vlan_upper);
-                                        rcu_read_unlock();
-                                        goto found;
-                                }
-                        }
-                }
-                /* if the device we're looking for is not on top of any of
-                 * our upper vlans, then just search for any dev that
-                 * matches, and in case it's a vlan - save the id
-                 */
-                netdev_for_each_all_upper_dev_rcu(bond->dev, upper, iter) {
-                        if (upper == rt->dst.dev) {
-                                rcu_read_unlock();
-                                goto found;
-                        }
-                }
                rcu_read_unlock();
+                if (ret)
+                        goto found;
                /* Not our device - skip */
                pr_debug("%s: no path to arp_ip_target %pI4 via rt.dev %s\n",
                         bond->dev->name, &targets[i],
@@ -2259,7 +2255,7 @@ found:
                addr = bond_confirm_addr(rt->dst.dev, targets[i], 0);
                ip_rt_put(rt);
                bond_arp_send(slave->dev, ARPOP_REQUEST, targets[i],
-                              addr, &inner, &outer);
+                              addr, tags);
        }
 }
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 724e30fa20b9..832070298446 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -125,6 +125,7 @@ static const struct bond_opt_value bond_fail_over_mac_tbl[] = {
 static const struct bond_opt_value bond_intmax_tbl[] = {
        { "off",     0,       BOND_VALFLAG_DEFAULT},
        { "maxval",  INT_MAX, BOND_VALFLAG_MAX},
+        { NULL,      -1,      0}
 };
 static const struct bond_opt_value bond_lacp_rate_tbl[] = {
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 0e8b268da0a0..5f6babcfc26e 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -534,7 +534,7 @@ static ssize_t bonding_show_min_links(struct device *d,
 {
        struct bonding *bond = to_bond(d);
-        return sprintf(buf, "%d\n", bond->params.min_links);
+        return sprintf(buf, "%u\n", bond->params.min_links);
 }
 static ssize_t bonding_store_min_links(struct device *d,
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index b8bdd0acc8f3..00bea320e3b5 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -36,6 +36,7 @@
 #define bond_version DRV_DESCRIPTION ": v" DRV_VERSION " (" DRV_RELDATE ")\n"
+#define BOND_MAX_VLAN_ENCAP     2
 #define BOND_MAX_ARP_TARGETS    16
 #define BOND_DEFAULT_MIIMON     100
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index a5c8dcfa8357..95e04e2002da 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -60,6 +60,8 @@
 #define CONTROL_IE              BIT(1)
 #define CONTROL_INIT            BIT(0)
+#define CONTROL_IRQMSK          (CONTROL_EIE | CONTROL_IE | CONTROL_SIE)
 /* test register */
 #define TEST_RX                 BIT(7)
 #define TEST_TX1                BIT(6)
@@ -108,11 +110,14 @@
 #define IF_COMM_CONTROL         BIT(4)
 #define IF_COMM_CLR_INT_PND     BIT(3)
 #define IF_COMM_TXRQST          BIT(2)
+#define IF_COMM_CLR_NEWDAT      IF_COMM_TXRQST
 #define IF_COMM_DATAA           BIT(1)
 #define IF_COMM_DATAB           BIT(0)
-#define IF_COMM_ALL             (IF_COMM_MASK | IF_COMM_ARB | \
-                                IF_COMM_CONTROL | IF_COMM_TXRQST | \
+/* TX buffer setup */
-                                IF_COMM_DATAA | IF_COMM_DATAB)
+#define IF_COMM_TX              (IF_COMM_ARB | IF_COMM_CONTROL | \
+                                 IF_COMM_TXRQST |                \
+                                 IF_COMM_DATAA | IF_COMM_DATAB)
 /* For the low buffers we clear the interrupt bit, but keep newdat */
 #define IF_COMM_RCV_LOW         (IF_COMM_MASK | IF_COMM_ARB | \
@@ -120,12 +125,19 @@
                                 IF_COMM_DATAA | IF_COMM_DATAB)
 /* For the high buffers we clear the interrupt bit and newdat */
-#define IF_COMM_RCV_HIGH        (IF_COMM_RCV_LOW | IF_COMM_TXRQST)
+#define IF_COMM_RCV_HIGH        (IF_COMM_RCV_LOW | IF_COMM_CLR_NEWDAT)
+/* Receive setup of message objects */
+#define IF_COMM_RCV_SETUP       (IF_COMM_MASK | IF_COMM_ARB | IF_COMM_CONTROL)
+/* Invalidation of message objects */
+#define IF_COMM_INVAL           (IF_COMM_ARB | IF_COMM_CONTROL)
 /* IFx arbitration */
-#define IF_ARB_MSGVAL           BIT(15)
+#define IF_ARB_MSGVAL           BIT(31)
-#define IF_ARB_MSGXTD           BIT(14)
+#define IF_ARB_MSGXTD           BIT(30)
-#define IF_ARB_TRANSMIT         BIT(13)
+#define IF_ARB_TRANSMIT         BIT(29)
 /* IFx message control */
 #define IF_MCONT_NEWDAT         BIT(15)
@@ -139,19 +151,17 @@
 #define IF_MCONT_EOB            BIT(7)
 #define IF_MCONT_DLC_MASK       0xf
+#define IF_MCONT_RCV            (IF_MCONT_RXIE | IF_MCONT_UMASK)
+#define IF_MCONT_RCV_EOB        (IF_MCONT_RCV | IF_MCONT_EOB)
+#define IF_MCONT_TX             (IF_MCONT_TXIE | IF_MCONT_EOB)
 /*
 * Use IF1 for RX and IF2 for TX
 */
 #define IF_RX                   0
 #define IF_TX                   1
-/* status interrupt */
-#define STATUS_INTERRUPT        0x8000
-/* global interrupt masks */
-#define ENABLE_ALL_INTERRUPTS   1
-#define DISABLE_ALL_INTERRUPTS  0
 /* minimum timeout for checking BUSY status */
 #define MIN_TIMEOUT_VALUE       6
@@ -171,6 +181,7 @@ enum c_can_lec_type {
        LEC_BIT0_ERROR,
        LEC_CRC_ERROR,
        LEC_UNUSED,
+        LEC_MASK = LEC_UNUSED,
 };
 /*
@@ -226,143 +237,115 @@ static inline void c_can_reset_ram(const struct c_can_priv *priv, bool enable)
                priv->raminit(priv, enable);
 }
-static inline int get_tx_next_msg_obj(const struct c_can_priv *priv)
+static void c_can_irq_control(struct c_can_priv *priv, bool enable)
-{
-        return (priv->tx_next & C_CAN_NEXT_MSG_OBJ_MASK) +
-                        C_CAN_MSG_OBJ_TX_FIRST;
-}
-static inline int get_tx_echo_msg_obj(int txecho)
-{
-        return (txecho & C_CAN_NEXT_MSG_OBJ_MASK) + C_CAN_MSG_OBJ_TX_FIRST;
-}
-static u32 c_can_read_reg32(struct c_can_priv *priv, enum reg index)
-{
-        u32 val = priv->read_reg(priv, index);
-        val |= ((u32) priv->read_reg(priv, index + 1)) << 16;
-        return val;
-}
-static void c_can_enable_all_interrupts(struct c_can_priv *priv,
-                                                int enable)
 {
-        unsigned int cntrl_save = priv->read_reg(priv,
+        u32 ctrl = priv->read_reg(priv, C_CAN_CTRL_REG) & ~CONTROL_IRQMSK;
-                                                C_CAN_CTRL_REG);
        if (enable)
-                cntrl_save |= (CONTROL_SIE | CONTROL_EIE | CONTROL_IE);
+                ctrl |= CONTROL_IRQMSK;
-        else
-                cntrl_save &= ~(CONTROL_EIE | CONTROL_IE | CONTROL_SIE);
-        priv->write_reg(priv, C_CAN_CTRL_REG, cntrl_save);
+        priv->write_reg(priv, C_CAN_CTRL_REG, ctrl);
 }
-static inline int c_can_msg_obj_is_busy(struct c_can_priv *priv, int iface)
+static void c_can_obj_update(struct net_device *dev, int iface, u32 cmd, u32 obj)
 {
-        int count = MIN_TIMEOUT_VALUE;
+        struct c_can_priv *priv = netdev_priv(dev);
+        int cnt, reg = C_CAN_IFACE(COMREQ_REG, iface);
-        while (count && priv->read_reg(priv,
+        priv->write_reg(priv, reg + 1, cmd);
-                                C_CAN_IFACE(COMREQ_REG, iface)) &
+        priv->write_reg(priv, reg, obj);
-                                IF_COMR_BUSY) {
-                count--;
+        for (cnt = MIN_TIMEOUT_VALUE; cnt; cnt--) {
+                if (!(priv->read_reg(priv, reg) & IF_COMR_BUSY))
+                        return;
                udelay(1);
        }
+        netdev_err(dev, "Updating object timed out\n");
-        if (!count)
+}
-                return 1;
-        return 0;
+static inline void c_can_object_get(struct net_device *dev, int iface,
+                                    u32 obj, u32 cmd)
+{
+        c_can_obj_update(dev, iface, cmd, obj);
 }
-static inline void c_can_object_get(struct net_device *dev,
+static inline void c_can_object_put(struct net_device *dev, int iface,
-                                        int iface, int objno, int mask)
+                                    u32 obj, u32 cmd)
 {
-        struct c_can_priv *priv = netdev_priv(dev);
+        c_can_obj_update(dev, iface, cmd | IF_COMM_WR, obj);
+}
-        /*
+/*
-         * As per specs, after writting the message object number in the
+ * Note: According to documentation clearing TXIE while MSGVAL is set
-         * IF command request register the transfer b/w interface
+ * is not allowed, but works nicely on C/DCAN. And that lowers the I/O
-         * register and message RAM must be complete in 6 CAN-CLK
+ * load significantly.
-         * period.
+ */
-         */
+static void c_can_inval_tx_object(struct net_device *dev, int iface, int obj)
-        priv->write_reg(priv, C_CAN_IFACE(COMMSK_REG, iface),
+{
-                        IFX_WRITE_LOW_16BIT(mask));
+        struct c_can_priv *priv = netdev_priv(dev);
-        priv->write_reg(priv, C_CAN_IFACE(COMREQ_REG, iface),
-                        IFX_WRITE_LOW_16BIT(objno));
-        if (c_can_msg_obj_is_busy(priv, iface))
+        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), 0);
-                netdev_err(dev, "timed out in object get\n");
+        c_can_object_put(dev, iface, obj, IF_COMM_INVAL);
 }
-static inline void c_can_object_put(struct net_device *dev,
+static void c_can_inval_msg_object(struct net_device *dev, int iface, int obj)
-                                        int iface, int objno, int mask)
 {
        struct c_can_priv *priv = netdev_priv(dev);
-        /*
+        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), 0);
-         * As per specs, after writting the message object number in the
+        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), 0);
-         * IF command request register the transfer b/w interface
+        c_can_inval_tx_object(dev, iface, obj);
-         * register and message RAM must be complete in 6 CAN-CLK
-         * period.
-         */
-        priv->write_reg(priv, C_CAN_IFACE(COMMSK_REG, iface),
-                        (IF_COMM_WR | IFX_WRITE_LOW_16BIT(mask)));
-        priv->write_reg(priv, C_CAN_IFACE(COMREQ_REG, iface),
-                        IFX_WRITE_LOW_16BIT(objno));
-        if (c_can_msg_obj_is_busy(priv, iface))
-                netdev_err(dev, "timed out in object put\n");
 }
-static void c_can_write_msg_object(struct net_device *dev,
+static void c_can_setup_tx_object(struct net_device *dev, int iface,
-                        int iface, struct can_frame *frame, int objno)
+                                  struct can_frame *frame, int idx)
 {
-        int i;
-        u16 flags = 0;
-        unsigned int id;
        struct c_can_priv *priv = netdev_priv(dev);
+        u16 ctrl = IF_MCONT_TX | frame->can_dlc;
-        if (!(frame->can_id & CAN_RTR_FLAG))
+        bool rtr = frame->can_id & CAN_RTR_FLAG;
-                flags |= IF_ARB_TRANSMIT;
+        u32 arb = IF_ARB_MSGVAL;
+        int i;
        if (frame->can_id & CAN_EFF_FLAG) {
-                id = frame->can_id & CAN_EFF_MASK;
+                arb |= frame->can_id & CAN_EFF_MASK;
-                flags |= IF_ARB_MSGXTD;
+                arb |= IF_ARB_MSGXTD;
-        } else
+        } else {
-                id = ((frame->can_id & CAN_SFF_MASK) << 18);
+                arb |= (frame->can_id & CAN_SFF_MASK) << 18;
+        }
+        if (!rtr)
+                arb |= IF_ARB_TRANSMIT;
+        /*
+         * If we change the DIR bit, we need to invalidate the buffer
+         * first, i.e. clear the MSGVAL flag in the arbiter.
+         */
+        if (rtr != (bool)test_bit(idx, &priv->tx_dir)) {
+                u32 obj = idx + C_CAN_MSG_OBJ_TX_FIRST;
+                c_can_inval_msg_object(dev, iface, obj);
+                change_bit(idx, &priv->tx_dir);
+        }
-        flags |= IF_ARB_MSGVAL;
+        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), arb);
+        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), arb >> 16);
-        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
+        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
-                                IFX_WRITE_LOW_16BIT(id));
-        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), flags |
-                                IFX_WRITE_HIGH_16BIT(id));
        for (i = 0; i < frame->can_dlc; i += 2) {
                priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2,
                                frame->data[i] | (frame->data[i + 1] << 8));
        }
-        /* enable interrupt for this message object */
-        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface),
-                        IF_MCONT_TXIE | IF_MCONT_TXRQST | IF_MCONT_EOB |
-                        frame->can_dlc);
-        c_can_object_put(dev, iface, objno, IF_COMM_ALL);
 }
 static inline void c_can_activate_all_lower_rx_msg_obj(struct net_device *dev,
-                                                int iface,
+                                                       int iface)
-                                                int ctrl_mask)
 {
        int i;
-        struct c_can_priv *priv = netdev_priv(dev);
-        for (i = C_CAN_MSG_OBJ_RX_FIRST; i <= C_CAN_MSG_RX_LOW_LAST; i++) {
+        for (i = C_CAN_MSG_OBJ_RX_FIRST; i <= C_CAN_MSG_RX_LOW_LAST; i++)
-                priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface),
+                c_can_object_get(dev, iface, i, IF_COMM_CLR_NEWDAT);
-                                ctrl_mask & ~IF_MCONT_NEWDAT);
-                c_can_object_put(dev, iface, i, IF_COMM_CONTROL);
-        }
 }
 static int c_can_handle_lost_msg_obj(struct net_device *dev,
@@ -377,6 +360,9 @@ static int c_can_handle_lost_msg_obj(struct net_device *dev,
        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
        c_can_object_put(dev, iface, objno, IF_COMM_CONTROL);
+        stats->rx_errors++;
+        stats->rx_over_errors++;
        /* create an error msg */
        skb = alloc_can_err_skb(dev, &frame);
        if (unlikely(!skb))
@@ -384,22 +370,18 @@ static int c_can_handle_lost_msg_obj(struct net_device *dev,
        frame->can_id |= CAN_ERR_CRTL;
        frame->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
-        stats->rx_errors++;
-        stats->rx_over_errors++;
        netif_receive_skb(skb);
        return 1;
 }
-static int c_can_read_msg_object(struct net_device *dev, int iface, int ctrl)
+static int c_can_read_msg_object(struct net_device *dev, int iface, u32 ctrl)
 {
-        u16 flags, data;
-        int i;
-        unsigned int val;
-        struct c_can_priv *priv = netdev_priv(dev);
        struct net_device_stats *stats = &dev->stats;
-        struct sk_buff *skb;
+        struct c_can_priv *priv = netdev_priv(dev);
        struct can_frame *frame;
+        struct sk_buff *skb;
+        u32 arb, data;
        skb = alloc_can_skb(dev, &frame);
        if (!skb) {
@@ -409,115 +391,82 @@ static int c_can_read_msg_object(struct net_device *dev, int iface, int ctrl)
        frame->can_dlc = get_can_dlc(ctrl & 0x0F);
-        flags = priv->read_reg(priv, C_CAN_IFACE(ARB2_REG, iface));
+        arb = priv->read_reg(priv, C_CAN_IFACE(ARB1_REG, iface));
-        val = priv->read_reg(priv, C_CAN_IFACE(ARB1_REG, iface)) |
+        arb |= priv->read_reg(priv, C_CAN_IFACE(ARB2_REG, iface)) << 16;
-                (flags << 16);
-        if (flags & IF_ARB_MSGXTD)
+        if (arb & IF_ARB_MSGXTD)
-                frame->can_id = (val & CAN_EFF_MASK) | CAN_EFF_FLAG;
+                frame->can_id = (arb & CAN_EFF_MASK) | CAN_EFF_FLAG;
        else
-                frame->can_id = (val >> 18) & CAN_SFF_MASK;
+                frame->can_id = (arb >> 18) & CAN_SFF_MASK;
-        if (flags & IF_ARB_TRANSMIT)
+        if (arb & IF_ARB_TRANSMIT) {
                frame->can_id |= CAN_RTR_FLAG;
-        else {
+        } else {
-                for (i = 0; i < frame->can_dlc; i += 2) {
+                int i, dreg = C_CAN_IFACE(DATA1_REG, iface);
-                        data = priv->read_reg(priv,
-                                C_CAN_IFACE(DATA1_REG, iface) + i / 2);
+                for (i = 0; i < frame->can_dlc; i += 2, dreg ++) {
+                        data = priv->read_reg(priv, dreg);
                        frame->data[i] = data;
                        frame->data[i + 1] = data >> 8;
                }
        }
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += frame->can_dlc;
+        netif_receive_skb(skb);
        return 0;
 }
 static void c_can_setup_receive_object(struct net_device *dev, int iface,
-                                        int objno, unsigned int mask,
+                                       u32 obj, u32 mask, u32 id, u32 mcont)
-                                        unsigned int id, unsigned int mcont)
 {
        struct c_can_priv *priv = netdev_priv(dev);
-        priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface),
+        mask |= BIT(29);
-                        IFX_WRITE_LOW_16BIT(mask));
+        priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface), mask);
+        priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface), mask >> 16);
-        /* According to C_CAN documentation, the reserved bit
-         * in IFx_MASK2 register is fixed 1
-         */
-        priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface),
-                        IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
-        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
+        id |= IF_ARB_MSGVAL;
-                        IFX_WRITE_LOW_16BIT(id));
+        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), id);
-        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface),
+        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), id >> 16);
-                        (IF_ARB_MSGVAL | IFX_WRITE_HIGH_16BIT(id)));
        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), mcont);
-        c_can_object_put(dev, iface, objno, IF_COMM_ALL & ~IF_COMM_TXRQST);
+        c_can_object_put(dev, iface, obj, IF_COMM_RCV_SETUP);
-        netdev_dbg(dev, "obj no:%d, msgval:0x%08x\n", objno,
-                        c_can_read_reg32(priv, C_CAN_MSGVAL1_REG));
-}
-static void c_can_inval_msg_object(struct net_device *dev, int iface, int objno)
-{
-        struct c_can_priv *priv = netdev_priv(dev);
-        priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface), 0);
-        priv->write_reg(priv, C_CAN_IFACE(ARB2_REG, iface), 0);
-        priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), 0);
-        c_can_object_put(dev, iface, objno, IF_COMM_ARB | IF_COMM_CONTROL);
-        netdev_dbg(dev, "obj no:%d, msgval:0x%08x\n", objno,
-                        c_can_read_reg32(priv, C_CAN_MSGVAL1_REG));
-}
-static inline int c_can_is_next_tx_obj_busy(struct c_can_priv *priv, int objno)
-{
-        int val = c_can_read_reg32(priv, C_CAN_TXRQST1_REG);
-        /*
-         * as transmission request register's bit n-1 corresponds to
-         * message object n, we need to handle the same properly.
-         */
-        if (val & (1 << (objno - 1)))
-                return 1;
-        return 0;
 }
 static netdev_tx_t c_can_start_xmit(struct sk_buff *skb,
-                                        struct net_device *dev)
+                                    struct net_device *dev)
 {
-        u32 msg_obj_no;
-        struct c_can_priv *priv = netdev_priv(dev);
        struct can_frame *frame = (struct can_frame *)skb->data;
+        struct c_can_priv *priv = netdev_priv(dev);
+        u32 idx, obj;
        if (can_dropped_invalid_skb(dev, skb))
                return NETDEV_TX_OK;
-        spin_lock_bh(&priv->xmit_lock);
-        msg_obj_no = get_tx_next_msg_obj(priv);
-        /* prepare message object for transmission */
-        c_can_write_msg_object(dev, IF_TX, frame, msg_obj_no);
-        priv->dlc[msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST] = frame->can_dlc;
-        can_put_echo_skb(skb, dev, msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
        /*
-         * we have to stop the queue in case of a wrap around or
+         * This is not a FIFO. C/D_CAN sends out the buffers
-         * if the next TX message object is still in use
+         * prioritized. The lowest buffer number wins.
         */
-        priv->tx_next++;
+        idx = fls(atomic_read(&priv->tx_active));
-        if (c_can_is_next_tx_obj_busy(priv, get_tx_next_msg_obj(priv)) ||
+        obj = idx + C_CAN_MSG_OBJ_TX_FIRST;
-                        (priv->tx_next & C_CAN_NEXT_MSG_OBJ_MASK) == 0)
+        /* If this is the last buffer, stop the xmit queue */
+        if (idx == C_CAN_MSG_OBJ_TX_NUM - 1)
                netif_stop_queue(dev);
-        spin_unlock_bh(&priv->xmit_lock);
+        /*
+         * Store the message in the interface so we can call
+         * can_put_echo_skb(). We must do this before we enable
+         * transmit as we might race against do_tx().
+         */
+        c_can_setup_tx_object(dev, IF_TX, frame, idx);
+        priv->dlc[idx] = frame->can_dlc;
+        can_put_echo_skb(skb, dev, idx);
+        /* Update the active bits */
+        atomic_add((1 << idx), &priv->tx_active);
+        /* Start transmission */
+        c_can_object_put(dev, IF_TX, obj, IF_COMM_TX);
        return NETDEV_TX_OK;
 }
@@ -594,11 +543,10 @@ static void c_can_configure_msg_objects(struct net_device *dev)
        /* setup receive message objects */
        for (i = C_CAN_MSG_OBJ_RX_FIRST; i < C_CAN_MSG_OBJ_RX_LAST; i++)
-                c_can_setup_receive_object(dev, IF_RX, i, 0, 0,
+                c_can_setup_receive_object(dev, IF_RX, i, 0, 0, IF_MCONT_RCV);
-                        (IF_MCONT_RXIE | IF_MCONT_UMASK) & ~IF_MCONT_EOB);
        c_can_setup_receive_object(dev, IF_RX, C_CAN_MSG_OBJ_RX_LAST, 0, 0,
-                        IF_MCONT_EOB | IF_MCONT_RXIE | IF_MCONT_UMASK);
+                                   IF_MCONT_RCV_EOB);
 }
 /*
@@ -612,30 +560,22 @@ static int c_can_chip_config(struct net_device *dev)
        struct c_can_priv *priv = netdev_priv(dev);
        /* enable automatic retransmission */
-        priv->write_reg(priv, C_CAN_CTRL_REG,
+        priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
-                        CONTROL_ENABLE_AR);
        if ((priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) &&
            (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)) {
                /* loopback + silent mode : useful for hot self-test */
-                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_EIE |
+                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_TEST);
-                                CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
+                priv->write_reg(priv, C_CAN_TEST_REG, TEST_LBACK | TEST_SILENT);
-                priv->write_reg(priv, C_CAN_TEST_REG,
-                                TEST_LBACK | TEST_SILENT);
        } else if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK) {
                /* loopback mode : useful for self-test function */
-                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_EIE |
+                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_TEST);
-                                CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
                priv->write_reg(priv, C_CAN_TEST_REG, TEST_LBACK);
        } else if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
                /* silent mode : bus-monitoring mode */
-                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_EIE |
+                priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_TEST);
-                                CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
                priv->write_reg(priv, C_CAN_TEST_REG, TEST_SILENT);
-        } else
+        }
-                /* normal mode*/
-                priv->write_reg(priv, C_CAN_CTRL_REG,
-                                CONTROL_EIE | CONTROL_SIE | CONTROL_IE);
        /* configure message objects */
        c_can_configure_msg_objects(dev);
@@ -643,6 +583,11 @@ static int c_can_chip_config(struct net_device *dev)
        /* set a `lec` value so that we can check for updates later */
        priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
+        /* Clear all internal status */
+        atomic_set(&priv->tx_active, 0);
+        priv->rxmasked = 0;
+        priv->tx_dir = 0;
        /* set bittiming params */
        return c_can_set_bittiming(dev);
 }
@@ -657,13 +602,11 @@ static int c_can_start(struct net_device *dev)
        if (err)
                return err;
-        priv->can.state = CAN_STATE_ERROR_ACTIVE;
+        /* Setup the command for new messages */
+        priv->comm_rcv_high = priv->type != BOSCH_D_CAN ?
-        /* reset tx helper pointers */
+                IF_COMM_RCV_LOW : IF_COMM_RCV_HIGH;
-        priv->tx_next = priv->tx_echo = 0;
-        /* enable status change, error and module interrupts */
+        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-        c_can_enable_all_interrupts(priv, ENABLE_ALL_INTERRUPTS);
        return 0;
 }
@@ -672,15 +615,13 @@ static void c_can_stop(struct net_device *dev)
 {
        struct c_can_priv *priv = netdev_priv(dev);
-        /* disable all interrupts */
+        c_can_irq_control(priv, false);
-        c_can_enable_all_interrupts(priv, DISABLE_ALL_INTERRUPTS);
-        /* set the state as STOPPED */
        priv->can.state = CAN_STATE_STOPPED;
 }
 static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
 {
+        struct c_can_priv *priv = netdev_priv(dev);
        int err;
        switch (mode) {
@@ -689,6 +630,7 @@ static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
                if (err)
                        return err;
                netif_wake_queue(dev);
+                c_can_irq_control(priv, true);
                break;
        default:
                return -EOPNOTSUPP;
@@ -724,42 +666,29 @@ static int c_can_get_berr_counter(const struct net_device *dev,
        return err;
 }
-/*
- * priv->tx_echo holds the number of the oldest can_frame put for
- * transmission into the hardware, but not yet ACKed by the CAN tx
- * complete IRQ.
- *
- * We iterate from priv->tx_echo to priv->tx_next and check if the
- * packet has been transmitted, echo it back to the CAN framework.
- * If we discover a not yet transmitted packet, stop looking for more.
- */
 static void c_can_do_tx(struct net_device *dev)
 {
        struct c_can_priv *priv = netdev_priv(dev);
        struct net_device_stats *stats = &dev->stats;
-        u32 val, obj, pkts = 0, bytes = 0;
+        u32 idx, obj, pkts = 0, bytes = 0, pend, clr;
-        spin_lock_bh(&priv->xmit_lock);
-        for (; (priv->tx_next - priv->tx_echo) > 0; priv->tx_echo++) {
-                obj = get_tx_echo_msg_obj(priv->tx_echo);
-                val = c_can_read_reg32(priv, C_CAN_TXRQST1_REG);
-                if (val & (1 << (obj - 1)))
+        clr = pend = priv->read_reg(priv, C_CAN_INTPND2_REG);
-                        break;
-                can_get_echo_skb(dev, obj - C_CAN_MSG_OBJ_TX_FIRST);
+        while ((idx = ffs(pend))) {
-                bytes += priv->dlc[obj - C_CAN_MSG_OBJ_TX_FIRST];
+                idx--;
+                pend &= ~(1 << idx);
+                obj = idx + C_CAN_MSG_OBJ_TX_FIRST;
+                c_can_inval_tx_object(dev, IF_RX, obj);
+                can_get_echo_skb(dev, idx);
+                bytes += priv->dlc[idx];
                pkts++;
-                c_can_inval_msg_object(dev, IF_TX, obj);
        }
-        /* restart queue if wrap-up or if queue stalled on last pkt */
+        /* Clear the bits in the tx_active mask */
-        if (((priv->tx_next & C_CAN_NEXT_MSG_OBJ_MASK) != 0) ||
+        atomic_sub(clr, &priv->tx_active);
-                        ((priv->tx_echo & C_CAN_NEXT_MSG_OBJ_MASK) == 0))
-                netif_wake_queue(dev);
-        spin_unlock_bh(&priv->xmit_lock);
+        if (clr & (1 << (C_CAN_MSG_OBJ_TX_NUM - 1)))
+                netif_wake_queue(dev);
        if (pkts) {
                stats->tx_bytes += bytes;
@@ -800,18 +729,28 @@ static u32 c_can_adjust_pending(u32 pend)
        return pend & ~((1 << lasts) - 1);
 }
+static inline void c_can_rx_object_get(struct net_device *dev,
+                                       struct c_can_priv *priv, u32 obj)
+{
+                c_can_object_get(dev, IF_RX, obj, priv->comm_rcv_high);
+}
+static inline void c_can_rx_finalize(struct net_device *dev,
+                                     struct c_can_priv *priv, u32 obj)
+{
+        if (priv->type != BOSCH_D_CAN)
+                c_can_object_get(dev, IF_RX, obj, IF_COMM_CLR_NEWDAT);
+}
 static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
                              u32 pend, int quota)
 {
-        u32 pkts = 0, ctrl, obj, mcmd;
+        u32 pkts = 0, ctrl, obj;
        while ((obj = ffs(pend)) && quota > 0) {
                pend &= ~BIT(obj - 1);
-                mcmd = obj < C_CAN_MSG_RX_LOW_LAST ?
+                c_can_rx_object_get(dev, priv, obj);
-                        IF_COMM_RCV_LOW : IF_COMM_RCV_HIGH;
-                c_can_object_get(dev, IF_RX, obj, mcmd);
                ctrl = priv->read_reg(priv, C_CAN_IFACE(MSGCTRL_REG, IF_RX));
                if (ctrl & IF_MCONT_MSGLST) {
@@ -833,9 +772,7 @@ static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
                /* read the data from the message object */
                c_can_read_msg_object(dev, IF_RX, ctrl);
-                if (obj == C_CAN_MSG_RX_LOW_LAST)
+                c_can_rx_finalize(dev, priv, obj);
-                        /* activate all lower message objects */
-                        c_can_activate_all_lower_rx_msg_obj(dev, IF_RX, ctrl);
                pkts++;
                quota--;
@@ -844,6 +781,13 @@ static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
        return pkts;
 }
+static inline u32 c_can_get_pending(struct c_can_priv *priv)
+{
+        u32 pend = priv->read_reg(priv, C_CAN_NEWDAT1_REG);
+        return pend;
+}
 /*
 * theory of operation:
 *
@@ -853,18 +797,9 @@ static int c_can_read_objects(struct net_device *dev, struct c_can_priv *priv,
 * has arrived. To work-around this issue, we keep two groups of message
 * objects whose partitioning is defined by C_CAN_MSG_OBJ_RX_SPLIT.
 *
- * To ensure in-order frame reception we use the following
+ * We clear the newdat bit right away.
- * approach while re-activating a message object to receive further
+ *
- * frames:
+ * This can result in packet reordering when the readout is slow.
- * - if the current message object number is lower than
- *   C_CAN_MSG_RX_LOW_LAST, do not clear the NEWDAT bit while clearing
- *   the INTPND bit.
- * - if the current message object number is equal to
- *   C_CAN_MSG_RX_LOW_LAST then clear the NEWDAT bit of all lower
- *   receive message objects.
- * - if the current message object number is greater than
- *   C_CAN_MSG_RX_LOW_LAST then clear the NEWDAT bit of
- *   only this message object.
 */
 static int c_can_do_rx_poll(struct net_device *dev, int quota)
 {
@@ -880,7 +815,7 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
        while (quota > 0) {
                if (!pend) {
-                        pend = priv->read_reg(priv, C_CAN_INTPND1_REG);
+                        pend = c_can_get_pending(priv);
                        if (!pend)
                                break;
                        /*
@@ -905,12 +840,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota)
        return pkts;
 }
-static inline int c_can_has_and_handle_berr(struct c_can_priv *priv)
-{
-        return (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING) &&
-                (priv->current_status & LEC_UNUSED);
-}
 static int c_can_handle_state_change(struct net_device *dev,
                                enum c_can_bus_error_types error_type)
 {
@@ -922,6 +851,26 @@ static int c_can_handle_state_change(struct net_device *dev,
        struct sk_buff *skb;
        struct can_berr_counter bec;
+        switch (error_type) {
+        case C_CAN_ERROR_WARNING:
+                /* error warning state */
+                priv->can.can_stats.error_warning++;
+                priv->can.state = CAN_STATE_ERROR_WARNING;
+                break;
+        case C_CAN_ERROR_PASSIVE:
+                /* error passive state */
+                priv->can.can_stats.error_passive++;
+                priv->can.state = CAN_STATE_ERROR_PASSIVE;
+                break;
+        case C_CAN_BUS_OFF:
+                /* bus-off state */
+                priv->can.state = CAN_STATE_BUS_OFF;
+                can_bus_off(dev);
+                break;
+        default:
+                break;
+        }
        /* propagate the error condition to the CAN stack */
        skb = alloc_can_err_skb(dev, &cf);
        if (unlikely(!skb))
@@ -935,8 +884,6 @@ static int c_can_handle_state_change(struct net_device *dev,
        switch (error_type) {
        case C_CAN_ERROR_WARNING:
                /* error warning state */
-                priv->can.can_stats.error_warning++;
-                priv->can.state = CAN_STATE_ERROR_WARNING;
                cf->can_id |= CAN_ERR_CRTL;
                cf->data[1] = (bec.txerr > bec.rxerr) ?
                        CAN_ERR_CRTL_TX_WARNING :
@@ -947,8 +894,6 @@ static int c_can_handle_state_change(struct net_device *dev,
                break;
        case C_CAN_ERROR_PASSIVE:
                /* error passive state */
-                priv->can.can_stats.error_passive++;
-                priv->can.state = CAN_STATE_ERROR_PASSIVE;
                cf->can_id |= CAN_ERR_CRTL;
                if (rx_err_passive)
                        cf->data[1] |= CAN_ERR_CRTL_RX_PASSIVE;
@@ -960,22 +905,16 @@ static int c_can_handle_state_change(struct net_device *dev,
                break;
        case C_CAN_BUS_OFF:
                /* bus-off state */
-                priv->can.state = CAN_STATE_BUS_OFF;
                cf->can_id |= CAN_ERR_BUSOFF;
-                /*
-                 * disable all interrupts in bus-off mode to ensure that
-                 * the CPU is not hogged down
-                 */
-                c_can_enable_all_interrupts(priv, DISABLE_ALL_INTERRUPTS);
                can_bus_off(dev);
                break;
        default:
                break;
        }
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        return 1;
 }
@@ -996,6 +935,13 @@ static int c_can_handle_bus_err(struct net_device *dev,
        if (lec_type == LEC_UNUSED || lec_type == LEC_NO_ERROR)
                return 0;
+        if (!(priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING))
+                return 0;
+        /* common for all type of bus errors */
+        priv->can.can_stats.bus_error++;
+        stats->rx_errors++;
        /* propagate the error condition to the CAN stack */
        skb = alloc_can_err_skb(dev, &cf);
        if (unlikely(!skb))
@@ -1005,10 +951,6 @@ static int c_can_handle_bus_err(struct net_device *dev,
         * check for 'last error code' which tells us the
         * type of the last error to occur on the CAN bus
         */
-        /* common for all type of bus errors */
-        priv->can.can_stats.bus_error++;
-        stats->rx_errors++;
        cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
        cf->data[2] |= CAN_ERR_PROT_UNSPEC;
@@ -1043,95 +985,64 @@ static int c_can_handle_bus_err(struct net_device *dev,
                break;
        }
-        /* set a `lec` value so that we can check for updates later */
-        priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
-        netif_receive_skb(skb);
        stats->rx_packets++;
        stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
        return 1;
 }
 static int c_can_poll(struct napi_struct *napi, int quota)
 {
-        u16 irqstatus;
-        int lec_type = 0;
-        int work_done = 0;
        struct net_device *dev = napi->dev;
        struct c_can_priv *priv = netdev_priv(dev);
+        u16 curr, last = priv->last_status;
+        int work_done = 0;
-        irqstatus = priv->irqstatus;
+        priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
-        if (!irqstatus)
+        /* Ack status on C_CAN. D_CAN is self clearing */
-                goto end;
+        if (priv->type != BOSCH_D_CAN)
+                priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
-        /* status events have the highest priority */
+        /* handle state changes */
-        if (irqstatus == STATUS_INTERRUPT) {
+        if ((curr & STATUS_EWARN) && (!(last & STATUS_EWARN))) {
-                priv->current_status = priv->read_reg(priv,
+                netdev_dbg(dev, "entered error warning state\n");
-                                        C_CAN_STS_REG);
+                work_done += c_can_handle_state_change(dev, C_CAN_ERROR_WARNING);
+        }
-                /* handle Tx/Rx events */
-                if (priv->current_status & STATUS_TXOK)
-                        priv->write_reg(priv, C_CAN_STS_REG,
-                                        priv->current_status & ~STATUS_TXOK);
-                if (priv->current_status & STATUS_RXOK)
-                        priv->write_reg(priv, C_CAN_STS_REG,
-                                        priv->current_status & ~STATUS_RXOK);
-                /* handle state changes */
-                if ((priv->current_status & STATUS_EWARN) &&
-                                (!(priv->last_status & STATUS_EWARN))) {
-                        netdev_dbg(dev, "entered error warning state\n");
-                        work_done += c_can_handle_state_change(dev,
-                                                C_CAN_ERROR_WARNING);
-                }
-                if ((priv->current_status & STATUS_EPASS) &&
-                                (!(priv->last_status & STATUS_EPASS))) {
-                        netdev_dbg(dev, "entered error passive state\n");
-                        work_done += c_can_handle_state_change(dev,
-                                                C_CAN_ERROR_PASSIVE);
-                }
-                if ((priv->current_status & STATUS_BOFF) &&
-                                (!(priv->last_status & STATUS_BOFF))) {
-                        netdev_dbg(dev, "entered bus off state\n");
-                        work_done += c_can_handle_state_change(dev,
-                                                C_CAN_BUS_OFF);
-                }
-                /* handle bus recovery events */
+        if ((curr & STATUS_EPASS) && (!(last & STATUS_EPASS))) {
-                if ((!(priv->current_status & STATUS_BOFF)) &&
+                netdev_dbg(dev, "entered error passive state\n");
-                                (priv->last_status & STATUS_BOFF)) {
+                work_done += c_can_handle_state_change(dev, C_CAN_ERROR_PASSIVE);
-                        netdev_dbg(dev, "left bus off state\n");
+        }
-                        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-                }
-                if ((!(priv->current_status & STATUS_EPASS)) &&
-                                (priv->last_status & STATUS_EPASS)) {
-                        netdev_dbg(dev, "left error passive state\n");
-                        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-                }
-                priv->last_status = priv->current_status;
+        if ((curr & STATUS_BOFF) && (!(last & STATUS_BOFF))) {
+                netdev_dbg(dev, "entered bus off state\n");
-                /* handle lec errors on the bus */
+                work_done += c_can_handle_state_change(dev, C_CAN_BUS_OFF);
-                lec_type = c_can_has_and_handle_berr(priv);
+                goto end;
-                if (lec_type)
-                        work_done += c_can_handle_bus_err(dev, lec_type);
-        } else if ((irqstatus >= C_CAN_MSG_OBJ_RX_FIRST) &&
-                        (irqstatus <= C_CAN_MSG_OBJ_RX_LAST)) {
-                /* handle events corresponding to receive message objects */
-                work_done += c_can_do_rx_poll(dev, (quota - work_done));
-        } else if ((irqstatus >= C_CAN_MSG_OBJ_TX_FIRST) &&
-                        (irqstatus <= C_CAN_MSG_OBJ_TX_LAST)) {
-                /* handle events corresponding to transmit message objects */
-                c_can_do_tx(dev);
        }
+        /* handle bus recovery events */
+        if ((!(curr & STATUS_BOFF)) && (last & STATUS_BOFF)) {
+                netdev_dbg(dev, "left bus off state\n");
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+        }
+        if ((!(curr & STATUS_EPASS)) && (last & STATUS_EPASS)) {
+                netdev_dbg(dev, "left error passive state\n");
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+        }
+        /* handle lec errors on the bus */
+        work_done += c_can_handle_bus_err(dev, curr & LEC_MASK);
+        /* Handle Tx/Rx events. We do this unconditionally */
+        work_done += c_can_do_rx_poll(dev, (quota - work_done));
+        c_can_do_tx(dev);
 end:
        if (work_done < quota) {
                napi_complete(napi);
-                /* enable all IRQs */
+                /* enable all IRQs if we are not in bus off state */
-                c_can_enable_all_interrupts(priv, ENABLE_ALL_INTERRUPTS);
+                if (priv->can.state != CAN_STATE_BUS_OFF)
+                        c_can_irq_control(priv, true);
        }
        return work_done;
@@ -1142,12 +1053,11 @@ static irqreturn_t c_can_isr(int irq, void *dev_id)
        struct net_device *dev = (struct net_device *)dev_id;
        struct c_can_priv *priv = netdev_priv(dev);
-        priv->irqstatus = priv->read_reg(priv, C_CAN_INT_REG);
+        if (!priv->read_reg(priv, C_CAN_INT_REG))
-        if (!priv->irqstatus)
                return IRQ_NONE;
        /* disable all interrupts and schedule the NAPI */
-        c_can_enable_all_interrupts(priv, DISABLE_ALL_INTERRUPTS);
+        c_can_irq_control(priv, false);
        napi_schedule(&priv->napi);
        return IRQ_HANDLED;
@@ -1184,6 +1094,8 @@ static int c_can_open(struct net_device *dev)
        can_led_event(dev, CAN_LED_EVENT_OPEN);
        napi_enable(&priv->napi);
+        /* enable status change, error and module interrupts */
+        c_can_irq_control(priv, true);
        netif_start_queue(dev);
        return 0;
@@ -1226,7 +1138,6 @@ struct net_device *alloc_c_can_dev(void)
                return NULL;
        priv = netdev_priv(dev);
-        spin_lock_init(&priv->xmit_lock);
        netif_napi_add(dev, &priv->napi, c_can_poll, C_CAN_NAPI_WEIGHT);
        priv->dev = dev;
@@ -1281,6 +1192,7 @@ int c_can_power_up(struct net_device *dev)
        u32 val;
        unsigned long time_out;
        struct c_can_priv *priv = netdev_priv(dev);
+        int ret;
        if (!(dev->flags & IFF_UP))
                return 0;
@@ -1307,7 +1219,11 @@ int c_can_power_up(struct net_device *dev)
        if (time_after(jiffies, time_out))
                return -ETIMEDOUT;
-        return c_can_start(dev);
+        ret = c_can_start(dev);
+        if (!ret)
+                c_can_irq_control(priv, true);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(c_can_power_up);
 #endif
diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h
index faa8404162b3..c56f1b1c11ca 100644
--- a/drivers/net/can/c_can/c_can.h
+++ b/drivers/net/can/c_can/c_can.h
@@ -22,14 +22,6 @@
 #ifndef C_CAN_H
 #define C_CAN_H
-/*
- * IFx register masks:
- * allow easy operation on 16-bit registers when the
- * argument is 32-bit instead
- */
-#define IFX_WRITE_LOW_16BIT(x)  ((x) & 0xFFFF)
-#define IFX_WRITE_HIGH_16BIT(x) (((x) & 0xFFFF0000) >> 16)
 /* message object split */
 #define C_CAN_NO_OF_OBJECTS     32
 #define C_CAN_MSG_OBJ_RX_NUM    16
@@ -45,8 +37,6 @@
 #define C_CAN_MSG_OBJ_RX_SPLIT  9
 #define C_CAN_MSG_RX_LOW_LAST   (C_CAN_MSG_OBJ_RX_SPLIT - 1)
-#define C_CAN_NEXT_MSG_OBJ_MASK (C_CAN_MSG_OBJ_TX_NUM - 1)
 #define RECEIVE_OBJECT_BITS     0x0000ffff
 enum reg {
@@ -183,23 +173,20 @@ struct c_can_priv {
        struct napi_struct napi;
        struct net_device *dev;
        struct device *device;
-        spinlock_t xmit_lock;
+        atomic_t tx_active;
-        int tx_object;
+        unsigned long tx_dir;
-        int current_status;
        int last_status;
        u16 (*read_reg) (struct c_can_priv *priv, enum reg index);
        void (*write_reg) (struct c_can_priv *priv, enum reg index, u16 val);
        void __iomem *base;
        const u16 *regs;
-        unsigned long irq_flags; /* for request_irq() */
-        unsigned int tx_next;
-        unsigned int tx_echo;
        void *priv;             /* for board-specific data */
-        u16 irqstatus;
        enum c_can_dev_id type;
        u32 __iomem *raminit_ctrlreg;
-        unsigned int instance;
+        int instance;
        void (*raminit) (const struct c_can_priv *priv, bool enable);
+        u32 comm_rcv_high;
+        u32 rxmasked;
        u32 dlc[C_CAN_MSG_OBJ_TX_NUM];
 };
diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
index bce0be54c2f5..fe5f6303b584 100644
--- a/drivers/net/can/c_can/c_can_pci.c
+++ b/drivers/net/can/c_can/c_can_pci.c
@@ -84,8 +84,11 @@ static int c_can_pci_probe(struct pci_dev *pdev,
                goto out_disable_device;
        }
-        pci_set_master(pdev);
+        ret = pci_enable_msi(pdev);
-        pci_enable_msi(pdev);
+        if (!ret) {
+                dev_info(&pdev->dev, "MSI enabled\n");
+                pci_set_master(pdev);
+        }
        addr = pci_iomap(pdev, 0, pci_resource_len(pdev, 0));
        if (!addr) {
@@ -132,6 +135,8 @@ static int c_can_pci_probe(struct pci_dev *pdev,
                goto out_free_c_can;
        }
+        priv->type = c_can_pci_data->type;
        /* Configure access to registers */
        switch (c_can_pci_data->reg_align) {
        case C_CAN_REG_ALIGN_32:
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 806d92753427..1df0b322d1e4 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -222,7 +222,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
                res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                priv->raminit_ctrlreg = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(priv->raminit_ctrlreg) || (int)priv->instance < 0)
+                if (IS_ERR(priv->raminit_ctrlreg) || priv->instance < 0)
                        dev_info(&pdev->dev, "control memory is not used for raminit\n");
                else
                        priv->raminit = c_can_hw_raminit;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index c7a260478749..e318e87e2bfc 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -256,7 +256,7 @@ static int can_get_bittiming(struct net_device *dev, struct can_bittiming *bt,
        /* Check if the CAN device has bit-timing parameters */
        if (!btc)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
        /*
         * Depending on the given can_bittiming parameter structure the CAN
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index c540e3d12e3d..564933ae218c 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -551,7 +551,7 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        struct sja1000_priv *priv;
        struct peak_pci_chan *chan;
-        struct net_device *dev;
+        struct net_device *dev, *prev_dev;
        void __iomem *cfg_base, *reg_base;
        u16 sub_sys_id, icr;
        int i, err, channels;
@@ -688,11 +688,13 @@ failure_remove_channels:
        writew(0x0, cfg_base + PITA_ICR + 2);
        chan = NULL;
-        for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) {
+        for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) {
-                unregister_sja1000dev(dev);
-                free_sja1000dev(dev);
                priv = netdev_priv(dev);
                chan = priv->priv;
+                prev_dev = chan->prev_dev;
+                unregister_sja1000dev(dev);
+                free_sja1000dev(dev);
        }
        /* free any PCIeC resources too */
@@ -726,10 +728,12 @@ static void peak_pci_remove(struct pci_dev *pdev)
        /* Loop over all registered devices */
        while (1) {
+                struct net_device *prev_dev = chan->prev_dev;
                dev_info(&pdev->dev, "removing device %s\n", dev->name);
                unregister_sja1000dev(dev);
                free_sja1000dev(dev);
-                dev = chan->prev_dev;
+                dev = prev_dev;
                if (!dev) {
                        /* do that only for first channel */
diff --git a/drivers/net/can/sja1000/sja1000_isa.c b/drivers/net/can/sja1000/sja1000_isa.c
index df136a2516c4..014695d7e6a3 100644
--- a/drivers/net/can/sja1000/sja1000_isa.c
+++ b/drivers/net/can/sja1000/sja1000_isa.c
@@ -46,6 +46,7 @@ static int clk[MAXDEV];
 static unsigned char cdr[MAXDEV] = {[0 ... (MAXDEV - 1)] = 0xff};
 static unsigned char ocr[MAXDEV] = {[0 ... (MAXDEV - 1)] = 0xff};
 static int indirect[MAXDEV] = {[0 ... (MAXDEV - 1)] = -1};
+static spinlock_t indirect_lock[MAXDEV];  /* lock for indirect access mode */
 module_param_array(port, ulong, NULL, S_IRUGO);
 MODULE_PARM_DESC(port, "I/O port number");
@@ -101,19 +102,26 @@ static void sja1000_isa_port_write_reg(const struct sja1000_priv *priv,
 static u8 sja1000_isa_port_read_reg_indirect(const struct sja1000_priv *priv,
                                             int reg)
 {
-        unsigned long base = (unsigned long)priv->reg_base;
+        unsigned long flags, base = (unsigned long)priv->reg_base;
+        u8 readval;
+        spin_lock_irqsave(&indirect_lock[priv->dev->dev_id], flags);
        outb(reg, base);
-        return inb(base + 1);
+        readval = inb(base + 1);
+        spin_unlock_irqrestore(&indirect_lock[priv->dev->dev_id], flags);
+        return readval;
 }
 static void sja1000_isa_port_write_reg_indirect(const struct sja1000_priv *priv,
                                                int reg, u8 val)
 {
-        unsigned long base = (unsigned long)priv->reg_base;
+        unsigned long flags, base = (unsigned long)priv->reg_base;
+        spin_lock_irqsave(&indirect_lock[priv->dev->dev_id], flags);
        outb(reg, base);
        outb(val, base + 1);
+        spin_unlock_irqrestore(&indirect_lock[priv->dev->dev_id], flags);
 }
 static int sja1000_isa_probe(struct platform_device *pdev)
@@ -169,6 +177,7 @@ static int sja1000_isa_probe(struct platform_device *pdev)
                if (iosize == SJA1000_IOSIZE_INDIRECT) {
                        priv->read_reg = sja1000_isa_port_read_reg_indirect;
                        priv->write_reg = sja1000_isa_port_write_reg_indirect;
+                        spin_lock_init(&indirect_lock[idx]);
                } else {
                        priv->read_reg = sja1000_isa_port_read_reg;
                        priv->write_reg = sja1000_isa_port_write_reg;
@@ -198,6 +207,7 @@ static int sja1000_isa_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, dev);
        SET_NETDEV_DEV(dev, &pdev->dev);
+        dev->dev_id = idx;
        err = register_sja1000dev(dev);
        if (err) {
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index f5b16e0e3a12..dcf9196f6316 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -322,13 +322,13 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
                return;
-        spin_lock(&sl->lock);
+        spin_lock_bh(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-                spin_unlock(&sl->lock);
+                spin_unlock_bh(&sl->lock);
                netif_wake_queue(sl->dev);
                return;
        }
@@ -336,7 +336,7 @@ static void slcan_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
-        spin_unlock(&sl->lock);
+        spin_unlock_bh(&sl->lock);
 }
 /* Send a can_frame to a TTY queue. */
diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index 39b26fe28d10..d7401017a3f1 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -35,6 +35,18 @@ source "drivers/net/ethernet/calxeda/Kconfig"
 source "drivers/net/ethernet/chelsio/Kconfig"
 source "drivers/net/ethernet/cirrus/Kconfig"
 source "drivers/net/ethernet/cisco/Kconfig"
+config CX_ECAT
+        tristate "Beckhoff CX5020 EtherCAT master support"
+        depends on PCI
+        ---help---
+          Driver for EtherCAT master module located on CCAT FPGA
+          that can be found on Beckhoff CX5020, and possibly other of CX
+          Beckhoff CX series industrial PCs.
+          To compile this driver as a module, choose M here. The module
+          will be called ec_bhf.
 source "drivers/net/ethernet/davicom/Kconfig"
 config DNET
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index 545d0b3b9cb4..35190e36c456 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -21,6 +21,7 @@ obj-$(CONFIG_NET_CALXEDA_XGMAC) += calxeda/
 obj-$(CONFIG_NET_VENDOR_CHELSIO) += chelsio/
 obj-$(CONFIG_NET_VENDOR_CIRRUS) += cirrus/
 obj-$(CONFIG_NET_VENDOR_CISCO) += cisco/
+obj-$(CONFIG_CX_ECAT) += ec_bhf.o
 obj-$(CONFIG_DM9000) += davicom/
 obj-$(CONFIG_DNET) += dnet.o
 obj-$(CONFIG_NET_VENDOR_DEC) += dec/
diff --git a/drivers/net/ethernet/altera/Kconfig b/drivers/net/ethernet/altera/Kconfig
index 80c1ab74a4b8..fdddba51473e 100644
--- a/drivers/net/ethernet/altera/Kconfig
+++ b/drivers/net/ethernet/altera/Kconfig
@@ -1,5 +1,6 @@
 config ALTERA_TSE
        tristate "Altera Triple-Speed Ethernet MAC support"
+        depends on HAS_DMA
        select PHYLIB
        ---help---
          This driver supports the Altera Triple-Speed (TSE) Ethernet MAC.
diff --git a/drivers/net/ethernet/altera/Makefile b/drivers/net/ethernet/altera/Makefile
index d4a187e45369..3eff2fd3997e 100644
--- a/drivers/net/ethernet/altera/Makefile
+++ b/drivers/net/ethernet/altera/Makefile
@@ -5,3 +5,4 @@
 obj-$(CONFIG_ALTERA_TSE) += altera_tse.o
 altera_tse-objs := altera_tse_main.o altera_tse_ethtool.o \
 altera_msgdma.o altera_sgdma.o altera_utils.o
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c
index 3df18669ea30..0fb986ba3290 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.c
+++ b/drivers/net/ethernet/altera/altera_msgdma.c
@@ -18,6 +18,7 @@
 #include "altera_utils.h"
 #include "altera_tse.h"
 #include "altera_msgdmahw.h"
+#include "altera_msgdma.h"
 /* No initialization work to do for MSGDMA */
 int msgdma_initialize(struct altera_tse_private *priv)
@@ -29,21 +30,23 @@ void msgdma_uninitialize(struct altera_tse_private *priv)
 {
 }
+void msgdma_start_rxdma(struct altera_tse_private *priv)
+{
+}
 void msgdma_reset(struct altera_tse_private *priv)
 {
        int counter;
-        struct msgdma_csr *txcsr =
-                (struct msgdma_csr *)priv->tx_dma_csr;
-        struct msgdma_csr *rxcsr =
-                (struct msgdma_csr *)priv->rx_dma_csr;
        /* Reset Rx mSGDMA */
-        iowrite32(MSGDMA_CSR_STAT_MASK, &rxcsr->status);
+        csrwr32(MSGDMA_CSR_STAT_MASK, priv->rx_dma_csr,
-        iowrite32(MSGDMA_CSR_CTL_RESET, &rxcsr->control);
+                msgdma_csroffs(status));
+        csrwr32(MSGDMA_CSR_CTL_RESET, priv->rx_dma_csr,
+                msgdma_csroffs(control));
        counter = 0;
        while (counter++ < ALTERA_TSE_SW_RESET_WATCHDOG_CNTR) {
-                if (tse_bit_is_clear(&rxcsr->status,
+                if (tse_bit_is_clear(priv->rx_dma_csr, msgdma_csroffs(status),
                                     MSGDMA_CSR_STAT_RESETTING))
                        break;
                udelay(1);
@@ -54,15 +57,18 @@ void msgdma_reset(struct altera_tse_private *priv)
                           "TSE Rx mSGDMA resetting bit never cleared!\n");
        /* clear all status bits */
-        iowrite32(MSGDMA_CSR_STAT_MASK, &rxcsr->status);
+        csrwr32(MSGDMA_CSR_STAT_MASK, priv->rx_dma_csr, msgdma_csroffs(status));
        /* Reset Tx mSGDMA */
-        iowrite32(MSGDMA_CSR_STAT_MASK, &txcsr->status);
+        csrwr32(MSGDMA_CSR_STAT_MASK, priv->tx_dma_csr,
-        iowrite32(MSGDMA_CSR_CTL_RESET, &txcsr->control);
+                msgdma_csroffs(status));
+        csrwr32(MSGDMA_CSR_CTL_RESET, priv->tx_dma_csr,
+                msgdma_csroffs(control));
        counter = 0;
        while (counter++ < ALTERA_TSE_SW_RESET_WATCHDOG_CNTR) {
-                if (tse_bit_is_clear(&txcsr->status,
+                if (tse_bit_is_clear(priv->tx_dma_csr, msgdma_csroffs(status),
                                     MSGDMA_CSR_STAT_RESETTING))
                        break;
                udelay(1);
@@ -73,58 +79,58 @@ void msgdma_reset(struct altera_tse_private *priv)
                           "TSE Tx mSGDMA resetting bit never cleared!\n");
        /* clear all status bits */
-        iowrite32(MSGDMA_CSR_STAT_MASK, &txcsr->status);
+        csrwr32(MSGDMA_CSR_STAT_MASK, priv->tx_dma_csr, msgdma_csroffs(status));
 }
 void msgdma_disable_rxirq(struct altera_tse_private *priv)
 {
-        struct msgdma_csr *csr = priv->rx_dma_csr;
+        tse_clear_bit(priv->rx_dma_csr, msgdma_csroffs(control),
-        tse_clear_bit(&csr->control, MSGDMA_CSR_CTL_GLOBAL_INTR);
+                      MSGDMA_CSR_CTL_GLOBAL_INTR);
 }
 void msgdma_enable_rxirq(struct altera_tse_private *priv)
 {
-        struct msgdma_csr *csr = priv->rx_dma_csr;
+        tse_set_bit(priv->rx_dma_csr, msgdma_csroffs(control),
-        tse_set_bit(&csr->control, MSGDMA_CSR_CTL_GLOBAL_INTR);
+                    MSGDMA_CSR_CTL_GLOBAL_INTR);
 }
 void msgdma_disable_txirq(struct altera_tse_private *priv)
 {
-        struct msgdma_csr *csr = priv->tx_dma_csr;
+        tse_clear_bit(priv->tx_dma_csr, msgdma_csroffs(control),
-        tse_clear_bit(&csr->control, MSGDMA_CSR_CTL_GLOBAL_INTR);
+                      MSGDMA_CSR_CTL_GLOBAL_INTR);
 }
 void msgdma_enable_txirq(struct altera_tse_private *priv)
 {
-        struct msgdma_csr *csr = priv->tx_dma_csr;
+        tse_set_bit(priv->tx_dma_csr, msgdma_csroffs(control),
-        tse_set_bit(&csr->control, MSGDMA_CSR_CTL_GLOBAL_INTR);
+                    MSGDMA_CSR_CTL_GLOBAL_INTR);
 }
 void msgdma_clear_rxirq(struct altera_tse_private *priv)
 {
-        struct msgdma_csr *csr = priv->rx_dma_csr;
+        csrwr32(MSGDMA_CSR_STAT_IRQ, priv->rx_dma_csr, msgdma_csroffs(status));
-        iowrite32(MSGDMA_CSR_STAT_IRQ, &csr->status);
 }
 void msgdma_clear_txirq(struct altera_tse_private *priv)
 {
-        struct msgdma_csr *csr = priv->tx_dma_csr;
+        csrwr32(MSGDMA_CSR_STAT_IRQ, priv->tx_dma_csr, msgdma_csroffs(status));
-        iowrite32(MSGDMA_CSR_STAT_IRQ, &csr->status);
 }
 /* return 0 to indicate transmit is pending */
 int msgdma_tx_buffer(struct altera_tse_private *priv, struct tse_buffer *buffer)
 {
-        struct msgdma_extended_desc *desc = priv->tx_dma_desc;
+        csrwr32(lower_32_bits(buffer->dma_addr), priv->tx_dma_desc,
+                msgdma_descroffs(read_addr_lo));
-        iowrite32(lower_32_bits(buffer->dma_addr), &desc->read_addr_lo);
+        csrwr32(upper_32_bits(buffer->dma_addr), priv->tx_dma_desc,
-        iowrite32(upper_32_bits(buffer->dma_addr), &desc->read_addr_hi);
+                msgdma_descroffs(read_addr_hi));
-        iowrite32(0, &desc->write_addr_lo);
+        csrwr32(0, priv->tx_dma_desc, msgdma_descroffs(write_addr_lo));
-        iowrite32(0, &desc->write_addr_hi);
+        csrwr32(0, priv->tx_dma_desc, msgdma_descroffs(write_addr_hi));
-        iowrite32(buffer->len, &desc->len);
+        csrwr32(buffer->len, priv->tx_dma_desc, msgdma_descroffs(len));
-        iowrite32(0, &desc->burst_seq_num);
+        csrwr32(0, priv->tx_dma_desc, msgdma_descroffs(burst_seq_num));
-        iowrite32(MSGDMA_DESC_TX_STRIDE, &desc->stride);
+        csrwr32(MSGDMA_DESC_TX_STRIDE, priv->tx_dma_desc,
-        iowrite32(MSGDMA_DESC_CTL_TX_SINGLE, &desc->control);
+                msgdma_descroffs(stride));
+        csrwr32(MSGDMA_DESC_CTL_TX_SINGLE, priv->tx_dma_desc,
+                msgdma_descroffs(control));
        return 0;
 }
@@ -133,17 +139,16 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
        u32 ready = 0;
        u32 inuse;
        u32 status;
-        struct msgdma_csr *txcsr =
-                (struct msgdma_csr *)priv->tx_dma_csr;
        /* Get number of sent descriptors */
-        inuse = ioread32(&txcsr->rw_fill_level) & 0xffff;
+        inuse = csrrd32(priv->tx_dma_csr, msgdma_csroffs(rw_fill_level))
+                        & 0xffff;
        if (inuse) { /* Tx FIFO is not empty */
                ready = priv->tx_prod - priv->tx_cons - inuse - 1;
        } else {
                /* Check for buffered last packet */
-                status = ioread32(&txcsr->status);
+                status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status));
                if (status & MSGDMA_CSR_STAT_BUSY)
                        ready = priv->tx_prod - priv->tx_cons - 1;
                else
@@ -154,10 +159,9 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
 /* Put buffer to the mSGDMA RX FIFO
 */
-int msgdma_add_rx_desc(struct altera_tse_private *priv,
+void msgdma_add_rx_desc(struct altera_tse_private *priv,
                        struct tse_buffer *rxbuffer)
 {
-        struct msgdma_extended_desc *desc = priv->rx_dma_desc;
        u32 len = priv->rx_dma_buf_sz;
        dma_addr_t dma_addr = rxbuffer->dma_addr;
        u32 control = (MSGDMA_DESC_CTL_END_ON_EOP
@@ -167,15 +171,16 @@ int msgdma_add_rx_desc(struct altera_tse_private *priv,
                        | MSGDMA_DESC_CTL_TR_ERR_IRQ
                        | MSGDMA_DESC_CTL_GO);
-        iowrite32(0, &desc->read_addr_lo);
+        csrwr32(0, priv->rx_dma_desc, msgdma_descroffs(read_addr_lo));
-        iowrite32(0, &desc->read_addr_hi);
+        csrwr32(0, priv->rx_dma_desc, msgdma_descroffs(read_addr_hi));
-        iowrite32(lower_32_bits(dma_addr), &desc->write_addr_lo);
+        csrwr32(lower_32_bits(dma_addr), priv->rx_dma_desc,
-        iowrite32(upper_32_bits(dma_addr), &desc->write_addr_hi);
+                msgdma_descroffs(write_addr_lo));
-        iowrite32(len, &desc->len);
+        csrwr32(upper_32_bits(dma_addr), priv->rx_dma_desc,
-        iowrite32(0, &desc->burst_seq_num);
+                msgdma_descroffs(write_addr_hi));
-        iowrite32(0x00010001, &desc->stride);
+        csrwr32(len, priv->rx_dma_desc, msgdma_descroffs(len));
-        iowrite32(control, &desc->control);
+        csrwr32(0, priv->rx_dma_desc, msgdma_descroffs(burst_seq_num));
-        return 1;
+        csrwr32(0x00010001, priv->rx_dma_desc, msgdma_descroffs(stride));
+        csrwr32(control, priv->rx_dma_desc, msgdma_descroffs(control));
 }
 /* status is returned on upper 16 bits,
@@ -186,14 +191,13 @@ u32 msgdma_rx_status(struct altera_tse_private *priv)
        u32 rxstatus = 0;
        u32 pktlength;
        u32 pktstatus;
-        struct msgdma_csr *rxcsr =
-                (struct msgdma_csr *)priv->rx_dma_csr;
+        if (csrrd32(priv->rx_dma_csr, msgdma_csroffs(resp_fill_level))
-        struct msgdma_response *rxresp =
+            & 0xffff) {
-                (struct msgdma_response *)priv->rx_dma_resp;
+                pktlength = csrrd32(priv->rx_dma_resp,
+                                    msgdma_respoffs(bytes_transferred));
-        if (ioread32(&rxcsr->resp_fill_level) & 0xffff) {
+                pktstatus = csrrd32(priv->rx_dma_resp,
-                pktlength = ioread32(&rxresp->bytes_transferred);
+                                    msgdma_respoffs(status));
-                pktstatus = ioread32(&rxresp->status);
                rxstatus = pktstatus;
                rxstatus = rxstatus << 16;
                rxstatus |= (pktlength & 0xffff);
diff --git a/drivers/net/ethernet/altera/altera_msgdma.h b/drivers/net/ethernet/altera/altera_msgdma.h
index 7f0f5bf2bba2..42cf61c81057 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.h
+++ b/drivers/net/ethernet/altera/altera_msgdma.h
@@ -25,10 +25,11 @@ void msgdma_disable_txirq(struct altera_tse_private *);
 void msgdma_clear_rxirq(struct altera_tse_private *);
 void msgdma_clear_txirq(struct altera_tse_private *);
 u32 msgdma_tx_completions(struct altera_tse_private *);
-int msgdma_add_rx_desc(struct altera_tse_private *, struct tse_buffer *);
+void msgdma_add_rx_desc(struct altera_tse_private *, struct tse_buffer *);
 int msgdma_tx_buffer(struct altera_tse_private *, struct tse_buffer *);
 u32 msgdma_rx_status(struct altera_tse_private *);
 int msgdma_initialize(struct altera_tse_private *);
 void msgdma_uninitialize(struct altera_tse_private *);
+void msgdma_start_rxdma(struct altera_tse_private *);
 #endif /*  __ALTERA_MSGDMA_H__ */
diff --git a/drivers/net/ethernet/altera/altera_msgdmahw.h b/drivers/net/ethernet/altera/altera_msgdmahw.h
index d7b59ba4019c..e335626e1b6b 100644
--- a/drivers/net/ethernet/altera/altera_msgdmahw.h
+++ b/drivers/net/ethernet/altera/altera_msgdmahw.h
@@ -17,15 +17,6 @@
 #ifndef __ALTERA_MSGDMAHW_H__
 #define __ALTERA_MSGDMAHW_H__
-/* mSGDMA standard descriptor format
- */
-struct msgdma_desc {
-        u32 read_addr;  /* data buffer source address */
-        u32 write_addr; /* data buffer destination address */
-        u32 len;        /* the number of bytes to transfer per descriptor */
-        u32 control;    /* characteristics of the transfer */
-};
 /* mSGDMA extended descriptor format
 */
 struct msgdma_extended_desc {
@@ -159,6 +150,10 @@ struct msgdma_response {
        u32 status;
 };
+#define msgdma_respoffs(a) (offsetof(struct msgdma_response, a))
+#define msgdma_csroffs(a) (offsetof(struct msgdma_csr, a))
+#define msgdma_descroffs(a) (offsetof(struct msgdma_extended_desc, a))
 /* mSGDMA response register bit definitions
 */
 #define MSGDMA_RESP_EARLY_TERM  BIT(8)
diff --git a/drivers/net/ethernet/altera/altera_sgdma.c b/drivers/net/ethernet/altera/altera_sgdma.c
index 0ee96639ae44..99cc56f451cf 100644
--- a/drivers/net/ethernet/altera/altera_sgdma.c
+++ b/drivers/net/ethernet/altera/altera_sgdma.c
@@ -20,28 +20,28 @@
 #include "altera_sgdmahw.h"
 #include "altera_sgdma.h"
-static void sgdma_descrip(struct sgdma_descrip *desc,
+static void sgdma_setup_descrip(struct sgdma_descrip __iomem *desc,
-                          struct sgdma_descrip *ndesc,
+                                struct sgdma_descrip __iomem *ndesc,
-                          dma_addr_t ndesc_phys,
+                                dma_addr_t ndesc_phys,
-                          dma_addr_t raddr,
+                                dma_addr_t raddr,
-                          dma_addr_t waddr,
+                                dma_addr_t waddr,
-                          u16 length,
+                                u16 length,
-                          int generate_eop,
+                                int generate_eop,
-                          int rfixed,
+                                int rfixed,
-                          int wfixed);
+                                int wfixed);
 static int sgdma_async_write(struct altera_tse_private *priv,
-                              struct sgdma_descrip *desc);
+                              struct sgdma_descrip __iomem *desc);
 static int sgdma_async_read(struct altera_tse_private *priv);
 static dma_addr_t
 sgdma_txphysaddr(struct altera_tse_private *priv,
-                 struct sgdma_descrip *desc);
+                 struct sgdma_descrip __iomem *desc);
 static dma_addr_t
 sgdma_rxphysaddr(struct altera_tse_private *priv,
-                 struct sgdma_descrip *desc);
+                 struct sgdma_descrip __iomem *desc);
 static int sgdma_txbusy(struct altera_tse_private *priv);
@@ -64,18 +64,23 @@ queue_rx_peekhead(struct altera_tse_private *priv);
 int sgdma_initialize(struct altera_tse_private *priv)
 {
-        priv->txctrlreg = SGDMA_CTRLREG_ILASTD;
+        priv->txctrlreg = SGDMA_CTRLREG_ILASTD |
+                      SGDMA_CTRLREG_INTEN;
        priv->rxctrlreg = SGDMA_CTRLREG_IDESCRIP |
+                      SGDMA_CTRLREG_INTEN |
                      SGDMA_CTRLREG_ILASTD;
+        priv->sgdmadesclen = sizeof(struct sgdma_descrip);
        INIT_LIST_HEAD(&priv->txlisthd);
        INIT_LIST_HEAD(&priv->rxlisthd);
        priv->rxdescphys = (dma_addr_t) 0;
        priv->txdescphys = (dma_addr_t) 0;
-        priv->rxdescphys = dma_map_single(priv->device, priv->rx_dma_desc,
+        priv->rxdescphys = dma_map_single(priv->device,
+                                          (void __force *)priv->rx_dma_desc,
                                          priv->rxdescmem, DMA_BIDIRECTIONAL);
        if (dma_mapping_error(priv->device, priv->rxdescphys)) {
@@ -84,7 +89,8 @@ int sgdma_initialize(struct altera_tse_private *priv)
                return -EINVAL;
        }
-        priv->txdescphys = dma_map_single(priv->device, priv->tx_dma_desc,
+        priv->txdescphys = dma_map_single(priv->device,
+                                          (void __force *)priv->tx_dma_desc,
                                          priv->txdescmem, DMA_TO_DEVICE);
        if (dma_mapping_error(priv->device, priv->txdescphys)) {
@@ -93,6 +99,16 @@ int sgdma_initialize(struct altera_tse_private *priv)
                return -EINVAL;
        }
+        /* Initialize descriptor memory to all 0's, sync memory to cache */
+        memset_io(priv->tx_dma_desc, 0, priv->txdescmem);
+        memset_io(priv->rx_dma_desc, 0, priv->rxdescmem);
+        dma_sync_single_for_device(priv->device, priv->txdescphys,
+                                   priv->txdescmem, DMA_TO_DEVICE);
+        dma_sync_single_for_device(priv->device, priv->rxdescphys,
+                                   priv->rxdescmem, DMA_TO_DEVICE);
        return 0;
 }
@@ -112,58 +128,48 @@ void sgdma_uninitialize(struct altera_tse_private *priv)
 */
 void sgdma_reset(struct altera_tse_private *priv)
 {
-        u32 *ptxdescripmem = (u32 *)priv->tx_dma_desc;
-        u32 txdescriplen   = priv->txdescmem;
-        u32 *prxdescripmem = (u32 *)priv->rx_dma_desc;
-        u32 rxdescriplen   = priv->rxdescmem;
-        struct sgdma_csr *ptxsgdma = (struct sgdma_csr *)priv->tx_dma_csr;
-        struct sgdma_csr *prxsgdma = (struct sgdma_csr *)priv->rx_dma_csr;
        /* Initialize descriptor memory to 0 */
-        memset(ptxdescripmem, 0, txdescriplen);
+        memset_io(priv->tx_dma_desc, 0, priv->txdescmem);
-        memset(prxdescripmem, 0, rxdescriplen);
+        memset_io(priv->rx_dma_desc, 0, priv->rxdescmem);
-        iowrite32(SGDMA_CTRLREG_RESET, &ptxsgdma->control);
+        csrwr32(SGDMA_CTRLREG_RESET, priv->tx_dma_csr, sgdma_csroffs(control));
-        iowrite32(0, &ptxsgdma->control);
+        csrwr32(0, priv->tx_dma_csr, sgdma_csroffs(control));
-        iowrite32(SGDMA_CTRLREG_RESET, &prxsgdma->control);
+        csrwr32(SGDMA_CTRLREG_RESET, priv->rx_dma_csr, sgdma_csroffs(control));
-        iowrite32(0, &prxsgdma->control);
+        csrwr32(0, priv->rx_dma_csr, sgdma_csroffs(control));
 }
+/* For SGDMA, interrupts remain enabled after initially enabling,
+ * so no need to provide implementations for abstract enable
+ * and disable
+ */
 void sgdma_enable_rxirq(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->rx_dma_csr;
-        priv->rxctrlreg |= SGDMA_CTRLREG_INTEN;
-        tse_set_bit(&csr->control, SGDMA_CTRLREG_INTEN);
 }
 void sgdma_enable_txirq(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->tx_dma_csr;
-        priv->txctrlreg |= SGDMA_CTRLREG_INTEN;
-        tse_set_bit(&csr->control, SGDMA_CTRLREG_INTEN);
 }
-/* for SGDMA, RX interrupts remain enabled after enabling */
 void sgdma_disable_rxirq(struct altera_tse_private *priv)
 {
 }
-/* for SGDMA, TX interrupts remain enabled after enabling */
 void sgdma_disable_txirq(struct altera_tse_private *priv)
 {
 }
 void sgdma_clear_rxirq(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->rx_dma_csr;
+        tse_set_bit(priv->rx_dma_csr, sgdma_csroffs(control),
-        tse_set_bit(&csr->control, SGDMA_CTRLREG_CLRINT);
+                    SGDMA_CTRLREG_CLRINT);
 }
 void sgdma_clear_txirq(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->tx_dma_csr;
+        tse_set_bit(priv->tx_dma_csr, sgdma_csroffs(control),
-        tse_set_bit(&csr->control, SGDMA_CTRLREG_CLRINT);
+                    SGDMA_CTRLREG_CLRINT);
 }
 /* transmits buffer through SGDMA. Returns number of buffers
@@ -173,28 +179,27 @@ void sgdma_clear_txirq(struct altera_tse_private *priv)
 */
 int sgdma_tx_buffer(struct altera_tse_private *priv, struct tse_buffer *buffer)
 {
-        int pktstx = 0;
+        struct sgdma_descrip __iomem *descbase =
-        struct sgdma_descrip *descbase =
+                (struct sgdma_descrip __iomem *)priv->tx_dma_desc;
-                (struct sgdma_descrip *)priv->tx_dma_desc;
-        struct sgdma_descrip *cdesc = &descbase[0];
+        struct sgdma_descrip __iomem *cdesc = &descbase[0];
-        struct sgdma_descrip *ndesc = &descbase[1];
+        struct sgdma_descrip __iomem *ndesc = &descbase[1];
        /* wait 'til the tx sgdma is ready for the next transmit request */
        if (sgdma_txbusy(priv))
                return 0;
-        sgdma_descrip(cdesc,                    /* current descriptor */
+        sgdma_setup_descrip(cdesc,                      /* current descriptor */
-                      ndesc,                    /* next descriptor */
+                            ndesc,                      /* next descriptor */
-                      sgdma_txphysaddr(priv, ndesc),
+                            sgdma_txphysaddr(priv, ndesc),
-                      buffer->dma_addr,         /* address of packet to xmit */
+                            buffer->dma_addr,           /* address of packet to xmit */
-                      0,                        /* write addr 0 for tx dma */
+                            0,                          /* write addr 0 for tx dma */
-                      buffer->len,              /* length of packet */
+                            buffer->len,                /* length of packet */
-                      SGDMA_CONTROL_EOP,        /* Generate EOP */
+                            SGDMA_CONTROL_EOP,          /* Generate EOP */
-                      0,                        /* read fixed */
+                            0,                          /* read fixed */
-                      SGDMA_CONTROL_WR_FIXED);  /* Generate SOP */
+                            SGDMA_CONTROL_WR_FIXED);    /* Generate SOP */
-        pktstx = sgdma_async_write(priv, cdesc);
+        sgdma_async_write(priv, cdesc);
        /* enqueue the request to the pending transmit queue */
        queue_tx(priv, buffer);
@@ -208,10 +213,10 @@ int sgdma_tx_buffer(struct altera_tse_private *priv, struct tse_buffer *buffer)
 u32 sgdma_tx_completions(struct altera_tse_private *priv)
 {
        u32 ready = 0;
-        struct sgdma_descrip *desc = (struct sgdma_descrip *)priv->tx_dma_desc;
        if (!sgdma_txbusy(priv) &&
-            ((desc->control & SGDMA_CONTROL_HW_OWNED) == 0) &&
+            ((csrrd8(priv->tx_dma_desc, sgdma_descroffs(control))
+             & SGDMA_CONTROL_HW_OWNED) == 0) &&
            (dequeue_tx(priv))) {
                ready = 1;
        }
@@ -219,11 +224,15 @@ u32 sgdma_tx_completions(struct altera_tse_private *priv)
        return ready;
 }
-int sgdma_add_rx_desc(struct altera_tse_private *priv,
+void sgdma_start_rxdma(struct altera_tse_private *priv)
-                      struct tse_buffer *rxbuffer)
+{
+        sgdma_async_read(priv);
+}
+void sgdma_add_rx_desc(struct altera_tse_private *priv,
+                       struct tse_buffer *rxbuffer)
 {
        queue_rx(priv, rxbuffer);
-        return sgdma_async_read(priv);
 }
 /* status is returned on upper 16 bits,
@@ -231,38 +240,62 @@ int sgdma_add_rx_desc(struct altera_tse_private *priv,
 */
 u32 sgdma_rx_status(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->rx_dma_csr;
+        struct sgdma_descrip __iomem *base =
-        struct sgdma_descrip *base = (struct sgdma_descrip *)priv->rx_dma_desc;
+                (struct sgdma_descrip __iomem *)priv->rx_dma_desc;
-        struct sgdma_descrip *desc = NULL;
+        struct sgdma_descrip __iomem *desc = NULL;
-        int pktsrx;
-        unsigned int rxstatus = 0;
-        unsigned int pktlength = 0;
-        unsigned int pktstatus = 0;
        struct tse_buffer *rxbuffer = NULL;
+        unsigned int rxstatus = 0;
-        dma_sync_single_for_cpu(priv->device,
+        u32 sts = csrrd32(priv->rx_dma_csr, sgdma_csroffs(status));
-                                priv->rxdescphys,
-                                priv->rxdescmem,
-                                DMA_BIDIRECTIONAL);
        desc = &base[0];
-        if ((ioread32(&csr->status) & SGDMA_STSREG_EOP) ||
+        if (sts & SGDMA_STSREG_EOP) {
-            (desc->status & SGDMA_STATUS_EOP)) {
+                unsigned int pktlength = 0;
-                pktlength = desc->bytes_xferred;
+                unsigned int pktstatus = 0;
-                pktstatus = desc->status & 0x3f;
+                dma_sync_single_for_cpu(priv->device,
-                rxstatus = pktstatus;
+                                        priv->rxdescphys,
+                                        priv->sgdmadesclen,
+                                        DMA_FROM_DEVICE);
+                pktlength = csrrd16(desc, sgdma_descroffs(bytes_xferred));
+                pktstatus = csrrd8(desc, sgdma_descroffs(status));
+                rxstatus = pktstatus & ~SGDMA_STATUS_EOP;
                rxstatus = rxstatus << 16;
                rxstatus |= (pktlength & 0xffff);
-                desc->status = 0;
+                if (rxstatus) {
+                        csrwr8(0, desc, sgdma_descroffs(status));
-                rxbuffer = dequeue_rx(priv);
-                if (rxbuffer == NULL)
+                        rxbuffer = dequeue_rx(priv);
+                        if (rxbuffer == NULL)
+                                netdev_info(priv->dev,
+                                            "sgdma rx and rx queue empty!\n");
+                        /* Clear control */
+                        csrwr32(0, priv->rx_dma_csr, sgdma_csroffs(control));
+                        /* clear status */
+                        csrwr32(0xf, priv->rx_dma_csr, sgdma_csroffs(status));
+                        /* kick the rx sgdma after reaping this descriptor */
+                        sgdma_async_read(priv);
+                } else {
+                        /* If the SGDMA indicated an end of packet on recv,
+                         * then it's expected that the rxstatus from the
+                         * descriptor is non-zero - meaning a valid packet
+                         * with a nonzero length, or an error has been
+                         * indicated. if not, then all we can do is signal
+                         * an error and return no packet received. Most likely
+                         * there is a system design error, or an error in the
+                         * underlying kernel (cache or cache management problem)
+                         */
                        netdev_err(priv->dev,
-                                   "sgdma rx and rx queue empty!\n");
+                                   "SGDMA RX Error Info: %x, %x, %x\n",
+                                   sts, csrrd8(desc, sgdma_descroffs(status)),
-                /* kick the rx sgdma after reaping this descriptor */
+                                   rxstatus);
-                pktsrx = sgdma_async_read(priv);
+                }
+        } else if (sts == 0) {
+                sgdma_async_read(priv);
        }
        return rxstatus;
@@ -270,38 +303,41 @@ u32 sgdma_rx_status(struct altera_tse_private *priv)
 /* Private functions */
-static void sgdma_descrip(struct sgdma_descrip *desc,
+static void sgdma_setup_descrip(struct sgdma_descrip __iomem *desc,
-                          struct sgdma_descrip *ndesc,
+                                struct sgdma_descrip __iomem *ndesc,
-                          dma_addr_t ndesc_phys,
+                                dma_addr_t ndesc_phys,
-                          dma_addr_t raddr,
+                                dma_addr_t raddr,
-                          dma_addr_t waddr,
+                                dma_addr_t waddr,
-                          u16 length,
+                                u16 length,
-                          int generate_eop,
+                                int generate_eop,
-                          int rfixed,
+                                int rfixed,
-                          int wfixed)
+                                int wfixed)
 {
        /* Clear the next descriptor as not owned by hardware */
-        u32 ctrl = ndesc->control;
+        u32 ctrl = csrrd8(ndesc, sgdma_descroffs(control));
        ctrl &= ~SGDMA_CONTROL_HW_OWNED;
-        ndesc->control = ctrl;
+        csrwr8(ctrl, ndesc, sgdma_descroffs(control));
-        ctrl = 0;
        ctrl = SGDMA_CONTROL_HW_OWNED;
        ctrl |= generate_eop;
        ctrl |= rfixed;
        ctrl |= wfixed;
        /* Channel is implicitly zero, initialized to 0 by default */
+        csrwr32(lower_32_bits(raddr), desc, sgdma_descroffs(raddr));
-        desc->raddr = raddr;
+        csrwr32(lower_32_bits(waddr), desc, sgdma_descroffs(waddr));
-        desc->waddr = waddr;
-        desc->next = lower_32_bits(ndesc_phys);
+        csrwr32(0, desc, sgdma_descroffs(pad1));
-        desc->control = ctrl;
+        csrwr32(0, desc, sgdma_descroffs(pad2));
-        desc->status = 0;
+        csrwr32(lower_32_bits(ndesc_phys), desc, sgdma_descroffs(next));
-        desc->rburst = 0;
-        desc->wburst = 0;
+        csrwr8(ctrl, desc, sgdma_descroffs(control));
-        desc->bytes = length;
+        csrwr8(0, desc, sgdma_descroffs(status));
-        desc->bytes_xferred = 0;
+        csrwr8(0, desc, sgdma_descroffs(wburst));
+        csrwr8(0, desc, sgdma_descroffs(rburst));
+        csrwr16(length, desc, sgdma_descroffs(bytes));
+        csrwr16(0, desc, sgdma_descroffs(bytes_xferred));
 }
 /* If hardware is busy, don't restart async read.
@@ -312,48 +348,43 @@ static void sgdma_descrip(struct sgdma_descrip *desc,
 */
 static int sgdma_async_read(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->rx_dma_csr;
+        struct sgdma_descrip __iomem *descbase =
-        struct sgdma_descrip *descbase =
+                (struct sgdma_descrip __iomem *)priv->rx_dma_desc;
-                (struct sgdma_descrip *)priv->rx_dma_desc;
-        struct sgdma_descrip *cdesc = &descbase[0];
+        struct sgdma_descrip __iomem *cdesc = &descbase[0];
-        struct sgdma_descrip *ndesc = &descbase[1];
+        struct sgdma_descrip __iomem *ndesc = &descbase[1];
-        unsigned int sts = ioread32(&csr->status);
        struct tse_buffer *rxbuffer = NULL;
        if (!sgdma_rxbusy(priv)) {
                rxbuffer = queue_rx_peekhead(priv);
-                if (rxbuffer == NULL)
+                if (rxbuffer == NULL) {
+                        netdev_err(priv->dev, "no rx buffers available\n");
                        return 0;
+                }
-                sgdma_descrip(cdesc,            /* current descriptor */
-                              ndesc,            /* next descriptor */
+                sgdma_setup_descrip(cdesc,              /* current descriptor */
-                              sgdma_rxphysaddr(priv, ndesc),
+                                    ndesc,              /* next descriptor */
-                              0,                /* read addr 0 for rx dma */
+                                    sgdma_rxphysaddr(priv, ndesc),
-                              rxbuffer->dma_addr, /* write addr for rx dma */
+                                    0,                  /* read addr 0 for rx dma */
-                              0,                /* read 'til EOP */
+                                    rxbuffer->dma_addr, /* write addr for rx dma */
-                              0,                /* EOP: NA for rx dma */
+                                    0,                  /* read 'til EOP */
-                              0,                /* read fixed: NA for rx dma */
+                                    0,                  /* EOP: NA for rx dma */
-                              0);               /* SOP: NA for rx DMA */
+                                    0,                  /* read fixed: NA for rx dma */
+                                    0);                 /* SOP: NA for rx DMA */
-                /* clear control and status */
-                iowrite32(0, &csr->control);
-                /* If status available, clear those bits */
-                if (sts & 0xf)
-                        iowrite32(0xf, &csr->status);
                dma_sync_single_for_device(priv->device,
                                           priv->rxdescphys,
-                                           priv->rxdescmem,
+                                           priv->sgdmadesclen,
-                                           DMA_BIDIRECTIONAL);
+                                           DMA_TO_DEVICE);
-                iowrite32(lower_32_bits(sgdma_rxphysaddr(priv, cdesc)),
+                csrwr32(lower_32_bits(sgdma_rxphysaddr(priv, cdesc)),
-                          &csr->next_descrip);
+                        priv->rx_dma_csr,
+                        sgdma_csroffs(next_descrip));
-                iowrite32((priv->rxctrlreg | SGDMA_CTRLREG_START),
+                csrwr32((priv->rxctrlreg | SGDMA_CTRLREG_START),
-                          &csr->control);
+                        priv->rx_dma_csr,
+                        sgdma_csroffs(control));
                return 1;
        }
@@ -362,32 +393,32 @@ static int sgdma_async_read(struct altera_tse_private *priv)
 }
 static int sgdma_async_write(struct altera_tse_private *priv,
-                             struct sgdma_descrip *desc)
+                             struct sgdma_descrip __iomem *desc)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->tx_dma_csr;
        if (sgdma_txbusy(priv))
                return 0;
        /* clear control and status */
-        iowrite32(0, &csr->control);
+        csrwr32(0, priv->tx_dma_csr, sgdma_csroffs(control));
-        iowrite32(0x1f, &csr->status);
+        csrwr32(0x1f, priv->tx_dma_csr, sgdma_csroffs(status));
        dma_sync_single_for_device(priv->device, priv->txdescphys,
-                                   priv->txdescmem, DMA_TO_DEVICE);
+                                   priv->sgdmadesclen, DMA_TO_DEVICE);
-        iowrite32(lower_32_bits(sgdma_txphysaddr(priv, desc)),
+        csrwr32(lower_32_bits(sgdma_txphysaddr(priv, desc)),
-                  &csr->next_descrip);
+                priv->tx_dma_csr,
+                sgdma_csroffs(next_descrip));
-        iowrite32((priv->txctrlreg | SGDMA_CTRLREG_START),
+        csrwr32((priv->txctrlreg | SGDMA_CTRLREG_START),
-                  &csr->control);
+                priv->tx_dma_csr,
+                sgdma_csroffs(control));
        return 1;
 }
 static dma_addr_t
 sgdma_txphysaddr(struct altera_tse_private *priv,
-                 struct sgdma_descrip *desc)
+                 struct sgdma_descrip __iomem *desc)
 {
        dma_addr_t paddr = priv->txdescmem_busaddr;
        uintptr_t offs = (uintptr_t)desc - (uintptr_t)priv->tx_dma_desc;
@@ -396,7 +427,7 @@ sgdma_txphysaddr(struct altera_tse_private *priv,
 static dma_addr_t
 sgdma_rxphysaddr(struct altera_tse_private *priv,
-                 struct sgdma_descrip *desc)
+                 struct sgdma_descrip __iomem *desc)
 {
        dma_addr_t paddr = priv->rxdescmem_busaddr;
        uintptr_t offs = (uintptr_t)desc - (uintptr_t)priv->rx_dma_desc;
@@ -485,8 +516,8 @@ queue_rx_peekhead(struct altera_tse_private *priv)
 */
 static int sgdma_rxbusy(struct altera_tse_private *priv)
 {
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->rx_dma_csr;
+        return csrrd32(priv->rx_dma_csr, sgdma_csroffs(status))
-        return ioread32(&csr->status) & SGDMA_STSREG_BUSY;
+                       & SGDMA_STSREG_BUSY;
 }
 /* waits for the tx sgdma to finish it's current operation, returns 0
@@ -495,13 +526,14 @@ static int sgdma_rxbusy(struct altera_tse_private *priv)
 static int sgdma_txbusy(struct altera_tse_private *priv)
 {
        int delay = 0;
-        struct sgdma_csr *csr = (struct sgdma_csr *)priv->tx_dma_csr;
        /* if DMA is busy, wait for current transactino to finish */
-        while ((ioread32(&csr->status) & SGDMA_STSREG_BUSY) && (delay++ < 100))
+        while ((csrrd32(priv->tx_dma_csr, sgdma_csroffs(status))
+                & SGDMA_STSREG_BUSY) && (delay++ < 100))
                udelay(1);
-        if (ioread32(&csr->status) & SGDMA_STSREG_BUSY) {
+        if (csrrd32(priv->tx_dma_csr, sgdma_csroffs(status))
+            & SGDMA_STSREG_BUSY) {
                netdev_err(priv->dev, "timeout waiting for tx dma\n");
                return 1;
        }
diff --git a/drivers/net/ethernet/altera/altera_sgdma.h b/drivers/net/ethernet/altera/altera_sgdma.h
index 07d471729dc4..584977e29ef9 100644
--- a/drivers/net/ethernet/altera/altera_sgdma.h
+++ b/drivers/net/ethernet/altera/altera_sgdma.h
@@ -26,10 +26,11 @@ void sgdma_clear_rxirq(struct altera_tse_private *);
 void sgdma_clear_txirq(struct altera_tse_private *);
 int sgdma_tx_buffer(struct altera_tse_private *priv, struct tse_buffer *);
 u32 sgdma_tx_completions(struct altera_tse_private *);
-int sgdma_add_rx_desc(struct altera_tse_private *priv, struct tse_buffer *);
+void sgdma_add_rx_desc(struct altera_tse_private *priv, struct tse_buffer *);
 void sgdma_status(struct altera_tse_private *);
 u32 sgdma_rx_status(struct altera_tse_private *);
 int sgdma_initialize(struct altera_tse_private *);
 void sgdma_uninitialize(struct altera_tse_private *);
+void sgdma_start_rxdma(struct altera_tse_private *);
 #endif /*  __ALTERA_SGDMA_H__ */
diff --git a/drivers/net/ethernet/altera/altera_sgdmahw.h b/drivers/net/ethernet/altera/altera_sgdmahw.h
index ba3334f35383..85bc33b218d9 100644
--- a/drivers/net/ethernet/altera/altera_sgdmahw.h
+++ b/drivers/net/ethernet/altera/altera_sgdmahw.h
@@ -19,16 +19,16 @@
 /* SGDMA descriptor structure */
 struct sgdma_descrip {
-        unsigned int    raddr; /* address of data to be read */
+        u32     raddr; /* address of data to be read */
-        unsigned int    pad1;
+        u32     pad1;
-        unsigned int    waddr;
+        u32     waddr;
-        unsigned int    pad2;
+        u32     pad2;
-        unsigned int    next;
+        u32     next;
-        unsigned int    pad3;
+        u32     pad3;
-        unsigned short  bytes;
+        u16     bytes;
-        unsigned char   rburst;
+        u8      rburst;
-        unsigned char   wburst;
+        u8      wburst;
-        unsigned short  bytes_xferred;  /* 16 bits, bytes xferred */
+        u16     bytes_xferred;  /* 16 bits, bytes xferred */
        /* bit 0: error
         * bit 1: length error
@@ -39,7 +39,7 @@ struct sgdma_descrip {
         * bit 6: reserved
         * bit 7: status eop for recv case
         */
-        unsigned char   status;
+        u8      status;
        /* bit 0: eop
         * bit 1: read_fixed
@@ -47,7 +47,7 @@ struct sgdma_descrip {
         * bits 3,4,5,6: Channel (always 0)
         * bit 7: hardware owned
         */
-        unsigned char   control;
+        u8      control;
 } __packed;
@@ -101,6 +101,8 @@ struct sgdma_csr {
        u32     pad3[3];
 };
+#define sgdma_csroffs(a) (offsetof(struct sgdma_csr, a))
+#define sgdma_descroffs(a) (offsetof(struct sgdma_descrip, a))
 #define SGDMA_STSREG_ERR        BIT(0) /* Error */
 #define SGDMA_STSREG_EOP        BIT(1) /* EOP */
diff --git a/drivers/net/ethernet/altera/altera_tse.h b/drivers/net/ethernet/altera/altera_tse.h
index 8feeed05de0e..2adb24d4523c 100644
--- a/drivers/net/ethernet/altera/altera_tse.h
+++ b/drivers/net/ethernet/altera/altera_tse.h
@@ -58,6 +58,8 @@
 /* MAC function configuration default settings */
 #define ALTERA_TSE_TX_IPG_LENGTH        12
+#define ALTERA_TSE_PAUSE_QUANTA         0xffff
 #define GET_BIT_VALUE(v, bit)           (((v) >> (bit)) & 0x1)
 /* MAC Command_Config Register Bit Definitions
@@ -355,6 +357,8 @@ struct altera_tse_mac {
        u32 reserved5[42];
 };
+#define tse_csroffs(a) (offsetof(struct altera_tse_mac, a))
 /* Transmit and Receive Command Registers Bit Definitions
 */
 #define ALTERA_TSE_TX_CMD_STAT_OMIT_CRC         BIT(17)
@@ -390,10 +394,11 @@ struct altera_dmaops {
        void (*clear_rxirq)(struct altera_tse_private *);
        int (*tx_buffer)(struct altera_tse_private *, struct tse_buffer *);
        u32 (*tx_completions)(struct altera_tse_private *);
-        int (*add_rx_desc)(struct altera_tse_private *, struct tse_buffer *);
+        void (*add_rx_desc)(struct altera_tse_private *, struct tse_buffer *);
        u32 (*get_rx_status)(struct altera_tse_private *);
        int (*init_dma)(struct altera_tse_private *);
        void (*uninit_dma)(struct altera_tse_private *);
+        void (*start_rxdma)(struct altera_tse_private *);
 };
 /* This structure is private to each device.
@@ -453,6 +458,7 @@ struct altera_tse_private {
        u32 rxctrlreg;
        dma_addr_t rxdescphys;
        dma_addr_t txdescphys;
+        size_t sgdmadesclen;
        struct list_head txlisthd;
        struct list_head rxlisthd;
@@ -483,4 +489,49 @@ struct altera_tse_private {
 */
 void altera_tse_set_ethtool_ops(struct net_device *);
+static inline
+u32 csrrd32(void __iomem *mac, size_t offs)
+{
+        void __iomem *paddr = (void __iomem *)((uintptr_t)mac + offs);
+        return readl(paddr);
+}
+static inline
+u16 csrrd16(void __iomem *mac, size_t offs)
+{
+        void __iomem *paddr = (void __iomem *)((uintptr_t)mac + offs);
+        return readw(paddr);
+}
+static inline
+u8 csrrd8(void __iomem *mac, size_t offs)
+{
+        void __iomem *paddr = (void __iomem *)((uintptr_t)mac + offs);
+        return readb(paddr);
+}
+static inline
+void csrwr32(u32 val, void __iomem *mac, size_t offs)
+{
+        void __iomem *paddr = (void __iomem *)((uintptr_t)mac + offs);
+        writel(val, paddr);
+}
+static inline
+void csrwr16(u16 val, void __iomem *mac, size_t offs)
+{
+        void __iomem *paddr = (void __iomem *)((uintptr_t)mac + offs);
+        writew(val, paddr);
+}
+static inline
+void csrwr8(u8 val, void __iomem *mac, size_t offs)
+{
+        void __iomem *paddr = (void __iomem *)((uintptr_t)mac + offs);
+        writeb(val, paddr);
+}
 #endif /* __ALTERA_TSE_H__ */
diff --git a/drivers/net/ethernet/altera/altera_tse_ethtool.c b/drivers/net/ethernet/altera/altera_tse_ethtool.c
index 319ca74f5e74..54c25eff7952 100644
--- a/drivers/net/ethernet/altera/altera_tse_ethtool.c
+++ b/drivers/net/ethernet/altera/altera_tse_ethtool.c
@@ -77,7 +77,7 @@ static void tse_get_drvinfo(struct net_device *dev,
        struct altera_tse_private *priv = netdev_priv(dev);
        u32 rev = ioread32(&priv->mac_dev->megacore_revision);
-        strcpy(info->driver, "Altera TSE MAC IP Driver");
+        strcpy(info->driver, "altera_tse");
        strcpy(info->version, "v8.0");
        snprintf(info->fw_version, ETHTOOL_FWVERS_LEN, "v%d.%d",
                 rev & 0xFFFF, (rev & 0xFFFF0000) >> 16);
@@ -96,54 +96,89 @@ static void tse_fill_stats(struct net_device *dev, struct ethtool_stats *dummy,
                           u64 *buf)
 {
        struct altera_tse_private *priv = netdev_priv(dev);
-        struct altera_tse_mac *mac = priv->mac_dev;
        u64 ext;
-        buf[0] = ioread32(&mac->frames_transmitted_ok);
+        buf[0] = csrrd32(priv->mac_dev,
-        buf[1] = ioread32(&mac->frames_received_ok);
+                         tse_csroffs(frames_transmitted_ok));
-        buf[2] = ioread32(&mac->frames_check_sequence_errors);
+        buf[1] = csrrd32(priv->mac_dev,
-        buf[3] = ioread32(&mac->alignment_errors);
+                         tse_csroffs(frames_received_ok));
+        buf[2] = csrrd32(priv->mac_dev,
+                         tse_csroffs(frames_check_sequence_errors));
+        buf[3] = csrrd32(priv->mac_dev,
+                         tse_csroffs(alignment_errors));
        /* Extended aOctetsTransmittedOK counter */
-        ext = (u64) ioread32(&mac->msb_octets_transmitted_ok) << 32;
+        ext = (u64) csrrd32(priv->mac_dev,
-        ext |= ioread32(&mac->octets_transmitted_ok);
+                            tse_csroffs(msb_octets_transmitted_ok)) << 32;
+        ext |= csrrd32(priv->mac_dev,
+                       tse_csroffs(octets_transmitted_ok));
        buf[4] = ext;
        /* Extended aOctetsReceivedOK counter */
-        ext = (u64) ioread32(&mac->msb_octets_received_ok) << 32;
+        ext = (u64) csrrd32(priv->mac_dev,
-        ext |= ioread32(&mac->octets_received_ok);
+                            tse_csroffs(msb_octets_received_ok)) << 32;
+        ext |= csrrd32(priv->mac_dev,
+                       tse_csroffs(octets_received_ok));
        buf[5] = ext;
-        buf[6] = ioread32(&mac->tx_pause_mac_ctrl_frames);
+        buf[6] = csrrd32(priv->mac_dev,
-        buf[7] = ioread32(&mac->rx_pause_mac_ctrl_frames);
+                         tse_csroffs(tx_pause_mac_ctrl_frames));
-        buf[8] = ioread32(&mac->if_in_errors);
+        buf[7] = csrrd32(priv->mac_dev,
-        buf[9] = ioread32(&mac->if_out_errors);
+                         tse_csroffs(rx_pause_mac_ctrl_frames));
-        buf[10] = ioread32(&mac->if_in_ucast_pkts);
+        buf[8] = csrrd32(priv->mac_dev,
-        buf[11] = ioread32(&mac->if_in_multicast_pkts);
+                         tse_csroffs(if_in_errors));
-        buf[12] = ioread32(&mac->if_in_broadcast_pkts);
+        buf[9] = csrrd32(priv->mac_dev,
-        buf[13] = ioread32(&mac->if_out_discards);
+                         tse_csroffs(if_out_errors));
-        buf[14] = ioread32(&mac->if_out_ucast_pkts);
+        buf[10] = csrrd32(priv->mac_dev,
-        buf[15] = ioread32(&mac->if_out_multicast_pkts);
+                          tse_csroffs(if_in_ucast_pkts));
-        buf[16] = ioread32(&mac->if_out_broadcast_pkts);
+        buf[11] = csrrd32(priv->mac_dev,
-        buf[17] = ioread32(&mac->ether_stats_drop_events);
+                          tse_csroffs(if_in_multicast_pkts));
+        buf[12] = csrrd32(priv->mac_dev,
+                          tse_csroffs(if_in_broadcast_pkts));
+        buf[13] = csrrd32(priv->mac_dev,
+                          tse_csroffs(if_out_discards));
+        buf[14] = csrrd32(priv->mac_dev,
+                          tse_csroffs(if_out_ucast_pkts));
+        buf[15] = csrrd32(priv->mac_dev,
+                          tse_csroffs(if_out_multicast_pkts));
+        buf[16] = csrrd32(priv->mac_dev,
+                          tse_csroffs(if_out_broadcast_pkts));
+        buf[17] = csrrd32(priv->mac_dev,
+                          tse_csroffs(ether_stats_drop_events));
        /* Extended etherStatsOctets counter */
-        ext = (u64) ioread32(&mac->msb_ether_stats_octets) << 32;
+        ext = (u64) csrrd32(priv->mac_dev,
-        ext |= ioread32(&mac->ether_stats_octets);
+                            tse_csroffs(msb_ether_stats_octets)) << 32;
+        ext |= csrrd32(priv->mac_dev,
+                       tse_csroffs(ether_stats_octets));
        buf[18] = ext;
-        buf[19] = ioread32(&mac->ether_stats_pkts);
+        buf[19] = csrrd32(priv->mac_dev,
-        buf[20] = ioread32(&mac->ether_stats_undersize_pkts);
+                          tse_csroffs(ether_stats_pkts));
-        buf[21] = ioread32(&mac->ether_stats_oversize_pkts);
+        buf[20] = csrrd32(priv->mac_dev,
-        buf[22] = ioread32(&mac->ether_stats_pkts_64_octets);
+                          tse_csroffs(ether_stats_undersize_pkts));
-        buf[23] = ioread32(&mac->ether_stats_pkts_65to127_octets);
+        buf[21] = csrrd32(priv->mac_dev,
-        buf[24] = ioread32(&mac->ether_stats_pkts_128to255_octets);
+                          tse_csroffs(ether_stats_oversize_pkts));
-        buf[25] = ioread32(&mac->ether_stats_pkts_256to511_octets);
+        buf[22] = csrrd32(priv->mac_dev,
-        buf[26] = ioread32(&mac->ether_stats_pkts_512to1023_octets);
+                          tse_csroffs(ether_stats_pkts_64_octets));
-        buf[27] = ioread32(&mac->ether_stats_pkts_1024to1518_octets);
+        buf[23] = csrrd32(priv->mac_dev,
-        buf[28] = ioread32(&mac->ether_stats_pkts_1519tox_octets);
+                          tse_csroffs(ether_stats_pkts_65to127_octets));
-        buf[29] = ioread32(&mac->ether_stats_jabbers);
+        buf[24] = csrrd32(priv->mac_dev,
-        buf[30] = ioread32(&mac->ether_stats_fragments);
+                          tse_csroffs(ether_stats_pkts_128to255_octets));
+        buf[25] = csrrd32(priv->mac_dev,
+                          tse_csroffs(ether_stats_pkts_256to511_octets));
+        buf[26] = csrrd32(priv->mac_dev,
+                          tse_csroffs(ether_stats_pkts_512to1023_octets));
+        buf[27] = csrrd32(priv->mac_dev,
+                          tse_csroffs(ether_stats_pkts_1024to1518_octets));
+        buf[28] = csrrd32(priv->mac_dev,
+                          tse_csroffs(ether_stats_pkts_1519tox_octets));
+        buf[29] = csrrd32(priv->mac_dev,
+                          tse_csroffs(ether_stats_jabbers));
+        buf[30] = csrrd32(priv->mac_dev,
+                          tse_csroffs(ether_stats_fragments));
 }
 static int tse_sset_count(struct net_device *dev, int sset)
@@ -178,19 +213,24 @@ static void tse_get_regs(struct net_device *dev, struct ethtool_regs *regs,
 {
        int i;
        struct altera_tse_private *priv = netdev_priv(dev);
-        u32 *tse_mac_regs = (u32 *)priv->mac_dev;
        u32 *buf = regbuf;
        /* Set version to a known value, so ethtool knows
         * how to do any special formatting of this data.
         * This version number will need to change if and
         * when this register table is changed.
+         *
+         * version[31:0] = 1: Dump the first 128 TSE Registers
+         *      Upper bits are all 0 by default
+         *
+         * Upper 16-bits will indicate feature presence for
+         * Ethtool register decoding in future version.
         */
        regs->version = 1;
        for (i = 0; i < TSE_NUM_REGS; i++)
-                buf[i] = ioread32(&tse_mac_regs[i]);
+                buf[i] = csrrd32(priv->mac_dev, i * 4);
 }
 static int tse_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index c70a29e0b9f7..7330681574d2 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -100,29 +100,30 @@ static inline u32 tse_tx_avail(struct altera_tse_private *priv)
 */
 static int altera_tse_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 {
-        struct altera_tse_mac *mac = (struct altera_tse_mac *)bus->priv;
+        struct net_device *ndev = bus->priv;
-        unsigned int *mdio_regs = (unsigned int *)&mac->mdio_phy0;
+        struct altera_tse_private *priv = netdev_priv(ndev);
-        u32 data;
        /* set MDIO address */
-        iowrite32((mii_id & 0x1f), &mac->mdio_phy0_addr);
+        csrwr32((mii_id & 0x1f), priv->mac_dev,
+                tse_csroffs(mdio_phy0_addr));
        /* get the data */
-        data = ioread32(&mdio_regs[regnum]) & 0xffff;
+        return csrrd32(priv->mac_dev,
-        return data;
+                       tse_csroffs(mdio_phy0) + regnum * 4) & 0xffff;
 }
 static int altera_tse_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
                                 u16 value)
 {
-        struct altera_tse_mac *mac = (struct altera_tse_mac *)bus->priv;
+        struct net_device *ndev = bus->priv;
-        unsigned int *mdio_regs = (unsigned int *)&mac->mdio_phy0;
+        struct altera_tse_private *priv = netdev_priv(ndev);
        /* set MDIO address */
-        iowrite32((mii_id & 0x1f), &mac->mdio_phy0_addr);
+        csrwr32((mii_id & 0x1f), priv->mac_dev,
+                tse_csroffs(mdio_phy0_addr));
        /* write the data */
-        iowrite32((u32) value, &mdio_regs[regnum]);
+        csrwr32(value, priv->mac_dev, tse_csroffs(mdio_phy0) + regnum * 4);
        return 0;
 }
@@ -168,7 +169,7 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id)
        for (i = 0; i < PHY_MAX_ADDR; i++)
                mdio->irq[i] = PHY_POLL;
-        mdio->priv = priv->mac_dev;
+        mdio->priv = dev;
        mdio->parent = priv->device;
        ret = of_mdiobus_register(mdio, mdio_node);
@@ -224,6 +225,7 @@ static int tse_init_rx_buffer(struct altera_tse_private *priv,
                dev_kfree_skb_any(rxbuffer->skb);
                return -EINVAL;
        }
+        rxbuffer->dma_addr &= (dma_addr_t)~3;
        rxbuffer->len = len;
        return 0;
 }
@@ -425,9 +427,10 @@ static int tse_rx(struct altera_tse_private *priv, int limit)
                priv->dev->stats.rx_bytes += pktlength;
                entry = next_entry;
+                tse_rx_refill(priv);
        }
-        tse_rx_refill(priv);
        return count;
 }
@@ -520,7 +523,6 @@ static irqreturn_t altera_isr(int irq, void *dev_id)
        struct altera_tse_private *priv;
        unsigned long int flags;
        if (unlikely(!dev)) {
                pr_err("%s: invalid dev pointer\n", __func__);
                return IRQ_NONE;
@@ -562,7 +564,6 @@ static int tse_start_xmit(struct sk_buff *skb, struct net_device *dev)
        unsigned int nopaged_len = skb_headlen(skb);
        enum netdev_tx ret = NETDEV_TX_OK;
        dma_addr_t dma_addr;
-        int txcomplete = 0;
        spin_lock_bh(&priv->tx_lock);
@@ -598,7 +599,7 @@ static int tse_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dma_sync_single_for_device(priv->device, buffer->dma_addr,
                                   buffer->len, DMA_TO_DEVICE);
-        txcomplete = priv->dmaops->tx_buffer(priv, buffer);
+        priv->dmaops->tx_buffer(priv, buffer);
        skb_tx_timestamp(skb);
@@ -697,7 +698,6 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
        struct altera_tse_private *priv = netdev_priv(dev);
        struct phy_device *phydev = NULL;
        char phy_id_fmt[MII_BUS_ID_SIZE + 3];
-        int ret;
        if (priv->phy_addr != POLL_PHY) {
                snprintf(phy_id_fmt, MII_BUS_ID_SIZE + 3, PHY_ID_FMT,
@@ -711,6 +711,7 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
                        netdev_err(dev, "Could not attach to PHY\n");
        } else {
+                int ret;
                phydev = phy_find_first(priv->mdio);
                if (phydev == NULL) {
                        netdev_err(dev, "No PHY found\n");
@@ -790,7 +791,6 @@ static int init_phy(struct net_device *dev)
 static void tse_update_mac_addr(struct altera_tse_private *priv, u8 *addr)
 {
-        struct altera_tse_mac *mac = priv->mac_dev;
        u32 msb;
        u32 lsb;
@@ -798,8 +798,8 @@ static void tse_update_mac_addr(struct altera_tse_private *priv, u8 *addr)
        lsb = ((addr[5] << 8) | addr[4]) & 0xffff;
        /* Set primary MAC address */
-        iowrite32(msb, &mac->mac_addr_0);
+        csrwr32(msb, priv->mac_dev, tse_csroffs(mac_addr_0));
-        iowrite32(lsb, &mac->mac_addr_1);
+        csrwr32(lsb, priv->mac_dev, tse_csroffs(mac_addr_1));
 }
 /* MAC software reset.
@@ -810,26 +810,26 @@ static void tse_update_mac_addr(struct altera_tse_private *priv, u8 *addr)
 */
 static int reset_mac(struct altera_tse_private *priv)
 {
-        void __iomem *cmd_cfg_reg = &priv->mac_dev->command_config;
        int counter;
        u32 dat;
-        dat = ioread32(cmd_cfg_reg);
+        dat = csrrd32(priv->mac_dev, tse_csroffs(command_config));
        dat &= ~(MAC_CMDCFG_TX_ENA | MAC_CMDCFG_RX_ENA);
        dat |= MAC_CMDCFG_SW_RESET | MAC_CMDCFG_CNT_RESET;
-        iowrite32(dat, cmd_cfg_reg);
+        csrwr32(dat, priv->mac_dev, tse_csroffs(command_config));
        counter = 0;
        while (counter++ < ALTERA_TSE_SW_RESET_WATCHDOG_CNTR) {
-                if (tse_bit_is_clear(cmd_cfg_reg, MAC_CMDCFG_SW_RESET))
+                if (tse_bit_is_clear(priv->mac_dev, tse_csroffs(command_config),
+                                     MAC_CMDCFG_SW_RESET))
                        break;
                udelay(1);
        }
        if (counter >= ALTERA_TSE_SW_RESET_WATCHDOG_CNTR) {
-                dat = ioread32(cmd_cfg_reg);
+                dat = csrrd32(priv->mac_dev, tse_csroffs(command_config));
                dat &= ~MAC_CMDCFG_SW_RESET;
-                iowrite32(dat, cmd_cfg_reg);
+                csrwr32(dat, priv->mac_dev, tse_csroffs(command_config));
                return -1;
        }
        return 0;
@@ -839,42 +839,58 @@ static int reset_mac(struct altera_tse_private *priv)
 */
 static int init_mac(struct altera_tse_private *priv)
 {
-        struct altera_tse_mac *mac = priv->mac_dev;
        unsigned int cmd = 0;
        u32 frm_length;
        /* Setup Rx FIFO */
-        iowrite32(priv->rx_fifo_depth - ALTERA_TSE_RX_SECTION_EMPTY,
+        csrwr32(priv->rx_fifo_depth - ALTERA_TSE_RX_SECTION_EMPTY,
-                  &mac->rx_section_empty);
+                priv->mac_dev, tse_csroffs(rx_section_empty));
-        iowrite32(ALTERA_TSE_RX_SECTION_FULL, &mac->rx_section_full);
-        iowrite32(ALTERA_TSE_RX_ALMOST_EMPTY, &mac->rx_almost_empty);
+        csrwr32(ALTERA_TSE_RX_SECTION_FULL, priv->mac_dev,
-        iowrite32(ALTERA_TSE_RX_ALMOST_FULL, &mac->rx_almost_full);
+                tse_csroffs(rx_section_full));
+        csrwr32(ALTERA_TSE_RX_ALMOST_EMPTY, priv->mac_dev,
+                tse_csroffs(rx_almost_empty));
+        csrwr32(ALTERA_TSE_RX_ALMOST_FULL, priv->mac_dev,
+                tse_csroffs(rx_almost_full));
        /* Setup Tx FIFO */
-        iowrite32(priv->tx_fifo_depth - ALTERA_TSE_TX_SECTION_EMPTY,
+        csrwr32(priv->tx_fifo_depth - ALTERA_TSE_TX_SECTION_EMPTY,
-                  &mac->tx_section_empty);
+                priv->mac_dev, tse_csroffs(tx_section_empty));
-        iowrite32(ALTERA_TSE_TX_SECTION_FULL, &mac->tx_section_full);
-        iowrite32(ALTERA_TSE_TX_ALMOST_EMPTY, &mac->tx_almost_empty);
+        csrwr32(ALTERA_TSE_TX_SECTION_FULL, priv->mac_dev,
-        iowrite32(ALTERA_TSE_TX_ALMOST_FULL, &mac->tx_almost_full);
+                tse_csroffs(tx_section_full));
+        csrwr32(ALTERA_TSE_TX_ALMOST_EMPTY, priv->mac_dev,
+                tse_csroffs(tx_almost_empty));
+        csrwr32(ALTERA_TSE_TX_ALMOST_FULL, priv->mac_dev,
+                tse_csroffs(tx_almost_full));
        /* MAC Address Configuration */
        tse_update_mac_addr(priv, priv->dev->dev_addr);
        /* MAC Function Configuration */
        frm_length = ETH_HLEN + priv->dev->mtu + ETH_FCS_LEN;
-        iowrite32(frm_length, &mac->frm_length);
+        csrwr32(frm_length, priv->mac_dev, tse_csroffs(frm_length));
-        iowrite32(ALTERA_TSE_TX_IPG_LENGTH, &mac->tx_ipg_length);
+        csrwr32(ALTERA_TSE_TX_IPG_LENGTH, priv->mac_dev,
+                tse_csroffs(tx_ipg_length));
        /* Disable RX/TX shift 16 for alignment of all received frames on 16-bit
         * start address
         */
-        tse_clear_bit(&mac->rx_cmd_stat, ALTERA_TSE_RX_CMD_STAT_RX_SHIFT16);
+        tse_set_bit(priv->mac_dev, tse_csroffs(rx_cmd_stat),
-        tse_clear_bit(&mac->tx_cmd_stat, ALTERA_TSE_TX_CMD_STAT_TX_SHIFT16 |
+                    ALTERA_TSE_RX_CMD_STAT_RX_SHIFT16);
-                                         ALTERA_TSE_TX_CMD_STAT_OMIT_CRC);
+        tse_clear_bit(priv->mac_dev, tse_csroffs(tx_cmd_stat),
+                      ALTERA_TSE_TX_CMD_STAT_TX_SHIFT16 |
+                      ALTERA_TSE_TX_CMD_STAT_OMIT_CRC);
        /* Set the MAC options */
-        cmd = ioread32(&mac->command_config);
+        cmd = csrrd32(priv->mac_dev, tse_csroffs(command_config));
-        cmd |= MAC_CMDCFG_PAD_EN;       /* Padding Removal on Receive */
+        cmd &= ~MAC_CMDCFG_PAD_EN;      /* No padding Removal on Receive */
        cmd &= ~MAC_CMDCFG_CRC_FWD;     /* CRC Removal */
        cmd |= MAC_CMDCFG_RX_ERR_DISC;  /* Automatically discard frames
                                         * with CRC errors
@@ -882,7 +898,16 @@ static int init_mac(struct altera_tse_private *priv)
        cmd |= MAC_CMDCFG_CNTL_FRM_ENA;
        cmd &= ~MAC_CMDCFG_TX_ENA;
        cmd &= ~MAC_CMDCFG_RX_ENA;
-        iowrite32(cmd, &mac->command_config);
+        /* Default speed and duplex setting, full/100 */
+        cmd &= ~MAC_CMDCFG_HD_ENA;
+        cmd &= ~MAC_CMDCFG_ETH_SPEED;
+        cmd &= ~MAC_CMDCFG_ENA_10;
+        csrwr32(cmd, priv->mac_dev, tse_csroffs(command_config));
+        csrwr32(ALTERA_TSE_PAUSE_QUANTA, priv->mac_dev,
+                tse_csroffs(pause_quanta));
        if (netif_msg_hw(priv))
                dev_dbg(priv->device,
@@ -895,15 +920,14 @@ static int init_mac(struct altera_tse_private *priv)
 */
 static void tse_set_mac(struct altera_tse_private *priv, bool enable)
 {
-        struct altera_tse_mac *mac = priv->mac_dev;
+        u32 value = csrrd32(priv->mac_dev, tse_csroffs(command_config));
-        u32 value = ioread32(&mac->command_config);
        if (enable)
                value |= MAC_CMDCFG_TX_ENA | MAC_CMDCFG_RX_ENA;
        else
                value &= ~(MAC_CMDCFG_TX_ENA | MAC_CMDCFG_RX_ENA);
-        iowrite32(value, &mac->command_config);
+        csrwr32(value, priv->mac_dev, tse_csroffs(command_config));
 }
 /* Change the MTU
@@ -933,13 +957,12 @@ static int tse_change_mtu(struct net_device *dev, int new_mtu)
 static void altera_tse_set_mcfilter(struct net_device *dev)
 {
        struct altera_tse_private *priv = netdev_priv(dev);
-        struct altera_tse_mac *mac = priv->mac_dev;
        int i;
        struct netdev_hw_addr *ha;
        /* clear the hash filter */
        for (i = 0; i < 64; i++)
-                iowrite32(0, &(mac->hash_table[i]));
+                csrwr32(0, priv->mac_dev, tse_csroffs(hash_table) + i * 4);
        netdev_for_each_mc_addr(ha, dev) {
                unsigned int hash = 0;
@@ -955,7 +978,7 @@ static void altera_tse_set_mcfilter(struct net_device *dev)
                        hash = (hash << 1) | xor_bit;
                }
-                iowrite32(1, &(mac->hash_table[hash]));
+                csrwr32(1, priv->mac_dev, tse_csroffs(hash_table) + hash * 4);
        }
 }
@@ -963,12 +986,11 @@ static void altera_tse_set_mcfilter(struct net_device *dev)
 static void altera_tse_set_mcfilterall(struct net_device *dev)
 {
        struct altera_tse_private *priv = netdev_priv(dev);
-        struct altera_tse_mac *mac = priv->mac_dev;
        int i;
        /* set the hash filter */
        for (i = 0; i < 64; i++)
-                iowrite32(1, &(mac->hash_table[i]));
+                csrwr32(1, priv->mac_dev, tse_csroffs(hash_table) + i * 4);
 }
 /* Set or clear the multicast filter for this adaptor
@@ -976,12 +998,12 @@ static void altera_tse_set_mcfilterall(struct net_device *dev)
 static void tse_set_rx_mode_hashfilter(struct net_device *dev)
 {
        struct altera_tse_private *priv = netdev_priv(dev);
-        struct altera_tse_mac *mac = priv->mac_dev;
        spin_lock(&priv->mac_cfg_lock);
        if (dev->flags & IFF_PROMISC)
-                tse_set_bit(&mac->command_config, MAC_CMDCFG_PROMIS_EN);
+                tse_set_bit(priv->mac_dev, tse_csroffs(command_config),
+                            MAC_CMDCFG_PROMIS_EN);
        if (dev->flags & IFF_ALLMULTI)
                altera_tse_set_mcfilterall(dev);
@@ -996,15 +1018,16 @@ static void tse_set_rx_mode_hashfilter(struct net_device *dev)
 static void tse_set_rx_mode(struct net_device *dev)
 {
        struct altera_tse_private *priv = netdev_priv(dev);
-        struct altera_tse_mac *mac = priv->mac_dev;
        spin_lock(&priv->mac_cfg_lock);
        if ((dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) ||
            !netdev_mc_empty(dev) || !netdev_uc_empty(dev))
-                tse_set_bit(&mac->command_config, MAC_CMDCFG_PROMIS_EN);
+                tse_set_bit(priv->mac_dev, tse_csroffs(command_config),
+                            MAC_CMDCFG_PROMIS_EN);
        else
-                tse_clear_bit(&mac->command_config, MAC_CMDCFG_PROMIS_EN);
+                tse_clear_bit(priv->mac_dev, tse_csroffs(command_config),
+                              MAC_CMDCFG_PROMIS_EN);
        spin_unlock(&priv->mac_cfg_lock);
 }
@@ -1085,17 +1108,19 @@ static int tse_open(struct net_device *dev)
        spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
-        /* Start MAC Rx/Tx */
-        spin_lock(&priv->mac_cfg_lock);
-        tse_set_mac(priv, true);
-        spin_unlock(&priv->mac_cfg_lock);
        if (priv->phydev)
                phy_start(priv->phydev);
        napi_enable(&priv->napi);
        netif_start_queue(dev);
+        priv->dmaops->start_rxdma(priv);
+        /* Start MAC Rx/Tx */
+        spin_lock(&priv->mac_cfg_lock);
+        tse_set_mac(priv, true);
+        spin_unlock(&priv->mac_cfg_lock);
        return 0;
 tx_request_irq_error:
@@ -1167,7 +1192,6 @@ static struct net_device_ops altera_tse_netdev_ops = {
        .ndo_validate_addr      = eth_validate_addr,
 };
 static int request_and_map(struct platform_device *pdev, const char *name,
                           struct resource **res, void __iomem **ptr)
 {
@@ -1235,7 +1259,7 @@ static int altera_tse_probe(struct platform_device *pdev)
                /* Get the mapped address to the SGDMA descriptor memory */
                ret = request_and_map(pdev, "s1", &dma_res, &descmap);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                /* Start of that memory is for transmit descriptors */
                priv->tx_dma_desc = descmap;
@@ -1254,24 +1278,24 @@ static int altera_tse_probe(struct platform_device *pdev)
                if (upper_32_bits(priv->rxdescmem_busaddr)) {
                        dev_dbg(priv->device,
                                "SGDMA bus addresses greater than 32-bits\n");
-                        goto out_free;
+                        goto err_free_netdev;
                }
                if (upper_32_bits(priv->txdescmem_busaddr)) {
                        dev_dbg(priv->device,
                                "SGDMA bus addresses greater than 32-bits\n");
-                        goto out_free;
+                        goto err_free_netdev;
                }
        } else if (priv->dmaops &&
                   priv->dmaops->altera_dtype == ALTERA_DTYPE_MSGDMA) {
                ret = request_and_map(pdev, "rx_resp", &dma_res,
                                      &priv->rx_dma_resp);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                ret = request_and_map(pdev, "tx_desc", &dma_res,
                                      &priv->tx_dma_desc);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                priv->txdescmem = resource_size(dma_res);
                priv->txdescmem_busaddr = dma_res->start;
@@ -1279,13 +1303,13 @@ static int altera_tse_probe(struct platform_device *pdev)
                ret = request_and_map(pdev, "rx_desc", &dma_res,
                                      &priv->rx_dma_desc);
                if (ret)
-                        goto out_free;
+                        goto err_free_netdev;
                priv->rxdescmem = resource_size(dma_res);
                priv->rxdescmem_busaddr = dma_res->start;
        } else {
-                goto out_free;
+                goto err_free_netdev;
        }
        if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask)))
@@ -1294,26 +1318,26 @@ static int altera_tse_probe(struct platform_device *pdev)
        else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32)))
                dma_set_coherent_mask(priv->device, DMA_BIT_MASK(32));
        else
-                goto out_free;
+                goto err_free_netdev;
        /* MAC address space */
        ret = request_and_map(pdev, "control_port", &control_port,
                              (void __iomem **)&priv->mac_dev);
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* xSGDMA Rx Dispatcher address space */
        ret = request_and_map(pdev, "rx_csr", &dma_res,
                              &priv->rx_dma_csr);
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* xSGDMA Tx Dispatcher address space */
        ret = request_and_map(pdev, "tx_csr", &dma_res,
                              &priv->tx_dma_csr);
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* Rx IRQ */
@@ -1321,7 +1345,7 @@ static int altera_tse_probe(struct platform_device *pdev)
        if (priv->rx_irq == -ENXIO) {
                dev_err(&pdev->dev, "cannot obtain Rx IRQ\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        /* Tx IRQ */
@@ -1329,7 +1353,7 @@ static int altera_tse_probe(struct platform_device *pdev)
        if (priv->tx_irq == -ENXIO) {
                dev_err(&pdev->dev, "cannot obtain Tx IRQ\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        /* get FIFO depths from device tree */
@@ -1337,14 +1361,14 @@ static int altera_tse_probe(struct platform_device *pdev)
                                 &priv->rx_fifo_depth)) {
                dev_err(&pdev->dev, "cannot obtain rx-fifo-depth\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        if (of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth",
                                 &priv->rx_fifo_depth)) {
                dev_err(&pdev->dev, "cannot obtain tx-fifo-depth\n");
                ret = -ENXIO;
-                goto out_free;
+                goto err_free_netdev;
        }
        /* get hash filter settings for this instance */
@@ -1352,6 +1376,11 @@ static int altera_tse_probe(struct platform_device *pdev)
                of_property_read_bool(pdev->dev.of_node,
                                      "altr,has-hash-multicast-filter");
+        /* Set hash filter to not set for now until the
+         * multicast filter receive issue is debugged
+         */
+        priv->hash_filter = 0;
        /* get supplemental address settings for this instance */
        priv->added_unicast =
                of_property_read_bool(pdev->dev.of_node,
@@ -1393,7 +1422,7 @@ static int altera_tse_probe(struct platform_device *pdev)
              ((priv->phy_addr >= 0) && (priv->phy_addr < PHY_MAX_ADDR)))) {
                dev_err(&pdev->dev, "invalid phy-addr specified %d\n",
                        priv->phy_addr);
-                goto out_free;
+                goto err_free_netdev;
        }
        /* Create/attach to MDIO bus */
@@ -1401,7 +1430,7 @@ static int altera_tse_probe(struct platform_device *pdev)
                                     atomic_add_return(1, &instance_count));
        if (ret)
-                goto out_free;
+                goto err_free_netdev;
        /* initialize netdev */
        ether_setup(ndev);
@@ -1438,7 +1467,7 @@ static int altera_tse_probe(struct platform_device *pdev)
        ret = register_netdev(ndev);
        if (ret) {
                dev_err(&pdev->dev, "failed to register TSE net device\n");
-                goto out_free_mdio;
+                goto err_register_netdev;
        }
        platform_set_drvdata(pdev, ndev);
@@ -1455,13 +1484,16 @@ static int altera_tse_probe(struct platform_device *pdev)
        ret = init_phy(ndev);
        if (ret != 0) {
                netdev_err(ndev, "Cannot attach to PHY (error: %d)\n", ret);
-                goto out_free_mdio;
+                goto err_init_phy;
        }
        return 0;
-out_free_mdio:
+err_init_phy:
+        unregister_netdev(ndev);
+err_register_netdev:
+        netif_napi_del(&priv->napi);
        altera_tse_mdio_destroy(ndev);
-out_free:
+err_free_netdev:
        free_netdev(ndev);
        return ret;
 }
@@ -1480,7 +1512,7 @@ static int altera_tse_remove(struct platform_device *pdev)
        return 0;
 }
-struct altera_dmaops altera_dtype_sgdma = {
+static const struct altera_dmaops altera_dtype_sgdma = {
        .altera_dtype = ALTERA_DTYPE_SGDMA,
        .dmamask = 32,
        .reset_dma = sgdma_reset,
@@ -1496,9 +1528,10 @@ struct altera_dmaops altera_dtype_sgdma = {
        .get_rx_status = sgdma_rx_status,
        .init_dma = sgdma_initialize,
        .uninit_dma = sgdma_uninitialize,
+        .start_rxdma = sgdma_start_rxdma,
 };
-struct altera_dmaops altera_dtype_msgdma = {
+static const struct altera_dmaops altera_dtype_msgdma = {
        .altera_dtype = ALTERA_DTYPE_MSGDMA,
        .dmamask = 64,
        .reset_dma = msgdma_reset,
@@ -1514,6 +1547,7 @@ struct altera_dmaops altera_dtype_msgdma = {
        .get_rx_status = msgdma_rx_status,
        .init_dma = msgdma_initialize,
        .uninit_dma = msgdma_uninitialize,
+        .start_rxdma = msgdma_start_rxdma,
 };
 static struct of_device_id altera_tse_ids[] = {
diff --git a/drivers/net/ethernet/altera/altera_utils.c b/drivers/net/ethernet/altera/altera_utils.c
index 70fa13f486b2..d7eeb1713ad2 100644
--- a/drivers/net/ethernet/altera/altera_utils.c
+++ b/drivers/net/ethernet/altera/altera_utils.c
@@ -17,28 +17,28 @@
 #include "altera_tse.h"
 #include "altera_utils.h"
-void tse_set_bit(void __iomem *ioaddr, u32 bit_mask)
+void tse_set_bit(void __iomem *ioaddr, size_t offs, u32 bit_mask)
 {
-        u32 value = ioread32(ioaddr);
+        u32 value = csrrd32(ioaddr, offs);
        value |= bit_mask;
-        iowrite32(value, ioaddr);
+        csrwr32(value, ioaddr, offs);
 }
-void tse_clear_bit(void __iomem *ioaddr, u32 bit_mask)
+void tse_clear_bit(void __iomem *ioaddr, size_t offs, u32 bit_mask)
 {
-        u32 value = ioread32(ioaddr);
+        u32 value = csrrd32(ioaddr, offs);
        value &= ~bit_mask;
-        iowrite32(value, ioaddr);
+        csrwr32(value, ioaddr, offs);
 }
-int tse_bit_is_set(void __iomem *ioaddr, u32 bit_mask)
+int tse_bit_is_set(void __iomem *ioaddr, size_t offs, u32 bit_mask)
 {
-        u32 value = ioread32(ioaddr);
+        u32 value = csrrd32(ioaddr, offs);
        return (value & bit_mask) ? 1 : 0;
 }
-int tse_bit_is_clear(void __iomem *ioaddr, u32 bit_mask)
+int tse_bit_is_clear(void __iomem *ioaddr, size_t offs, u32 bit_mask)
 {
-        u32 value = ioread32(ioaddr);
+        u32 value = csrrd32(ioaddr, offs);
        return (value & bit_mask) ? 0 : 1;
 }
diff --git a/drivers/net/ethernet/altera/altera_utils.h b/drivers/net/ethernet/altera/altera_utils.h
index ce1db36d3583..baf100ccf587 100644
--- a/drivers/net/ethernet/altera/altera_utils.h
+++ b/drivers/net/ethernet/altera/altera_utils.h
@@ -19,9 +19,9 @@
 #ifndef __ALTERA_UTILS_H__
 #define __ALTERA_UTILS_H__
-void tse_set_bit(void __iomem *ioaddr, u32 bit_mask);
+void tse_set_bit(void __iomem *ioaddr, size_t offs, u32 bit_mask);
-void tse_clear_bit(void __iomem *ioaddr, u32 bit_mask);
+void tse_clear_bit(void __iomem *ioaddr, size_t offs, u32 bit_mask);
-int tse_bit_is_set(void __iomem *ioaddr, u32 bit_mask);
+int tse_bit_is_set(void __iomem *ioaddr, size_t offs, u32 bit_mask);
-int tse_bit_is_clear(void __iomem *ioaddr, u32 bit_mask);
+int tse_bit_is_clear(void __iomem *ioaddr, size_t offs, u32 bit_mask);
 #endif /* __ALTERA_UTILS_H__*/
diff --git a/drivers/net/ethernet/arc/emac.h b/drivers/net/ethernet/arc/emac.h
index 928fac6dd10a..53f85bf71526 100644
--- a/drivers/net/ethernet/arc/emac.h
+++ b/drivers/net/ethernet/arc/emac.h
@@ -11,6 +11,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/netdevice.h>
 #include <linux/phy.h>
+#include <linux/clk.h>
 /* STATUS and ENABLE Register bit masks */
 #define TXINT_MASK      (1<<0)  /* Transmit interrupt */
@@ -131,6 +132,7 @@ struct arc_emac_priv {
        struct mii_bus *bus;
        void __iomem *regs;
+        struct clk *clk;
        struct napi_struct napi;
        struct net_device_stats stats;
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index eeecc29cf5b7..d647a7d115ac 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -574,6 +574,18 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        return NETDEV_TX_OK;
 }
+static void arc_emac_set_address_internal(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        unsigned int addr_low, addr_hi;
+        addr_low = le32_to_cpu(*(__le32 *) &ndev->dev_addr[0]);
+        addr_hi = le16_to_cpu(*(__le16 *) &ndev->dev_addr[4]);
+        arc_reg_set(priv, R_ADDRL, addr_low);
+        arc_reg_set(priv, R_ADDRH, addr_hi);
+}
 /**
 * arc_emac_set_address - Set the MAC address for this device.
 * @ndev:       Pointer to net_device structure.
@@ -587,9 +599,7 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
 */
 static int arc_emac_set_address(struct net_device *ndev, void *p)
 {
-        struct arc_emac_priv *priv = netdev_priv(ndev);
        struct sockaddr *addr = p;
-        unsigned int addr_low, addr_hi;
        if (netif_running(ndev))
                return -EBUSY;
@@ -599,11 +609,7 @@ static int arc_emac_set_address(struct net_device *ndev, void *p)
        memcpy(ndev->dev_addr, addr->sa_data, ndev->addr_len);
-        addr_low = le32_to_cpu(*(__le32 *) &ndev->dev_addr[0]);
+        arc_emac_set_address_internal(ndev);
-        addr_hi = le16_to_cpu(*(__le16 *) &ndev->dev_addr[4]);
-        arc_reg_set(priv, R_ADDRL, addr_low);
-        arc_reg_set(priv, R_ADDRH, addr_hi);
        return 0;
 }
@@ -643,13 +649,6 @@ static int arc_emac_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        /* Get CPU clock frequency from device tree */
-        if (of_property_read_u32(pdev->dev.of_node, "clock-frequency",
-                                 &clock_frequency)) {
-                dev_err(&pdev->dev, "failed to retrieve <clock-frequency> from device tree\n");
-                return -EINVAL;
-        }
        /* Get IRQ from device tree */
        irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
        if (!irq) {
@@ -677,17 +676,36 @@ static int arc_emac_probe(struct platform_device *pdev)
        priv->regs = devm_ioremap_resource(&pdev->dev, &res_regs);
        if (IS_ERR(priv->regs)) {
                err = PTR_ERR(priv->regs);
-                goto out;
+                goto out_netdev;
        }
        dev_dbg(&pdev->dev, "Registers base address is 0x%p\n", priv->regs);
+        priv->clk = of_clk_get(pdev->dev.of_node, 0);
+        if (IS_ERR(priv->clk)) {
+                /* Get CPU clock frequency from device tree */
+                if (of_property_read_u32(pdev->dev.of_node, "clock-frequency",
+                                        &clock_frequency)) {
+                        dev_err(&pdev->dev, "failed to retrieve <clock-frequency> from device tree\n");
+                        err = -EINVAL;
+                        goto out_netdev;
+                }
+        } else {
+                err = clk_prepare_enable(priv->clk);
+                if (err) {
+                        dev_err(&pdev->dev, "failed to enable clock\n");
+                        goto out_clkget;
+                }
+                clock_frequency = clk_get_rate(priv->clk);
+        }
        id = arc_reg_get(priv, R_ID);
        /* Check for EMAC revision 5 or 7, magic number */
        if (!(id == 0x0005fd02 || id == 0x0007fd02)) {
                dev_err(&pdev->dev, "ARC EMAC not detected, id=0x%x\n", id);
                err = -ENODEV;
-                goto out;
+                goto out_clken;
        }
        dev_info(&pdev->dev, "ARC EMAC detected with id: 0x%x\n", id);
@@ -702,7 +720,7 @@ static int arc_emac_probe(struct platform_device *pdev)
                               ndev->name, ndev);
        if (err) {
                dev_err(&pdev->dev, "could not allocate IRQ\n");
-                goto out;
+                goto out_clken;
        }
        /* Get MAC address from device tree */
@@ -713,6 +731,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        else
                eth_hw_addr_random(ndev);
+        arc_emac_set_address_internal(ndev);
        dev_info(&pdev->dev, "MAC address is now %pM\n", ndev->dev_addr);
        /* Do 1 allocation instead of 2 separate ones for Rx and Tx BD rings */
@@ -722,7 +741,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        if (!priv->rxbd) {
                dev_err(&pdev->dev, "failed to allocate data buffers\n");
                err = -ENOMEM;
-                goto out;
+                goto out_clken;
        }
        priv->txbd = priv->rxbd + RX_BD_NUM;
@@ -734,7 +753,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        err = arc_mdio_probe(pdev, priv);
        if (err) {
                dev_err(&pdev->dev, "failed to probe MII bus\n");
-                goto out;
+                goto out_clken;
        }
        priv->phy_dev = of_phy_connect(ndev, phy_node, arc_emac_adjust_link, 0,
@@ -742,7 +761,7 @@ static int arc_emac_probe(struct platform_device *pdev)
        if (!priv->phy_dev) {
                dev_err(&pdev->dev, "of_phy_connect() failed\n");
                err = -ENODEV;
-                goto out;
+                goto out_mdio;
        }
        dev_info(&pdev->dev, "connected to %s phy with id 0x%x\n",
@@ -752,14 +771,25 @@ static int arc_emac_probe(struct platform_device *pdev)
        err = register_netdev(ndev);
        if (err) {
-                netif_napi_del(&priv->napi);
                dev_err(&pdev->dev, "failed to register network device\n");
-                goto out;
+                goto out_netif_api;
        }
        return 0;
-out:
+out_netif_api:
+        netif_napi_del(&priv->napi);
+        phy_disconnect(priv->phy_dev);
+        priv->phy_dev = NULL;
+out_mdio:
+        arc_mdio_remove(priv);
+out_clken:
+        if (!IS_ERR(priv->clk))
+                clk_disable_unprepare(priv->clk);
+out_clkget:
+        if (!IS_ERR(priv->clk))
+                clk_put(priv->clk);
+out_netdev:
        free_netdev(ndev);
        return err;
 }
@@ -774,6 +804,12 @@ static int arc_emac_remove(struct platform_device *pdev)
        arc_mdio_remove(priv);
        unregister_netdev(ndev);
        netif_napi_del(&priv->napi);
+        if (!IS_ERR(priv->clk)) {
+                clk_disable_unprepare(priv->clk);
+                clk_put(priv->clk);
+        }
        free_netdev(ndev);
        return 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index a8efb18e42fa..0ab83708b6a1 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -8627,6 +8627,7 @@ bnx2_remove_one(struct pci_dev *pdev)
        pci_disable_device(pdev);
 }
+#ifdef CONFIG_PM_SLEEP
 static int
 bnx2_suspend(struct device *device)
 {
@@ -8665,7 +8666,6 @@ bnx2_resume(struct device *device)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
 static SIMPLE_DEV_PM_OPS(bnx2_pm_ops, bnx2_suspend, bnx2_resume);
 #define BNX2_PM_OPS (&bnx2_pm_ops)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index a78edaccceee..3b0d43154e67 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10051,8 +10051,8 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
 #define BCM_5710_UNDI_FW_MF_MAJOR       (0x07)
 #define BCM_5710_UNDI_FW_MF_MINOR       (0x08)
 #define BCM_5710_UNDI_FW_MF_VERS        (0x05)
-#define BNX2X_PREV_UNDI_MF_PORT(p)      (0x1a150c + ((p) << 4))
+#define BNX2X_PREV_UNDI_MF_PORT(p) (BAR_TSTRORM_INTMEM + 0x150c + ((p) << 4))
-#define BNX2X_PREV_UNDI_MF_FUNC(f)      (0x1a184c + ((f) << 4))
+#define BNX2X_PREV_UNDI_MF_FUNC(f) (BAR_TSTRORM_INTMEM + 0x184c + ((f) << 4))
 static bool bnx2x_prev_unload_undi_fw_supports_mf(struct bnx2x *bp)
 {
        u8 major, minor, version;
@@ -10352,6 +10352,7 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
        /* Reset should be performed after BRB is emptied */
        if (reset_reg & MISC_REGISTERS_RESET_REG_1_RST_BRB1) {
                u32 timer_count = 1000;
+                bool need_write = true;
                /* Close the MAC Rx to prevent BRB from filling up */
                bnx2x_prev_unload_close_mac(bp, &mac_vals);
@@ -10398,7 +10399,10 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
                         * cleaning methods - might be redundant but harmless.
                         */
                        if (bnx2x_prev_unload_undi_fw_supports_mf(bp)) {
-                                bnx2x_prev_unload_undi_mf(bp);
+                                if (need_write) {
+                                        bnx2x_prev_unload_undi_mf(bp);
+                                        need_write = false;
+                                }
                        } else if (prev_undi) {
                                /* If UNDI resides in memory,
                                 * manually increment it
@@ -13233,6 +13237,8 @@ static void __bnx2x_remove(struct pci_dev *pdev,
                                iounmap(bp->doorbells);
                        bnx2x_release_firmware(bp);
+                } else {
+                        bnx2x_vf_pci_dealloc(bp);
                }
                bnx2x_free_mem_bp(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 5c523b32db70..b8078d50261b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -427,7 +427,9 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp,
        if (filter->add && filter->type == BNX2X_VF_FILTER_VLAN &&
            (atomic_read(&bnx2x_vfq(vf, qid, vlan_count)) >=
             vf_vlan_rules_cnt(vf))) {
-                BNX2X_ERR("No credits for vlan\n");
+                BNX2X_ERR("No credits for vlan [%d >= %d]\n",
+                          atomic_read(&bnx2x_vfq(vf, qid, vlan_count)),
+                          vf_vlan_rules_cnt(vf));
                return -ENOMEM;
        }
@@ -610,6 +612,7 @@ int bnx2x_vf_mcast(struct bnx2x *bp, struct bnx2x_virtf *vf,
                }
                /* add new mcasts */
+                mcast.mcast_list_len = mc_num;
                rc = bnx2x_config_mcast(bp, &mcast, BNX2X_MCAST_CMD_ADD);
                if (rc)
                        BNX2X_ERR("Faled to add multicasts\n");
@@ -837,6 +840,29 @@ int bnx2x_vf_flr_clnup_epilog(struct bnx2x *bp, u8 abs_vfid)
        return 0;
 }
+static void bnx2x_iov_re_set_vlan_filters(struct bnx2x *bp,
+                                          struct bnx2x_virtf *vf,
+                                          int new)
+{
+        int num = vf_vlan_rules_cnt(vf);
+        int diff = new - num;
+        bool rc = true;
+        DP(BNX2X_MSG_IOV, "vf[%d] - %d vlan filter credits [previously %d]\n",
+           vf->abs_vfid, new, num);
+        if (diff > 0)
+                rc = bp->vlans_pool.get(&bp->vlans_pool, diff);
+        else if (diff < 0)
+                rc = bp->vlans_pool.put(&bp->vlans_pool, -diff);
+        if (rc)
+                vf_vlan_rules_cnt(vf) = new;
+        else
+                DP(BNX2X_MSG_IOV, "vf[%d] - Failed to configure vlan filter credits change\n",
+                   vf->abs_vfid);
+}
 /* must be called after the number of PF queues and the number of VFs are
 * both known
 */
@@ -854,9 +880,11 @@ bnx2x_iov_static_resc(struct bnx2x *bp, struct bnx2x_virtf *vf)
        resc->num_mac_filters = 1;
        /* divvy up vlan rules */
+        bnx2x_iov_re_set_vlan_filters(bp, vf, 0);
        vlan_count = bp->vlans_pool.check(&bp->vlans_pool);
        vlan_count = 1 << ilog2(vlan_count);
-        resc->num_vlan_filters = vlan_count / BNX2X_NR_VIRTFN(bp);
+        bnx2x_iov_re_set_vlan_filters(bp, vf,
+                                      vlan_count / BNX2X_NR_VIRTFN(bp));
        /* no real limitation */
        resc->num_mc_filters = 0;
@@ -1478,10 +1506,6 @@ int bnx2x_iov_nic_init(struct bnx2x *bp)
                bnx2x_iov_static_resc(bp, vf);
                /* queues are initialized during VF-ACQUIRE */
-                /* reserve the vf vlan credit */
-                bp->vlans_pool.get(&bp->vlans_pool, vf_vlan_rules_cnt(vf));
                vf->filter_state = 0;
                vf->sp_cl_id = bnx2x_fp(bp, 0, cl_id);
@@ -1912,11 +1936,12 @@ int bnx2x_vf_chk_avail_resc(struct bnx2x *bp, struct bnx2x_virtf *vf,
        u8 rxq_cnt = vf_rxq_count(vf) ? : bnx2x_vf_max_queue_cnt(bp, vf);
        u8 txq_cnt = vf_txq_count(vf) ? : bnx2x_vf_max_queue_cnt(bp, vf);
+        /* Save a vlan filter for the Hypervisor */
        return ((req_resc->num_rxqs <= rxq_cnt) &&
                (req_resc->num_txqs <= txq_cnt) &&
                (req_resc->num_sbs <= vf_sb_count(vf))   &&
                (req_resc->num_mac_filters <= vf_mac_rules_cnt(vf)) &&
-                (req_resc->num_vlan_filters <= vf_vlan_rules_cnt(vf)));
+                (req_resc->num_vlan_filters <= vf_vlan_rules_visible_cnt(vf)));
 }
 /* CORE VF API */
@@ -1972,14 +1997,14 @@ int bnx2x_vf_acquire(struct bnx2x *bp, struct bnx2x_virtf *vf,
        vf_txq_count(vf) = resc->num_txqs ? : bnx2x_vf_max_queue_cnt(bp, vf);
        if (resc->num_mac_filters)
                vf_mac_rules_cnt(vf) = resc->num_mac_filters;
-        if (resc->num_vlan_filters)
+        /* Add an additional vlan filter credit for the hypervisor */
-                vf_vlan_rules_cnt(vf) = resc->num_vlan_filters;
+        bnx2x_iov_re_set_vlan_filters(bp, vf, resc->num_vlan_filters + 1);
        DP(BNX2X_MSG_IOV,
           "Fulfilling vf request: sb count %d, tx_count %d, rx_count %d, mac_rules_count %d, vlan_rules_count %d\n",
           vf_sb_count(vf), vf_rxq_count(vf),
           vf_txq_count(vf), vf_mac_rules_cnt(vf),
-           vf_vlan_rules_cnt(vf));
+           vf_vlan_rules_visible_cnt(vf));
        /* Initialize the queues */
        if (!vf->vfqs) {
@@ -2670,7 +2695,7 @@ out:
                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_MAC);
        }
-        return 0;
+        return rc;
 }
 int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
@@ -2896,6 +2921,14 @@ void __iomem *bnx2x_vf_doorbells(struct bnx2x *bp)
        return bp->regview + PXP_VF_ADDR_DB_START;
 }
+void bnx2x_vf_pci_dealloc(struct bnx2x *bp)
+{
+        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
+                       sizeof(struct bnx2x_vf_mbx_msg));
+        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
+                       sizeof(union pf_vf_bulletin));
+}
 int bnx2x_vf_pci_alloc(struct bnx2x *bp)
 {
        mutex_init(&bp->vf2pf_mutex);
@@ -2915,10 +2948,7 @@ int bnx2x_vf_pci_alloc(struct bnx2x *bp)
        return 0;
 alloc_mem_err:
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
+        bnx2x_vf_pci_dealloc(bp);
-                       sizeof(struct bnx2x_vf_mbx_msg));
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
-                       sizeof(union pf_vf_bulletin));
        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 8bf764570eef..6929adba52f9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -159,6 +159,8 @@ struct bnx2x_virtf {
 #define vf_mac_rules_cnt(vf)            ((vf)->alloc_resc.num_mac_filters)
 #define vf_vlan_rules_cnt(vf)           ((vf)->alloc_resc.num_vlan_filters)
 #define vf_mc_rules_cnt(vf)             ((vf)->alloc_resc.num_mc_filters)
+        /* Hide a single vlan filter credit for the hypervisor */
+#define vf_vlan_rules_visible_cnt(vf)   (vf_vlan_rules_cnt(vf) - 1)
        u8 sb_count;    /* actual number of SBs */
        u8 igu_base_id; /* base igu status block id */
@@ -502,6 +504,7 @@ static inline int bnx2x_vf_ustorm_prods_offset(struct bnx2x *bp,
 enum sample_bulletin_result bnx2x_sample_bulletin(struct bnx2x *bp);
 void bnx2x_timer_sriov(struct bnx2x *bp);
 void __iomem *bnx2x_vf_doorbells(struct bnx2x *bp);
+void bnx2x_vf_pci_dealloc(struct bnx2x *bp);
 int bnx2x_vf_pci_alloc(struct bnx2x *bp);
 int bnx2x_enable_sriov(struct bnx2x *bp);
 void bnx2x_disable_sriov(struct bnx2x *bp);
@@ -568,6 +571,7 @@ static inline void __iomem *bnx2x_vf_doorbells(struct bnx2x *bp)
        return NULL;
 }
+static inline void bnx2x_vf_pci_dealloc(struct bnx2 *bp) {return 0; }
 static inline int bnx2x_vf_pci_alloc(struct bnx2x *bp) {return 0; }
 static inline void bnx2x_pf_set_vfs_vlan(struct bnx2x *bp) {}
 static inline int bnx2x_sriov_configure(struct pci_dev *dev, int num_vfs) {return 0; }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 0622884596b2..784c7155b98a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -747,7 +747,7 @@ int bnx2x_vfpf_config_mac(struct bnx2x *bp, u8 *addr, u8 vf_qid, bool set)
 out:
        bnx2x_vfpf_finalize(bp, &req->first_tlv);
-        return 0;
+        return rc;
 }
 /* request pf to config rss table for vf queues*/
@@ -1163,7 +1163,7 @@ static void bnx2x_vf_mbx_acquire_resp(struct bnx2x *bp, struct bnx2x_virtf *vf,
                        bnx2x_vf_max_queue_cnt(bp, vf);
                resc->num_sbs = vf_sb_count(vf);
                resc->num_mac_filters = vf_mac_rules_cnt(vf);
-                resc->num_vlan_filters = vf_vlan_rules_cnt(vf);
+                resc->num_vlan_filters = vf_vlan_rules_visible_cnt(vf);
                resc->num_mc_filters = 0;
                if (status == PFVF_STATUS_SUCCESS) {
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index b9f7022f4e81..e5d95c5ce1ad 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12286,7 +12286,9 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
        if (tg3_flag(tp, MAX_RXPEND_64) &&
            tp->rx_pending > 63)
                tp->rx_pending = 63;
-        tp->rx_jumbo_pending = ering->rx_jumbo_pending;
+        if (tg3_flag(tp, JUMBO_RING_ENABLE))
+                tp->rx_jumbo_pending = ering->rx_jumbo_pending;
        for (i = 0; i < tp->irq_max; i++)
                tp->napi[i].tx_pending = ering->tx_pending;
diff --git a/drivers/net/ethernet/cadence/Kconfig b/drivers/net/ethernet/cadence/Kconfig
index 751d5c7b312d..9e089d24466e 100644
--- a/drivers/net/ethernet/cadence/Kconfig
+++ b/drivers/net/ethernet/cadence/Kconfig
@@ -4,7 +4,7 @@
 config NET_CADENCE
        bool "Cadence devices"
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && (ARM || AVR32 || MICROBLAZE || COMPILE_TEST)
        default y
        ---help---
          If you have a network (Ethernet) card belonging to this class, say Y.
@@ -22,7 +22,7 @@ if NET_CADENCE
 config ARM_AT91_ETHER
        tristate "AT91RM9200 Ethernet support"
-        depends on HAS_DMA
+        depends on HAS_DMA && (ARCH_AT91RM9200 || COMPILE_TEST)
        select MACB
        ---help---
          If you wish to compile a kernel for the AT91RM9200 and enable
@@ -30,7 +30,7 @@ config ARM_AT91_ETHER
 config MACB
        tristate "Cadence MACB/GEM support"
-        depends on HAS_DMA
+        depends on HAS_DMA && (PLATFORM_AT32AP || ARCH_AT91 || ARCH_PICOXCELL || ARCH_ZYNQ || MICROBLAZE || COMPILE_TEST)
        select PHYLIB
        ---help---
          The Cadence MACB ethernet interface is found on many Atmel AT32 and
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index ca97005e24b4..e9daa072ebb4 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -599,25 +599,16 @@ static void gem_rx_refill(struct macb *bp)
 {
        unsigned int            entry;
        struct sk_buff          *skb;
-        struct macb_dma_desc    *desc;
        dma_addr_t              paddr;
        while (CIRC_SPACE(bp->rx_prepared_head, bp->rx_tail, RX_RING_SIZE) > 0) {
-                u32 addr, ctrl;
                entry = macb_rx_ring_wrap(bp->rx_prepared_head);
-                desc = &bp->rx_ring[entry];
                /* Make hw descriptor updates visible to CPU */
                rmb();
-                addr = desc->addr;
-                ctrl = desc->ctrl;
                bp->rx_prepared_head++;
-                if ((addr & MACB_BIT(RX_USED)))
-                        continue;
                if (bp->rx_skbuff[entry] == NULL) {
                        /* allocate sk_buff for this free entry in ring */
                        skb = netdev_alloc_skb(bp->dev, bp->rx_buffer_size);
@@ -698,7 +689,6 @@ static int gem_rx(struct macb *bp, int budget)
                if (!(addr & MACB_BIT(RX_USED)))
                        break;
-                desc->addr &= ~MACB_BIT(RX_USED);
                bp->rx_tail++;
                count++;
@@ -891,16 +881,15 @@ static int macb_poll(struct napi_struct *napi, int budget)
        if (work_done < budget) {
                napi_complete(napi);
-                /*
-                 * We've done what we can to clean the buffers. Make sure we
-                 * get notified when new packets arrive.
-                 */
-                macb_writel(bp, IER, MACB_RX_INT_FLAGS);
                /* Packets received while interrupts were disabled */
                status = macb_readl(bp, RSR);
-                if (unlikely(status))
+                if (status) {
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_BIT(RCOMP));
                        napi_reschedule(napi);
+                } else {
+                        macb_writel(bp, IER, MACB_RX_INT_FLAGS);
+                }
        }
        /* TODO: Handle errors */
@@ -951,6 +940,10 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                if (unlikely(status & (MACB_TX_ERR_FLAGS))) {
                        macb_writel(bp, IDR, MACB_TX_INT_FLAGS);
                        schedule_work(&bp->tx_error_task);
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_TX_ERR_FLAGS);
                        break;
                }
@@ -968,6 +961,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                                bp->hw_stats.gem.rx_overruns++;
                        else
                                bp->hw_stats.macb.rx_overruns++;
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_BIT(ISR_ROVR));
                }
                if (status & MACB_BIT(HRESP)) {
@@ -977,6 +973,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                         * (work queue?)
                         */
                        netdev_err(dev, "DMA bus error: HRESP not OK\n");
+                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+                                macb_writel(bp, ISR, MACB_BIT(HRESP));
                }
                status = macb_readl(bp, ISR);
@@ -1113,7 +1112,7 @@ static void gem_free_rx_buffers(struct macb *bp)
                desc = &bp->rx_ring[i];
                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
-                dma_unmap_single(&bp->pdev->dev, addr, skb->len,
+                dma_unmap_single(&bp->pdev->dev, addr, bp->rx_buffer_size,
                                 DMA_FROM_DEVICE);
                dev_kfree_skb_any(skb);
                skb = NULL;
diff --git a/drivers/net/ethernet/chelsio/Kconfig b/drivers/net/ethernet/chelsio/Kconfig
index d40c994a4f6a..570222c33410 100644
--- a/drivers/net/ethernet/chelsio/Kconfig
+++ b/drivers/net/ethernet/chelsio/Kconfig
@@ -67,13 +67,13 @@ config CHELSIO_T3
          will be called cxgb3.
 config CHELSIO_T4
-        tristate "Chelsio Communications T4 Ethernet support"
+        tristate "Chelsio Communications T4/T5 Ethernet support"
        depends on PCI
        select FW_LOADER
        select MDIO
        ---help---
-          This driver supports Chelsio T4-based gigabit and 10Gb Ethernet
+          This driver supports Chelsio T4 and T5 based gigabit, 10Gb Ethernet
-          adapters.
+          adapter and T5 based 40Gb Ethernet adapter.
          For general information about Chelsio and our products, visit
          our website at <http://www.chelsio.com>.
@@ -87,11 +87,12 @@ config CHELSIO_T4
          will be called cxgb4.
 config CHELSIO_T4VF
-        tristate "Chelsio Communications T4 Virtual Function Ethernet support"
+        tristate "Chelsio Communications T4/T5 Virtual Function Ethernet support"
        depends on PCI
        ---help---
-          This driver supports Chelsio T4-based gigabit and 10Gb Ethernet
+          This driver supports Chelsio T4 and T5 based gigabit, 10Gb Ethernet
-          adapters with PCI-E SR-IOV Virtual Functions.
+          adapters and T5 based 40Gb Ethernet adapters with PCI-E SR-IOV Virtual
+          Functions.
          For general information about Chelsio and our products, visit
          our website at <http://www.chelsio.com>.
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 6fe58913403a..24e16e3301e0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5870,6 +5870,8 @@ static void print_port_info(const struct net_device *dev)
                spd = " 2.5 GT/s";
        else if (adap->params.pci.speed == PCI_EXP_LNKSTA_CLS_5_0GB)
                spd = " 5 GT/s";
+        else if (adap->params.pci.speed == PCI_EXP_LNKSTA_CLS_8_0GB)
+                spd = " 8 GT/s";
        if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_100M)
                bufp += sprintf(bufp, "100/");
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
index 81e8402a74b4..8a96572fdde0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
@@ -154,7 +154,7 @@ static int write_l2e(struct adapter *adap, struct l2t_entry *e, int sync)
        req->params = htons(L2T_W_PORT(e->lport) | L2T_W_NOREPLY(!sync));
        req->l2t_idx = htons(e->idx);
        req->vlan = htons(e->vlan);
-        if (e->neigh)
+        if (e->neigh && !(e->neigh->dev->flags & IFF_LOOPBACK))
                memcpy(e->dmac, e->neigh->ha, sizeof(e->dmac));
        memcpy(req->dst_mac, e->dmac, sizeof(req->dst_mac));
@@ -394,6 +394,8 @@ struct l2t_entry *cxgb4_l2t_get(struct l2t_data *d, struct neighbour *neigh,
        if (e) {
                spin_lock(&e->lock);          /* avoid race with t4_l2t_free */
                e->state = L2T_STATE_RESOLVING;
+                if (neigh->dev->flags & IFF_LOOPBACK)
+                        memcpy(e->dmac, physdev->dev_addr, sizeof(e->dmac));
                memcpy(e->addr, addr, addr_len);
                e->ifindex = ifidx;
                e->hash = hash;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index fb2fe65903c2..bba67681aeaa 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -682,7 +682,7 @@ enum {
        SF_RD_ID        = 0x9f,       /* read ID */
        SF_ERASE_SECTOR = 0xd8,       /* erase sector */
-        FW_MAX_SIZE = 512 * 1024,
+        FW_MAX_SIZE = 16 * SF_SEC_SIZE,
 };
 /**
diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c
new file mode 100644
index 000000000000..4884205e56ee
--- /dev/null
+++ b/drivers/net/ethernet/ec_bhf.c
@@ -0,0 +1,706 @@
+ /*
+ * drivers/net/ethernet/beckhoff/ec_bhf.c
+ *
+ * Copyright (C) 2014 Darek Marcinkiewicz <reksio@newterm.pl>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+/* This is a driver for EtherCAT master module present on CCAT FPGA.
+ * Those can be found on Bechhoff CX50xx industrial PCs.
+ */
+#if 0
+#define DEBUG
+#endif
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/hrtimer.h>
+#include <linux/interrupt.h>
+#include <linux/stat.h>
+#define TIMER_INTERVAL_NSEC     20000
+#define INFO_BLOCK_SIZE         0x10
+#define INFO_BLOCK_TYPE         0x0
+#define INFO_BLOCK_REV          0x2
+#define INFO_BLOCK_BLK_CNT      0x4
+#define INFO_BLOCK_TX_CHAN      0x4
+#define INFO_BLOCK_RX_CHAN      0x5
+#define INFO_BLOCK_OFFSET       0x8
+#define EC_MII_OFFSET           0x4
+#define EC_FIFO_OFFSET          0x8
+#define EC_MAC_OFFSET           0xc
+#define MAC_FRAME_ERR_CNT       0x0
+#define MAC_RX_ERR_CNT          0x1
+#define MAC_CRC_ERR_CNT         0x2
+#define MAC_LNK_LST_ERR_CNT     0x3
+#define MAC_TX_FRAME_CNT        0x10
+#define MAC_RX_FRAME_CNT        0x14
+#define MAC_TX_FIFO_LVL         0x20
+#define MAC_DROPPED_FRMS        0x28
+#define MAC_CONNECTED_CCAT_FLAG 0x78
+#define MII_MAC_ADDR            0x8
+#define MII_MAC_FILT_FLAG       0xe
+#define MII_LINK_STATUS         0xf
+#define FIFO_TX_REG             0x0
+#define FIFO_TX_RESET           0x8
+#define FIFO_RX_REG             0x10
+#define FIFO_RX_ADDR_VALID      (1u << 31)
+#define FIFO_RX_RESET           0x18
+#define DMA_CHAN_OFFSET         0x1000
+#define DMA_CHAN_SIZE           0x8
+#define DMA_WINDOW_SIZE_MASK    0xfffffffc
+static struct pci_device_id ids[] = {
+        { PCI_DEVICE(0x15ec, 0x5000), },
+        { 0, }
+};
+MODULE_DEVICE_TABLE(pci, ids);
+struct rx_header {
+#define RXHDR_NEXT_ADDR_MASK    0xffffffu
+#define RXHDR_NEXT_VALID        (1u << 31)
+        __le32 next;
+#define RXHDR_NEXT_RECV_FLAG    0x1
+        __le32 recv;
+#define RXHDR_LEN_MASK          0xfffu
+        __le16 len;
+        __le16 port;
+        __le32 reserved;
+        u8 timestamp[8];
+} __packed;
+#define PKT_PAYLOAD_SIZE        0x7e8
+struct rx_desc {
+        struct rx_header header;
+        u8 data[PKT_PAYLOAD_SIZE];
+} __packed;
+struct tx_header {
+        __le16 len;
+#define TX_HDR_PORT_0           0x1
+#define TX_HDR_PORT_1           0x2
+        u8 port;
+        u8 ts_enable;
+#define TX_HDR_SENT             0x1
+        __le32 sent;
+        u8 timestamp[8];
+} __packed;
+struct tx_desc {
+        struct tx_header header;
+        u8 data[PKT_PAYLOAD_SIZE];
+} __packed;
+#define FIFO_SIZE               64
+static long polling_frequency = TIMER_INTERVAL_NSEC;
+struct bhf_dma {
+        u8 *buf;
+        size_t len;
+        dma_addr_t buf_phys;
+        u8 *alloc;
+        size_t alloc_len;
+        dma_addr_t alloc_phys;
+};
+struct ec_bhf_priv {
+        struct net_device *net_dev;
+        struct pci_dev *dev;
+        void * __iomem io;
+        void * __iomem dma_io;
+        struct hrtimer hrtimer;
+        int tx_dma_chan;
+        int rx_dma_chan;
+        void * __iomem ec_io;
+        void * __iomem fifo_io;
+        void * __iomem mii_io;
+        void * __iomem mac_io;
+        struct bhf_dma rx_buf;
+        struct rx_desc *rx_descs;
+        int rx_dnext;
+        int rx_dcount;
+        struct bhf_dma tx_buf;
+        struct tx_desc *tx_descs;
+        int tx_dcount;
+        int tx_dnext;
+        u64 stat_rx_bytes;
+        u64 stat_tx_bytes;
+};
+#define PRIV_TO_DEV(priv) (&(priv)->dev->dev)
+#define ETHERCAT_MASTER_ID      0x14
+static void ec_bhf_print_status(struct ec_bhf_priv *priv)
+{
+        struct device *dev = PRIV_TO_DEV(priv);
+        dev_dbg(dev, "Frame error counter: %d\n",
+                ioread8(priv->mac_io + MAC_FRAME_ERR_CNT));
+        dev_dbg(dev, "RX error counter: %d\n",
+                ioread8(priv->mac_io + MAC_RX_ERR_CNT));
+        dev_dbg(dev, "CRC error counter: %d\n",
+                ioread8(priv->mac_io + MAC_CRC_ERR_CNT));
+        dev_dbg(dev, "TX frame counter: %d\n",
+                ioread32(priv->mac_io + MAC_TX_FRAME_CNT));
+        dev_dbg(dev, "RX frame counter: %d\n",
+                ioread32(priv->mac_io + MAC_RX_FRAME_CNT));
+        dev_dbg(dev, "TX fifo level: %d\n",
+                ioread8(priv->mac_io + MAC_TX_FIFO_LVL));
+        dev_dbg(dev, "Dropped frames: %d\n",
+                ioread8(priv->mac_io + MAC_DROPPED_FRMS));
+        dev_dbg(dev, "Connected with CCAT slot: %d\n",
+                ioread8(priv->mac_io + MAC_CONNECTED_CCAT_FLAG));
+        dev_dbg(dev, "Link status: %d\n",
+                ioread8(priv->mii_io + MII_LINK_STATUS));
+}
+static void ec_bhf_reset(struct ec_bhf_priv *priv)
+{
+        iowrite8(0, priv->mac_io + MAC_FRAME_ERR_CNT);
+        iowrite8(0, priv->mac_io + MAC_RX_ERR_CNT);
+        iowrite8(0, priv->mac_io + MAC_CRC_ERR_CNT);
+        iowrite8(0, priv->mac_io + MAC_LNK_LST_ERR_CNT);
+        iowrite32(0, priv->mac_io + MAC_TX_FRAME_CNT);
+        iowrite32(0, priv->mac_io + MAC_RX_FRAME_CNT);
+        iowrite8(0, priv->mac_io + MAC_DROPPED_FRMS);
+        iowrite8(0, priv->fifo_io + FIFO_TX_RESET);
+        iowrite8(0, priv->fifo_io + FIFO_RX_RESET);
+        iowrite8(0, priv->mac_io + MAC_TX_FIFO_LVL);
+}
+static void ec_bhf_send_packet(struct ec_bhf_priv *priv, struct tx_desc *desc)
+{
+        u32 len = le16_to_cpu(desc->header.len) + sizeof(desc->header);
+        u32 addr = (u8 *)desc - priv->tx_buf.buf;
+        iowrite32((ALIGN(len, 8) << 24) | addr, priv->fifo_io + FIFO_TX_REG);
+        dev_dbg(PRIV_TO_DEV(priv), "Done sending packet\n");
+}
+static int ec_bhf_desc_sent(struct tx_desc *desc)
+{
+        return le32_to_cpu(desc->header.sent) & TX_HDR_SENT;
+}
+static void ec_bhf_process_tx(struct ec_bhf_priv *priv)
+{
+        if (unlikely(netif_queue_stopped(priv->net_dev))) {
+                /* Make sure that we perceive changes to tx_dnext. */
+                smp_rmb();
+                if (ec_bhf_desc_sent(&priv->tx_descs[priv->tx_dnext]))
+                        netif_wake_queue(priv->net_dev);
+        }
+}
+static int ec_bhf_pkt_received(struct rx_desc *desc)
+{
+        return le32_to_cpu(desc->header.recv) & RXHDR_NEXT_RECV_FLAG;
+}
+static void ec_bhf_add_rx_desc(struct ec_bhf_priv *priv, struct rx_desc *desc)
+{
+        iowrite32(FIFO_RX_ADDR_VALID | ((u8 *)(desc) - priv->rx_buf.buf),
+                  priv->fifo_io + FIFO_RX_REG);
+}
+static void ec_bhf_process_rx(struct ec_bhf_priv *priv)
+{
+        struct rx_desc *desc = &priv->rx_descs[priv->rx_dnext];
+        struct device *dev = PRIV_TO_DEV(priv);
+        while (ec_bhf_pkt_received(desc)) {
+                int pkt_size = (le16_to_cpu(desc->header.len) &
+                               RXHDR_LEN_MASK) - sizeof(struct rx_header) - 4;
+                u8 *data = desc->data;
+                struct sk_buff *skb;
+                skb = netdev_alloc_skb_ip_align(priv->net_dev, pkt_size);
+                dev_dbg(dev, "Received packet, size: %d\n", pkt_size);
+                if (skb) {
+                        memcpy(skb_put(skb, pkt_size), data, pkt_size);
+                        skb->protocol = eth_type_trans(skb, priv->net_dev);
+                        dev_dbg(dev, "Protocol type: %x\n", skb->protocol);
+                        priv->stat_rx_bytes += pkt_size;
+                        netif_rx(skb);
+                } else {
+                        dev_err_ratelimited(dev,
+                                "Couldn't allocate a skb_buff for a packet of size %u\n",
+                                pkt_size);
+                }
+                desc->header.recv = 0;
+                ec_bhf_add_rx_desc(priv, desc);
+                priv->rx_dnext = (priv->rx_dnext + 1) % priv->rx_dcount;
+                desc = &priv->rx_descs[priv->rx_dnext];
+        }
+}
+static enum hrtimer_restart ec_bhf_timer_fun(struct hrtimer *timer)
+{
+        struct ec_bhf_priv *priv = container_of(timer, struct ec_bhf_priv,
+                                                hrtimer);
+        ec_bhf_process_rx(priv);
+        ec_bhf_process_tx(priv);
+        if (!netif_running(priv->net_dev))
+                return HRTIMER_NORESTART;
+        hrtimer_forward_now(timer, ktime_set(0, polling_frequency));
+        return HRTIMER_RESTART;
+}
+static int ec_bhf_setup_offsets(struct ec_bhf_priv *priv)
+{
+        struct device *dev = PRIV_TO_DEV(priv);
+        unsigned block_count, i;
+        void * __iomem ec_info;
+        dev_dbg(dev, "Info block:\n");
+        dev_dbg(dev, "Type of function: %x\n", (unsigned)ioread16(priv->io));
+        dev_dbg(dev, "Revision of function: %x\n",
+                (unsigned)ioread16(priv->io + INFO_BLOCK_REV));
+        block_count = ioread8(priv->io + INFO_BLOCK_BLK_CNT);
+        dev_dbg(dev, "Number of function blocks: %x\n", block_count);
+        for (i = 0; i < block_count; i++) {
+                u16 type = ioread16(priv->io + i * INFO_BLOCK_SIZE +
+                                    INFO_BLOCK_TYPE);
+                if (type == ETHERCAT_MASTER_ID)
+                        break;
+        }
+        if (i == block_count) {
+                dev_err(dev, "EtherCAT master with DMA block not found\n");
+                return -ENODEV;
+        }
+        dev_dbg(dev, "EtherCAT master with DMA block found at pos: %d\n", i);
+        ec_info = priv->io + i * INFO_BLOCK_SIZE;
+        dev_dbg(dev, "EtherCAT master revision: %d\n",
+                ioread16(ec_info + INFO_BLOCK_REV));
+        priv->tx_dma_chan = ioread8(ec_info + INFO_BLOCK_TX_CHAN);
+        dev_dbg(dev, "EtherCAT master tx dma channel: %d\n",
+                priv->tx_dma_chan);
+        priv->rx_dma_chan = ioread8(ec_info + INFO_BLOCK_RX_CHAN);
+        dev_dbg(dev, "EtherCAT master rx dma channel: %d\n",
+                 priv->rx_dma_chan);
+        priv->ec_io = priv->io + ioread32(ec_info + INFO_BLOCK_OFFSET);
+        priv->mii_io = priv->ec_io + ioread32(priv->ec_io + EC_MII_OFFSET);
+        priv->fifo_io = priv->ec_io + ioread32(priv->ec_io + EC_FIFO_OFFSET);
+        priv->mac_io = priv->ec_io + ioread32(priv->ec_io + EC_MAC_OFFSET);
+        dev_dbg(dev,
+                "EtherCAT block addres: %p, fifo address: %p, mii address: %p, mac address: %p\n",
+                priv->ec_io, priv->fifo_io, priv->mii_io, priv->mac_io);
+        return 0;
+}
+static netdev_tx_t ec_bhf_start_xmit(struct sk_buff *skb,
+                                     struct net_device *net_dev)
+{
+        struct ec_bhf_priv *priv = netdev_priv(net_dev);
+        struct tx_desc *desc;
+        unsigned len;
+        dev_dbg(PRIV_TO_DEV(priv), "Starting xmit\n");
+        desc = &priv->tx_descs[priv->tx_dnext];
+        skb_copy_and_csum_dev(skb, desc->data);
+        len = skb->len;
+        memset(&desc->header, 0, sizeof(desc->header));
+        desc->header.len = cpu_to_le16(len);
+        desc->header.port = TX_HDR_PORT_0;
+        ec_bhf_send_packet(priv, desc);
+        priv->tx_dnext = (priv->tx_dnext + 1) % priv->tx_dcount;
+        if (!ec_bhf_desc_sent(&priv->tx_descs[priv->tx_dnext])) {
+                /* Make sure that update updates to tx_dnext are perceived
+                 * by timer routine.
+                 */
+                smp_wmb();
+                netif_stop_queue(net_dev);
+                dev_dbg(PRIV_TO_DEV(priv), "Stopping netif queue\n");
+                ec_bhf_print_status(priv);
+        }
+        priv->stat_tx_bytes += len;
+        dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
+}
+static int ec_bhf_alloc_dma_mem(struct ec_bhf_priv *priv,
+                                struct bhf_dma *buf,
+                                int channel,
+                                int size)
+{
+        int offset = channel * DMA_CHAN_SIZE + DMA_CHAN_OFFSET;
+        struct device *dev = PRIV_TO_DEV(priv);
+        u32 mask;
+        iowrite32(0xffffffff, priv->dma_io + offset);
+        mask = ioread32(priv->dma_io + offset);
+        mask &= DMA_WINDOW_SIZE_MASK;
+        dev_dbg(dev, "Read mask %x for channel %d\n", mask, channel);
+        /* We want to allocate a chunk of memory that is:
+         * - aligned to the mask we just read
+         * - is of size 2^mask bytes (at most)
+         * In order to ensure that we will allocate buffer of
+         * 2 * 2^mask bytes.
+         */
+        buf->len = min_t(int, ~mask + 1, size);
+        buf->alloc_len = 2 * buf->len;
+        dev_dbg(dev, "Allocating %d bytes for channel %d",
+                (int)buf->alloc_len, channel);
+        buf->alloc = dma_alloc_coherent(dev, buf->alloc_len, &buf->alloc_phys,
+                                        GFP_KERNEL);
+        if (buf->alloc == NULL) {
+                dev_info(dev, "Failed to allocate buffer\n");
+                return -ENOMEM;
+        }
+        buf->buf_phys = (buf->alloc_phys + buf->len) & mask;
+        buf->buf = buf->alloc + (buf->buf_phys - buf->alloc_phys);
+        iowrite32(0, priv->dma_io + offset + 4);
+        iowrite32(buf->buf_phys, priv->dma_io + offset);
+        dev_dbg(dev, "Buffer: %x and read from dev: %x",
+                (unsigned)buf->buf_phys, ioread32(priv->dma_io + offset));
+        return 0;
+}
+static void ec_bhf_setup_tx_descs(struct ec_bhf_priv *priv)
+{
+        int i = 0;
+        priv->tx_dcount = priv->tx_buf.len / sizeof(struct tx_desc);
+        priv->tx_descs = (struct tx_desc *) priv->tx_buf.buf;
+        priv->tx_dnext = 0;
+        for (i = 0; i < priv->tx_dcount; i++)
+                priv->tx_descs[i].header.sent = cpu_to_le32(TX_HDR_SENT);
+}
+static void ec_bhf_setup_rx_descs(struct ec_bhf_priv *priv)
+{
+        int i;
+        priv->rx_dcount = priv->rx_buf.len / sizeof(struct rx_desc);
+        priv->rx_descs = (struct rx_desc *) priv->rx_buf.buf;
+        priv->rx_dnext = 0;
+        for (i = 0; i < priv->rx_dcount; i++) {
+                struct rx_desc *desc = &priv->rx_descs[i];
+                u32 next;
+                if (i != priv->rx_dcount - 1)
+                        next = (u8 *)(desc + 1) - priv->rx_buf.buf;
+                else
+                        next = 0;
+                next |= RXHDR_NEXT_VALID;
+                desc->header.next = cpu_to_le32(next);
+                desc->header.recv = 0;
+                ec_bhf_add_rx_desc(priv, desc);
+        }
+}
+static int ec_bhf_open(struct net_device *net_dev)
+{
+        struct ec_bhf_priv *priv = netdev_priv(net_dev);
+        struct device *dev = PRIV_TO_DEV(priv);
+        int err = 0;
+        dev_info(dev, "Opening device\n");
+        ec_bhf_reset(priv);
+        err = ec_bhf_alloc_dma_mem(priv, &priv->rx_buf, priv->rx_dma_chan,
+                                   FIFO_SIZE * sizeof(struct rx_desc));
+        if (err) {
+                dev_err(dev, "Failed to allocate rx buffer\n");
+                goto out;
+        }
+        ec_bhf_setup_rx_descs(priv);
+        dev_info(dev, "RX buffer allocated, address: %x\n",
+                 (unsigned)priv->rx_buf.buf_phys);
+        err = ec_bhf_alloc_dma_mem(priv, &priv->tx_buf, priv->tx_dma_chan,
+                                   FIFO_SIZE * sizeof(struct tx_desc));
+        if (err) {
+                dev_err(dev, "Failed to allocate tx buffer\n");
+                goto error_rx_free;
+        }
+        dev_dbg(dev, "TX buffer allocated, addres: %x\n",
+                (unsigned)priv->tx_buf.buf_phys);
+        iowrite8(0, priv->mii_io + MII_MAC_FILT_FLAG);
+        ec_bhf_setup_tx_descs(priv);
+        netif_start_queue(net_dev);
+        hrtimer_init(&priv->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        priv->hrtimer.function = ec_bhf_timer_fun;
+        hrtimer_start(&priv->hrtimer, ktime_set(0, polling_frequency),
+                      HRTIMER_MODE_REL);
+        dev_info(PRIV_TO_DEV(priv), "Device open\n");
+        ec_bhf_print_status(priv);
+        return 0;
+error_rx_free:
+        dma_free_coherent(dev, priv->rx_buf.alloc_len, priv->rx_buf.alloc,
+                          priv->rx_buf.alloc_len);
+out:
+        return err;
+}
+static int ec_bhf_stop(struct net_device *net_dev)
+{
+        struct ec_bhf_priv *priv = netdev_priv(net_dev);
+        struct device *dev = PRIV_TO_DEV(priv);
+        hrtimer_cancel(&priv->hrtimer);
+        ec_bhf_reset(priv);
+        netif_tx_disable(net_dev);
+        dma_free_coherent(dev, priv->tx_buf.alloc_len,
+                          priv->tx_buf.alloc, priv->tx_buf.alloc_phys);
+        dma_free_coherent(dev, priv->rx_buf.alloc_len,
+                          priv->rx_buf.alloc, priv->rx_buf.alloc_phys);
+        return 0;
+}
+static struct rtnl_link_stats64 *
+ec_bhf_get_stats(struct net_device *net_dev,
+                 struct rtnl_link_stats64 *stats)
+{
+        struct ec_bhf_priv *priv = netdev_priv(net_dev);
+        stats->rx_errors = ioread8(priv->mac_io + MAC_RX_ERR_CNT) +
+                                ioread8(priv->mac_io + MAC_CRC_ERR_CNT) +
+                                ioread8(priv->mac_io + MAC_FRAME_ERR_CNT);
+        stats->rx_packets = ioread32(priv->mac_io + MAC_RX_FRAME_CNT);
+        stats->tx_packets = ioread32(priv->mac_io + MAC_TX_FRAME_CNT);
+        stats->rx_dropped = ioread8(priv->mac_io + MAC_DROPPED_FRMS);
+        stats->tx_bytes = priv->stat_tx_bytes;
+        stats->rx_bytes = priv->stat_rx_bytes;
+        return stats;
+}
+static const struct net_device_ops ec_bhf_netdev_ops = {
+        .ndo_start_xmit         = ec_bhf_start_xmit,
+        .ndo_open               = ec_bhf_open,
+        .ndo_stop               = ec_bhf_stop,
+        .ndo_get_stats64        = ec_bhf_get_stats,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = eth_mac_addr
+};
+static int ec_bhf_probe(struct pci_dev *dev, const struct pci_device_id *id)
+{
+        struct net_device *net_dev;
+        struct ec_bhf_priv *priv;
+        void * __iomem dma_io;
+        void * __iomem io;
+        int err = 0;
+        err = pci_enable_device(dev);
+        if (err)
+                return err;
+        pci_set_master(dev);
+        err = pci_set_dma_mask(dev, DMA_BIT_MASK(32));
+        if (err) {
+                dev_err(&dev->dev,
+                        "Required dma mask not supported, failed to initialize device\n");
+                err = -EIO;
+                goto err_disable_dev;
+        }
+        err = pci_set_consistent_dma_mask(dev, DMA_BIT_MASK(32));
+        if (err) {
+                dev_err(&dev->dev,
+                        "Required dma mask not supported, failed to initialize device\n");
+                goto err_disable_dev;
+        }
+        err = pci_request_regions(dev, "ec_bhf");
+        if (err) {
+                dev_err(&dev->dev, "Failed to request pci memory regions\n");
+                goto err_disable_dev;
+        }
+        io = pci_iomap(dev, 0, 0);
+        if (!io) {
+                dev_err(&dev->dev, "Failed to map pci card memory bar 0");
+                err = -EIO;
+                goto err_release_regions;
+        }
+        dma_io = pci_iomap(dev, 2, 0);
+        if (!dma_io) {
+                dev_err(&dev->dev, "Failed to map pci card memory bar 2");
+                err = -EIO;
+                goto err_unmap;
+        }
+        net_dev = alloc_etherdev(sizeof(struct ec_bhf_priv));
+        if (net_dev == 0) {
+                err = -ENOMEM;
+                goto err_unmap_dma_io;
+        }
+        pci_set_drvdata(dev, net_dev);
+        SET_NETDEV_DEV(net_dev, &dev->dev);
+        net_dev->features = 0;
+        net_dev->flags |= IFF_NOARP;
+        net_dev->netdev_ops = &ec_bhf_netdev_ops;
+        priv = netdev_priv(net_dev);
+        priv->net_dev = net_dev;
+        priv->io = io;
+        priv->dma_io = dma_io;
+        priv->dev = dev;
+        err = ec_bhf_setup_offsets(priv);
+        if (err < 0)
+                goto err_free_net_dev;
+        memcpy_fromio(net_dev->dev_addr, priv->mii_io + MII_MAC_ADDR, 6);
+        dev_dbg(&dev->dev, "CX5020 Ethercat master address: %pM\n",
+                net_dev->dev_addr);
+        err = register_netdev(net_dev);
+        if (err < 0)
+                goto err_free_net_dev;
+        return 0;
+err_free_net_dev:
+        free_netdev(net_dev);
+err_unmap_dma_io:
+        pci_iounmap(dev, dma_io);
+err_unmap:
+        pci_iounmap(dev, io);
+err_release_regions:
+        pci_release_regions(dev);
+err_disable_dev:
+        pci_clear_master(dev);
+        pci_disable_device(dev);
+        return err;
+}
+static void ec_bhf_remove(struct pci_dev *dev)
+{
+        struct net_device *net_dev = pci_get_drvdata(dev);
+        struct ec_bhf_priv *priv = netdev_priv(net_dev);
+        unregister_netdev(net_dev);
+        free_netdev(net_dev);
+        pci_iounmap(dev, priv->dma_io);
+        pci_iounmap(dev, priv->io);
+        pci_release_regions(dev);
+        pci_clear_master(dev);
+        pci_disable_device(dev);
+}
+static struct pci_driver pci_driver = {
+        .name           = "ec_bhf",
+        .id_table       = ids,
+        .probe          = ec_bhf_probe,
+        .remove         = ec_bhf_remove,
+};
+static int __init ec_bhf_init(void)
+{
+        return pci_register_driver(&pci_driver);
+}
+static void __exit ec_bhf_exit(void)
+{
+        pci_unregister_driver(&pci_driver);
+}
+module_init(ec_bhf_init);
+module_exit(ec_bhf_exit);
+module_param(polling_frequency, long, S_IRUGO);
+MODULE_PARM_DESC(polling_frequency, "Polling timer frequency in ns");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dariusz Marcinkiewicz <reksio@newterm.pl>");
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 8ccaa2520dc3..97db5a7179df 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -374,6 +374,7 @@ enum vf_state {
 #define BE_FLAGS_NAPI_ENABLED                   (1 << 9)
 #define BE_FLAGS_QNQ_ASYNC_EVT_RCVD             (1 << 11)
 #define BE_FLAGS_VXLAN_OFFLOADS                 (1 << 12)
+#define BE_FLAGS_SETUP_DONE                     (1 << 13)
 #define BE_UC_PMAC_COUNT                        30
 #define BE_VF_UC_PMAC_COUNT                     2
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 3e6df47b6973..dc19bc5dec77 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2033,11 +2033,13 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
        bool dummy_wrb;
        int i, pending_txqs;
-        /* Wait for a max of 200ms for all the tx-completions to arrive. */
+        /* Stop polling for compls when HW has been silent for 10ms */
        do {
                pending_txqs = adapter->num_tx_qs;
                for_all_tx_queues(adapter, txo, i) {
+                        cmpl = 0;
+                        num_wrbs = 0;
                        txq = &txo->q;
                        while ((txcp = be_tx_compl_get(&txo->cq))) {
                                end_idx =
@@ -2050,14 +2052,13 @@ static void be_tx_compl_clean(struct be_adapter *adapter)
                        if (cmpl) {
                                be_cq_notify(adapter, txo->cq.id, false, cmpl);
                                atomic_sub(num_wrbs, &txq->used);
-                                cmpl = 0;
+                                timeo = 0;
-                                num_wrbs = 0;
                        }
                        if (atomic_read(&txq->used) == 0)
                                pending_txqs--;
                }
-                if (pending_txqs == 0 || ++timeo > 200)
+                if (pending_txqs == 0 || ++timeo > 10 || be_hw_error(adapter))
                        break;
                mdelay(1);
@@ -2725,6 +2726,12 @@ static int be_close(struct net_device *netdev)
        struct be_eq_obj *eqo;
        int i;
+        /* This protection is needed as be_close() may be called even when the
+         * adapter is in cleared state (after eeh perm failure)
+         */
+        if (!(adapter->flags & BE_FLAGS_SETUP_DONE))
+                return 0;
        be_roce_dev_close(adapter);
        if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
@@ -3055,6 +3062,7 @@ static int be_clear(struct be_adapter *adapter)
        be_clear_queues(adapter);
        be_msix_disable(adapter);
+        adapter->flags &= ~BE_FLAGS_SETUP_DONE;
        return 0;
 }
@@ -3559,6 +3567,7 @@ static int be_setup(struct be_adapter *adapter)
                adapter->phy.fc_autoneg = 1;
        be_schedule_worker(adapter);
+        adapter->flags |= BE_FLAGS_SETUP_DONE;
        return 0;
 err:
        be_clear(adapter);
@@ -4940,6 +4949,12 @@ static void be_eeh_resume(struct pci_dev *pdev)
        if (status)
                goto err;
+        /* On some BE3 FW versions, after a HW reset,
+         * interrupts will remain disabled for each function.
+         * So, explicitly enable interrupts
+         */
+        be_intr_set(adapter, true);
        /* tell fw we're ready to fire cmds */
        status = be_cmd_fw_init(adapter);
        if (status)
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 9125d9abf099..e2d42475b006 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -121,6 +121,7 @@ static irqreturn_t gfar_error(int irq, void *dev_id);
 static irqreturn_t gfar_transmit(int irq, void *dev_id);
 static irqreturn_t gfar_interrupt(int irq, void *dev_id);
 static void adjust_link(struct net_device *dev);
+static noinline void gfar_update_link_state(struct gfar_private *priv);
 static int init_phy(struct net_device *dev);
 static int gfar_probe(struct platform_device *ofdev);
 static int gfar_remove(struct platform_device *ofdev);
@@ -3076,41 +3077,6 @@ static irqreturn_t gfar_interrupt(int irq, void *grp_id)
        return IRQ_HANDLED;
 }
-static u32 gfar_get_flowctrl_cfg(struct gfar_private *priv)
-{
-        struct phy_device *phydev = priv->phydev;
-        u32 val = 0;
-        if (!phydev->duplex)
-                return val;
-        if (!priv->pause_aneg_en) {
-                if (priv->tx_pause_en)
-                        val |= MACCFG1_TX_FLOW;
-                if (priv->rx_pause_en)
-                        val |= MACCFG1_RX_FLOW;
-        } else {
-                u16 lcl_adv, rmt_adv;
-                u8 flowctrl;
-                /* get link partner capabilities */
-                rmt_adv = 0;
-                if (phydev->pause)
-                        rmt_adv = LPA_PAUSE_CAP;
-                if (phydev->asym_pause)
-                        rmt_adv |= LPA_PAUSE_ASYM;
-                lcl_adv = mii_advertise_flowctrl(phydev->advertising);
-                flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
-                if (flowctrl & FLOW_CTRL_TX)
-                        val |= MACCFG1_TX_FLOW;
-                if (flowctrl & FLOW_CTRL_RX)
-                        val |= MACCFG1_RX_FLOW;
-        }
-        return val;
-}
 /* Called every time the controller might need to be made
 * aware of new link state.  The PHY code conveys this
 * information through variables in the phydev structure, and this
@@ -3120,83 +3086,12 @@ static u32 gfar_get_flowctrl_cfg(struct gfar_private *priv)
 static void adjust_link(struct net_device *dev)
 {
        struct gfar_private *priv = netdev_priv(dev);
-        struct gfar __iomem *regs = priv->gfargrp[0].regs;
        struct phy_device *phydev = priv->phydev;
-        int new_state = 0;
-        if (test_bit(GFAR_RESETTING, &priv->state))
+        if (unlikely(phydev->link != priv->oldlink ||
-                return;
+                     phydev->duplex != priv->oldduplex ||
+                     phydev->speed != priv->oldspeed))
-        if (phydev->link) {
+                gfar_update_link_state(priv);
-                u32 tempval1 = gfar_read(&regs->maccfg1);
-                u32 tempval = gfar_read(&regs->maccfg2);
-                u32 ecntrl = gfar_read(&regs->ecntrl);
-                /* Now we make sure that we can be in full duplex mode.
-                 * If not, we operate in half-duplex mode.
-                 */
-                if (phydev->duplex != priv->oldduplex) {
-                        new_state = 1;
-                        if (!(phydev->duplex))
-                                tempval &= ~(MACCFG2_FULL_DUPLEX);
-                        else
-                                tempval |= MACCFG2_FULL_DUPLEX;
-                        priv->oldduplex = phydev->duplex;
-                }
-                if (phydev->speed != priv->oldspeed) {
-                        new_state = 1;
-                        switch (phydev->speed) {
-                        case 1000:
-                                tempval =
-                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_GMII);
-                                ecntrl &= ~(ECNTRL_R100);
-                                break;
-                        case 100:
-                        case 10:
-                                tempval =
-                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_MII);
-                                /* Reduced mode distinguishes
-                                 * between 10 and 100
-                                 */
-                                if (phydev->speed == SPEED_100)
-                                        ecntrl |= ECNTRL_R100;
-                                else
-                                        ecntrl &= ~(ECNTRL_R100);
-                                break;
-                        default:
-                                netif_warn(priv, link, dev,
-                                           "Ack!  Speed (%d) is not 10/100/1000!\n",
-                                           phydev->speed);
-                                break;
-                        }
-                        priv->oldspeed = phydev->speed;
-                }
-                tempval1 &= ~(MACCFG1_TX_FLOW | MACCFG1_RX_FLOW);
-                tempval1 |= gfar_get_flowctrl_cfg(priv);
-                gfar_write(&regs->maccfg1, tempval1);
-                gfar_write(&regs->maccfg2, tempval);
-                gfar_write(&regs->ecntrl, ecntrl);
-                if (!priv->oldlink) {
-                        new_state = 1;
-                        priv->oldlink = 1;
-                }
-        } else if (priv->oldlink) {
-                new_state = 1;
-                priv->oldlink = 0;
-                priv->oldspeed = 0;
-                priv->oldduplex = -1;
-        }
-        if (new_state && netif_msg_link(priv))
-                phy_print_status(phydev);
 }
 /* Update the hash table based on the current list of multicast
@@ -3442,6 +3337,114 @@ static irqreturn_t gfar_error(int irq, void *grp_id)
        return IRQ_HANDLED;
 }
+static u32 gfar_get_flowctrl_cfg(struct gfar_private *priv)
+{
+        struct phy_device *phydev = priv->phydev;
+        u32 val = 0;
+        if (!phydev->duplex)
+                return val;
+        if (!priv->pause_aneg_en) {
+                if (priv->tx_pause_en)
+                        val |= MACCFG1_TX_FLOW;
+                if (priv->rx_pause_en)
+                        val |= MACCFG1_RX_FLOW;
+        } else {
+                u16 lcl_adv, rmt_adv;
+                u8 flowctrl;
+                /* get link partner capabilities */
+                rmt_adv = 0;
+                if (phydev->pause)
+                        rmt_adv = LPA_PAUSE_CAP;
+                if (phydev->asym_pause)
+                        rmt_adv |= LPA_PAUSE_ASYM;
+                lcl_adv = mii_advertise_flowctrl(phydev->advertising);
+                flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
+                if (flowctrl & FLOW_CTRL_TX)
+                        val |= MACCFG1_TX_FLOW;
+                if (flowctrl & FLOW_CTRL_RX)
+                        val |= MACCFG1_RX_FLOW;
+        }
+        return val;
+}
+static noinline void gfar_update_link_state(struct gfar_private *priv)
+{
+        struct gfar __iomem *regs = priv->gfargrp[0].regs;
+        struct phy_device *phydev = priv->phydev;
+        if (unlikely(test_bit(GFAR_RESETTING, &priv->state)))
+                return;
+        if (phydev->link) {
+                u32 tempval1 = gfar_read(&regs->maccfg1);
+                u32 tempval = gfar_read(&regs->maccfg2);
+                u32 ecntrl = gfar_read(&regs->ecntrl);
+                if (phydev->duplex != priv->oldduplex) {
+                        if (!(phydev->duplex))
+                                tempval &= ~(MACCFG2_FULL_DUPLEX);
+                        else
+                                tempval |= MACCFG2_FULL_DUPLEX;
+                        priv->oldduplex = phydev->duplex;
+                }
+                if (phydev->speed != priv->oldspeed) {
+                        switch (phydev->speed) {
+                        case 1000:
+                                tempval =
+                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_GMII);
+                                ecntrl &= ~(ECNTRL_R100);
+                                break;
+                        case 100:
+                        case 10:
+                                tempval =
+                                    ((tempval & ~(MACCFG2_IF)) | MACCFG2_MII);
+                                /* Reduced mode distinguishes
+                                 * between 10 and 100
+                                 */
+                                if (phydev->speed == SPEED_100)
+                                        ecntrl |= ECNTRL_R100;
+                                else
+                                        ecntrl &= ~(ECNTRL_R100);
+                                break;
+                        default:
+                                netif_warn(priv, link, priv->ndev,
+                                           "Ack!  Speed (%d) is not 10/100/1000!\n",
+                                           phydev->speed);
+                                break;
+                        }
+                        priv->oldspeed = phydev->speed;
+                }
+                tempval1 &= ~(MACCFG1_TX_FLOW | MACCFG1_RX_FLOW);
+                tempval1 |= gfar_get_flowctrl_cfg(priv);
+                gfar_write(&regs->maccfg1, tempval1);
+                gfar_write(&regs->maccfg2, tempval);
+                gfar_write(&regs->ecntrl, ecntrl);
+                if (!priv->oldlink)
+                        priv->oldlink = 1;
+        } else if (priv->oldlink) {
+                priv->oldlink = 0;
+                priv->oldspeed = 0;
+                priv->oldduplex = -1;
+        }
+        if (netif_msg_link(priv))
+                phy_print_status(phydev);
+}
 static struct of_device_id gfar_match[] =
 {
        {
diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
index 891dbee6e6c1..76d70708f864 100644
--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -533,6 +533,9 @@ static int gfar_spauseparam(struct net_device *dev,
        struct gfar __iomem *regs = priv->gfargrp[0].regs;
        u32 oldadv, newadv;
+        if (!phydev)
+                return -ENODEV;
        if (!(phydev->supported & SUPPORTED_Pause) ||
            (!(phydev->supported & SUPPORTED_Asym_Pause) &&
             (epause->rx_pause != epause->tx_pause)))
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 9866f264f55e..f0bbd4246d71 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -186,7 +186,7 @@ static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
 {
        u16 phy_reg = 0;
        u32 phy_id = 0;
-        s32 ret_val;
+        s32 ret_val = 0;
        u16 retry_count;
        u32 mac_reg = 0;
@@ -217,11 +217,13 @@ static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
        /* In case the PHY needs to be in mdio slow mode,
         * set slow mode and try to get the PHY id again.
         */
-        hw->phy.ops.release(hw);
+        if (hw->mac.type < e1000_pch_lpt) {
-        ret_val = e1000_set_mdio_slow_mode_hv(hw);
+                hw->phy.ops.release(hw);
-        if (!ret_val)
+                ret_val = e1000_set_mdio_slow_mode_hv(hw);
-                ret_val = e1000e_get_phy_id(hw);
+                if (!ret_val)
-        hw->phy.ops.acquire(hw);
+                        ret_val = e1000e_get_phy_id(hw);
+                hw->phy.ops.acquire(hw);
+        }
        if (ret_val)
                return false;
@@ -842,6 +844,17 @@ s32 e1000_set_eee_pchlan(struct e1000_hw *hw)
                }
        }
+        if (hw->phy.type == e1000_phy_82579) {
+                ret_val = e1000_read_emi_reg_locked(hw, I82579_LPI_PLL_SHUT,
+                                                    &data);
+                if (ret_val)
+                        goto release;
+                data &= ~I82579_LPI_100_PLL_SHUT;
+                ret_val = e1000_write_emi_reg_locked(hw, I82579_LPI_PLL_SHUT,
+                                                     data);
+        }
        /* R/Clr IEEE MMD 3.1 bits 11:10 - Tx/Rx LPI Received */
        ret_val = e1000_read_emi_reg_locked(hw, pcs_status, &data);
        if (ret_val)
@@ -1314,14 +1327,17 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                        return ret_val;
        }
-        /* When connected at 10Mbps half-duplex, 82579 parts are excessively
+        /* When connected at 10Mbps half-duplex, some parts are excessively
         * aggressive resulting in many collisions. To avoid this, increase
         * the IPG and reduce Rx latency in the PHY.
         */
-        if ((hw->mac.type == e1000_pch2lan) && link) {
+        if (((hw->mac.type == e1000_pch2lan) ||
+             (hw->mac.type == e1000_pch_lpt)) && link) {
                u32 reg;
                reg = er32(STATUS);
                if (!(reg & (E1000_STATUS_FD | E1000_STATUS_SPEED_MASK))) {
+                        u16 emi_addr;
                        reg = er32(TIPG);
                        reg &= ~E1000_TIPG_IPGT_MASK;
                        reg |= 0xFF;
@@ -1332,8 +1348,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                        if (ret_val)
                                return ret_val;
-                        ret_val =
+                        if (hw->mac.type == e1000_pch2lan)
-                            e1000_write_emi_reg_locked(hw, I82579_RX_CONFIG, 0);
+                                emi_addr = I82579_RX_CONFIG;
+                        else
+                                emi_addr = I217_RX_CONFIG;
+                        ret_val = e1000_write_emi_reg_locked(hw, emi_addr, 0);
                        hw->phy.ops.release(hw);
@@ -2493,51 +2513,44 @@ release:
 *  e1000_k1_gig_workaround_lv - K1 Si workaround
 *  @hw:   pointer to the HW structure
 *
- *  Workaround to set the K1 beacon duration for 82579 parts
+ *  Workaround to set the K1 beacon duration for 82579 parts in 10Mbps
+ *  Disable K1 in 1000Mbps and 100Mbps
 **/
 static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
 {
        s32 ret_val = 0;
        u16 status_reg = 0;
-        u32 mac_reg;
-        u16 phy_reg;
        if (hw->mac.type != e1000_pch2lan)
                return 0;
-        /* Set K1 beacon duration based on 1Gbps speed or otherwise */
+        /* Set K1 beacon duration based on 10Mbs speed */
        ret_val = e1e_rphy(hw, HV_M_STATUS, &status_reg);
        if (ret_val)
                return ret_val;
        if ((status_reg & (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE))
            == (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE)) {
-                mac_reg = er32(FEXTNVM4);
+                if (status_reg &
-                mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
+                    (HV_M_STATUS_SPEED_1000 | HV_M_STATUS_SPEED_100)) {
-                ret_val = e1e_rphy(hw, I82579_LPI_CTRL, &phy_reg);
-                if (ret_val)
-                        return ret_val;
-                if (status_reg & HV_M_STATUS_SPEED_1000) {
                        u16 pm_phy_reg;
-                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
+                        /* LV 1G/100 Packet drop issue wa  */
-                        phy_reg &= ~I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
-                        /* LV 1G Packet drop issue wa  */
                        ret_val = e1e_rphy(hw, HV_PM_CTRL, &pm_phy_reg);
                        if (ret_val)
                                return ret_val;
-                        pm_phy_reg &= ~HV_PM_CTRL_PLL_STOP_IN_K1_GIGA;
+                        pm_phy_reg &= ~HV_PM_CTRL_K1_ENABLE;
                        ret_val = e1e_wphy(hw, HV_PM_CTRL, pm_phy_reg);
                        if (ret_val)
                                return ret_val;
                } else {
+                        u32 mac_reg;
+                        mac_reg = er32(FEXTNVM4);
+                        mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
-                        phy_reg |= I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                        ew32(FEXTNVM4, mac_reg);
                }
-                ew32(FEXTNVM4, mac_reg);
-                ret_val = e1e_wphy(hw, I82579_LPI_CTRL, phy_reg);
        }
        return ret_val;
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index bead50f9187b..5515126c81c1 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -232,16 +232,19 @@
 #define I82577_MSE_THRESHOLD    0x0887  /* 82577 Mean Square Error Threshold */
 #define I82579_MSE_LINK_DOWN    0x2411  /* MSE count before dropping link */
 #define I82579_RX_CONFIG                0x3412  /* Receive configuration */
+#define I82579_LPI_PLL_SHUT             0x4412  /* LPI PLL Shut Enable */
 #define I82579_EEE_PCS_STATUS           0x182E  /* IEEE MMD Register 3.1 >> 8 */
 #define I82579_EEE_CAPABILITY           0x0410  /* IEEE MMD Register 3.20 */
 #define I82579_EEE_ADVERTISEMENT        0x040E  /* IEEE MMD Register 7.60 */
 #define I82579_EEE_LP_ABILITY           0x040F  /* IEEE MMD Register 7.61 */
 #define I82579_EEE_100_SUPPORTED        (1 << 1)        /* 100BaseTx EEE */
 #define I82579_EEE_1000_SUPPORTED       (1 << 2)        /* 1000BaseTx EEE */
+#define I82579_LPI_100_PLL_SHUT (1 << 2)        /* 100M LPI PLL Shut Enabled */
 #define I217_EEE_PCS_STATUS     0x9401  /* IEEE MMD Register 3.1 */
 #define I217_EEE_CAPABILITY     0x8000  /* IEEE MMD Register 3.20 */
 #define I217_EEE_ADVERTISEMENT  0x8001  /* IEEE MMD Register 7.60 */
 #define I217_EEE_LP_ABILITY     0x8002  /* IEEE MMD Register 7.61 */
+#define I217_RX_CONFIG          0xB20C  /* Receive configuration */
 #define E1000_EEE_RX_LPI_RCVD   0x0400  /* Tx LP idle received */
 #define E1000_EEE_TX_LPI_RCVD   0x0800  /* Rx LP idle received */
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index d50c91e50528..3e69386add04 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1165,7 +1165,7 @@ static void e1000e_tx_hwtstamp_work(struct work_struct *work)
                dev_kfree_skb_any(adapter->tx_hwtstamp_skb);
                adapter->tx_hwtstamp_skb = NULL;
                adapter->tx_hwtstamp_timeouts++;
-                e_warn("clearing Tx timestamp hang");
+                e_warn("clearing Tx timestamp hang\n");
        } else {
                /* reschedule to check later */
                schedule_work(&adapter->tx_hwtstamp_work);
@@ -5687,7 +5687,7 @@ struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev,
 static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
 {
        struct e1000_adapter *adapter = netdev_priv(netdev);
-        int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+        int max_frame = new_mtu + VLAN_HLEN + ETH_HLEN + ETH_FCS_LEN;
        /* Jumbo frame support */
        if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
@@ -6235,6 +6235,7 @@ static int __e1000_resume(struct pci_dev *pdev)
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
 static int e1000e_pm_thaw(struct device *dev)
 {
        struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev));
@@ -6255,7 +6256,6 @@ static int e1000e_pm_thaw(struct device *dev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
 static int e1000e_pm_suspend(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
diff --git a/drivers/net/ethernet/intel/e1000e/phy.h b/drivers/net/ethernet/intel/e1000e/phy.h
index 3841bccf058c..537d2780b408 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.h
+++ b/drivers/net/ethernet/intel/e1000e/phy.h
@@ -164,6 +164,7 @@ s32 e1000_get_cable_length_82577(struct e1000_hw *hw);
 #define HV_M_STATUS_AUTONEG_COMPLETE    0x1000
 #define HV_M_STATUS_SPEED_MASK          0x0300
 #define HV_M_STATUS_SPEED_1000          0x0200
+#define HV_M_STATUS_SPEED_100           0x0100
 #define HV_M_STATUS_LINK_UP             0x0040
 #define IGP01E1000_PHY_PCS_INIT_REG     0x00B4
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 861b722c2672..cf0761f08911 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -2897,12 +2897,9 @@ static irqreturn_t i40e_intr(int irq, void *data)
                u32 prttsyn_stat = rd32(hw, I40E_PRTTSYN_STAT_0);
                if (prttsyn_stat & I40E_PRTTSYN_STAT_0_TXTIME_MASK) {
-                        ena_mask &= ~I40E_PFINT_ICR0_ENA_TIMESYNC_MASK;
+                        icr0 &= ~I40E_PFINT_ICR0_ENA_TIMESYNC_MASK;
                        i40e_ptp_tx_hwtstamp(pf);
-                        prttsyn_stat &= ~I40E_PRTTSYN_STAT_0_TXTIME_MASK;
                }
-                wr32(hw, I40E_PRTTSYN_STAT_0, prttsyn_stat);
        }
        /* If a critical error is pending we have no choice but to reset the
@@ -4271,6 +4268,14 @@ static int i40e_open(struct net_device *netdev)
        if (err)
                return err;
+        /* configure global TSO hardware offload settings */
+        wr32(&pf->hw, I40E_GLLAN_TSOMSK_F, be32_to_cpu(TCP_FLAG_PSH |
+                                                       TCP_FLAG_FIN) >> 16);
+        wr32(&pf->hw, I40E_GLLAN_TSOMSK_M, be32_to_cpu(TCP_FLAG_PSH |
+                                                       TCP_FLAG_FIN |
+                                                       TCP_FLAG_CWR) >> 16);
+        wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16);
 #ifdef CONFIG_I40E_VXLAN
        vxlan_get_rx_port(netdev);
 #endif
@@ -6712,6 +6717,7 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
                           NETIF_F_HW_VLAN_CTAG_FILTER |
                           NETIF_F_IPV6_CSUM           |
                           NETIF_F_TSO                 |
+                           NETIF_F_TSO_ECN             |
                           NETIF_F_TSO6                |
                           NETIF_F_RXCSUM              |
                           NETIF_F_NTUPLE              |
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index 262bdf11d221..81299189a47d 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -160,7 +160,7 @@ static i40e_status i40e_poll_sr_srctl_done_bit(struct i40e_hw *hw)
                udelay(5);
        }
        if (ret_code == I40E_ERR_TIMEOUT)
-                hw_dbg(hw, "Done bit in GLNVM_SRCTL not set");
+                hw_dbg(hw, "Done bit in GLNVM_SRCTL not set\n");
        return ret_code;
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
index e33ec6c842b7..e61e63720800 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -239,7 +239,7 @@ static void i40e_ptp_tx_work(struct work_struct *work)
                dev_kfree_skb_any(pf->ptp_tx_skb);
                pf->ptp_tx_skb = NULL;
                pf->tx_hwtstamp_timeouts++;
-                dev_warn(&pf->pdev->dev, "clearing Tx timestamp hang");
+                dev_warn(&pf->pdev->dev, "clearing Tx timestamp hang\n");
                return;
        }
@@ -321,7 +321,7 @@ void i40e_ptp_rx_hang(struct i40e_vsi *vsi)
                pf->last_rx_ptp_check = jiffies;
                pf->rx_hwtstamp_cleared++;
                dev_warn(&vsi->back->pdev->dev,
-                         "%s: clearing Rx timestamp hang",
+                         "%s: clearing Rx timestamp hang\n",
                         __func__);
        }
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 0f5d96ad281d..9478ddc66caf 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -418,7 +418,7 @@ int i40e_add_del_fdir(struct i40e_vsi *vsi,
                }
                break;
        default:
-                dev_info(&pf->pdev->dev, "Could not specify spec type %d",
+                dev_info(&pf->pdev->dev, "Could not specify spec type %d\n",
                         input->flow_type);
                ret = -EINVAL;
        }
@@ -478,7 +478,7 @@ static void i40e_fd_handle_status(struct i40e_ring *rx_ring,
                                pf->flags |= I40E_FLAG_FDIR_REQUIRES_REINIT;
                        }
                } else {
-                        dev_info(&pdev->dev, "FD filter programming error");
+                        dev_info(&pdev->dev, "FD filter programming error\n");
                }
        } else if (error ==
                          (0x1 << I40E_RX_PROG_STATUS_DESC_NO_FD_ENTRY_SHIFT)) {
@@ -1713,9 +1713,11 @@ static int i40e_tx_prepare_vlan_flags(struct sk_buff *skb,
                                I40E_TX_FLAGS_VLAN_PRIO_SHIFT;
                if (tx_flags & I40E_TX_FLAGS_SW_VLAN) {
                        struct vlan_ethhdr *vhdr;
-                        if (skb_header_cloned(skb) &&
+                        int rc;
-                            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
-                                return -ENOMEM;
+                        rc = skb_cow_head(skb, 0);
+                        if (rc < 0)
+                                return rc;
                        vhdr = (struct vlan_ethhdr *)skb->data;
                        vhdr->h_vlan_TCI = htons(tx_flags >>
                                                 I40E_TX_FLAGS_VLAN_SHIFT);
@@ -1743,20 +1745,18 @@ static int i40e_tso(struct i40e_ring *tx_ring, struct sk_buff *skb,
                    u64 *cd_type_cmd_tso_mss, u32 *cd_tunneling)
 {
        u32 cd_cmd, cd_tso_len, cd_mss;
+        struct ipv6hdr *ipv6h;
        struct tcphdr *tcph;
        struct iphdr *iph;
        u32 l4len;
        int err;
-        struct ipv6hdr *ipv6h;
        if (!skb_is_gso(skb))
                return 0;
-        if (skb_header_cloned(skb)) {
+        err = skb_cow_head(skb, 0);
-                err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+        if (err < 0)
-                if (err)
+                return err;
-                        return err;
-        }
        if (protocol == htons(ETH_P_IP)) {
                iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
index db963397cc27..f67f8a170b90 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
@@ -365,7 +365,7 @@ static s32 igb_read_invm_word_i210(struct e1000_hw *hw, u8 address, u16 *data)
                        word_address = INVM_DWORD_TO_WORD_ADDRESS(invm_dword);
                        if (word_address == address) {
                                *data = INVM_DWORD_TO_WORD_DATA(invm_dword);
-                                hw_dbg("Read INVM Word 0x%02x = %x",
+                                hw_dbg("Read INVM Word 0x%02x = %x\n",
                                          address, *data);
                                status = E1000_SUCCESS;
                                break;
diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c
index 5910a932ea7c..1e0c404db81a 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.c
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.c
@@ -929,11 +929,10 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                         */
                        if (hw->fc.requested_mode == e1000_fc_full) {
                                hw->fc.current_mode = e1000_fc_full;
-                                hw_dbg("Flow Control = FULL.\r\n");
+                                hw_dbg("Flow Control = FULL.\n");
                        } else {
                                hw->fc.current_mode = e1000_fc_rx_pause;
-                                hw_dbg("Flow Control = "
+                                hw_dbg("Flow Control = RX PAUSE frames only.\n");
-                                       "RX PAUSE frames only.\r\n");
                        }
                }
                /* For receiving PAUSE frames ONLY.
@@ -948,7 +947,7 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                          (mii_nway_lp_ability_reg & NWAY_LPAR_PAUSE) &&
                          (mii_nway_lp_ability_reg & NWAY_LPAR_ASM_DIR)) {
                        hw->fc.current_mode = e1000_fc_tx_pause;
-                        hw_dbg("Flow Control = TX PAUSE frames only.\r\n");
+                        hw_dbg("Flow Control = TX PAUSE frames only.\n");
                }
                /* For transmitting PAUSE frames ONLY.
                 *
@@ -962,7 +961,7 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                         !(mii_nway_lp_ability_reg & NWAY_LPAR_PAUSE) &&
                         (mii_nway_lp_ability_reg & NWAY_LPAR_ASM_DIR)) {
                        hw->fc.current_mode = e1000_fc_rx_pause;
-                        hw_dbg("Flow Control = RX PAUSE frames only.\r\n");
+                        hw_dbg("Flow Control = RX PAUSE frames only.\n");
                }
                /* Per the IEEE spec, at this point flow control should be
                 * disabled.  However, we want to consider that we could
@@ -988,10 +987,10 @@ s32 igb_config_fc_after_link_up(struct e1000_hw *hw)
                         (hw->fc.requested_mode == e1000_fc_tx_pause) ||
                         (hw->fc.strict_ieee)) {
                        hw->fc.current_mode = e1000_fc_none;
-                        hw_dbg("Flow Control = NONE.\r\n");
+                        hw_dbg("Flow Control = NONE.\n");
                } else {
                        hw->fc.current_mode = e1000_fc_rx_pause;
-                        hw_dbg("Flow Control = RX PAUSE frames only.\r\n");
+                        hw_dbg("Flow Control = RX PAUSE frames only.\n");
                }
                /* Now we need to do one last check...  If we auto-
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index fb98d4602f9d..16430a8440fa 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5193,8 +5193,10 @@ void igb_update_stats(struct igb_adapter *adapter,
        rcu_read_lock();
        for (i = 0; i < adapter->num_rx_queues; i++) {
-                u32 rqdpc = rd32(E1000_RQDPC(i));
                struct igb_ring *ring = adapter->rx_ring[i];
+                u32 rqdpc = rd32(E1000_RQDPC(i));
+                if (hw->mac.type >= e1000_i210)
+                        wr32(E1000_RQDPC(i), 0);
                if (rqdpc) {
                        ring->rx_stats.drops += rqdpc;
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index 9209d652e1c9..ab25e49365f7 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -389,7 +389,7 @@ static void igb_ptp_tx_work(struct work_struct *work)
                adapter->ptp_tx_skb = NULL;
                clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state);
                adapter->tx_hwtstamp_timeouts++;
-                dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang");
+                dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n");
                return;
        }
@@ -451,7 +451,7 @@ void igb_ptp_rx_hang(struct igb_adapter *adapter)
                rd32(E1000_RXSTMPH);
                adapter->last_rx_ptp_check = jiffies;
                adapter->rx_hwtstamp_cleared++;
-                dev_warn(&adapter->pdev->dev, "clearing Rx timestamp hang");
+                dev_warn(&adapter->pdev->dev, "clearing Rx timestamp hang\n");
        }
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 1a12c1dd7a27..c6c4ca7d68e6 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -256,7 +256,6 @@ struct ixgbe_ring {
                struct ixgbe_tx_buffer *tx_buffer_info;
                struct ixgbe_rx_buffer *rx_buffer_info;
        };
-        unsigned long last_rx_timestamp;
        unsigned long state;
        u8 __iomem *tail;
        dma_addr_t dma;                 /* phys. address of descriptor ring */
@@ -770,6 +769,7 @@ struct ixgbe_adapter {
        unsigned long ptp_tx_start;
        unsigned long last_overflow_check;
        unsigned long last_rx_ptp_check;
+        unsigned long last_rx_timestamp;
        spinlock_t tmreg_lock;
        struct cyclecounter cc;
        struct timecounter tc;
@@ -944,24 +944,7 @@ void ixgbe_ptp_init(struct ixgbe_adapter *adapter);
 void ixgbe_ptp_stop(struct ixgbe_adapter *adapter);
 void ixgbe_ptp_overflow_check(struct ixgbe_adapter *adapter);
 void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter);
-void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
+void ixgbe_ptp_rx_hwtstamp(struct ixgbe_adapter *adapter, struct sk_buff *skb);
-                             struct sk_buff *skb);
-static inline void ixgbe_ptp_rx_hwtstamp(struct ixgbe_ring *rx_ring,
-                                         union ixgbe_adv_rx_desc *rx_desc,
-                                         struct sk_buff *skb)
-{
-        if (unlikely(!ixgbe_test_staterr(rx_desc, IXGBE_RXDADV_STAT_TS)))
-                return;
-        __ixgbe_ptp_rx_hwtstamp(rx_ring->q_vector, skb);
-        /*
-         * Update the last_rx_timestamp timer in order to enable watchdog check
-         * for error case of latched timestamp on a dropped packet.
-         */
-        rx_ring->last_rx_timestamp = jiffies;
-}
 int ixgbe_ptp_set_ts_config(struct ixgbe_adapter *adapter, struct ifreq *ifr);
 int ixgbe_ptp_get_ts_config(struct ixgbe_adapter *adapter, struct ifreq *ifr);
 void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 24fba39e194e..981b8a7b100d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1195,7 +1195,7 @@ static s32 ixgbe_detect_eeprom_page_size_generic(struct ixgbe_hw *hw,
         */
        hw->eeprom.word_page_size = IXGBE_EEPROM_PAGE_SIZE_MAX - data[0];
-        hw_dbg(hw, "Detected EEPROM page size = %d words.",
+        hw_dbg(hw, "Detected EEPROM page size = %d words.\n",
               hw->eeprom.word_page_size);
 out:
        return status;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index c4c526b7f99f..d62e7a25cf97 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1664,7 +1664,8 @@ static void ixgbe_process_skb_fields(struct ixgbe_ring *rx_ring,
        ixgbe_rx_checksum(rx_ring, rx_desc, skb);
-        ixgbe_ptp_rx_hwtstamp(rx_ring, rx_desc, skb);
+        if (unlikely(ixgbe_test_staterr(rx_desc, IXGBE_RXDADV_STAT_TS)))
+                ixgbe_ptp_rx_hwtstamp(rx_ring->q_vector->adapter, skb);
        if ((dev->features & NETIF_F_HW_VLAN_CTAG_RX) &&
            ixgbe_test_staterr(rx_desc, IXGBE_RXD_STAT_VP)) {
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index 23f765263f12..a76af8e28a04 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -536,7 +536,7 @@ s32 ixgbe_setup_phy_link_generic(struct ixgbe_hw *hw)
        if (time_out == max_time_out) {
                status = IXGBE_ERR_LINK_SETUP;
-                hw_dbg(hw, "ixgbe_setup_phy_link_generic: time out");
+                hw_dbg(hw, "ixgbe_setup_phy_link_generic: time out\n");
        }
        return status;
@@ -745,7 +745,7 @@ s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
        if (time_out == max_time_out) {
                status = IXGBE_ERR_LINK_SETUP;
-                hw_dbg(hw, "ixgbe_setup_phy_link_tnx: time out");
+                hw_dbg(hw, "ixgbe_setup_phy_link_tnx: time out\n");
        }
        return status;
@@ -1175,7 +1175,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw)
                                status = 0;
                        } else {
                                if (hw->allow_unsupported_sfp) {
-                                        e_warn(drv, "WARNING: Intel (R) Network Connections are quality tested using Intel (R) Ethernet Optics.  Using untested modules is not supported and may cause unstable operation or damage to the module or the adapter.  Intel Corporation is not responsible for any harm caused by using untested modules.");
+                                        e_warn(drv, "WARNING: Intel (R) Network Connections are quality tested using Intel (R) Ethernet Optics.  Using untested modules is not supported and may cause unstable operation or damage to the module or the adapter.  Intel Corporation is not responsible for any harm caused by using untested modules.\n");
                                        status = 0;
                                } else {
                                        hw_dbg(hw,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index 63515a6f67fa..8902ae683457 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -435,10 +435,8 @@ void ixgbe_ptp_overflow_check(struct ixgbe_adapter *adapter)
 void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter)
 {
        struct ixgbe_hw *hw = &adapter->hw;
-        struct ixgbe_ring *rx_ring;
        u32 tsyncrxctl = IXGBE_READ_REG(hw, IXGBE_TSYNCRXCTL);
        unsigned long rx_event;
-        int n;
        /* if we don't have a valid timestamp in the registers, just update the
         * timeout counter and exit
@@ -450,18 +448,15 @@ void ixgbe_ptp_rx_hang(struct ixgbe_adapter *adapter)
        /* determine the most recent watchdog or rx_timestamp event */
        rx_event = adapter->last_rx_ptp_check;
-        for (n = 0; n < adapter->num_rx_queues; n++) {
+        if (time_after(adapter->last_rx_timestamp, rx_event))
-                rx_ring = adapter->rx_ring[n];
+                rx_event = adapter->last_rx_timestamp;
-                if (time_after(rx_ring->last_rx_timestamp, rx_event))
-                        rx_event = rx_ring->last_rx_timestamp;
-        }
        /* only need to read the high RXSTMP register to clear the lock */
        if (time_is_before_jiffies(rx_event + 5*HZ)) {
                IXGBE_READ_REG(hw, IXGBE_RXSTMPH);
                adapter->last_rx_ptp_check = jiffies;
-                e_warn(drv, "clearing RX Timestamp hang");
+                e_warn(drv, "clearing RX Timestamp hang\n");
        }
 }
@@ -517,7 +512,7 @@ static void ixgbe_ptp_tx_hwtstamp_work(struct work_struct *work)
                dev_kfree_skb_any(adapter->ptp_tx_skb);
                adapter->ptp_tx_skb = NULL;
                clear_bit_unlock(__IXGBE_PTP_TX_IN_PROGRESS, &adapter->state);
-                e_warn(drv, "clearing Tx Timestamp hang");
+                e_warn(drv, "clearing Tx Timestamp hang\n");
                return;
        }
@@ -530,35 +525,22 @@ static void ixgbe_ptp_tx_hwtstamp_work(struct work_struct *work)
 }
 /**
- * __ixgbe_ptp_rx_hwtstamp - utility function which checks for RX time stamp
+ * ixgbe_ptp_rx_hwtstamp - utility function which checks for RX time stamp
- * @q_vector: structure containing interrupt and ring information
+ * @adapter: pointer to adapter struct
 * @skb: particular skb to send timestamp with
 *
 * if the timestamp is valid, we convert it into the timecounter ns
 * value, then store that result into the shhwtstamps structure which
 * is passed up the network stack
 */
-void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
+void ixgbe_ptp_rx_hwtstamp(struct ixgbe_adapter *adapter, struct sk_buff *skb)
-                             struct sk_buff *skb)
 {
-        struct ixgbe_adapter *adapter;
+        struct ixgbe_hw *hw = &adapter->hw;
-        struct ixgbe_hw *hw;
        struct skb_shared_hwtstamps *shhwtstamps;
        u64 regval = 0, ns;
        u32 tsyncrxctl;
        unsigned long flags;
-        /* we cannot process timestamps on a ring without a q_vector */
-        if (!q_vector || !q_vector->adapter)
-                return;
-        adapter = q_vector->adapter;
-        hw = &adapter->hw;
-        /*
-         * Read the tsyncrxctl register afterwards in order to prevent taking an
-         * I/O hit on every packet.
-         */
        tsyncrxctl = IXGBE_READ_REG(hw, IXGBE_TSYNCRXCTL);
        if (!(tsyncrxctl & IXGBE_TSYNCRXCTL_VALID))
                return;
@@ -566,13 +548,17 @@ void __ixgbe_ptp_rx_hwtstamp(struct ixgbe_q_vector *q_vector,
        regval |= (u64)IXGBE_READ_REG(hw, IXGBE_RXSTMPL);
        regval |= (u64)IXGBE_READ_REG(hw, IXGBE_RXSTMPH) << 32;
        spin_lock_irqsave(&adapter->tmreg_lock, flags);
        ns = timecounter_cyc2time(&adapter->tc, regval);
        spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
        shhwtstamps = skb_hwtstamps(skb);
        shhwtstamps->hwtstamp = ns_to_ktime(ns);
+        /* Update the last_rx_timestamp timer in order to enable watchdog check
+         * for error case of latched timestamp on a dropped packet.
+         */
+        adapter->last_rx_timestamp = jiffies;
 }
 int ixgbe_ptp_get_ts_config(struct ixgbe_adapter *adapter, struct ifreq *ifr)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index b0c6050479eb..b78378cea5e3 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -1988,7 +1988,7 @@ jme_alloc_txdesc(struct jme_adapter *jme,
        return idx;
 }
-static void
+static int
 jme_fill_tx_map(struct pci_dev *pdev,
                struct txdesc *txdesc,
                struct jme_buffer_info *txbi,
@@ -2005,6 +2005,9 @@ jme_fill_tx_map(struct pci_dev *pdev,
                                len,
                                PCI_DMA_TODEVICE);
+        if (unlikely(pci_dma_mapping_error(pdev, dmaaddr)))
+                return -EINVAL;
        pci_dma_sync_single_for_device(pdev,
                                       dmaaddr,
                                       len,
@@ -2021,9 +2024,30 @@ jme_fill_tx_map(struct pci_dev *pdev,
        txbi->mapping = dmaaddr;
        txbi->len = len;
+        return 0;
 }
-static void
+static void jme_drop_tx_map(struct jme_adapter *jme, int startidx, int count)
+{
+        struct jme_ring *txring = &(jme->txring[0]);
+        struct jme_buffer_info *txbi = txring->bufinf, *ctxbi;
+        int mask = jme->tx_ring_mask;
+        int j;
+        for (j = 0 ; j < count ; j++) {
+                ctxbi = txbi + ((startidx + j + 2) & (mask));
+                pci_unmap_page(jme->pdev,
+                                ctxbi->mapping,
+                                ctxbi->len,
+                                PCI_DMA_TODEVICE);
+                                ctxbi->mapping = 0;
+                                ctxbi->len = 0;
+        }
+}
+static int
 jme_map_tx_skb(struct jme_adapter *jme, struct sk_buff *skb, int idx)
 {
        struct jme_ring *txring = &(jme->txring[0]);
@@ -2034,25 +2058,37 @@ jme_map_tx_skb(struct jme_adapter *jme, struct sk_buff *skb, int idx)
        int mask = jme->tx_ring_mask;
        const struct skb_frag_struct *frag;
        u32 len;
+        int ret = 0;
        for (i = 0 ; i < nr_frags ; ++i) {
                frag = &skb_shinfo(skb)->frags[i];
                ctxdesc = txdesc + ((idx + i + 2) & (mask));
                ctxbi = txbi + ((idx + i + 2) & (mask));
-                jme_fill_tx_map(jme->pdev, ctxdesc, ctxbi,
+                ret = jme_fill_tx_map(jme->pdev, ctxdesc, ctxbi,
                                skb_frag_page(frag),
                                frag->page_offset, skb_frag_size(frag), hidma);
+                if (ret) {
+                        jme_drop_tx_map(jme, idx, i);
+                        goto out;
+                }
        }
        len = skb_is_nonlinear(skb) ? skb_headlen(skb) : skb->len;
        ctxdesc = txdesc + ((idx + 1) & (mask));
        ctxbi = txbi + ((idx + 1) & (mask));
-        jme_fill_tx_map(jme->pdev, ctxdesc, ctxbi, virt_to_page(skb->data),
+        ret = jme_fill_tx_map(jme->pdev, ctxdesc, ctxbi, virt_to_page(skb->data),
                        offset_in_page(skb->data), len, hidma);
+        if (ret)
+                jme_drop_tx_map(jme, idx, i);
+out:
+        return ret;
 }
 static int
 jme_tx_tso(struct sk_buff *skb, __le16 *mss, u8 *flags)
 {
@@ -2131,6 +2167,7 @@ jme_fill_tx_desc(struct jme_adapter *jme, struct sk_buff *skb, int idx)
        struct txdesc *txdesc;
        struct jme_buffer_info *txbi;
        u8 flags;
+        int ret = 0;
        txdesc = (struct txdesc *)txring->desc + idx;
        txbi = txring->bufinf + idx;
@@ -2155,7 +2192,10 @@ jme_fill_tx_desc(struct jme_adapter *jme, struct sk_buff *skb, int idx)
        if (jme_tx_tso(skb, &txdesc->desc1.mss, &flags))
                jme_tx_csum(jme, skb, &flags);
        jme_tx_vlan(skb, &txdesc->desc1.vlan, &flags);
-        jme_map_tx_skb(jme, skb, idx);
+        ret = jme_map_tx_skb(jme, skb, idx);
+        if (ret)
+                return ret;
        txdesc->desc1.flags = flags;
        /*
         * Set tx buffer info after telling NIC to send
@@ -2228,7 +2268,8 @@ jme_start_xmit(struct sk_buff *skb, struct net_device *netdev)
                return NETDEV_TX_BUSY;
        }
-        jme_fill_tx_desc(jme, skb, idx);
+        if (jme_fill_tx_desc(jme, skb, idx))
+                return NETDEV_TX_OK;
        jwrite32(jme, JME_TXCS, jme->reg_txcs |
                                TXCS_SELECT_QUEUE0 |
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index b161a525fc5b..9d5ced263a5e 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -232,7 +232,7 @@ static int orion_mdio_probe(struct platform_device *pdev)
                clk_prepare_enable(dev->clk);
        dev->err_interrupt = platform_get_irq(pdev, 0);
-        if (dev->err_interrupt != -ENXIO) {
+        if (dev->err_interrupt > 0) {
                ret = devm_request_irq(&pdev->dev, dev->err_interrupt,
                                        orion_mdio_err_irq,
                                        IRQF_SHARED, pdev->name, dev);
@@ -241,6 +241,9 @@ static int orion_mdio_probe(struct platform_device *pdev)
                writel(MVMDIO_ERR_INT_SMI_DONE,
                        dev->regs + MVMDIO_ERR_INT_MASK);
+        } else if (dev->err_interrupt == -EPROBE_DEFER) {
+                return -EPROBE_DEFER;
        }
        mutex_init(&dev->lock);
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index d04b1c3c9b85..14786c8bf99e 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -91,7 +91,7 @@
 #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
 #define MVNETA_SERDES_CFG                        0x24A0
 #define      MVNETA_SGMII_SERDES_PROTO           0x0cc7
-#define      MVNETA_RGMII_SERDES_PROTO           0x0667
+#define      MVNETA_QSGMII_SERDES_PROTO          0x0667
 #define MVNETA_TYPE_PRIO                         0x24bc
 #define      MVNETA_FORCE_UNI                    BIT(21)
 #define MVNETA_TXQ_CMD_1                         0x24e4
@@ -2721,29 +2721,44 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp,
 }
 /* Power up the port */
-static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
+static int mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
 {
-        u32 val;
+        u32 ctrl;
        /* MAC Cause register should be cleared */
        mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0);
-        if (phy_mode == PHY_INTERFACE_MODE_SGMII)
+        ctrl = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
-                mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
-        else
-                mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_RGMII_SERDES_PROTO);
-        val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
+        /* Even though it might look weird, when we're configured in
+         * SGMII or QSGMII mode, the RGMII bit needs to be set.
-        val |= MVNETA_GMAC2_PCS_ENABLE | MVNETA_GMAC2_PORT_RGMII;
+         */
+        switch(phy_mode) {
+        case PHY_INTERFACE_MODE_QSGMII:
+                mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_QSGMII_SERDES_PROTO);
+                ctrl |= MVNETA_GMAC2_PCS_ENABLE | MVNETA_GMAC2_PORT_RGMII;
+                break;
+        case PHY_INTERFACE_MODE_SGMII:
+                mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
+                ctrl |= MVNETA_GMAC2_PCS_ENABLE | MVNETA_GMAC2_PORT_RGMII;
+                break;
+        case PHY_INTERFACE_MODE_RGMII:
+        case PHY_INTERFACE_MODE_RGMII_ID:
+                ctrl |= MVNETA_GMAC2_PORT_RGMII;
+                break;
+        default:
+                return -EINVAL;
+        }
        /* Cancel Port Reset */
-        val &= ~MVNETA_GMAC2_PORT_RESET;
+        ctrl &= ~MVNETA_GMAC2_PORT_RESET;
-        mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+        mvreg_write(pp, MVNETA_GMAC_CTRL_2, ctrl);
        while ((mvreg_read(pp, MVNETA_GMAC_CTRL_2) &
                MVNETA_GMAC2_PORT_RESET) != 0)
                continue;
+        return 0;
 }
 /* Device initialization routine */
@@ -2854,7 +2869,12 @@ static int mvneta_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "can't init eth hal\n");
                goto err_free_stats;
        }
-        mvneta_port_power_up(pp, phy_mode);
+        err = mvneta_port_power_up(pp, phy_mode);
+        if (err < 0) {
+                dev_err(&pdev->dev, "can't power up port\n");
+                goto err_deinit;
+        }
        dram_target_info = mv_mbus_dram_info();
        if (dram_target_info)
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 78099eab7673..92d3249f63f1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -1253,12 +1253,12 @@ static struct mlx4_cmd_info cmd_info[] = {
        },
        {
                .opcode = MLX4_CMD_UPDATE_QP,
-                .has_inbox = false,
+                .has_inbox = true,
                .has_outbox = false,
                .out_is_imm = false,
                .encode_slave_id = false,
                .verify = NULL,
-                .wrapper = mlx4_CMD_EPERM_wrapper
+                .wrapper = mlx4_UPDATE_QP_wrapper
        },
        {
                .opcode = MLX4_CMD_GET_OP_REQ,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
index 70e95324a97d..c2cd8d31bcad 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
@@ -66,7 +66,6 @@ int mlx4_en_create_cq(struct mlx4_en_priv *priv,
        cq->ring = ring;
        cq->is_tx = mode;
-        spin_lock_init(&cq->lock);
        /* Allocate HW buffers on provided NUMA node.
         * dev->numa_node is used in mtt range allocation flow.
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index f085c2df5e69..7e4b1720c3d1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1304,15 +1304,11 @@ static void mlx4_en_netpoll(struct net_device *dev)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        struct mlx4_en_cq *cq;
-        unsigned long flags;
        int i;
        for (i = 0; i < priv->rx_ring_num; i++) {
                cq = priv->rx_cq[i];
-                spin_lock_irqsave(&cq->lock, flags);
+                napi_schedule(&cq->napi);
-                napi_synchronize(&cq->napi);
-                mlx4_en_process_rx_cq(dev, cq, 0);
-                spin_unlock_irqrestore(&cq->lock, flags);
        }
 }
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index f0ae95f66ceb..7cf9dadcb471 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -754,10 +754,10 @@ static void mlx4_request_modules(struct mlx4_dev *dev)
                        has_eth_port = true;
        }
-        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
-                request_module_nowait(IB_DRV_NAME);
        if (has_eth_port)
                request_module_nowait(EN_DRV_NAME);
+        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
+                request_module_nowait(IB_DRV_NAME);
 }
 /*
@@ -2301,13 +2301,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data)
        /* Allow large DMA segments, up to the firmware limit of 1 GB */
        dma_set_max_seg_size(&pdev->dev, 1024 * 1024 * 1024);
-        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        dev       = pci_get_drvdata(pdev);
-        if (!priv) {
+        priv      = mlx4_priv(dev);
-                err = -ENOMEM;
-                goto err_release_regions;
-        }
-        dev       = &priv->dev;
        dev->pdev = pdev;
        INIT_LIST_HEAD(&priv->ctx_list);
        spin_lock_init(&priv->ctx_lock);
@@ -2374,10 +2369,10 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data)
                        } else {
                                atomic_inc(&pf_loading);
                                err = pci_enable_sriov(pdev, total_vfs);
-                                atomic_dec(&pf_loading);
                                if (err) {
                                        mlx4_err(dev, "Failed to enable SR-IOV, continuing without SR-IOV (err = %d).\n",
                                                 err);
+                                        atomic_dec(&pf_loading);
                                        err = 0;
                                } else {
                                        mlx4_warn(dev, "Running in master mode\n");
@@ -2445,7 +2440,8 @@ slave_start:
         * No return code for this call, just warn the user in case of PCI
         * express device capabilities are under-satisfied by the bus.
         */
-        mlx4_check_pcie_caps(dev);
+        if (!mlx4_is_slave(dev))
+                mlx4_check_pcie_caps(dev);
        /* In master functions, the communication channel must be initialized
         * after obtaining its address from fw */
@@ -2535,8 +2531,10 @@ slave_start:
        mlx4_sense_init(dev);
        mlx4_start_sense(dev);
-        priv->pci_dev_data = pci_dev_data;
+        priv->removed = 0;
-        pci_set_drvdata(pdev, dev);
+        if (mlx4_is_master(dev) && dev->num_vfs)
+                atomic_dec(&pf_loading);
        return 0;
@@ -2588,6 +2586,9 @@ err_rel_own:
        if (!mlx4_is_slave(dev))
                mlx4_free_ownership(dev);
+        if (mlx4_is_master(dev) && dev->num_vfs)
+                atomic_dec(&pf_loading);
        kfree(priv->dev.dev_vfs);
 err_free_dev:
@@ -2604,85 +2605,110 @@ err_disable_pdev:
 static int mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 {
+        struct mlx4_priv *priv;
+        struct mlx4_dev *dev;
        printk_once(KERN_INFO "%s", mlx4_version);
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+        dev       = &priv->dev;
+        pci_set_drvdata(pdev, dev);
+        priv->pci_dev_data = id->driver_data;
        return __mlx4_init_one(pdev, id->driver_data);
 }
-static void mlx4_remove_one(struct pci_dev *pdev)
+static void __mlx4_remove_one(struct pci_dev *pdev)
 {
        struct mlx4_dev  *dev  = pci_get_drvdata(pdev);
        struct mlx4_priv *priv = mlx4_priv(dev);
+        int               pci_dev_data;
        int p;
-        if (dev) {
+        if (priv->removed)
-                /* in SRIOV it is not allowed to unload the pf's
+                return;
-                 * driver while there are alive vf's */
-                if (mlx4_is_master(dev)) {
-                        if (mlx4_how_many_lives_vf(dev))
-                                printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n");
-                }
-                mlx4_stop_sense(dev);
-                mlx4_unregister_device(dev);
-                for (p = 1; p <= dev->caps.num_ports; p++) {
+        pci_dev_data = priv->pci_dev_data;
-                        mlx4_cleanup_port_info(&priv->port[p]);
-                        mlx4_CLOSE_PORT(dev, p);
-                }
-                if (mlx4_is_master(dev))
+        /* in SRIOV it is not allowed to unload the pf's
-                        mlx4_free_resource_tracker(dev,
+         * driver while there are alive vf's */
-                                                   RES_TR_FREE_SLAVES_ONLY);
+        if (mlx4_is_master(dev) && mlx4_how_many_lives_vf(dev))
+                printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n");
-                mlx4_cleanup_counters_table(dev);
+        mlx4_stop_sense(dev);
-                mlx4_cleanup_qp_table(dev);
+        mlx4_unregister_device(dev);
-                mlx4_cleanup_srq_table(dev);
-                mlx4_cleanup_cq_table(dev);
-                mlx4_cmd_use_polling(dev);
-                mlx4_cleanup_eq_table(dev);
-                mlx4_cleanup_mcg_table(dev);
-                mlx4_cleanup_mr_table(dev);
-                mlx4_cleanup_xrcd_table(dev);
-                mlx4_cleanup_pd_table(dev);
-                if (mlx4_is_master(dev))
+        for (p = 1; p <= dev->caps.num_ports; p++) {
-                        mlx4_free_resource_tracker(dev,
+                mlx4_cleanup_port_info(&priv->port[p]);
-                                                   RES_TR_FREE_STRUCTS_ONLY);
+                mlx4_CLOSE_PORT(dev, p);
+        }
-                iounmap(priv->kar);
-                mlx4_uar_free(dev, &priv->driver_uar);
+        if (mlx4_is_master(dev))
-                mlx4_cleanup_uar_table(dev);
+                mlx4_free_resource_tracker(dev,
-                if (!mlx4_is_slave(dev))
+                                           RES_TR_FREE_SLAVES_ONLY);
-                        mlx4_clear_steering(dev);
-                mlx4_free_eq_table(dev);
+        mlx4_cleanup_counters_table(dev);
-                if (mlx4_is_master(dev))
+        mlx4_cleanup_qp_table(dev);
-                        mlx4_multi_func_cleanup(dev);
+        mlx4_cleanup_srq_table(dev);
-                mlx4_close_hca(dev);
+        mlx4_cleanup_cq_table(dev);
-                if (mlx4_is_slave(dev))
+        mlx4_cmd_use_polling(dev);
-                        mlx4_multi_func_cleanup(dev);
+        mlx4_cleanup_eq_table(dev);
-                mlx4_cmd_cleanup(dev);
+        mlx4_cleanup_mcg_table(dev);
+        mlx4_cleanup_mr_table(dev);
-                if (dev->flags & MLX4_FLAG_MSI_X)
+        mlx4_cleanup_xrcd_table(dev);
-                        pci_disable_msix(pdev);
+        mlx4_cleanup_pd_table(dev);
-                if (dev->flags & MLX4_FLAG_SRIOV) {
-                        mlx4_warn(dev, "Disabling SR-IOV\n");
-                        pci_disable_sriov(pdev);
-                }
-                if (!mlx4_is_slave(dev))
+        if (mlx4_is_master(dev))
-                        mlx4_free_ownership(dev);
+                mlx4_free_resource_tracker(dev,
+                                           RES_TR_FREE_STRUCTS_ONLY);
-                kfree(dev->caps.qp0_tunnel);
+        iounmap(priv->kar);
-                kfree(dev->caps.qp0_proxy);
+        mlx4_uar_free(dev, &priv->driver_uar);
-                kfree(dev->caps.qp1_tunnel);
+        mlx4_cleanup_uar_table(dev);
-                kfree(dev->caps.qp1_proxy);
+        if (!mlx4_is_slave(dev))
-                kfree(dev->dev_vfs);
+                mlx4_clear_steering(dev);
+        mlx4_free_eq_table(dev);
+        if (mlx4_is_master(dev))
+                mlx4_multi_func_cleanup(dev);
+        mlx4_close_hca(dev);
+        if (mlx4_is_slave(dev))
+                mlx4_multi_func_cleanup(dev);
+        mlx4_cmd_cleanup(dev);
-                kfree(priv);
+        if (dev->flags & MLX4_FLAG_MSI_X)
-                pci_release_regions(pdev);
+                pci_disable_msix(pdev);
-                pci_disable_device(pdev);
+        if (dev->flags & MLX4_FLAG_SRIOV) {
-                pci_set_drvdata(pdev, NULL);
+                mlx4_warn(dev, "Disabling SR-IOV\n");
+                pci_disable_sriov(pdev);
+                dev->num_vfs = 0;
        }
+        if (!mlx4_is_slave(dev))
+                mlx4_free_ownership(dev);
+        kfree(dev->caps.qp0_tunnel);
+        kfree(dev->caps.qp0_proxy);
+        kfree(dev->caps.qp1_tunnel);
+        kfree(dev->caps.qp1_proxy);
+        kfree(dev->dev_vfs);
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+        memset(priv, 0, sizeof(*priv));
+        priv->pci_dev_data = pci_dev_data;
+        priv->removed = 1;
+}
+static void mlx4_remove_one(struct pci_dev *pdev)
+{
+        struct mlx4_dev  *dev  = pci_get_drvdata(pdev);
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        __mlx4_remove_one(pdev);
+        kfree(priv);
+        pci_set_drvdata(pdev, NULL);
 }
 int mlx4_restart_one(struct pci_dev *pdev)
@@ -2692,7 +2718,7 @@ int mlx4_restart_one(struct pci_dev *pdev)
        int               pci_dev_data;
        pci_dev_data = priv->pci_dev_data;
-        mlx4_remove_one(pdev);
+        __mlx4_remove_one(pdev);
        return __mlx4_init_one(pdev, pci_dev_data);
 }
@@ -2747,7 +2773,7 @@ MODULE_DEVICE_TABLE(pci, mlx4_pci_table);
 static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev,
                                              pci_channel_state_t state)
 {
-        mlx4_remove_one(pdev);
+        __mlx4_remove_one(pdev);
        return state == pci_channel_io_perm_failure ?
                PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
@@ -2755,11 +2781,11 @@ static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev,
 static pci_ers_result_t mlx4_pci_slot_reset(struct pci_dev *pdev)
 {
-        const struct pci_device_id *id;
+        struct mlx4_dev  *dev  = pci_get_drvdata(pdev);
-        int ret;
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        int               ret;
-        id = pci_match_id(mlx4_pci_table, pdev);
+        ret = __mlx4_init_one(pdev, priv->pci_dev_data);
-        ret = __mlx4_init_one(pdev, id->driver_data);
        return ret ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index cf8be41abb36..212cea440f90 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -800,6 +800,7 @@ struct mlx4_priv {
        spinlock_t              ctx_lock;
        int                     pci_dev_data;
+        int                     removed;
        struct list_head        pgdir_list;
        struct mutex            pgdir_mutex;
@@ -1194,6 +1195,12 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                           struct mlx4_cmd_mailbox *outbox,
                           struct mlx4_cmd_info *cmd);
+int mlx4_UPDATE_QP_wrapper(struct mlx4_dev *dev, int slave,
+                           struct mlx4_vhcr *vhcr,
+                           struct mlx4_cmd_mailbox *inbox,
+                           struct mlx4_cmd_mailbox *outbox,
+                           struct mlx4_cmd_info *cmd);
 int mlx4_PROMISC_wrapper(struct mlx4_dev *dev, int slave,
                         struct mlx4_vhcr *vhcr,
                         struct mlx4_cmd_mailbox *inbox,
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 7a733c287744..04d9b6fe3e80 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -319,7 +319,6 @@ struct mlx4_en_cq {
        struct mlx4_cq          mcq;
        struct mlx4_hwq_resources wqres;
        int                     ring;
-        spinlock_t              lock;
        struct net_device      *dev;
        struct napi_struct      napi;
        int size;
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index cfcad26ed40f..b5b3549b0c8d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -1106,6 +1106,9 @@ int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,
        }
        if (found_ix >= 0) {
+                /* Calculate a slave_gid which is the slave number in the gid
+                 * table and not a globally unique slave number.
+                 */
                if (found_ix < MLX4_ROCE_PF_GIDS)
                        slave_gid = 0;
                else if (found_ix < MLX4_ROCE_PF_GIDS + (vf_gids % num_vfs) *
@@ -1118,41 +1121,43 @@ int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,
                          ((vf_gids % num_vfs) * ((vf_gids / num_vfs + 1)))) /
                         (vf_gids / num_vfs)) + vf_gids % num_vfs + 1;
+                /* Calculate the globally unique slave id */
                if (slave_gid) {
                        struct mlx4_active_ports exclusive_ports;
                        struct mlx4_active_ports actv_ports;
                        struct mlx4_slaves_pport slaves_pport_actv;
                        unsigned max_port_p_one;
-                        int num_slaves_before = 1;
+                        int num_vfs_before = 0;
+                        int candidate_slave_gid;
+                        /* Calculate how many VFs are on the previous port, if exists */
                        for (i = 1; i < port; i++) {
                                bitmap_zero(exclusive_ports.ports, dev->caps.num_ports);
-                                set_bit(i, exclusive_ports.ports);
+                                set_bit(i - 1, exclusive_ports.ports);
                                slaves_pport_actv =
                                        mlx4_phys_to_slaves_pport_actv(
                                                        dev, &exclusive_ports);
-                                num_slaves_before += bitmap_weight(
+                                num_vfs_before += bitmap_weight(
                                                slaves_pport_actv.slaves,
                                                dev->num_vfs + 1);
                        }
-                        if (slave_gid < num_slaves_before) {
+                        /* candidate_slave_gid isn't necessarily the correct slave, but
-                                bitmap_zero(exclusive_ports.ports, dev->caps.num_ports);
+                         * it has the same number of ports and is assigned to the same
-                                set_bit(port - 1, exclusive_ports.ports);
+                         * ports as the real slave we're looking for. On dual port VF,
-                                slaves_pport_actv =
+                         * slave_gid = [single port VFs on port <port>] +
-                                        mlx4_phys_to_slaves_pport_actv(
+                         * [offset of the current slave from the first dual port VF] +
-                                                        dev, &exclusive_ports);
+                         * 1 (for the PF).
-                                slave_gid += bitmap_weight(
+                         */
-                                                slaves_pport_actv.slaves,
+                        candidate_slave_gid = slave_gid + num_vfs_before;
-                                                dev->num_vfs + 1) -
-                                                num_slaves_before;
+                        actv_ports = mlx4_get_active_ports(dev, candidate_slave_gid);
-                        }
-                        actv_ports = mlx4_get_active_ports(dev, slave_gid);
                        max_port_p_one = find_first_bit(
                                actv_ports.ports, dev->caps.num_ports) +
                                bitmap_weight(actv_ports.ports,
                                              dev->caps.num_ports) + 1;
+                        /* Calculate the real slave number */
                        for (i = 1; i < max_port_p_one; i++) {
                                if (i == port)
                                        continue;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 61d64ebffd56..fbd32af89c7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -389,6 +389,41 @@ err_icm:
 EXPORT_SYMBOL_GPL(mlx4_qp_alloc);
+#define MLX4_UPDATE_QP_SUPPORTED_ATTRS MLX4_UPDATE_QP_SMAC
+int mlx4_update_qp(struct mlx4_dev *dev, struct mlx4_qp *qp,
+                   enum mlx4_update_qp_attr attr,
+                   struct mlx4_update_qp_params *params)
+{
+        struct mlx4_cmd_mailbox *mailbox;
+        struct mlx4_update_qp_context *cmd;
+        u64 pri_addr_path_mask = 0;
+        int err = 0;
+        mailbox = mlx4_alloc_cmd_mailbox(dev);
+        if (IS_ERR(mailbox))
+                return PTR_ERR(mailbox);
+        cmd = (struct mlx4_update_qp_context *)mailbox->buf;
+        if (!attr || (attr & ~MLX4_UPDATE_QP_SUPPORTED_ATTRS))
+                return -EINVAL;
+        if (attr & MLX4_UPDATE_QP_SMAC) {
+                pri_addr_path_mask |= 1ULL << MLX4_UPD_QP_PATH_MASK_MAC_INDEX;
+                cmd->qp_context.pri_path.grh_mylmc = params->smac_index;
+        }
+        cmd->primary_addr_path_mask = cpu_to_be64(pri_addr_path_mask);
+        err = mlx4_cmd(dev, mailbox->dma, qp->qpn & 0xffffff, 0,
+                       MLX4_CMD_UPDATE_QP, MLX4_CMD_TIME_CLASS_A,
+                       MLX4_CMD_NATIVE);
+        mlx4_free_cmd_mailbox(dev, mailbox);
+        return err;
+}
+EXPORT_SYMBOL_GPL(mlx4_update_qp);
 void mlx4_qp_remove(struct mlx4_dev *dev, struct mlx4_qp *qp)
 {
        struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 3b5f53ef29b2..8f1254a79832 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -3733,6 +3733,25 @@ static int qp_detach(struct mlx4_dev *dev, struct mlx4_qp *qp,
        }
 }
+static int mlx4_adjust_port(struct mlx4_dev *dev, int slave,
+                            u8 *gid, enum mlx4_protocol prot)
+{
+        int real_port;
+        if (prot != MLX4_PROT_ETH)
+                return 0;
+        if (dev->caps.steering_mode == MLX4_STEERING_MODE_B0 ||
+            dev->caps.steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) {
+                real_port = mlx4_slave_convert_port(dev, slave, gid[5]);
+                if (real_port < 0)
+                        return -EINVAL;
+                gid[5] = real_port;
+        }
+        return 0;
+}
 int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                               struct mlx4_vhcr *vhcr,
                               struct mlx4_cmd_mailbox *inbox,
@@ -3768,6 +3787,10 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                if (err)
                        goto ex_detach;
        } else {
+                err = mlx4_adjust_port(dev, slave, gid, prot);
+                if (err)
+                        goto ex_put;
                err = rem_mcg_res(dev, slave, rqp, gid, prot, type, &reg_id);
                if (err)
                        goto ex_put;
@@ -3872,6 +3895,60 @@ static int add_eth_header(struct mlx4_dev *dev, int slave,
 }
+#define MLX4_UPD_QP_PATH_MASK_SUPPORTED (1ULL << MLX4_UPD_QP_PATH_MASK_MAC_INDEX)
+int mlx4_UPDATE_QP_wrapper(struct mlx4_dev *dev, int slave,
+                           struct mlx4_vhcr *vhcr,
+                           struct mlx4_cmd_mailbox *inbox,
+                           struct mlx4_cmd_mailbox *outbox,
+                           struct mlx4_cmd_info *cmd_info)
+{
+        int err;
+        u32 qpn = vhcr->in_modifier & 0xffffff;
+        struct res_qp *rqp;
+        u64 mac;
+        unsigned port;
+        u64 pri_addr_path_mask;
+        struct mlx4_update_qp_context *cmd;
+        int smac_index;
+        cmd = (struct mlx4_update_qp_context *)inbox->buf;
+        pri_addr_path_mask = be64_to_cpu(cmd->primary_addr_path_mask);
+        if (cmd->qp_mask || cmd->secondary_addr_path_mask ||
+            (pri_addr_path_mask & ~MLX4_UPD_QP_PATH_MASK_SUPPORTED))
+                return -EPERM;
+        /* Just change the smac for the QP */
+        err = get_res(dev, slave, qpn, RES_QP, &rqp);
+        if (err) {
+                mlx4_err(dev, "Updating qpn 0x%x for slave %d rejected\n", qpn, slave);
+                return err;
+        }
+        port = (rqp->sched_queue >> 6 & 1) + 1;
+        smac_index = cmd->qp_context.pri_path.grh_mylmc;
+        err = mac_find_smac_ix_in_slave(dev, slave, port,
+                                        smac_index, &mac);
+        if (err) {
+                mlx4_err(dev, "Failed to update qpn 0x%x, MAC is invalid. smac_ix: %d\n",
+                         qpn, smac_index);
+                goto err_mac;
+        }
+        err = mlx4_cmd(dev, inbox->dma,
+                       vhcr->in_modifier, 0,
+                       MLX4_CMD_UPDATE_QP, MLX4_CMD_TIME_CLASS_A,
+                       MLX4_CMD_NATIVE);
+        if (err) {
+                mlx4_err(dev, "Failed to update qpn on qpn 0x%x, command failed\n", qpn);
+                goto err_mac;
+        }
+err_mac:
+        put_res(dev, slave, qpn, RES_QP);
+        return err;
+}
 int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                                         struct mlx4_vhcr *vhcr,
                                         struct mlx4_cmd_mailbox *inbox,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 7b52a88923ef..f785d01c7d12 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1719,22 +1719,6 @@ static inline u32 qlcnic_tx_avail(struct qlcnic_host_tx_ring *tx_ring)
                                tx_ring->producer;
 }
-static inline int qlcnic_set_real_num_queues(struct qlcnic_adapter *adapter,
-                                             struct net_device *netdev)
-{
-        int err;
-        netdev->num_tx_queues = adapter->drv_tx_rings;
-        netdev->real_num_tx_queues = adapter->drv_tx_rings;
-        err = netif_set_real_num_tx_queues(netdev, adapter->drv_tx_rings);
-        if (err)
-                netdev_err(netdev, "failed to set %d Tx queues\n",
-                           adapter->drv_tx_rings);
-        return err;
-}
 struct qlcnic_nic_template {
        int (*config_bridged_mode) (struct qlcnic_adapter *, u32);
        int (*config_led) (struct qlcnic_adapter *, u32, u32);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index b48737dcd3c5..ba20c721ee97 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -2139,8 +2139,6 @@ static int qlcnic_83xx_get_nic_configuration(struct qlcnic_adapter *adapter)
        ahw->max_mac_filters = nic_info.max_mac_filters;
        ahw->max_mtu = nic_info.max_mtu;
-        adapter->max_tx_rings = ahw->max_tx_ques;
-        adapter->max_sds_rings = ahw->max_rx_ques;
        /* eSwitch capability indicates vNIC mode.
         * vNIC and SRIOV are mutually exclusive operational modes.
         * If SR-IOV capability is detected, SR-IOV physical function
@@ -2161,6 +2159,7 @@ static int qlcnic_83xx_get_nic_configuration(struct qlcnic_adapter *adapter)
 int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
 {
        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u16 max_sds_rings, max_tx_rings;
        int ret;
        ret = qlcnic_83xx_get_nic_configuration(adapter);
@@ -2173,18 +2172,21 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
                if (qlcnic_83xx_config_vnic_opmode(adapter))
                        return -EIO;
-                adapter->max_sds_rings = QLCNIC_MAX_VNIC_SDS_RINGS;
+                max_sds_rings = QLCNIC_MAX_VNIC_SDS_RINGS;
-                adapter->max_tx_rings = QLCNIC_MAX_VNIC_TX_RINGS;
+                max_tx_rings = QLCNIC_MAX_VNIC_TX_RINGS;
        } else if (ret == QLC_83XX_DEFAULT_OPMODE) {
                ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
                ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
-                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
+                max_sds_rings = QLCNIC_MAX_SDS_RINGS;
-                adapter->max_tx_rings = QLCNIC_MAX_TX_RINGS;
+                max_tx_rings = QLCNIC_MAX_TX_RINGS;
        } else {
                return -EIO;
        }
+        adapter->max_sds_rings = min(ahw->max_rx_ques, max_sds_rings);
+        adapter->max_tx_rings = min(ahw->max_tx_ques, max_tx_rings);
        return 0;
 }
@@ -2348,15 +2350,16 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
                goto disable_intr;
        }
+        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
        err = qlcnic_83xx_setup_mbx_intr(adapter);
        if (err)
                goto disable_mbx_intr;
        qlcnic_83xx_clear_function_resources(adapter);
+        qlcnic_dcb_enable(adapter->dcb);
-        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
        qlcnic_83xx_initialize_nic(adapter, 1);
+        qlcnic_dcb_get_info(adapter->dcb);
        /* Configure default, SR-IOV or Virtual NIC mode of operation */
        err = qlcnic_83xx_configure_opmode(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
index 64dcbf33d8f0..c1e11f5715b0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
@@ -883,8 +883,6 @@ int qlcnic_82xx_get_nic_info(struct qlcnic_adapter *adapter,
                npar_info->max_rx_ques = le16_to_cpu(nic_info->max_rx_ques);
                npar_info->capabilities = le32_to_cpu(nic_info->capabilities);
                npar_info->max_mtu = le16_to_cpu(nic_info->max_mtu);
-                adapter->max_tx_rings = npar_info->max_tx_ques;
-                adapter->max_sds_rings = npar_info->max_rx_ques;
        }
        qlcnic_free_mbx_args(&cmd);
@@ -1356,6 +1354,7 @@ int qlcnic_config_switch_port(struct qlcnic_adapter *adapter,
                        arg2 &= ~BIT_3;
                break;
        case QLCNIC_ADD_VLAN:
+                        arg1 &= ~(0x0ffff << 16);
                        arg1 |= (BIT_2 | BIT_5);
                        arg1 |= (esw_cfg->vlan_id << 16);
                        break;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index 7d4f54912bad..a51fe18f09a8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -330,8 +330,6 @@ static int __qlcnic_dcb_attach(struct qlcnic_dcb *dcb)
                goto out_free_cfg;
        }
-        qlcnic_dcb_get_info(dcb);
        return 0;
 out_free_cfg:
        kfree(dcb->cfg);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 309d05640883..7e55e88a81bf 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -670,7 +670,7 @@ int qlcnic_setup_tss_rss_intr(struct qlcnic_adapter *adapter)
        else
                num_msix += adapter->drv_tx_rings;
-        if (adapter->drv_rss_rings  > 0)
+        if (adapter->drv_rss_rings > 0)
                num_msix += adapter->drv_rss_rings;
        else
                num_msix += adapter->drv_sds_rings;
@@ -686,19 +686,15 @@ int qlcnic_setup_tss_rss_intr(struct qlcnic_adapter *adapter)
                        return -ENOMEM;
        }
-restore:
        for (vector = 0; vector < num_msix; vector++)
                adapter->msix_entries[vector].entry = vector;
+restore:
        err = pci_enable_msix(pdev, adapter->msix_entries, num_msix);
-        if (err == 0) {
+        if (err > 0) {
-                adapter->ahw->num_msix = num_msix;
+                if (!adapter->drv_tss_rings && !adapter->drv_rss_rings)
-                if (adapter->drv_tss_rings > 0)
+                        return -ENOSPC;
-                        adapter->drv_tx_rings = adapter->drv_tss_rings;
-                if (adapter->drv_rss_rings > 0)
-                        adapter->drv_sds_rings = adapter->drv_rss_rings;
-        } else {
                netdev_info(adapter->netdev,
                            "Unable to allocate %d MSI-X vectors, Available vectors %d\n",
                            num_msix, err);
@@ -716,12 +712,20 @@ restore:
                            "Restoring %d Tx, %d SDS rings for total %d vectors.\n",
                            adapter->drv_tx_rings, adapter->drv_sds_rings,
                            num_msix);
-                goto restore;
-                err = -EIO;
+                goto restore;
+        } else if (err < 0) {
+                return err;
        }
-        return err;
+        adapter->ahw->num_msix = num_msix;
+        if (adapter->drv_tss_rings > 0)
+                adapter->drv_tx_rings = adapter->drv_tss_rings;
+        if (adapter->drv_rss_rings > 0)
+                adapter->drv_sds_rings = adapter->drv_rss_rings;
+        return 0;
 }
 int qlcnic_enable_msix(struct qlcnic_adapter *adapter, u32 num_msix)
@@ -2202,6 +2206,31 @@ static void qlcnic_82xx_set_mac_filter_count(struct qlcnic_adapter *adapter)
        ahw->max_uc_count = count;
 }
+static int qlcnic_set_real_num_queues(struct qlcnic_adapter *adapter,
+                                      u8 tx_queues, u8 rx_queues)
+{
+        struct net_device *netdev = adapter->netdev;
+        int err = 0;
+        if (tx_queues) {
+                err = netif_set_real_num_tx_queues(netdev, tx_queues);
+                if (err) {
+                        netdev_err(netdev, "failed to set %d Tx queues\n",
+                                   tx_queues);
+                        return err;
+                }
+        }
+        if (rx_queues) {
+                err = netif_set_real_num_rx_queues(netdev, rx_queues);
+                if (err)
+                        netdev_err(netdev, "failed to set %d Rx queues\n",
+                                   rx_queues);
+        }
+        return err;
+}
 int
 qlcnic_setup_netdev(struct qlcnic_adapter *adapter, struct net_device *netdev,
                    int pci_using_dac)
@@ -2265,7 +2294,8 @@ qlcnic_setup_netdev(struct qlcnic_adapter *adapter, struct net_device *netdev,
        netdev->priv_flags |= IFF_UNICAST_FLT;
        netdev->irq = adapter->msix_entries[0].vector;
-        err = qlcnic_set_real_num_queues(adapter, netdev);
+        err = qlcnic_set_real_num_queues(adapter, adapter->drv_tx_rings,
+                                         adapter->drv_sds_rings);
        if (err)
                return err;
@@ -2370,6 +2400,14 @@ void qlcnic_set_drv_version(struct qlcnic_adapter *adapter)
                qlcnic_fw_cmd_set_drv_version(adapter, fw_cmd);
 }
+/* Reset firmware API lock */
+static void qlcnic_reset_api_lock(struct qlcnic_adapter *adapter)
+{
+        qlcnic_api_lock(adapter);
+        qlcnic_api_unlock(adapter);
+}
 static int
 qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -2472,6 +2510,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (qlcnic_82xx_check(adapter)) {
                qlcnic_check_vf(adapter, ent);
                adapter->portnum = adapter->ahw->pci_func;
+                qlcnic_reset_api_lock(adapter);
                err = qlcnic_start_firmware(adapter);
                if (err) {
                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n"
@@ -2528,8 +2567,6 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                goto err_out_free_hw;
        }
-        qlcnic_dcb_enable(adapter->dcb);
        if (qlcnic_read_mac_addr(adapter))
                dev_warn(&pdev->dev, "failed to read mac addr\n");
@@ -2549,7 +2586,10 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                         "Device does not support MSI interrupts\n");
        if (qlcnic_82xx_check(adapter)) {
+                qlcnic_dcb_enable(adapter->dcb);
+                qlcnic_dcb_get_info(adapter->dcb);
                err = qlcnic_setup_intr(adapter);
                if (err) {
                        dev_err(&pdev->dev, "Failed to setup interrupt\n");
                        goto err_out_disable_msi;
@@ -2929,9 +2969,13 @@ static void qlcnic_dump_tx_rings(struct qlcnic_adapter *adapter)
                            tx_ring->tx_stats.xmit_called,
                            tx_ring->tx_stats.xmit_on,
                            tx_ring->tx_stats.xmit_off);
+                if (tx_ring->crb_intr_mask)
+                        netdev_info(netdev, "crb_intr_mask=%d\n",
+                                    readl(tx_ring->crb_intr_mask));
                netdev_info(netdev,
-                            "crb_intr_mask=%d, hw_producer=%d, sw_producer=%d sw_consumer=%d, hw_consumer=%d\n",
+                            "hw_producer=%d, sw_producer=%d sw_consumer=%d, hw_consumer=%d\n",
-                            readl(tx_ring->crb_intr_mask),
                            readl(tx_ring->crb_cmd_producer),
                            tx_ring->producer, tx_ring->sw_consumer,
                            le32_to_cpu(*(tx_ring->hw_consumer)));
@@ -3964,12 +4008,21 @@ int qlcnic_validate_rings(struct qlcnic_adapter *adapter, __u32 ring_cnt,
 int qlcnic_setup_rings(struct qlcnic_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
+        u8 tx_rings, rx_rings;
        int err;
        if (test_bit(__QLCNIC_RESETTING, &adapter->state))
                return -EBUSY;
+        tx_rings = adapter->drv_tss_rings;
+        rx_rings = adapter->drv_rss_rings;
        netif_device_detach(netdev);
+        err = qlcnic_set_real_num_queues(adapter, tx_rings, rx_rings);
+        if (err)
+                goto done;
        if (netif_running(netdev))
                __qlcnic_down(adapter, netdev);
@@ -3989,7 +4042,17 @@ int qlcnic_setup_rings(struct qlcnic_adapter *adapter)
                return err;
        }
-        netif_set_real_num_tx_queues(netdev, adapter->drv_tx_rings);
+        /* Check if we need to update real_num_{tx|rx}_queues because
+         * qlcnic_setup_intr() may change Tx/Rx rings size
+         */
+        if ((tx_rings != adapter->drv_tx_rings) ||
+            (rx_rings != adapter->drv_sds_rings)) {
+                err = qlcnic_set_real_num_queues(adapter,
+                                                 adapter->drv_tx_rings,
+                                                 adapter->drv_sds_rings);
+                if (err)
+                        goto done;
+        }
        if (qlcnic_83xx_check(adapter)) {
                qlcnic_83xx_initialize_nic(adapter, 1);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 0638c1810d54..6afe9c1f5ab9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -1370,7 +1370,7 @@ static int qlcnic_sriov_issue_cmd(struct qlcnic_adapter *adapter,
        rsp = qlcnic_sriov_alloc_bc_trans(&trans);
        if (rsp)
-                return rsp;
+                goto free_cmd;
        rsp = qlcnic_sriov_prepare_bc_hdr(trans, cmd, seq, QLC_BC_COMMAND);
        if (rsp)
@@ -1425,6 +1425,13 @@ err_out:
 cleanup_transaction:
        qlcnic_sriov_cleanup_transaction(trans);
+free_cmd:
+        if (cmd->type == QLC_83XX_MBX_CMD_NO_WAIT) {
+                qlcnic_free_mbx_args(cmd);
+                kfree(cmd);
+        }
        return rsp;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 14f748cbf0de..280137991544 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -461,6 +461,16 @@ static int qlcnic_pci_sriov_disable(struct qlcnic_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
+        if (pci_vfs_assigned(adapter->pdev)) {
+                netdev_err(adapter->netdev,
+                           "SR-IOV VFs belonging to port %d are assigned to VMs. SR-IOV can not be disabled on this port\n",
+                           adapter->portnum);
+                netdev_info(adapter->netdev,
+                            "Please detach SR-IOV VFs belonging to port %d from VMs, and then try to disable SR-IOV on this port\n",
+                            adapter->portnum);
+                return -EPERM;
+        }
        rtnl_lock();
        if (netif_running(netdev))
                __qlcnic_down(adapter, netdev);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index 448d156c3d08..cd346e27f2e1 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -354,7 +354,7 @@ int qlcnic_is_valid_nic_func(struct qlcnic_adapter *adapter, u8 pci_func)
 {
        int i;
-        for (i = 0; i < adapter->ahw->max_vnic_func; i++) {
+        for (i = 0; i < adapter->ahw->total_nic_func; i++) {
                if (adapter->npars[i].pci_func == pci_func)
                        return i;
        }
@@ -720,6 +720,7 @@ static ssize_t qlcnic_sysfs_read_npar_config(struct file *file,
        struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
        struct qlcnic_npar_func_cfg *np_cfg;
        struct qlcnic_info nic_info;
+        u8 pci_func;
        int i, ret;
        u32 count;
@@ -729,26 +730,28 @@ static ssize_t qlcnic_sysfs_read_npar_config(struct file *file,
        count = size / sizeof(struct qlcnic_npar_func_cfg);
        for (i = 0; i < adapter->ahw->total_nic_func; i++) {
-                if (qlcnic_is_valid_nic_func(adapter, i) < 0)
-                        continue;
                if (adapter->npars[i].pci_func >= count) {
                        dev_dbg(dev, "%s: Total nic functions[%d], App sent function count[%d]\n",
                                __func__, adapter->ahw->total_nic_func, count);
                        continue;
                }
-                ret = qlcnic_get_nic_info(adapter, &nic_info, i);
-                if (ret)
-                        return ret;
                if (!adapter->npars[i].eswitch_status)
                        continue;
-                np_cfg[i].pci_func = i;
+                pci_func = adapter->npars[i].pci_func;
-                np_cfg[i].op_mode = (u8)nic_info.op_mode;
+                if (qlcnic_is_valid_nic_func(adapter, pci_func) < 0)
-                np_cfg[i].port_num = nic_info.phys_port;
+                        continue;
-                np_cfg[i].fw_capab = nic_info.capabilities;
+                ret = qlcnic_get_nic_info(adapter, &nic_info, pci_func);
-                np_cfg[i].min_bw = nic_info.min_tx_bw;
+                if (ret)
-                np_cfg[i].max_bw = nic_info.max_tx_bw;
+                        return ret;
-                np_cfg[i].max_tx_queues = nic_info.max_tx_ques;
-                np_cfg[i].max_rx_queues = nic_info.max_rx_ques;
+                np_cfg[pci_func].pci_func = pci_func;
+                np_cfg[pci_func].op_mode = (u8)nic_info.op_mode;
+                np_cfg[pci_func].port_num = nic_info.phys_port;
+                np_cfg[pci_func].fw_capab = nic_info.capabilities;
+                np_cfg[pci_func].min_bw = nic_info.min_tx_bw;
+                np_cfg[pci_func].max_bw = nic_info.max_tx_bw;
+                np_cfg[pci_func].max_tx_queues = nic_info.max_tx_ques;
+                np_cfg[pci_func].max_rx_queues = nic_info.max_rx_ques;
        }
        return size;
 }
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h b/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h
index 6203c7d8550f..45019649bbbd 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_common.h
@@ -358,6 +358,8 @@ struct sxgbe_core_ops {
        /* Enable disable checksum offload operations */
        void (*enable_rx_csum)(void __iomem *ioaddr);
        void (*disable_rx_csum)(void __iomem *ioaddr);
+        void (*enable_rxqueue)(void __iomem *ioaddr, int queue_num);
+        void (*disable_rxqueue)(void __iomem *ioaddr, int queue_num);
 };
 const struct sxgbe_core_ops *sxgbe_get_core_ops(void);
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c
index c4da7a2b002a..58c35692560e 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_core.c
@@ -165,6 +165,26 @@ static void sxgbe_core_set_speed(void __iomem *ioaddr, unsigned char speed)
        writel(tx_cfg, ioaddr + SXGBE_CORE_TX_CONFIG_REG);
 }
+static void sxgbe_core_enable_rxqueue(void __iomem *ioaddr, int queue_num)
+{
+        u32 reg_val;
+        reg_val = readl(ioaddr + SXGBE_CORE_RX_CTL0_REG);
+        reg_val &= ~(SXGBE_CORE_RXQ_ENABLE_MASK << queue_num);
+        reg_val |= SXGBE_CORE_RXQ_ENABLE;
+        writel(reg_val, ioaddr + SXGBE_CORE_RX_CTL0_REG);
+}
+static void sxgbe_core_disable_rxqueue(void __iomem *ioaddr, int queue_num)
+{
+        u32 reg_val;
+        reg_val = readl(ioaddr + SXGBE_CORE_RX_CTL0_REG);
+        reg_val &= ~(SXGBE_CORE_RXQ_ENABLE_MASK << queue_num);
+        reg_val |= SXGBE_CORE_RXQ_DISABLE;
+        writel(reg_val, ioaddr + SXGBE_CORE_RX_CTL0_REG);
+}
 static void  sxgbe_set_eee_mode(void __iomem *ioaddr)
 {
        u32 ctrl;
@@ -254,6 +274,8 @@ static const struct sxgbe_core_ops core_ops = {
        .set_eee_pls            = sxgbe_set_eee_pls,
        .enable_rx_csum         = sxgbe_enable_rx_csum,
        .disable_rx_csum        = sxgbe_disable_rx_csum,
+        .enable_rxqueue         = sxgbe_core_enable_rxqueue,
+        .disable_rxqueue        = sxgbe_core_disable_rxqueue,
 };
 const struct sxgbe_core_ops *sxgbe_get_core_ops(void)
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c
index e896dbbd2e15..2686bb5b6765 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.c
@@ -45,10 +45,10 @@ static void sxgbe_prepare_tx_desc(struct sxgbe_tx_norm_desc *p, u8 is_fd,
        p->tdes23.tx_rd_des23.first_desc = is_fd;
        p->tdes23.tx_rd_des23.buf1_size = buf1_len;
-        p->tdes23.tx_rd_des23.tx_pkt_len.cksum_pktlen.total_pkt_len = pkt_len;
+        p->tdes23.tx_rd_des23.tx_pkt_len.pkt_len.total_pkt_len = pkt_len;
        if (cksum)
-                p->tdes23.tx_rd_des23.tx_pkt_len.cksum_pktlen.cksum_ctl = cic_full;
+                p->tdes23.tx_rd_des23.cksum_ctl = cic_full;
 }
 /* Set VLAN control information */
@@ -233,6 +233,12 @@ static void sxgbe_set_rx_owner(struct sxgbe_rx_norm_desc *p)
        p->rdes23.rx_rd_des23.own_bit = 1;
 }
+/* Set Interrupt on completion bit */
+static void sxgbe_set_rx_int_on_com(struct sxgbe_rx_norm_desc *p)
+{
+        p->rdes23.rx_rd_des23.int_on_com = 1;
+}
 /* Get the receive frame size */
 static int sxgbe_get_rx_frame_len(struct sxgbe_rx_norm_desc *p)
 {
@@ -498,6 +504,7 @@ static const struct sxgbe_desc_ops desc_ops = {
        .init_rx_desc                   = sxgbe_init_rx_desc,
        .get_rx_owner                   = sxgbe_get_rx_owner,
        .set_rx_owner                   = sxgbe_set_rx_owner,
+        .set_rx_int_on_com              = sxgbe_set_rx_int_on_com,
        .get_rx_frame_len               = sxgbe_get_rx_frame_len,
        .get_rx_fd_status               = sxgbe_get_rx_fd_status,
        .get_rx_ld_status               = sxgbe_get_rx_ld_status,
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h
index 838cb9fb0ea9..18609324db72 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_desc.h
@@ -39,22 +39,22 @@ struct sxgbe_tx_norm_desc {
                        u32 int_on_com:1;
                        /* TDES3 */
                        union {
-                                u32 tcp_payload_len:18;
+                                u16 tcp_payload_len;
                                struct {
                                        u32 total_pkt_len:15;
                                        u32 reserved1:1;
-                                        u32 cksum_ctl:2;
+                                } pkt_len;
-                                } cksum_pktlen;
                        } tx_pkt_len;
-                        u32 tse_bit:1;
+                        u16 cksum_ctl:2;
-                        u32 tcp_hdr_len:4;
+                        u16 tse_bit:1;
-                        u32 sa_insert_ctl:3;
+                        u16 tcp_hdr_len:4;
-                        u32 crc_pad_ctl:2;
+                        u16 sa_insert_ctl:3;
-                        u32 last_desc:1;
+                        u16 crc_pad_ctl:2;
-                        u32 first_desc:1;
+                        u16 last_desc:1;
-                        u32 ctxt_bit:1;
+                        u16 first_desc:1;
-                        u32 own_bit:1;
+                        u16 ctxt_bit:1;
+                        u16 own_bit:1;
                } tx_rd_des23;
                /* tx write back Desc 2,3 */
@@ -70,25 +70,20 @@ struct sxgbe_tx_norm_desc {
 struct sxgbe_rx_norm_desc {
        union {
-                u32 rdes0; /* buf1 address */
+                u64 rdes01; /* buf1 address */
-                struct {
+                union {
                        u32 out_vlan_tag:16;
                        u32 in_vlan_tag:16;
-                } wb_rx_des0;
+                        u32 rss_hash;
-        } rd_wb_des0;
+                } rx_wb_des01;
+        } rdes01;
-        union {
-                u32 rdes1;      /* buf2 address or buf1[63:32] */
-                u32 rss_hash;   /* Write-back RX */
-        } rd_wb_des1;
        union {
                /* RX Read format Desc 2,3 */
                struct{
                        /* RDES2 */
-                        u32 buf2_addr;
+                        u64 buf2_addr:62;
                        /* RDES3 */
-                        u32 buf2_hi_addr:30;
                        u32 int_on_com:1;
                        u32 own_bit:1;
                } rx_rd_des23;
@@ -263,6 +258,9 @@ struct sxgbe_desc_ops {
        /* Set own bit */
        void (*set_rx_owner)(struct sxgbe_rx_norm_desc *p);
+        /* Set Interrupt on completion bit */
+        void (*set_rx_int_on_com)(struct sxgbe_rx_norm_desc *p);
        /* Get the receive frame size */
        int (*get_rx_frame_len)(struct sxgbe_rx_norm_desc *p);
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
index 4d989ff6c978..bb9b5b8afc5f 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_dma.c
@@ -23,21 +23,8 @@
 /* DMA core initialization */
 static int sxgbe_dma_init(void __iomem *ioaddr, int fix_burst, int burst_map)
 {
-        int retry_count = 10;
        u32 reg_val;
-        /* reset the DMA */
-        writel(SXGBE_DMA_SOFT_RESET, ioaddr + SXGBE_DMA_MODE_REG);
-        while (retry_count--) {
-                if (!(readl(ioaddr + SXGBE_DMA_MODE_REG) &
-                      SXGBE_DMA_SOFT_RESET))
-                        break;
-                mdelay(10);
-        }
-        if (retry_count < 0)
-                return -EBUSY;
        reg_val = readl(ioaddr + SXGBE_DMA_SYSBUS_MODE_REG);
        /* if fix_burst = 0, Set UNDEF = 1 of DMA_Sys_Mode Register.
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 27e8c824b204..82a9a983869f 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -1076,6 +1076,9 @@ static int sxgbe_open(struct net_device *dev)
        /* Initialize the MAC Core */
        priv->hw->mac->core_init(priv->ioaddr);
+        SXGBE_FOR_EACH_QUEUE(SXGBE_RX_QUEUES, queue_num) {
+                priv->hw->mac->enable_rxqueue(priv->ioaddr, queue_num);
+        }
        /* Request the IRQ lines */
        ret = devm_request_irq(priv->device, priv->irq, sxgbe_common_interrupt,
@@ -1453,6 +1456,7 @@ static void sxgbe_rx_refill(struct sxgbe_priv_data *priv)
                /* Added memory barrier for RX descriptor modification */
                wmb();
                priv->hw->desc->set_rx_owner(p);
+                priv->hw->desc->set_rx_int_on_com(p);
                /* Added memory barrier for RX descriptor modification */
                wmb();
        }
@@ -2070,6 +2074,24 @@ static int sxgbe_hw_init(struct sxgbe_priv_data * const priv)
        return 0;
 }
+static int sxgbe_sw_reset(void __iomem *addr)
+{
+        int retry_count = 10;
+        writel(SXGBE_DMA_SOFT_RESET, addr + SXGBE_DMA_MODE_REG);
+        while (retry_count--) {
+                if (!(readl(addr + SXGBE_DMA_MODE_REG) &
+                      SXGBE_DMA_SOFT_RESET))
+                        break;
+                mdelay(10);
+        }
+        if (retry_count < 0)
+                return -EBUSY;
+        return 0;
+}
 /**
 * sxgbe_drv_probe
 * @device: device pointer
@@ -2102,6 +2124,10 @@ struct sxgbe_priv_data *sxgbe_drv_probe(struct device *device,
        priv->plat = plat_dat;
        priv->ioaddr = addr;
+        ret = sxgbe_sw_reset(priv->ioaddr);
+        if (ret)
+                goto error_free_netdev;
        /* Verify driver arguments */
        sxgbe_verify_args();
@@ -2218,9 +2244,14 @@ error_free_netdev:
 int sxgbe_drv_remove(struct net_device *ndev)
 {
        struct sxgbe_priv_data *priv = netdev_priv(ndev);
+        u8 queue_num;
        netdev_info(ndev, "%s: removing driver\n", __func__);
+        SXGBE_FOR_EACH_QUEUE(SXGBE_RX_QUEUES, queue_num) {
+                priv->hw->mac->disable_rxqueue(priv->ioaddr, queue_num);
+        }
        priv->hw->dma->stop_rx(priv->ioaddr, SXGBE_RX_QUEUES);
        priv->hw->dma->stop_tx(priv->ioaddr, SXGBE_TX_QUEUES);
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c
index 01af2cbb479d..43ccb4a6de15 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_mdio.c
@@ -27,7 +27,7 @@
 #define SXGBE_SMA_PREAD_CMD     0x02 /* post read  increament address */
 #define SXGBE_SMA_READ_CMD      0x03 /* read command */
 #define SXGBE_SMA_SKIP_ADDRFRM  0x00040000 /* skip the address frame */
-#define SXGBE_MII_BUSY          0x00800000 /* mii busy */
+#define SXGBE_MII_BUSY          0x00400000 /* mii busy */
 static int sxgbe_mdio_busy_wait(void __iomem *ioaddr, unsigned int mii_data)
 {
@@ -147,6 +147,7 @@ int sxgbe_mdio_register(struct net_device *ndev)
        struct sxgbe_mdio_bus_data *mdio_data = priv->plat->mdio_bus_data;
        int err, phy_addr;
        int *irqlist;
+        bool phy_found = false;
        bool act;
        /* allocate the new mdio bus */
@@ -162,7 +163,7 @@ int sxgbe_mdio_register(struct net_device *ndev)
                irqlist = priv->mii_irq;
        /* assign mii bus fields */
-        mdio_bus->name = "samsxgbe";
+        mdio_bus->name = "sxgbe";
        mdio_bus->read = &sxgbe_mdio_read;
        mdio_bus->write = &sxgbe_mdio_write;
        snprintf(mdio_bus->id, MII_BUS_ID_SIZE, "%s-%x",
@@ -216,13 +217,22 @@ int sxgbe_mdio_register(struct net_device *ndev)
                        netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
                                    phy->phy_id, phy_addr, irq_str,
                                    dev_name(&phy->dev), act ? " active" : "");
+                        phy_found = true;
                }
        }
+        if (!phy_found) {
+                netdev_err(ndev, "PHY not found\n");
+                goto phyfound_err;
+        }
        priv->mii = mdio_bus;
        return 0;
+phyfound_err:
+        err = -ENODEV;
+        mdiobus_unregister(mdio_bus);
 mdiobus_err:
        mdiobus_free(mdio_bus);
        return err;
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h b/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h
index 5a89acb4c505..56f8bf5a3f1b 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_reg.h
@@ -52,6 +52,10 @@
 #define SXGBE_CORE_RX_CTL2_REG          0x00A8
 #define SXGBE_CORE_RX_CTL3_REG          0x00AC
+#define SXGBE_CORE_RXQ_ENABLE_MASK      0x0003
+#define SXGBE_CORE_RXQ_ENABLE           0x0002
+#define SXGBE_CORE_RXQ_DISABLE          0x0000
 /* Interrupt Registers */
 #define SXGBE_CORE_INT_STATUS_REG       0x00B0
 #define SXGBE_CORE_INT_ENABLE_REG       0x00B4
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 21c20ea0dad0..b5ed30a39144 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -738,8 +738,11 @@ static int efx_ef10_reset(struct efx_nic *efx, enum reset_type reset_type)
        /* If it was a port reset, trigger reallocation of MC resources.
         * Note that on an MC reset nothing needs to be done now because we'll
         * detect the MC reset later and handle it then.
+         * For an FLR, we never get an MC reset event, but the MC has reset all
+         * resources assigned to us, so we have to trigger reallocation now.
         */
-        if (reset_type == RESET_TYPE_ALL && !rc)
+        if ((reset_type == RESET_TYPE_ALL ||
+             reset_type == RESET_TYPE_MCDI_TIMEOUT) && !rc)
                efx_ef10_reset_mc_allocations(efx);
        return rc;
 }
@@ -2141,6 +2144,11 @@ static int efx_ef10_fini_dmaq(struct efx_nic *efx)
        return 0;
 }
+static void efx_ef10_prepare_flr(struct efx_nic *efx)
+{
+        atomic_set(&efx->active_queues, 0);
+}
 static bool efx_ef10_filter_equal(const struct efx_filter_spec *left,
                                  const struct efx_filter_spec *right)
 {
@@ -3603,6 +3611,8 @@ const struct efx_nic_type efx_hunt_a0_nic_type = {
        .probe_port = efx_mcdi_port_probe,
        .remove_port = efx_mcdi_port_remove,
        .fini_dmaq = efx_ef10_fini_dmaq,
+        .prepare_flr = efx_ef10_prepare_flr,
+        .finish_flr = efx_port_dummy_op_void,
        .describe_stats = efx_ef10_describe_stats,
        .update_stats = efx_ef10_update_stats,
        .start_stats = efx_mcdi_mac_start_stats,
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 57b971e5e6b2..63d595fd3cc5 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -76,6 +76,7 @@ const char *const efx_reset_type_names[] = {
        [RESET_TYPE_RECOVER_OR_ALL]     = "RECOVER_OR_ALL",
        [RESET_TYPE_WORLD]              = "WORLD",
        [RESET_TYPE_RECOVER_OR_DISABLE] = "RECOVER_OR_DISABLE",
+        [RESET_TYPE_MC_BIST]            = "MC_BIST",
        [RESET_TYPE_DISABLE]            = "DISABLE",
        [RESET_TYPE_TX_WATCHDOG]        = "TX_WATCHDOG",
        [RESET_TYPE_INT_ERROR]          = "INT_ERROR",
@@ -83,7 +84,7 @@ const char *const efx_reset_type_names[] = {
        [RESET_TYPE_DMA_ERROR]          = "DMA_ERROR",
        [RESET_TYPE_TX_SKIP]            = "TX_SKIP",
        [RESET_TYPE_MC_FAILURE]         = "MC_FAILURE",
-        [RESET_TYPE_MC_BIST]            = "MC_BIST",
+        [RESET_TYPE_MCDI_TIMEOUT]       = "MCDI_TIMEOUT (FLR)",
 };
 /* Reset workqueue. If any NIC has a hardware failure then a reset will be
@@ -1739,7 +1740,8 @@ static void efx_start_all(struct efx_nic *efx)
        /* Check that it is appropriate to restart the interface. All
         * of these flags are safe to read under just the rtnl lock */
-        if (efx->port_enabled || !netif_running(efx->net_dev))
+        if (efx->port_enabled || !netif_running(efx->net_dev) ||
+            efx->reset_pending)
                return;
        efx_start_port(efx);
@@ -2334,6 +2336,9 @@ void efx_reset_down(struct efx_nic *efx, enum reset_type method)
 {
        EFX_ASSERT_RESET_SERIALISED(efx);
+        if (method == RESET_TYPE_MCDI_TIMEOUT)
+                efx->type->prepare_flr(efx);
        efx_stop_all(efx);
        efx_disable_interrupts(efx);
@@ -2354,6 +2359,10 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
        EFX_ASSERT_RESET_SERIALISED(efx);
+        if (method == RESET_TYPE_MCDI_TIMEOUT)
+                efx->type->finish_flr(efx);
+        /* Ensure that SRAM is initialised even if we're disabling the device */
        rc = efx->type->init(efx);
        if (rc) {
                netif_err(efx, drv, efx->net_dev, "failed to initialise NIC\n");
@@ -2417,7 +2426,10 @@ int efx_reset(struct efx_nic *efx, enum reset_type method)
        /* Clear flags for the scopes we covered.  We assume the NIC and
         * driver are now quiescent so that there is no race here.
         */
-        efx->reset_pending &= -(1 << (method + 1));
+        if (method < RESET_TYPE_MAX_METHOD)
+                efx->reset_pending &= -(1 << (method + 1));
+        else /* it doesn't fit into the well-ordered scope hierarchy */
+                __clear_bit(method, &efx->reset_pending);
        /* Reinitialise bus-mastering, which may have been turned off before
         * the reset was scheduled. This is still appropriate, even in the
@@ -2546,6 +2558,7 @@ void efx_schedule_reset(struct efx_nic *efx, enum reset_type type)
        case RESET_TYPE_DISABLE:
        case RESET_TYPE_RECOVER_OR_DISABLE:
        case RESET_TYPE_MC_BIST:
+        case RESET_TYPE_MCDI_TIMEOUT:
                method = type;
                netif_dbg(efx, drv, efx->net_dev, "scheduling %s reset\n",
                          RESET_TYPE(method));
diff --git a/drivers/net/ethernet/sfc/enum.h b/drivers/net/ethernet/sfc/enum.h
index 75ef7ef6450b..d1dbb5fb31bb 100644
--- a/drivers/net/ethernet/sfc/enum.h
+++ b/drivers/net/ethernet/sfc/enum.h
@@ -143,6 +143,7 @@ enum efx_loopback_mode {
 * @RESET_TYPE_WORLD: Reset as much as possible
 * @RESET_TYPE_RECOVER_OR_DISABLE: Try to recover. Apply RESET_TYPE_DISABLE if
 * unsuccessful.
+ * @RESET_TYPE_MC_BIST: MC entering BIST mode.
 * @RESET_TYPE_DISABLE: Reset datapath, MAC and PHY; leave NIC disabled
 * @RESET_TYPE_TX_WATCHDOG: reset due to TX watchdog
 * @RESET_TYPE_INT_ERROR: reset due to internal error
@@ -150,14 +151,16 @@ enum efx_loopback_mode {
 * @RESET_TYPE_DMA_ERROR: DMA error
 * @RESET_TYPE_TX_SKIP: hardware completed empty tx descriptors
 * @RESET_TYPE_MC_FAILURE: MC reboot/assertion
+ * @RESET_TYPE_MCDI_TIMEOUT: MCDI timeout.
 */
 enum reset_type {
-        RESET_TYPE_INVISIBLE = 0,
+        RESET_TYPE_INVISIBLE,
-        RESET_TYPE_RECOVER_OR_ALL = 1,
+        RESET_TYPE_RECOVER_OR_ALL,
-        RESET_TYPE_ALL = 2,
+        RESET_TYPE_ALL,
-        RESET_TYPE_WORLD = 3,
+        RESET_TYPE_WORLD,
-        RESET_TYPE_RECOVER_OR_DISABLE = 4,
+        RESET_TYPE_RECOVER_OR_DISABLE,
-        RESET_TYPE_DISABLE = 5,
+        RESET_TYPE_MC_BIST,
+        RESET_TYPE_DISABLE,
        RESET_TYPE_MAX_METHOD,
        RESET_TYPE_TX_WATCHDOG,
        RESET_TYPE_INT_ERROR,
@@ -165,7 +168,13 @@ enum reset_type {
        RESET_TYPE_DMA_ERROR,
        RESET_TYPE_TX_SKIP,
        RESET_TYPE_MC_FAILURE,
-        RESET_TYPE_MC_BIST,
+        /* RESET_TYPE_MCDI_TIMEOUT is actually a method, not just a reason, but
+         * it doesn't fit the scope hierarchy (not well-ordered by inclusion).
+         * We encode this by having its enum value be greater than
+         * RESET_TYPE_MAX_METHOD. This also prevents issuing it with
+         * efx_ioctl_reset.
+         */
+        RESET_TYPE_MCDI_TIMEOUT,
        RESET_TYPE_MAX,
 };
diff --git a/drivers/net/ethernet/sfc/falcon.c b/drivers/net/ethernet/sfc/falcon.c
index 8ec20b713cc6..fae25a418647 100644
--- a/drivers/net/ethernet/sfc/falcon.c
+++ b/drivers/net/ethernet/sfc/falcon.c
@@ -2696,6 +2696,8 @@ const struct efx_nic_type falcon_a1_nic_type = {
        .fini_dmaq = efx_farch_fini_dmaq,
        .prepare_flush = falcon_prepare_flush,
        .finish_flush = efx_port_dummy_op_void,
+        .prepare_flr = efx_port_dummy_op_void,
+        .finish_flr = efx_farch_finish_flr,
        .describe_stats = falcon_describe_nic_stats,
        .update_stats = falcon_update_nic_stats,
        .start_stats = falcon_start_nic_stats,
@@ -2790,6 +2792,8 @@ const struct efx_nic_type falcon_b0_nic_type = {
        .fini_dmaq = efx_farch_fini_dmaq,
        .prepare_flush = falcon_prepare_flush,
        .finish_flush = efx_port_dummy_op_void,
+        .prepare_flr = efx_port_dummy_op_void,
+        .finish_flr = efx_farch_finish_flr,
        .describe_stats = falcon_describe_nic_stats,
        .update_stats = falcon_update_nic_stats,
        .start_stats = falcon_start_nic_stats,
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index a08761360cdf..0537381cd2f6 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -741,6 +741,28 @@ int efx_farch_fini_dmaq(struct efx_nic *efx)
        return rc;
 }
+/* Reset queue and flush accounting after FLR
+ *
+ * One possible cause of FLR recovery is that DMA may be failing (eg. if bus
+ * mastering was disabled), in which case we don't receive (RXQ) flush
+ * completion events.  This means that efx->rxq_flush_outstanding remained at 4
+ * after the FLR; also, efx->active_queues was non-zero (as no flush completion
+ * events were received, and we didn't go through efx_check_tx_flush_complete())
+ * If we don't fix this up, on the next call to efx_realloc_channels() we won't
+ * flush any RX queues because efx->rxq_flush_outstanding is at the limit of 4
+ * for batched flush requests; and the efx->active_queues gets messed up because
+ * we keep incrementing for the newly initialised queues, but it never went to
+ * zero previously.  Then we get a timeout every time we try to restart the
+ * queues, as it doesn't go back to zero when we should be flushing the queues.
+ */
+void efx_farch_finish_flr(struct efx_nic *efx)
+{
+        atomic_set(&efx->rxq_flush_pending, 0);
+        atomic_set(&efx->rxq_flush_outstanding, 0);
+        atomic_set(&efx->active_queues, 0);
+}
 /**************************************************************************
 *
 * Event queue processing
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index 7bd4b14bf3b3..5239cf9bdc56 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -52,12 +52,7 @@ static void efx_mcdi_timeout_async(unsigned long context);
 static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                               bool *was_attached_out);
 static bool efx_mcdi_poll_once(struct efx_nic *efx);
+static void efx_mcdi_abandon(struct efx_nic *efx);
-static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
-{
-        EFX_BUG_ON_PARANOID(!efx->mcdi);
-        return &efx->mcdi->iface;
-}
 int efx_mcdi_init(struct efx_nic *efx)
 {
@@ -558,6 +553,8 @@ static int _efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                        rc = 0;
                }
+                efx_mcdi_abandon(efx);
                /* Close the race with efx_mcdi_ev_cpl() executing just too late
                 * and completing a request we've just cancelled, by ensuring
                 * that the seqno check therein fails.
@@ -672,6 +669,9 @@ int efx_mcdi_rpc_start(struct efx_nic *efx, unsigned cmd,
        if (efx->mc_bist_for_other_fn)
                return -ENETDOWN;
+        if (mcdi->mode == MCDI_MODE_FAIL)
+                return -ENETDOWN;
        efx_mcdi_acquire_sync(mcdi);
        efx_mcdi_send_request(efx, cmd, inbuf, inlen);
        return 0;
@@ -812,7 +812,11 @@ void efx_mcdi_mode_poll(struct efx_nic *efx)
                return;
        mcdi = efx_mcdi(efx);
-        if (mcdi->mode == MCDI_MODE_POLL)
+        /* If already in polling mode, nothing to do.
+         * If in fail-fast state, don't switch to polled completion.
+         * FLR recovery will do that later.
+         */
+        if (mcdi->mode == MCDI_MODE_POLL || mcdi->mode == MCDI_MODE_FAIL)
                return;
        /* We can switch from event completion to polled completion, because
@@ -841,8 +845,8 @@ void efx_mcdi_flush_async(struct efx_nic *efx)
        mcdi = efx_mcdi(efx);
-        /* We must be in polling mode so no more requests can be queued */
+        /* We must be in poll or fail mode so no more requests can be queued */
-        BUG_ON(mcdi->mode != MCDI_MODE_POLL);
+        BUG_ON(mcdi->mode == MCDI_MODE_EVENTS);
        del_timer_sync(&mcdi->async_timer);
@@ -875,8 +879,11 @@ void efx_mcdi_mode_event(struct efx_nic *efx)
                return;
        mcdi = efx_mcdi(efx);
+        /* If already in event completion mode, nothing to do.
-        if (mcdi->mode == MCDI_MODE_EVENTS)
+         * If in fail-fast state, don't switch to event completion.  FLR
+         * recovery will do that later.
+         */
+        if (mcdi->mode == MCDI_MODE_EVENTS || mcdi->mode == MCDI_MODE_FAIL)
                return;
        /* We can't switch from polled to event completion in the middle of a
@@ -966,6 +973,19 @@ static void efx_mcdi_ev_bist(struct efx_nic *efx)
        spin_unlock(&mcdi->iface_lock);
 }
+/* MCDI timeouts seen, so make all MCDI calls fail-fast and issue an FLR to try
+ * to recover.
+ */
+static void efx_mcdi_abandon(struct efx_nic *efx)
+{
+        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+        if (xchg(&mcdi->mode, MCDI_MODE_FAIL) == MCDI_MODE_FAIL)
+                return; /* it had already been done */
+        netif_dbg(efx, hw, efx->net_dev, "MCDI is timing out; trying to recover\n");
+        efx_schedule_reset(efx, RESET_TYPE_MCDI_TIMEOUT);
+}
 /* Called from  falcon_process_eventq for MCDI events */
 void efx_mcdi_process_event(struct efx_channel *channel,
                            efx_qword_t *event)
@@ -1512,6 +1532,19 @@ int efx_mcdi_reset(struct efx_nic *efx, enum reset_type method)
 {
        int rc;
+        /* If MCDI is down, we can't handle_assertion */
+        if (method == RESET_TYPE_MCDI_TIMEOUT) {
+                rc = pci_reset_function(efx->pci_dev);
+                if (rc)
+                        return rc;
+                /* Re-enable polled MCDI completion */
+                if (efx->mcdi) {
+                        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+                        mcdi->mode = MCDI_MODE_POLL;
+                }
+                return 0;
+        }
        /* Recover from a failed assertion pre-reset */
        rc = efx_mcdi_handle_assertion(efx);
        if (rc)
diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
index 52931aebf3c3..56465f7465a2 100644
--- a/drivers/net/ethernet/sfc/mcdi.h
+++ b/drivers/net/ethernet/sfc/mcdi.h
@@ -28,9 +28,16 @@ enum efx_mcdi_state {
        MCDI_STATE_COMPLETED,
 };
+/**
+ * enum efx_mcdi_mode - MCDI transaction mode
+ * @MCDI_MODE_POLL: poll for MCDI completion, until timeout
+ * @MCDI_MODE_EVENTS: wait for an mcdi_event.  On timeout, poll once
+ * @MCDI_MODE_FAIL: we think MCDI is dead, so fail-fast all calls
+ */
 enum efx_mcdi_mode {
        MCDI_MODE_POLL,
        MCDI_MODE_EVENTS,
+        MCDI_MODE_FAIL,
 };
 /**
@@ -104,6 +111,12 @@ struct efx_mcdi_data {
        u32 fn_flags;
 };
+static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
+{
+        EFX_BUG_ON_PARANOID(!efx->mcdi);
+        return &efx->mcdi->iface;
+}
 #ifdef CONFIG_SFC_MCDI_MON
 static inline struct efx_mcdi_mon *efx_mcdi_mon(struct efx_nic *efx)
 {
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index 8a400a0595eb..5bdae8ed7c57 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -972,6 +972,8 @@ struct efx_mtd_partition {
 *      (for Falcon architecture)
 * @finish_flush: Clean up after flushing the DMA queues (for Falcon
 *      architecture)
+ * @prepare_flr: Prepare for an FLR
+ * @finish_flr: Clean up after an FLR
 * @describe_stats: Describe statistics for ethtool
 * @update_stats: Update statistics not provided by event handling.
 *      Either argument may be %NULL.
@@ -1100,6 +1102,8 @@ struct efx_nic_type {
        int (*fini_dmaq)(struct efx_nic *efx);
        void (*prepare_flush)(struct efx_nic *efx);
        void (*finish_flush)(struct efx_nic *efx);
+        void (*prepare_flr)(struct efx_nic *efx);
+        void (*finish_flr)(struct efx_nic *efx);
        size_t (*describe_stats)(struct efx_nic *efx, u8 *names);
        size_t (*update_stats)(struct efx_nic *efx, u64 *full_stats,
                               struct rtnl_link_stats64 *core_stats);
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index 32d969e857f7..89b83e59e1dc 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -156,13 +156,15 @@ void efx_nic_fini_interrupt(struct efx_nic *efx)
        efx->net_dev->rx_cpu_rmap = NULL;
 #endif
-        /* Disable MSI/MSI-X interrupts */
+        if (EFX_INT_MODE_USE_MSI(efx)) {
-        efx_for_each_channel(channel, efx)
+                /* Disable MSI/MSI-X interrupts */
-                free_irq(channel->irq, &efx->msi_context[channel->channel]);
+                efx_for_each_channel(channel, efx)
+                        free_irq(channel->irq,
-        /* Disable legacy interrupt */
+                                 &efx->msi_context[channel->channel]);
-        if (efx->legacy_irq)
+        } else {
+                /* Disable legacy interrupt */
                free_irq(efx->legacy_irq, efx);
+        }
 }
 /* Register dump */
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index a001fae1a8d7..d3ad8ed8d901 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -757,6 +757,7 @@ static inline int efx_nic_irq_test_irq_cpu(struct efx_nic *efx)
 int efx_nic_flush_queues(struct efx_nic *efx);
 void siena_prepare_flush(struct efx_nic *efx);
 int efx_farch_fini_dmaq(struct efx_nic *efx);
+void efx_farch_finish_flr(struct efx_nic *efx);
 void siena_finish_flush(struct efx_nic *efx);
 void falcon_start_nic_stats(struct efx_nic *efx);
 void falcon_stop_nic_stats(struct efx_nic *efx);
diff --git a/drivers/net/ethernet/sfc/siena.c b/drivers/net/ethernet/sfc/siena.c
index 23f3a6f7737a..50ffefed492c 100644
--- a/drivers/net/ethernet/sfc/siena.c
+++ b/drivers/net/ethernet/sfc/siena.c
@@ -921,6 +921,8 @@ const struct efx_nic_type siena_a0_nic_type = {
        .fini_dmaq = efx_farch_fini_dmaq,
        .prepare_flush = siena_prepare_flush,
        .finish_flush = siena_finish_flush,
+        .prepare_flr = efx_port_dummy_op_void,
+        .finish_flr = efx_farch_finish_flr,
        .describe_stats = siena_describe_nic_stats,
        .update_stats = siena_update_nic_stats,
        .start_stats = efx_mcdi_mac_start_stats,
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index d1b4dca53a9d..bcaa41af1e62 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -147,18 +147,19 @@ MODULE_ALIAS("platform:smc91x");
 */
 #define MII_DELAY               1
-#if SMC_DEBUG > 0
+#define DBG(n, dev, fmt, ...)                                   \
-#define DBG(n, dev, args...)                            \
+        do {                                                    \
-        do {                                            \
+                if (SMC_DEBUG >= (n))                           \
-                if (SMC_DEBUG >= (n))                   \
+                        netdev_dbg(dev, fmt, ##__VA_ARGS__);    \
-                        netdev_dbg(dev, args);          \
        } while (0)
-#define PRINTK(dev, args...)   netdev_info(dev, args)
+#define PRINTK(dev, fmt, ...)                                   \
-#else
+        do {                                                    \
-#define DBG(n, dev, args...)   do { } while (0)
+                if (SMC_DEBUG > 0)                              \
-#define PRINTK(dev, args...)   netdev_dbg(dev, args)
+                        netdev_info(dev, fmt, ##__VA_ARGS__);   \
-#endif
+                else                                            \
+                        netdev_dbg(dev, fmt, ##__VA_ARGS__);    \
+        } while (0)
 #if SMC_DEBUG > 3
 static void PRINT_PKT(u_char *buf, int length)
@@ -191,7 +192,7 @@ static void PRINT_PKT(u_char *buf, int length)
        pr_cont("\n");
 }
 #else
-#define PRINT_PKT(x...)  do { } while (0)
+static inline void PRINT_PKT(u_char *buf, int length) { }
 #endif
@@ -1781,7 +1782,7 @@ static int smc_findirq(struct smc_local *lp)
        int timeout = 20;
        unsigned long cookie;
-        DBG(2, dev, "%s: %s\n", CARDNAME, __func__);
+        DBG(2, lp->dev, "%s: %s\n", CARDNAME, __func__);
        cookie = probe_irq_on();
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index d940034acdd4..0f4841d2e8dc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1704,7 +1704,7 @@ static int stmmac_open(struct net_device *dev)
                if (ret) {
                        pr_err("%s: Cannot attach to PHY (error: %d)\n",
                               __func__, ret);
-                        goto phy_error;
+                        return ret;
                }
        }
@@ -1779,8 +1779,6 @@ init_error:
 dma_desc_error:
        if (priv->phydev)
                phy_disconnect(priv->phydev);
-phy_error:
-        clk_disable_unprepare(priv->stmmac_clk);
        return ret;
 }
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index df8d383acf48..b9ac20f42651 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -246,7 +246,7 @@ static inline void cas_lock_tx(struct cas *cp)
        int i;
        for (i = 0; i < N_TX_RINGS; i++)
-                spin_lock(&cp->tx_lock[i]);
+                spin_lock_nested(&cp->tx_lock[i], i);
 }
 static inline void cas_lock_all(struct cas *cp)
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 36aa109416c4..c331b7ebc812 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1871,18 +1871,13 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                phyid = be32_to_cpup(parp+1);
                mdio = of_find_device_by_node(mdio_node);
+                of_node_put(mdio_node);
-                if (strncmp(mdio->name, "gpio", 4) == 0) {
+                if (!mdio) {
-                        /* GPIO bitbang MDIO driver attached */
+                        pr_err("Missing mdio platform device\n");
-                        struct mii_bus *bus = dev_get_drvdata(&mdio->dev);
+                        return -EINVAL;
-                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                                 PHY_ID_FMT, bus->id, phyid);
-                } else {
-                        /* davinci MDIO driver attached */
-                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                                 PHY_ID_FMT, mdio->name, phyid);
                }
+                snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                         PHY_ID_FMT, mdio->name, phyid);
                mac_addr = of_get_mac_address(slave_node);
                if (mac_addr)
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 31e55fba7cad..7918d5132c1f 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -382,6 +382,10 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
        if (skb_is_gso(skb))
                goto do_lso;
+        if ((skb->ip_summed == CHECKSUM_NONE) ||
+            (skb->ip_summed == CHECKSUM_UNNECESSARY))
+                goto do_send;
        rndis_msg_size += NDIS_CSUM_PPI_SIZE;
        ppi = init_ppi_data(rndis_msg, NDIS_CSUM_PPI_SIZE,
                            TCPIP_CHKSUM_PKTINFO);
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 430bb0db9bc4..e36f194673a4 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -365,7 +365,7 @@ __at86rf230_read_subreg(struct at86rf230_local *lp,
        dev_vdbg(&lp->spi->dev, "buf[1] = %02x\n", buf[1]);
        if (status == 0)
-                *data = buf[1];
+                *data = (buf[1] & mask) >> shift;
        return status;
 }
@@ -1025,14 +1025,6 @@ static int at86rf230_hw_init(struct at86rf230_local *lp)
                return -EINVAL;
        }
-        rc = at86rf230_read_subreg(lp, SR_AVDD_OK, &status);
-        if (rc)
-                return rc;
-        if (!status) {
-                dev_err(&lp->spi->dev, "AVDD error\n");
-                return -EINVAL;
-        }
        return 0;
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 753a8c23d15d..d53e299ae1d9 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -263,11 +263,9 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
        const struct macvlan_dev *vlan = netdev_priv(dev);
        const struct macvlan_port *port = vlan->port;
        const struct macvlan_dev *dest;
-        __u8 ip_summed = skb->ip_summed;
        if (vlan->mode == MACVLAN_MODE_BRIDGE) {
                const struct ethhdr *eth = (void *)skb->data;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
                /* send to other bridge ports directly */
                if (is_multicast_ether_addr(eth->h_dest)) {
@@ -285,7 +283,6 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
        }
 xmit_world:
-        skb->ip_summed = ip_summed;
        skb->dev = vlan->lowerdev;
        return dev_queue_xmit(skb);
 }
@@ -461,8 +458,10 @@ static void macvlan_change_rx_flags(struct net_device *dev, int change)
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;
-        if (change & IFF_ALLMULTI)
+        if (dev->flags & IFF_UP) {
-                dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
+                if (change & IFF_ALLMULTI)
+                        dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
+        }
 }
 static void macvlan_set_mac_lists(struct net_device *dev)
@@ -518,6 +517,11 @@ static struct lock_class_key macvlan_netdev_addr_lock_key;
 #define MACVLAN_STATE_MASK \
        ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
+static int macvlan_get_nest_level(struct net_device *dev)
+{
+        return ((struct macvlan_dev *)netdev_priv(dev))->nest_level;
+}
 static void macvlan_set_lockdep_class_one(struct net_device *dev,
                                          struct netdev_queue *txq,
                                          void *_unused)
@@ -528,8 +532,9 @@ static void macvlan_set_lockdep_class_one(struct net_device *dev,
 static void macvlan_set_lockdep_class(struct net_device *dev)
 {
-        lockdep_set_class(&dev->addr_list_lock,
+        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                          &macvlan_netdev_addr_lock_key);
+                                       &macvlan_netdev_addr_lock_key,
+                                       macvlan_get_nest_level(dev));
        netdev_for_each_tx_queue(dev, macvlan_set_lockdep_class_one, NULL);
 }
@@ -724,6 +729,7 @@ static const struct net_device_ops macvlan_netdev_ops = {
        .ndo_fdb_add            = macvlan_fdb_add,
        .ndo_fdb_del            = macvlan_fdb_del,
        .ndo_fdb_dump           = ndo_dflt_fdb_dump,
+        .ndo_get_lock_subclass  = macvlan_get_nest_level,
 };
 void macvlan_common_setup(struct net_device *dev)
@@ -852,6 +858,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
        vlan->dev      = dev;
        vlan->port     = port;
        vlan->set_features = MACVLAN_FEATURES;
+        vlan->nest_level = dev_get_nest_level(lowerdev, netif_is_macvlan) + 1;
        vlan->mode     = MACVLAN_MODE_VEPA;
        if (data && data[IFLA_MACVLAN_MODE])
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index ff111a89e17f..3381c4f91a8c 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -322,6 +322,15 @@ static rx_handler_result_t macvtap_handle_frame(struct sk_buff **pskb)
                        segs = nskb;
                }
        } else {
+                /* If we receive a partial checksum and the tap side
+                 * doesn't support checksum offload, compute the checksum.
+                 * Note: it doesn't matter which checksum feature to
+                 *        check, we either support them all or none.
+                 */
+                if (skb->ip_summed == CHECKSUM_PARTIAL &&
+                    !(features & NETIF_F_ALL_CSUM) &&
+                    skb_checksum_help(skb))
+                        goto drop;
                skb_queue_tail(&q->sk.sk_receive_queue, skb);
        }
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index e701433bf52f..5f1a2250018f 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -32,29 +32,39 @@
 struct mdio_gpio_info {
        struct mdiobb_ctrl ctrl;
-        int mdc, mdio;
+        int mdc, mdio, mdo;
+        int mdc_active_low, mdio_active_low, mdo_active_low;
 };
 static void *mdio_gpio_of_get_data(struct platform_device *pdev)
 {
        struct device_node *np = pdev->dev.of_node;
        struct mdio_gpio_platform_data *pdata;
+        enum of_gpio_flags flags;
        int ret;
        pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
        if (!pdata)
                return NULL;
-        ret = of_get_gpio(np, 0);
+        ret = of_get_gpio_flags(np, 0, &flags);
        if (ret < 0)
                return NULL;
        pdata->mdc = ret;
+        pdata->mdc_active_low = flags & OF_GPIO_ACTIVE_LOW;
-        ret = of_get_gpio(np, 1);
+        ret = of_get_gpio_flags(np, 1, &flags);
        if (ret < 0)
                return NULL;
        pdata->mdio = ret;
+        pdata->mdio_active_low = flags & OF_GPIO_ACTIVE_LOW;
+        ret = of_get_gpio_flags(np, 2, &flags);
+        if (ret > 0) {
+                pdata->mdo = ret;
+                pdata->mdo_active_low = flags & OF_GPIO_ACTIVE_LOW;
+        }
        return pdata;
 }
@@ -64,8 +74,19 @@ static void mdio_dir(struct mdiobb_ctrl *ctrl, int dir)
        struct mdio_gpio_info *bitbang =
                container_of(ctrl, struct mdio_gpio_info, ctrl);
+        if (bitbang->mdo) {
+                /* Separate output pin. Always set its value to high
+                 * when changing direction. If direction is input,
+                 * assume the pin serves as pull-up. If direction is
+                 * output, the default value is high.
+                 */
+                gpio_set_value(bitbang->mdo, 1 ^ bitbang->mdo_active_low);
+                return;
+        }
        if (dir)
-                gpio_direction_output(bitbang->mdio, 1);
+                gpio_direction_output(bitbang->mdio,
+                                      1 ^ bitbang->mdio_active_low);
        else
                gpio_direction_input(bitbang->mdio);
 }
@@ -75,7 +96,7 @@ static int mdio_get(struct mdiobb_ctrl *ctrl)
        struct mdio_gpio_info *bitbang =
                container_of(ctrl, struct mdio_gpio_info, ctrl);
-        return gpio_get_value(bitbang->mdio);
+        return gpio_get_value(bitbang->mdio) ^ bitbang->mdio_active_low;
 }
 static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
@@ -83,7 +104,10 @@ static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
        struct mdio_gpio_info *bitbang =
                container_of(ctrl, struct mdio_gpio_info, ctrl);
-        gpio_set_value(bitbang->mdio, what);
+        if (bitbang->mdo)
+                gpio_set_value(bitbang->mdo, what ^ bitbang->mdo_active_low);
+        else
+                gpio_set_value(bitbang->mdio, what ^ bitbang->mdio_active_low);
 }
 static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
@@ -91,7 +115,7 @@ static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
        struct mdio_gpio_info *bitbang =
                container_of(ctrl, struct mdio_gpio_info, ctrl);
-        gpio_set_value(bitbang->mdc, what);
+        gpio_set_value(bitbang->mdc, what ^ bitbang->mdc_active_low);
 }
 static struct mdiobb_ops mdio_gpio_ops = {
@@ -110,18 +134,22 @@ static struct mii_bus *mdio_gpio_bus_init(struct device *dev,
        struct mdio_gpio_info *bitbang;
        int i;
-        bitbang = kzalloc(sizeof(*bitbang), GFP_KERNEL);
+        bitbang = devm_kzalloc(dev, sizeof(*bitbang), GFP_KERNEL);
        if (!bitbang)
                goto out;
        bitbang->ctrl.ops = &mdio_gpio_ops;
        bitbang->ctrl.reset = pdata->reset;
        bitbang->mdc = pdata->mdc;
+        bitbang->mdc_active_low = pdata->mdc_active_low;
        bitbang->mdio = pdata->mdio;
+        bitbang->mdio_active_low = pdata->mdio_active_low;
+        bitbang->mdo = pdata->mdo;
+        bitbang->mdo_active_low = pdata->mdo_active_low;
        new_bus = alloc_mdio_bitbang(&bitbang->ctrl);
        if (!new_bus)
-                goto out_free_bitbang;
+                goto out;
        new_bus->name = "GPIO Bitbanged MDIO",
@@ -138,11 +166,18 @@ static struct mii_bus *mdio_gpio_bus_init(struct device *dev,
        snprintf(new_bus->id, MII_BUS_ID_SIZE, "gpio-%x", bus_id);
-        if (gpio_request(bitbang->mdc, "mdc"))
+        if (devm_gpio_request(dev, bitbang->mdc, "mdc"))
+                goto out_free_bus;
+        if (devm_gpio_request(dev, bitbang->mdio, "mdio"))
                goto out_free_bus;
-        if (gpio_request(bitbang->mdio, "mdio"))
+        if (bitbang->mdo) {
-                goto out_free_mdc;
+                if (devm_gpio_request(dev, bitbang->mdo, "mdo"))
+                        goto out_free_bus;
+                gpio_direction_output(bitbang->mdo, 1);
+                gpio_direction_input(bitbang->mdio);
+        }
        gpio_direction_output(bitbang->mdc, 0);
@@ -150,12 +185,8 @@ static struct mii_bus *mdio_gpio_bus_init(struct device *dev,
        return new_bus;
-out_free_mdc:
-        gpio_free(bitbang->mdc);
 out_free_bus:
        free_mdio_bitbang(new_bus);
-out_free_bitbang:
-        kfree(bitbang);
 out:
        return NULL;
 }
@@ -163,13 +194,8 @@ out:
 static void mdio_gpio_bus_deinit(struct device *dev)
 {
        struct mii_bus *bus = dev_get_drvdata(dev);
-        struct mdio_gpio_info *bitbang = bus->priv;
-        dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdio);
-        gpio_free(bitbang->mdc);
        free_mdio_bitbang(bus);
-        kfree(bitbang);
 }
 static void mdio_gpio_bus_destroy(struct device *dev)
@@ -189,6 +215,10 @@ static int mdio_gpio_probe(struct platform_device *pdev)
        if (pdev->dev.of_node) {
                pdata = mdio_gpio_of_get_data(pdev);
                bus_id = of_alias_get_id(pdev->dev.of_node, "mdio-gpio");
+                if (bus_id < 0) {
+                        dev_warn(&pdev->dev, "failed to get alias id\n");
+                        bus_id = 0;
+                }
        } else {
                pdata = dev_get_platdata(&pdev->dev);
                bus_id = pdev->id;
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 5ad971a55c5d..d849684231c1 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -246,13 +246,13 @@ static int ksz9021_load_values_from_of(struct phy_device *phydev,
        if (val1 != -1)
                newval = ((newval & 0xfff0) | ((val1 / PS_TO_REG) & 0xf) << 0);
-        if (val2 != -1)
+        if (val2 != -2)
                newval = ((newval & 0xff0f) | ((val2 / PS_TO_REG) & 0xf) << 4);
-        if (val3 != -1)
+        if (val3 != -3)
                newval = ((newval & 0xf0ff) | ((val3 / PS_TO_REG) & 0xf) << 8);
-        if (val4 != -1)
+        if (val4 != -4)
                newval = ((newval & 0x0fff) | ((val4 / PS_TO_REG) & 0xf) << 12);
        return kszphy_extended_write(phydev, reg, newval);
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1b6d09aef427..3bc079a67a3d 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -715,7 +715,7 @@ void phy_state_machine(struct work_struct *work)
        struct delayed_work *dwork = to_delayed_work(work);
        struct phy_device *phydev =
                        container_of(dwork, struct phy_device, state_queue);
-        int needs_aneg = 0, do_suspend = 0;
+        bool needs_aneg = false, do_suspend = false, do_resume = false;
        int err = 0;
        mutex_lock(&phydev->lock);
@@ -727,7 +727,7 @@ void phy_state_machine(struct work_struct *work)
        case PHY_PENDING:
                break;
        case PHY_UP:
-                needs_aneg = 1;
+                needs_aneg = true;
                phydev->link_timeout = PHY_AN_TIMEOUT;
@@ -757,7 +757,7 @@ void phy_state_machine(struct work_struct *work)
                        phydev->adjust_link(phydev->attached_dev);
                } else if (0 == phydev->link_timeout--)
-                        needs_aneg = 1;
+                        needs_aneg = true;
                break;
        case PHY_NOLINK:
                err = phy_read_status(phydev);
@@ -765,6 +765,17 @@ void phy_state_machine(struct work_struct *work)
                        break;
                if (phydev->link) {
+                        if (AUTONEG_ENABLE == phydev->autoneg) {
+                                err = phy_aneg_done(phydev);
+                                if (err < 0)
+                                        break;
+                                if (!err) {
+                                        phydev->state = PHY_AN;
+                                        phydev->link_timeout = PHY_AN_TIMEOUT;
+                                        break;
+                                }
+                        }
                        phydev->state = PHY_RUNNING;
                        netif_carrier_on(phydev->attached_dev);
                        phydev->adjust_link(phydev->attached_dev);
@@ -780,7 +791,7 @@ void phy_state_machine(struct work_struct *work)
                        netif_carrier_on(phydev->attached_dev);
                } else {
                        if (0 == phydev->link_timeout--)
-                                needs_aneg = 1;
+                                needs_aneg = true;
                }
                phydev->adjust_link(phydev->attached_dev);
@@ -816,7 +827,7 @@ void phy_state_machine(struct work_struct *work)
                        phydev->link = 0;
                        netif_carrier_off(phydev->attached_dev);
                        phydev->adjust_link(phydev->attached_dev);
-                        do_suspend = 1;
+                        do_suspend = true;
                }
                break;
        case PHY_RESUMING:
@@ -865,6 +876,7 @@ void phy_state_machine(struct work_struct *work)
                        }
                        phydev->adjust_link(phydev->attached_dev);
                }
+                do_resume = true;
                break;
        }
@@ -872,9 +884,10 @@ void phy_state_machine(struct work_struct *work)
        if (needs_aneg)
                err = phy_start_aneg(phydev);
+        else if (do_suspend)
-        if (do_suspend)
                phy_suspend(phydev);
+        else if (do_resume)
+                phy_resume(phydev);
        if (err < 0)
                phy_error(phydev);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 0ce606624296..4987a1c6dc52 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -614,8 +614,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
        err = phy_init_hw(phydev);
        if (err)
                phy_detach(phydev);
+        else
-        phy_resume(phydev);
+                phy_resume(phydev);
        return err;
 }
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index cc70ecfc7062..ad4a94e9ff57 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -429,13 +429,13 @@ static void slip_write_wakeup(struct tty_struct *tty)
        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
                return;
-        spin_lock(&sl->lock);
+        spin_lock_bh(&sl->lock);
        if (sl->xleft <= 0)  {
                /* Now serial buffer is almost free & we can start
                 * transmission of another packet */
                sl->dev->stats.tx_packets++;
                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-                spin_unlock(&sl->lock);
+                spin_unlock_bh(&sl->lock);
                sl_unlock(sl);
                return;
        }
@@ -443,7 +443,7 @@ static void slip_write_wakeup(struct tty_struct *tty)
        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
        sl->xleft -= actual;
        sl->xhead += actual;
-        spin_unlock(&sl->lock);
+        spin_unlock_bh(&sl->lock);
 }
 static void sl_tx_timeout(struct net_device *dev)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 33008c1d1d67..767fe61b5ac9 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2834,8 +2834,10 @@ static int team_device_event(struct notifier_block *unused,
        case NETDEV_UP:
                if (netif_carrier_ok(dev))
                        team_port_change_check(port, true);
+                break;
        case NETDEV_DOWN:
                team_port_change_check(port, false);
+                break;
        case NETDEV_CHANGE:
                if (netif_running(port->dev))
                        team_port_change_check(port,
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index c9f3281506af..2e025ddcef21 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -120,6 +120,16 @@ static void cdc_mbim_unbind(struct usbnet *dev, struct usb_interface *intf)
        cdc_ncm_unbind(dev, intf);
 }
+/* verify that the ethernet protocol is IPv4 or IPv6 */
+static bool is_ip_proto(__be16 proto)
+{
+        switch (proto) {
+        case htons(ETH_P_IP):
+        case htons(ETH_P_IPV6):
+                return true;
+        }
+        return false;
+}
 static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
 {
@@ -128,6 +138,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
        struct cdc_ncm_ctx *ctx = info->ctx;
        __le32 sign = cpu_to_le32(USB_CDC_MBIM_NDP16_IPS_SIGN);
        u16 tci = 0;
+        bool is_ip;
        u8 *c;
        if (!ctx)
@@ -137,25 +148,32 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
                if (skb->len <= ETH_HLEN)
                        goto error;
+                /* Some applications using e.g. packet sockets will
+                 * bypass the VLAN acceleration and create tagged
+                 * ethernet frames directly.  We primarily look for
+                 * the accelerated out-of-band tag, but fall back if
+                 * required
+                 */
+                skb_reset_mac_header(skb);
+                if (vlan_get_tag(skb, &tci) < 0 && skb->len > VLAN_ETH_HLEN &&
+                    __vlan_get_tag(skb, &tci) == 0) {
+                        is_ip = is_ip_proto(vlan_eth_hdr(skb)->h_vlan_encapsulated_proto);
+                        skb_pull(skb, VLAN_ETH_HLEN);
+                } else {
+                        is_ip = is_ip_proto(eth_hdr(skb)->h_proto);
+                        skb_pull(skb, ETH_HLEN);
+                }
                /* mapping VLANs to MBIM sessions:
                 *   no tag     => IPS session <0>
                 *   1 - 255    => IPS session <vlanid>
                 *   256 - 511  => DSS session <vlanid - 256>
                 *   512 - 4095 => unsupported, drop
                 */
-                vlan_get_tag(skb, &tci);
                switch (tci & 0x0f00) {
                case 0x0000: /* VLAN ID 0 - 255 */
-                        /* verify that datagram is IPv4 or IPv6 */
+                        if (!is_ip)
-                        skb_reset_mac_header(skb);
-                        switch (eth_hdr(skb)->h_proto) {
-                        case htons(ETH_P_IP):
-                        case htons(ETH_P_IPV6):
-                                break;
-                        default:
                                goto error;
-                        }
                        c = (u8 *)&sign;
                        c[3] = tci;
                        break;
@@ -169,7 +187,6 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
                                  "unsupported tci=0x%04x\n", tci);
                        goto error;
                }
-                skb_pull(skb, ETH_HLEN);
        }
        spin_lock_bh(&ctx->mtx);
@@ -204,17 +221,23 @@ static void do_neigh_solicit(struct usbnet *dev, u8 *buf, u16 tci)
                return;
        /* need to send the NA on the VLAN dev, if any */
-        if (tci)
+        rcu_read_lock();
+        if (tci) {
                netdev = __vlan_find_dev_deep(dev->net, htons(ETH_P_8021Q),
                                              tci);
-        else
+                if (!netdev) {
+                        rcu_read_unlock();
+                        return;
+                }
+        } else {
                netdev = dev->net;
-        if (!netdev)
+        }
-                return;
+        dev_hold(netdev);
+        rcu_read_unlock();
        in6_dev = in6_dev_get(netdev);
        if (!in6_dev)
-                return;
+                goto out;
        is_router = !!in6_dev->cnf.forwarding;
        in6_dev_put(in6_dev);
@@ -224,6 +247,8 @@ static void do_neigh_solicit(struct usbnet *dev, u8 *buf, u16 tci)
                                 true /* solicited */,
                                 false /* override */,
                                 true /* inc_opt */);
+out:
+        dev_put(netdev);
 }
 static bool is_neigh_solicit(u8 *buf, size_t len)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 549dbac710ed..9a2bd11943eb 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -785,7 +785,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
            skb_out->len > CDC_NCM_MIN_TX_PKT)
                memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0,
                       ctx->tx_max - skb_out->len);
-        else if ((skb_out->len % dev->maxpacket) == 0)
+        else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0)
                *skb_put(skb_out, 1) = 0;       /* force short packet */
        /* set final frame length */
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index e3458e3c44f1..83208d4fdc59 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -669,6 +669,22 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
+        {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
+        {QMI_FIXED_INTF(0x16d8, 0x6007, 0)},    /* CMOTech CHE-628S */
+        {QMI_FIXED_INTF(0x16d8, 0x6008, 0)},    /* CMOTech CMU-301 */
+        {QMI_FIXED_INTF(0x16d8, 0x6280, 0)},    /* CMOTech CHU-628 */
+        {QMI_FIXED_INTF(0x16d8, 0x7001, 0)},    /* CMOTech CHU-720S */
+        {QMI_FIXED_INTF(0x16d8, 0x7002, 0)},    /* CMOTech 7002 */
+        {QMI_FIXED_INTF(0x16d8, 0x7003, 4)},    /* CMOTech CHU-629K */
+        {QMI_FIXED_INTF(0x16d8, 0x7004, 3)},    /* CMOTech 7004 */
+        {QMI_FIXED_INTF(0x16d8, 0x7006, 5)},    /* CMOTech CGU-629 */
+        {QMI_FIXED_INTF(0x16d8, 0x700a, 4)},    /* CMOTech CHU-629S */
+        {QMI_FIXED_INTF(0x16d8, 0x7211, 0)},    /* CMOTech CHU-720I */
+        {QMI_FIXED_INTF(0x16d8, 0x7212, 0)},    /* CMOTech 7212 */
+        {QMI_FIXED_INTF(0x16d8, 0x7213, 0)},    /* CMOTech 7213 */
+        {QMI_FIXED_INTF(0x16d8, 0x7251, 1)},    /* CMOTech 7251 */
+        {QMI_FIXED_INTF(0x16d8, 0x7252, 1)},    /* CMOTech 7252 */
+        {QMI_FIXED_INTF(0x16d8, 0x7253, 1)},    /* CMOTech 7253 */
        {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
        {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
        {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
@@ -730,16 +746,28 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
        {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
        {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
+        {QMI_FIXED_INTF(0x1199, 0x68c0, 8)},    /* Sierra Wireless MC73xx */
+        {QMI_FIXED_INTF(0x1199, 0x68c0, 10)},   /* Sierra Wireless MC73xx */
+        {QMI_FIXED_INTF(0x1199, 0x68c0, 11)},   /* Sierra Wireless MC73xx */
        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
+        {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
+        {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
        {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+        {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
        {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
+        {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},    /* Olivetti Olicard 500 */
        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
        {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},    /* Cinterion PHxx,PXxx */
+        {QMI_FIXED_INTF(0x413c, 0x81a2, 8)},    /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a3, 8)},    /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7b687469199b..8a852b5f215f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1285,7 +1285,7 @@ static int virtnet_set_channels(struct net_device *dev,
        if (channels->rx_count || channels->tx_count || channels->other_count)
                return -EINVAL;
-        if (queue_pairs > vi->max_queue_pairs)
+        if (queue_pairs > vi->max_queue_pairs || queue_pairs == 0)
                return -EINVAL;
        get_online_cpus();
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index c55e316373a1..4dbb2ed85b97 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -389,8 +389,8 @@ static inline size_t vxlan_nlmsg_size(void)
                + nla_total_size(sizeof(struct nda_cacheinfo));
 }
-static void vxlan_fdb_notify(struct vxlan_dev *vxlan,
+static void vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
-                             struct vxlan_fdb *fdb, int type)
+                             struct vxlan_rdst *rd, int type)
 {
        struct net *net = dev_net(vxlan->dev);
        struct sk_buff *skb;
@@ -400,8 +400,7 @@ static void vxlan_fdb_notify(struct vxlan_dev *vxlan,
        if (skb == NULL)
                goto errout;
-        err = vxlan_fdb_info(skb, vxlan, fdb, 0, 0, type, 0,
+        err = vxlan_fdb_info(skb, vxlan, fdb, 0, 0, type, 0, rd);
-                             first_remote_rtnl(fdb));
        if (err < 0) {
                /* -EMSGSIZE implies BUG in vxlan_nlmsg_size() */
                WARN_ON(err == -EMSGSIZE);
@@ -427,10 +426,7 @@ static void vxlan_ip_miss(struct net_device *dev, union vxlan_addr *ipa)
                .remote_vni = VXLAN_N_VID,
        };
-        INIT_LIST_HEAD(&f.remotes);
+        vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH);
-        list_add_rcu(&remote.list, &f.remotes);
-        vxlan_fdb_notify(vxlan, &f, RTM_GETNEIGH);
 }
 static void vxlan_fdb_miss(struct vxlan_dev *vxlan, const u8 eth_addr[ETH_ALEN])
@@ -438,11 +434,11 @@ static void vxlan_fdb_miss(struct vxlan_dev *vxlan, const u8 eth_addr[ETH_ALEN])
        struct vxlan_fdb f = {
                .state = NUD_STALE,
        };
+        struct vxlan_rdst remote = { };
-        INIT_LIST_HEAD(&f.remotes);
        memcpy(f.eth_addr, eth_addr, ETH_ALEN);
-        vxlan_fdb_notify(vxlan, &f, RTM_GETNEIGH);
+        vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH);
 }
 /* Hash Ethernet address */
@@ -533,7 +529,8 @@ static int vxlan_fdb_replace(struct vxlan_fdb *f,
 /* Add/update destinations for multicast */
 static int vxlan_fdb_append(struct vxlan_fdb *f,
-                            union vxlan_addr *ip, __be16 port, __u32 vni, __u32 ifindex)
+                            union vxlan_addr *ip, __be16 port, __u32 vni,
+                            __u32 ifindex, struct vxlan_rdst **rdp)
 {
        struct vxlan_rdst *rd;
@@ -551,6 +548,7 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
        list_add_tail_rcu(&rd->list, &f->remotes);
+        *rdp = rd;
        return 1;
 }
@@ -690,6 +688,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                            __be16 port, __u32 vni, __u32 ifindex,
                            __u8 ndm_flags)
 {
+        struct vxlan_rdst *rd = NULL;
        struct vxlan_fdb *f;
        int notify = 0;
@@ -726,7 +725,8 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                if ((flags & NLM_F_APPEND) &&
                    (is_multicast_ether_addr(f->eth_addr) ||
                     is_zero_ether_addr(f->eth_addr))) {
-                        int rc = vxlan_fdb_append(f, ip, port, vni, ifindex);
+                        int rc = vxlan_fdb_append(f, ip, port, vni, ifindex,
+                                                  &rd);
                        if (rc < 0)
                                return rc;
@@ -756,15 +756,18 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                INIT_LIST_HEAD(&f->remotes);
                memcpy(f->eth_addr, mac, ETH_ALEN);
-                vxlan_fdb_append(f, ip, port, vni, ifindex);
+                vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
                ++vxlan->addrcnt;
                hlist_add_head_rcu(&f->hlist,
                                   vxlan_fdb_head(vxlan, mac));
        }
-        if (notify)
+        if (notify) {
-                vxlan_fdb_notify(vxlan, f, RTM_NEWNEIGH);
+                if (rd == NULL)
+                        rd = first_remote_rtnl(f);
+                vxlan_fdb_notify(vxlan, f, rd, RTM_NEWNEIGH);
+        }
        return 0;
 }
@@ -785,7 +788,7 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
                    "delete %pM\n", f->eth_addr);
        --vxlan->addrcnt;
-        vxlan_fdb_notify(vxlan, f, RTM_DELNEIGH);
+        vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH);
        hlist_del_rcu(&f->hlist);
        call_rcu(&f->rcu, vxlan_fdb_free);
@@ -919,6 +922,7 @@ static int vxlan_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
         */
        if (rd && !list_is_singular(&f->remotes)) {
                list_del_rcu(&rd->list);
+                vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
                kfree_rcu(rd, rcu);
                goto out;
        }
@@ -993,7 +997,7 @@ static bool vxlan_snoop(struct net_device *dev,
                rdst->remote_ip = *src_ip;
                f->updated = jiffies;
-                vxlan_fdb_notify(vxlan, f, RTM_NEWNEIGH);
+                vxlan_fdb_notify(vxlan, f, rdst, RTM_NEWNEIGH);
        } else {
                /* learned new entry */
                spin_lock(&vxlan->hash_lock);
@@ -1755,8 +1759,8 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
        if (err)
                return err;
-        return iptunnel_xmit(rt, skb, src, dst, IPPROTO_UDP, tos, ttl, df,
+        return iptunnel_xmit(vs->sock->sk, rt, skb, src, dst, IPPROTO_UDP,
-                             false);
+                             tos, ttl, df, false);
 }
 EXPORT_SYMBOL_GPL(vxlan_xmit_skb);
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index 84734a805092..83c39e2858bf 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -1521,11 +1521,7 @@ static int cosa_reset_and_read_id(struct cosa_data *cosa, char *idstring)
        cosa_putstatus(cosa, 0);
        cosa_getdata8(cosa);
        cosa_putstatus(cosa, SR_RST);
-#ifdef MODULE
        msleep(500);
-#else
-        udelay(5*100000);
-#endif
        /* Disable all IRQs from the card */
        cosa_putstatus(cosa, 0);
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index a0398fe3eb28..be3eb2a8d602 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -86,7 +86,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
        int irq;
        int ret = 0;
        struct ath_hw *ah;
-        struct ath_common *common;
        char hw_name[64];
        if (!dev_get_platdata(&pdev->dev)) {
@@ -146,9 +145,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
        wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                   hw_name, (unsigned long)mem, irq);
-        common = ath9k_hw_common(sc->sc_ah);
-        /* Will be cleared in ath9k_start() */
-        set_bit(ATH_OP_INVALID, &common->op_flags);
        return 0;
 err_irq:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 6d47783f2e5b..ba502a2d199b 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -155,6 +155,9 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
                ATH9K_ANI_RSSI_THR_LOW,
                ATH9K_ANI_RSSI_THR_HIGH);
+        if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_OFDM_DEF_LEVEL)
+                immunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;
        if (!scan)
                aniState->ofdmNoiseImmunityLevel = immunityLevel;
@@ -235,6 +238,9 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
                BEACON_RSSI(ah), ATH9K_ANI_RSSI_THR_LOW,
                ATH9K_ANI_RSSI_THR_HIGH);
+        if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_CCK_DEF_LEVEL)
+                immunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
        if (ah->opmode == NL80211_IFTYPE_STATION &&
            BEACON_RSSI(ah) <= ATH9K_ANI_RSSI_THR_LOW &&
            immunityLevel > ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI)
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 44d74495c4de..3ba03dde4215 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -251,7 +251,6 @@ struct ath_atx_tid {
        s8 bar_index;
        bool sched;
-        bool paused;
        bool active;
 };
diff --git a/drivers/net/wireless/ath/ath9k/debug_sta.c b/drivers/net/wireless/ath/ath9k/debug_sta.c
index d76e6e0120d2..ffca918ff16a 100644
--- a/drivers/net/wireless/ath/ath9k/debug_sta.c
+++ b/drivers/net/wireless/ath/ath9k/debug_sta.c
@@ -72,7 +72,7 @@ static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
                ath_txq_lock(sc, txq);
                if (tid->active) {
                        len += scnprintf(buf + len, size - len,
-                                         "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                         "%3d%11d%10d%10d%10d%10d%9d%6d\n",
                                         tid->tidno,
                                         tid->seq_start,
                                         tid->seq_next,
@@ -80,8 +80,7 @@ static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
                                         tid->baw_head,
                                         tid->baw_tail,
                                         tid->bar_index,
-                                         tid->sched,
+                                         tid->sched);
-                                         tid->paused);
                }
                ath_txq_unlock(sc, txq);
        }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index f46cd0250e48..5627917c5ff7 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -95,8 +95,10 @@ static void ath9k_htc_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
        if ((vif->type == NL80211_IFTYPE_AP ||
             vif->type == NL80211_IFTYPE_MESH_POINT) &&
-            bss_conf->enable_beacon)
+            bss_conf->enable_beacon) {
                priv->reconfig_beacon = true;
+                priv->rearm_ani = true;
+        }
        if (bss_conf->assoc) {
                priv->rearm_ani = true;
@@ -257,6 +259,7 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
        ath9k_htc_ps_wakeup(priv);
+        ath9k_htc_stop_ani(priv);
        del_timer_sync(&priv->tx.cleanup_timer);
        ath9k_htc_tx_drain(priv);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index cbbb02a6b13b..36ae6490e554 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -783,6 +783,9 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
        common = ath9k_hw_common(ah);
        ath9k_set_hw_capab(sc, hw);
+        /* Will be cleared in ath9k_start() */
+        set_bit(ATH_OP_INVALID, &common->op_flags);
        /* Initialize regulatory */
        error = ath_regd_init(&common->regulatory, sc->hw->wiphy,
                              ath9k_reg_notifier);
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 25304adece57..914dbc6b1720 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -784,7 +784,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
        struct ath_softc *sc;
        struct ieee80211_hw *hw;
-        struct ath_common *common;
        u8 csz;
        u32 val;
        int ret = 0;
@@ -877,10 +876,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                   hw_name, (unsigned long)sc->mem, pdev->irq);
-        /* Will be cleared in ath9k_start() */
-        common = ath9k_hw_common(sc->sc_ah);
-        set_bit(ATH_OP_INVALID, &common->op_flags);
        return 0;
 err_init:
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 6c9accdb52e4..19df969ec909 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -975,6 +975,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
        u64 tsf = 0;
        unsigned long flags;
        dma_addr_t new_buf_addr;
+        unsigned int budget = 512;
        if (edma)
                dma_type = DMA_BIDIRECTIONAL;
@@ -1113,15 +1114,17 @@ requeue_drop_frag:
                }
 requeue:
                list_add_tail(&bf->list, &sc->rx.rxbuf);
-                if (flush)
-                        continue;
                if (edma) {
                        ath_rx_edma_buf_link(sc, qtype);
                } else {
                        ath_rx_buf_relink(sc, bf);
-                        ath9k_hw_rxena(ah);
+                        if (!flush)
+                                ath9k_hw_rxena(ah);
                }
+                if (!budget--)
+                        break;
        } while (1);
        if (!(ah->imask & ATH9K_INT_RXEOL)) {
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 87cbec47fb48..66acb2cbd9df 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -107,9 +107,6 @@ static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
 {
        struct ath_atx_ac *ac = tid->ac;
-        if (tid->paused)
-                return;
        if (tid->sched)
                return;
@@ -1407,7 +1404,6 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
        ath_tx_tid_change_state(sc, txtid);
        txtid->active = true;
-        txtid->paused = true;
        *ssn = txtid->seq_start = txtid->seq_next;
        txtid->bar_index = -1;
@@ -1427,7 +1423,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
        ath_txq_lock(sc, txq);
        txtid->active = false;
-        txtid->paused = false;
        ath_tx_flush_tid(sc, txtid);
        ath_tx_tid_change_state(sc, txtid);
        ath_txq_unlock_complete(sc, txq);
@@ -1487,7 +1482,7 @@ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
                ath_txq_lock(sc, txq);
                ac->clear_ps_filter = true;
-                if (!tid->paused && ath_tid_has_buffered(tid)) {
+                if (ath_tid_has_buffered(tid)) {
                        ath_tx_queue_tid(txq, tid);
                        ath_txq_schedule(sc, txq);
                }
@@ -1510,7 +1505,6 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
        ath_txq_lock(sc, txq);
        tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-        tid->paused = false;
        if (ath_tid_has_buffered(tid)) {
                ath_tx_queue_tid(txq, tid);
@@ -1544,8 +1538,6 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                        continue;
                tid = ATH_AN_2_TID(an, i);
-                if (tid->paused)
-                        continue;
                ath_txq_lock(sc, tid->ac->txq);
                while (nframes > 0) {
@@ -1844,9 +1836,6 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
                        list_del(&tid->list);
                        tid->sched = false;
-                        if (tid->paused)
-                                continue;
                        if (ath_tx_sched_aggr(sc, txq, tid, &stop))
                                sent = true;
@@ -2698,7 +2687,6 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
                tid->baw_size  = WME_MAX_BA;
                tid->baw_head  = tid->baw_tail = 0;
                tid->sched     = false;
-                tid->paused    = false;
                tid->active        = false;
                __skb_queue_head_init(&tid->buf_q);
                __skb_queue_head_init(&tid->retry_q);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index df130ef53d1c..c7c9f15c0fe0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -303,10 +303,10 @@ static void brcmf_chip_ai_coredisable(struct brcmf_core_priv *core,
        ci = core->chip;
-        /* if core is already in reset, just return */
+        /* if core is already in reset, skip reset */
        regdata = ci->ops->read32(ci->ctx, core->wrapbase + BCMA_RESET_CTL);
        if ((regdata & BCMA_RESET_CTL_RESET) != 0)
-                return;
+                goto in_reset_configure;
        /* configure reset */
        ci->ops->write32(ci->ctx, core->wrapbase + BCMA_IOCTL,
@@ -322,6 +322,7 @@ static void brcmf_chip_ai_coredisable(struct brcmf_core_priv *core,
        SPINWAIT(ci->ops->read32(ci->ctx, core->wrapbase + BCMA_RESET_CTL) !=
                 BCMA_RESET_CTL_RESET, 300);
+in_reset_configure:
        /* in-reset configure */
        ci->ops->write32(ci->ctx, core->wrapbase + BCMA_IOCTL,
                         reset | BCMA_IOCTL_FGC | BCMA_IOCTL_CLK);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index afb3d15e38ff..be1985296bdc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -4948,7 +4948,7 @@ static int brcmf_enable_bw40_2g(struct brcmf_if *ifp)
        if (!err) {
                /* only set 2G bandwidth using bw_cap command */
                band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
-                band_bwcap.bw_cap = cpu_to_le32(WLC_BW_40MHZ_BIT);
+                band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
                err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
                                               sizeof(band_bwcap));
        } else {
diff --git a/drivers/net/wireless/cw1200/debug.c b/drivers/net/wireless/cw1200/debug.c
index e323b4d54338..34f97c31eecf 100644
--- a/drivers/net/wireless/cw1200/debug.c
+++ b/drivers/net/wireless/cw1200/debug.c
@@ -41,6 +41,8 @@ static const char * const cw1200_debug_link_id[] = {
        "REQ",
        "SOFT",
        "HARD",
+        "RESET",
+        "RESET_REMAP",
 };
 static const char *cw1200_debug_mode(int mode)
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 003a546571d4..4c2d4ef28b22 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -67,8 +67,8 @@
 #include "iwl-agn-hw.h"
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   8
+#define IWL7260_UCODE_API_MAX   9
-#define IWL3160_UCODE_API_MAX   8
+#define IWL3160_UCODE_API_MAX   9
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    8
@@ -244,3 +244,4 @@ const struct iwl_cfg iwl7265_n_cfg = {
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
+MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 685f7e8e6943..0489314425cb 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -190,7 +190,7 @@ static const __le32 iwl_combined_lookup[BT_COEX_MAX_LUT][BT_COEX_LUT_SIZE] = {
                cpu_to_le32(0xcc00aaaa),
                cpu_to_le32(0x0000aaaa),
                cpu_to_le32(0xc0004000),
-                cpu_to_le32(0x00000000),
+                cpu_to_le32(0x00004000),
                cpu_to_le32(0xf0005000),
                cpu_to_le32(0xf0005000),
        },
@@ -213,16 +213,16 @@ static const __le32 iwl_combined_lookup[BT_COEX_MAX_LUT][BT_COEX_LUT_SIZE] = {
                /* Tx Tx disabled */
                cpu_to_le32(0xaaaaaaaa),
                cpu_to_le32(0xaaaaaaaa),
-                cpu_to_le32(0xaaaaaaaa),
+                cpu_to_le32(0xeeaaaaaa),
                cpu_to_le32(0xaaaaaaaa),
                cpu_to_le32(0xcc00ff28),
                cpu_to_le32(0x0000aaaa),
                cpu_to_le32(0xcc00aaaa),
                cpu_to_le32(0x0000aaaa),
-                cpu_to_le32(0xC0004000),
+                cpu_to_le32(0xc0004000),
-                cpu_to_le32(0xC0004000),
+                cpu_to_le32(0xc0004000),
-                cpu_to_le32(0xF0005000),
+                cpu_to_le32(0xf0005000),
-                cpu_to_le32(0xF0005000),
+                cpu_to_le32(0xf0005000),
        },
 };
@@ -611,14 +611,14 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                bt_cmd->flags |= cpu_to_le32(BT_COEX_SYNC2SCO);
        if (IWL_MVM_BT_COEX_CORUNNING) {
-                bt_cmd->valid_bit_msk = cpu_to_le32(BT_VALID_CORUN_LUT_20 |
+                bt_cmd->valid_bit_msk |= cpu_to_le32(BT_VALID_CORUN_LUT_20 |
-                                                    BT_VALID_CORUN_LUT_40);
+                                                     BT_VALID_CORUN_LUT_40);
                bt_cmd->flags |= cpu_to_le32(BT_COEX_CORUNNING);
        }
        if (IWL_MVM_BT_COEX_MPLUT) {
                bt_cmd->flags |= cpu_to_le32(BT_COEX_MPLUT);
-                bt_cmd->valid_bit_msk = cpu_to_le32(BT_VALID_MULTI_PRIO_LUT);
+                bt_cmd->valid_bit_msk |= cpu_to_le32(BT_VALID_MULTI_PRIO_LUT);
        }
        if (mvm->cfg->bt_shared_single_ant)
@@ -1262,6 +1262,7 @@ int iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        u32 ant_isolation = le32_to_cpup((void *)pkt->data);
        u8 __maybe_unused lower_bound, upper_bound;
+        int ret;
        u8 lut;
        struct iwl_bt_coex_cmd *bt_cmd;
@@ -1318,5 +1319,8 @@ int iwl_mvm_rx_ant_coupling_notif(struct iwl_mvm *mvm,
        memcpy(bt_cmd->bt4_corun_lut40, antenna_coupling_ranges[lut].lut20,
               sizeof(bt_cmd->bt4_corun_lut40));
-        return 0;
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+        kfree(bt_cmd);
+        return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 9426905de6b2..d73a89ecd78a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -183,9 +183,9 @@ enum iwl_scan_type {
 *      this number of packets were received (typically 1)
 * @passive2active: is auto switching from passive to active during scan allowed
 * @rxchain_sel_flags: RXON_RX_CHAIN_*
- * @max_out_time: in usecs, max out of serving channel time
+ * @max_out_time: in TUs, max out of serving channel time
 * @suspend_time: how long to pause scan when returning to service channel:
- *      bits 0-19: beacon interal in usecs (suspend before executing)
+ *      bits 0-19: beacon interal in TUs (suspend before executing)
 *      bits 20-23: reserved
 *      bits 24-31: number of beacons (suspend between channels)
 * @rxon_flags: RXON_FLG_*
@@ -383,8 +383,8 @@ enum scan_framework_client {
 * @quiet_plcp_th:      quiet channel num of packets threshold
 * @good_CRC_th:        passive to active promotion threshold
 * @rx_chain:           RXON rx chain.
- * @max_out_time:       max uSec to be out of assoceated channel
+ * @max_out_time:       max TUs to be out of assoceated channel
- * @suspend_time:       pause scan this long when returning to service channel
+ * @suspend_time:       pause scan this TUs when returning to service channel
 * @flags:              RXON flags
 * @filter_flags:       RXONfilter
 * @tx_cmd:             tx command for active scan; for 2GHz and for 5GHz.
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 4dd9ff43b8b6..b41dc84e9431 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -1007,7 +1007,7 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
        memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
        len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
-        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_SYNC, len, cmd);
+        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
        if (ret)
                IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
 }
@@ -1023,7 +1023,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
        if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
                return;
-        ieee80211_iterate_active_interfaces(
+        ieee80211_iterate_active_interfaces_atomic(
                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
                iwl_mvm_mc_iface_iterator, &iter_data);
 }
@@ -1332,6 +1332,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                 */
                iwl_mvm_remove_time_event(mvm, mvmvif,
                                          &mvmvif->time_event_data);
+                iwl_mvm_sf_update(mvm, vif, false);
                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC));
        } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
                              BSS_CHANGED_QOS)) {
@@ -1806,6 +1807,11 @@ static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
        mutex_lock(&mvm->mutex);
+        if (!iwl_mvm_is_idle(mvm)) {
+                ret = -EBUSY;
+                goto out;
+        }
        switch (mvm->scan_status) {
        case IWL_MVM_SCAN_OS:
                IWL_DEBUG_SCAN(mvm, "Stopping previous scan for sched_scan\n");
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d564233a65da..f1ec0986c3c9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -1003,6 +1003,9 @@ static inline bool iwl_mvm_vif_low_latency(struct iwl_mvm_vif *mvmvif)
        return mvmvif->low_latency;
 }
+/* Assoc status */
+bool iwl_mvm_is_idle(struct iwl_mvm *mvm);
 /* Thermal management and CT-kill */
 void iwl_mvm_tt_tx_backoff(struct iwl_mvm *mvm, u32 backoff);
 void iwl_mvm_tt_handler(struct iwl_mvm *mvm);
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 568abd61b14f..e1c838899363 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -59,7 +59,7 @@
 /* max allowed rate miss before sync LQ cmd */
 #define IWL_MISSED_RATE_MAX             15
 #define RS_STAY_IN_COLUMN_TIMEOUT       (5*HZ)
+#define RS_IDLE_TIMEOUT                 (5*HZ)
 static u8 rs_ht_to_legacy[] = {
        [IWL_RATE_MCS_0_INDEX] = IWL_RATE_6M_INDEX,
@@ -142,7 +142,7 @@ enum rs_column_mode {
        RS_MIMO2,
 };
-#define MAX_NEXT_COLUMNS 5
+#define MAX_NEXT_COLUMNS 7
 #define MAX_COLUMN_CHECKS 3
 typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
@@ -212,8 +212,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_LEGACY_ANT_B,
                        RS_COLUMN_SISO_ANT_A,
                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_INVALID,
-                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                },
        },
        [RS_COLUMN_LEGACY_ANT_B] = {
@@ -223,8 +225,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_LEGACY_ANT_A,
                        RS_COLUMN_SISO_ANT_A,
                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_INVALID,
-                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                },
        },
        [RS_COLUMN_SISO_ANT_A] = {
@@ -235,7 +239,9 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_MIMO2,
                        RS_COLUMN_SISO_ANT_A_SGI,
                        RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
                },
                .checks = {
                        rs_siso_allow,
@@ -249,7 +255,9 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_MIMO2,
                        RS_COLUMN_SISO_ANT_B_SGI,
                        RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
                },
                .checks = {
                        rs_siso_allow,
@@ -265,6 +273,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_SISO_ANT_A,
                        RS_COLUMN_SISO_ANT_B,
                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_LEGACY_ANT_B,
                },
                .checks = {
                        rs_siso_allow,
@@ -281,6 +291,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_SISO_ANT_B,
                        RS_COLUMN_SISO_ANT_A,
                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_LEGACY_ANT_B,
                },
                .checks = {
                        rs_siso_allow,
@@ -296,6 +308,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_SISO_ANT_A_SGI,
                        RS_COLUMN_SISO_ANT_B_SGI,
                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_LEGACY_ANT_B,
                },
                .checks = {
                        rs_mimo_allow,
@@ -311,6 +325,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                        RS_COLUMN_SISO_ANT_A,
                        RS_COLUMN_SISO_ANT_B,
                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_LEGACY_ANT_B,
                },
                .checks = {
                        rs_mimo_allow,
@@ -503,10 +519,12 @@ static void rs_rate_scale_clear_window(struct iwl_rate_scale_data *window)
        window->average_tpt = IWL_INVALID_VALUE;
 }
-static void rs_rate_scale_clear_tbl_windows(struct iwl_scale_tbl_info *tbl)
+static void rs_rate_scale_clear_tbl_windows(struct iwl_mvm *mvm,
+                                            struct iwl_scale_tbl_info *tbl)
 {
        int i;
+        IWL_DEBUG_RATE(mvm, "Clearing up window stats\n");
        for (i = 0; i < IWL_RATE_COUNT; i++)
                rs_rate_scale_clear_window(&tbl->win[i]);
 }
@@ -992,6 +1010,13 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
                return;
        }
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* Disable last tx check if we are debugging with fixed rate */
+        if (lq_sta->dbg_fixed_rate) {
+                IWL_DEBUG_RATE(mvm, "Fixed rate. avoid rate scaling\n");
+                return;
+        }
+#endif
        if (!ieee80211_is_data(hdr->frame_control) ||
            info->flags & IEEE80211_TX_CTL_NO_ACK)
                return;
@@ -1034,6 +1059,18 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
                        mac_index++;
        }
+        if (time_after(jiffies,
+                       (unsigned long)(lq_sta->last_tx + RS_IDLE_TIMEOUT))) {
+                int tid;
+                IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
+                for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
+                        ieee80211_stop_tx_ba_session(sta, tid);
+                iwl_mvm_rs_rate_init(mvm, sta, sband->band, false);
+                return;
+        }
+        lq_sta->last_tx = jiffies;
        /* Here we actually compare this rate to the latest LQ command */
        if ((mac_index < 0) ||
            (rate.sgi != !!(mac_flags & IEEE80211_TX_RC_SHORT_GI)) ||
@@ -1186,9 +1223,26 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
        lq_sta->visited_columns = 0;
 }
+static int rs_get_max_allowed_rate(struct iwl_lq_sta *lq_sta,
+                                   const struct rs_tx_column *column)
+{
+        switch (column->mode) {
+        case RS_LEGACY:
+                return lq_sta->max_legacy_rate_idx;
+        case RS_SISO:
+                return lq_sta->max_siso_rate_idx;
+        case RS_MIMO2:
+                return lq_sta->max_mimo2_rate_idx;
+        default:
+                WARN_ON_ONCE(1);
+        }
+        return lq_sta->max_legacy_rate_idx;
+}
 static const u16 *rs_get_expected_tpt_table(struct iwl_lq_sta *lq_sta,
-                                      const struct rs_tx_column *column,
+                                            const struct rs_tx_column *column,
-                                      u32 bw)
+                                            u32 bw)
 {
        /* Used to choose among HT tables */
        const u16 (*ht_tbl_pointer)[IWL_RATE_COUNT];
@@ -1438,7 +1492,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                                IWL_DEBUG_RATE(mvm,
                                               "LQ: stay in table clear win\n");
-                                rs_rate_scale_clear_tbl_windows(tbl);
+                                rs_rate_scale_clear_tbl_windows(mvm, tbl);
                        }
                }
@@ -1446,8 +1500,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                 * bitmaps and stats in active table (this will become the new
                 * "search" table). */
                if (lq_sta->rs_state == RS_STATE_SEARCH_CYCLE_STARTED) {
-                        IWL_DEBUG_RATE(mvm, "Clearing up window stats\n");
+                        rs_rate_scale_clear_tbl_windows(mvm, tbl);
-                        rs_rate_scale_clear_tbl_windows(tbl);
                }
        }
 }
@@ -1485,14 +1538,14 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                                         struct ieee80211_sta *sta,
                                         struct iwl_scale_tbl_info *tbl)
 {
-        int i, j, n;
+        int i, j, max_rate;
        enum rs_column next_col_id;
        const struct rs_tx_column *curr_col = &rs_tx_columns[tbl->column];
        const struct rs_tx_column *next_col;
        allow_column_func_t allow_func;
        u8 valid_ants = mvm->fw->valid_tx_ant;
        const u16 *expected_tpt_tbl;
-        s32 tpt, max_expected_tpt;
+        u16 tpt, max_expected_tpt;
        for (i = 0; i < MAX_NEXT_COLUMNS; i++) {
                next_col_id = curr_col->next_columns[i];
@@ -1535,11 +1588,11 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                if (WARN_ON_ONCE(!expected_tpt_tbl))
                        continue;
-                max_expected_tpt = 0;
+                max_rate = rs_get_max_allowed_rate(lq_sta, next_col);
-                for (n = 0; n < IWL_RATE_COUNT; n++)
+                if (WARN_ON_ONCE(max_rate == IWL_RATE_INVALID))
-                        if (expected_tpt_tbl[n] > max_expected_tpt)
+                        continue;
-                                max_expected_tpt = expected_tpt_tbl[n];
+                max_expected_tpt = expected_tpt_tbl[max_rate];
                if (tpt >= max_expected_tpt) {
                        IWL_DEBUG_RATE(mvm,
                                       "Skip column %d: can't beat current TPT. Max expected %d current %d\n",
@@ -1547,14 +1600,15 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                        continue;
                }
+                IWL_DEBUG_RATE(mvm,
+                               "Found potential column %d. Max expected %d current %d\n",
+                               next_col_id, max_expected_tpt, tpt);
                break;
        }
        if (i == MAX_NEXT_COLUMNS)
                return RS_COLUMN_INVALID;
-        IWL_DEBUG_RATE(mvm, "Found potential column %d\n", next_col_id);
        return next_col_id;
 }
@@ -1640,85 +1694,76 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
 {
        enum rs_action action = RS_ACTION_STAY;
-        /* Too many failures, decrease rate */
        if ((sr <= RS_SR_FORCE_DECREASE) || (current_tpt == 0)) {
                IWL_DEBUG_RATE(mvm,
-                               "decrease rate because of low SR\n");
+                               "Decrease rate because of low SR\n");
-                action = RS_ACTION_DOWNSCALE;
+                return RS_ACTION_DOWNSCALE;
-        /* No throughput measured yet for adjacent rates; try increase. */
-        } else if ((low_tpt == IWL_INVALID_VALUE) &&
-                   (high_tpt == IWL_INVALID_VALUE)) {
-                if (high != IWL_RATE_INVALID && sr >= IWL_RATE_INCREASE_TH) {
-                        IWL_DEBUG_RATE(mvm,
-                                       "Good SR and no high rate measurement. "
-                                       "Increase rate\n");
-                        action = RS_ACTION_UPSCALE;
-                } else if (low != IWL_RATE_INVALID) {
-                        IWL_DEBUG_RATE(mvm,
-                                       "Remain in current rate\n");
-                        action = RS_ACTION_STAY;
-                }
        }
-        /* Both adjacent throughputs are measured, but neither one has better
+        if ((low_tpt == IWL_INVALID_VALUE) &&
-         * throughput; we're using the best rate, don't change it!
+            (high_tpt == IWL_INVALID_VALUE) &&
-         */
+            (high != IWL_RATE_INVALID)) {
-        else if ((low_tpt != IWL_INVALID_VALUE) &&
-                 (high_tpt != IWL_INVALID_VALUE) &&
-                 (low_tpt < current_tpt) &&
-                 (high_tpt < current_tpt)) {
                IWL_DEBUG_RATE(mvm,
-                               "Both high and low are worse. "
+                               "No data about high/low rates. Increase rate\n");
-                               "Maintain rate\n");
+                return RS_ACTION_UPSCALE;
-                action = RS_ACTION_STAY;
        }
-        /* At least one adjacent rate's throughput is measured,
+        if ((high_tpt == IWL_INVALID_VALUE) &&
-         * and may have better performance.
+            (high != IWL_RATE_INVALID) &&
-         */
+            (low_tpt != IWL_INVALID_VALUE) &&
-        else {
+            (low_tpt < current_tpt)) {
-                /* Higher adjacent rate's throughput is measured */
+                IWL_DEBUG_RATE(mvm,
-                if (high_tpt != IWL_INVALID_VALUE) {
+                               "No data about high rate and low rate is worse. Increase rate\n");
-                        /* Higher rate has better throughput */
+                return RS_ACTION_UPSCALE;
-                        if (high_tpt > current_tpt &&
+        }
-                            sr >= IWL_RATE_INCREASE_TH) {
-                                IWL_DEBUG_RATE(mvm,
-                                               "Higher rate is better and good "
-                                               "SR. Increate rate\n");
-                                action = RS_ACTION_UPSCALE;
-                        } else {
-                                IWL_DEBUG_RATE(mvm,
-                                               "Higher rate isn't better OR "
-                                               "no good SR. Maintain rate\n");
-                                action = RS_ACTION_STAY;
-                        }
-                /* Lower adjacent rate's throughput is measured */
+        if ((high_tpt != IWL_INVALID_VALUE) &&
-                } else if (low_tpt != IWL_INVALID_VALUE) {
+            (high_tpt > current_tpt)) {
-                        /* Lower rate has better throughput */
+                IWL_DEBUG_RATE(mvm,
-                        if (low_tpt > current_tpt) {
+                               "Higher rate is better. Increate rate\n");
-                                IWL_DEBUG_RATE(mvm,
+                return RS_ACTION_UPSCALE;
-                                               "Lower rate is better. "
-                                               "Decrease rate\n");
-                                action = RS_ACTION_DOWNSCALE;
-                        } else if (sr >= IWL_RATE_INCREASE_TH) {
-                                IWL_DEBUG_RATE(mvm,
-                                               "Lower rate isn't better and "
-                                               "good SR. Increase rate\n");
-                                action = RS_ACTION_UPSCALE;
-                        }
-                }
        }
-        /* Sanity check; asked for decrease, but success rate or throughput
+        if ((low_tpt != IWL_INVALID_VALUE) &&
-         * has been good at old rate.  Don't change it.
+            (high_tpt != IWL_INVALID_VALUE) &&
-         */
+            (low_tpt < current_tpt) &&
-        if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID) &&
+            (high_tpt < current_tpt)) {
-            ((sr > IWL_RATE_HIGH_TH) ||
+                IWL_DEBUG_RATE(mvm,
-             (current_tpt > (100 * tbl->expected_tpt[low])))) {
+                               "Both high and low are worse. Maintain rate\n");
+                return RS_ACTION_STAY;
+        }
+        if ((low_tpt != IWL_INVALID_VALUE) &&
+            (low_tpt > current_tpt)) {
+                IWL_DEBUG_RATE(mvm,
+                               "Lower rate is better\n");
+                action = RS_ACTION_DOWNSCALE;
+                goto out;
+        }
+        if ((low_tpt == IWL_INVALID_VALUE) &&
+            (low != IWL_RATE_INVALID)) {
                IWL_DEBUG_RATE(mvm,
-                               "Sanity check failed. Maintain rate\n");
+                               "No data about lower rate\n");
-                action = RS_ACTION_STAY;
+                action = RS_ACTION_DOWNSCALE;
+                goto out;
+        }
+        IWL_DEBUG_RATE(mvm, "Maintain rate\n");
+out:
+        if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID)) {
+                if (sr >= RS_SR_NO_DECREASE) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "SR is above NO DECREASE. Avoid downscale\n");
+                        action = RS_ACTION_STAY;
+                } else if (current_tpt > (100 * tbl->expected_tpt[low])) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Current TPT is higher than max expected in low rate. Avoid downscale\n");
+                        action = RS_ACTION_STAY;
+                } else {
+                        IWL_DEBUG_RATE(mvm, "Decrease rate\n");
+                }
        }
        return action;
@@ -1792,6 +1837,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                               "Aggregation changed: prev %d current %d. Update expected TPT table\n",
                               prev_agg, lq_sta->is_agg);
                rs_set_expected_tpt_table(lq_sta, tbl);
+                rs_rate_scale_clear_tbl_windows(mvm, tbl);
        }
        /* current tx rate */
@@ -2021,7 +2067,7 @@ lq_update:
                if (lq_sta->search_better_tbl) {
                        /* Access the "search" table, clear its history. */
                        tbl = &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
-                        rs_rate_scale_clear_tbl_windows(tbl);
+                        rs_rate_scale_clear_tbl_windows(mvm, tbl);
                        /* Use new "search" start rate */
                        index = tbl->rate.index;
@@ -2042,8 +2088,18 @@ lq_update:
                 * stay with best antenna legacy modulation for a while
                 * before next round of mode comparisons. */
                tbl1 = &(lq_sta->lq_info[lq_sta->active_tbl]);
-                if (is_legacy(&tbl1->rate) && !sta->ht_cap.ht_supported) {
+                if (is_legacy(&tbl1->rate)) {
                        IWL_DEBUG_RATE(mvm, "LQ: STAY in legacy table\n");
+                        if (tid != IWL_MAX_TID_COUNT) {
+                                tid_data = &sta_priv->tid_data[tid];
+                                if (tid_data->state != IWL_AGG_OFF) {
+                                        IWL_DEBUG_RATE(mvm,
+                                                       "Stop aggregation on tid %d\n",
+                                                       tid);
+                                        ieee80211_stop_tx_ba_session(sta, tid);
+                                }
+                        }
                        rs_set_stay_in_table(mvm, 1, lq_sta);
                } else {
                /* If we're in an HT mode, and all 3 mode switch actions
@@ -2342,9 +2398,10 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
        lq_sta->lq.sta_id = sta_priv->sta_id;
        for (j = 0; j < LQ_SIZE; j++)
-                rs_rate_scale_clear_tbl_windows(&lq_sta->lq_info[j]);
+                rs_rate_scale_clear_tbl_windows(mvm, &lq_sta->lq_info[j]);
        lq_sta->flush_timer = 0;
+        lq_sta->last_tx = jiffies;
        IWL_DEBUG_RATE(mvm,
                       "LQ: *** rate scale station global init for station %d ***\n",
@@ -2388,11 +2445,22 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                lq_sta->is_vht = true;
        }
-        IWL_DEBUG_RATE(mvm,
+        lq_sta->max_legacy_rate_idx = find_last_bit(&lq_sta->active_legacy_rate,
-                       "SISO-RATE=%X MIMO2-RATE=%X VHT=%d\n",
+                                                    BITS_PER_LONG);
+        lq_sta->max_siso_rate_idx = find_last_bit(&lq_sta->active_siso_rate,
+                                                  BITS_PER_LONG);
+        lq_sta->max_mimo2_rate_idx = find_last_bit(&lq_sta->active_mimo2_rate,
+                                                   BITS_PER_LONG);
+        IWL_DEBUG_RATE(mvm, "RATE MASK: LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d\n",
+                       lq_sta->active_legacy_rate,
                       lq_sta->active_siso_rate,
                       lq_sta->active_mimo2_rate,
                       lq_sta->is_vht);
+        IWL_DEBUG_RATE(mvm, "MAX RATE: LEGACY=%d SISO=%d MIMO2=%d\n",
+                       lq_sta->max_legacy_rate_idx,
+                       lq_sta->max_siso_rate_idx,
+                       lq_sta->max_mimo2_rate_idx);
        /* These values will be overridden later */
        lq_sta->lq.single_stream_ant_msk =
@@ -2547,6 +2615,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
        if (is_siso(&rate)) {
                num_rates = RS_SECONDARY_SISO_NUM_RATES;
                num_retries = RS_SECONDARY_SISO_RETRIES;
+                lq_cmd->mimo_delim = index;
        } else if (is_legacy(&rate)) {
                num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
                num_retries = RS_LEGACY_RETRIES_PER_RATE;
@@ -2749,7 +2818,7 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                return -ENOMEM;
        desc += sprintf(buff+desc, "sta_id %d\n", lq_sta->lq.sta_id);
-        desc += sprintf(buff+desc, "failed=%d success=%d rate=0%X\n",
+        desc += sprintf(buff+desc, "failed=%d success=%d rate=0%lX\n",
                        lq_sta->total_failed, lq_sta->total_success,
                        lq_sta->active_legacy_rate);
        desc += sprintf(buff+desc, "fixed rate 0x%X\n",
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index 3332b396011e..0acfac96a56c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -156,6 +156,7 @@ enum {
 #define IWL_RATE_HIGH_TH                10880   /*  85% */
 #define IWL_RATE_INCREASE_TH            6400    /*  50% */
 #define RS_SR_FORCE_DECREASE            1920    /*  15% */
+#define RS_SR_NO_DECREASE               10880   /*  85% */
 #define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
 #define LINK_QUAL_AGG_TIME_LIMIT_MAX    (8000)
@@ -310,13 +311,20 @@ struct iwl_lq_sta {
        u32 visited_columns;    /* Bitmask marking which Tx columns were
                                 * explored during a search cycle
                                 */
+        u64 last_tx;
        bool is_vht;
        enum ieee80211_band band;
        /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
-        u16 active_legacy_rate;
+        unsigned long active_legacy_rate;
-        u16 active_siso_rate;
+        unsigned long active_siso_rate;
-        u16 active_mimo2_rate;
+        unsigned long active_mimo2_rate;
+        /* Highest rate per Tx mode */
+        u8 max_legacy_rate_idx;
+        u8 max_siso_rate_idx;
+        u8 max_mimo2_rate_idx;
        s8 max_rate_idx;     /* Max rate set by user */
        u8 missed_rate_counter;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index c91dc8498852..c28de54c75d4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -277,51 +277,22 @@ static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
                                            IEEE80211_IFACE_ITER_NORMAL,
                                            iwl_mvm_scan_condition_iterator,
                                            &global_bound);
-        /*
-         * Under low latency traffic passive scan is fragmented meaning
-         * that dwell on a particular channel will be fragmented. Each fragment
-         * dwell time is 20ms and fragments period is 105ms. Skipping to next
-         * channel will be delayed by the same period - 105ms. So suspend_time
-         * parameter describing both fragments and channels skipping periods is
-         * set to 105ms. This value is chosen so that overall passive scan
-         * duration will not be too long. Max_out_time in this case is set to
-         * 70ms, so for active scanning operating channel will be left for 70ms
-         * while for passive still for 20ms (fragment dwell).
-         */
-        if (global_bound) {
-                if (!iwl_mvm_low_latency(mvm)) {
-                        params->suspend_time = ieee80211_tu_to_usec(100);
-                        params->max_out_time = ieee80211_tu_to_usec(600);
-                } else {
-                        params->suspend_time = ieee80211_tu_to_usec(105);
-                        /* P2P doesn't support fragmented passive scan, so
-                         * configure max_out_time to be at least longest dwell
-                         * time for passive scan.
-                         */
-                        if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
-                                params->max_out_time = ieee80211_tu_to_usec(70);
-                                params->passive_fragmented = true;
-                        } else {
-                                u32 passive_dwell;
-                                /*
+        if (!global_bound)
-                                 * Use band G so that passive channel dwell time
+                goto not_bound;
-                                 * will be assigned with maximum value.
-                                 */
+        params->suspend_time = 100;
-                                band = IEEE80211_BAND_2GHZ;
+        params->max_out_time = 600;
-                                passive_dwell = iwl_mvm_get_passive_dwell(band);
-                                params->max_out_time =
+        if (iwl_mvm_low_latency(mvm)) {
-                                        ieee80211_tu_to_usec(passive_dwell);
+                params->suspend_time = 250;
-                        }
+                params->max_out_time = 250;
-                }
        }
+not_bound:
        for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
-                if (params->passive_fragmented)
+                params->dwell[band].passive = iwl_mvm_get_passive_dwell(band);
-                        params->dwell[band].passive = 20;
-                else
-                        params->dwell[band].passive =
-                                iwl_mvm_get_passive_dwell(band);
                params->dwell[band].active = iwl_mvm_get_active_dwell(band,
                                                                      n_ssids);
        }
@@ -761,7 +732,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
        int band_2ghz = mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels;
        int band_5ghz = mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
        int head = 0;
-        int tail = band_2ghz + band_5ghz;
+        int tail = band_2ghz + band_5ghz - 1;
        u32 ssid_bitmap;
        int cmd_len;
        int ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c
index 8401627c0030..88809b2d1654 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
@@ -274,7 +274,8 @@ int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *changed_vif,
                                return -EINVAL;
                        if (changed_vif->type != NL80211_IFTYPE_STATION) {
                                new_state = SF_UNINIT;
-                        } else if (changed_vif->bss_conf.assoc) {
+                        } else if (changed_vif->bss_conf.assoc &&
+                                   changed_vif->bss_conf.dtim_period) {
                                mvmvif = iwl_mvm_vif_from_mac80211(changed_vif);
                                sta_id = mvmvif->ap_sta_id;
                                new_state = SF_FULL_ON;
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index d619851745a1..2180902266ae 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -644,3 +644,22 @@ bool iwl_mvm_low_latency(struct iwl_mvm *mvm)
        return result;
 }
+static void iwl_mvm_idle_iter(void *_data, u8 *mac, struct ieee80211_vif *vif)
+{
+        bool *idle = _data;
+        if (!vif->bss_conf.idle)
+                *idle = false;
+}
+bool iwl_mvm_is_idle(struct iwl_mvm *mvm)
+{
+        bool idle = true;
+        ieee80211_iterate_active_interfaces_atomic(
+                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        iwl_mvm_idle_iter, &idle);
+        return idle;
+}
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index edb015c99049..3d1d57f9f5bc 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -373,12 +373,14 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5102, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9200, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index dcfd6d866d09..2365553f1ef7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1749,6 +1749,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         * PCI Tx retries from interfering with C3 CPU state */
        pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
+        trans->dev = &pdev->dev;
+        trans_pcie->pci_dev = pdev;
+        iwl_disable_interrupts(trans);
        err = pci_enable_msi(pdev);
        if (err) {
                dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", err);
@@ -1760,8 +1764,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                }
        }
-        trans->dev = &pdev->dev;
-        trans_pcie->pci_dev = pdev;
        trans->hw_rev = iwl_read32(trans, CSR_HW_REV);
        trans->hw_id = (pdev->device << 16) + pdev->subsystem_device;
        snprintf(trans->hw_id_str, sizeof(trans->hw_id_str),
@@ -1787,8 +1789,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                goto out_pci_disable_msi;
        }
-        trans_pcie->inta_mask = CSR_INI_SET_MASK;
        if (iwl_pcie_alloc_ict(trans))
                goto out_free_cmd_pool;
@@ -1800,6 +1800,8 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                goto out_free_ict;
        }
+        trans_pcie->inta_mask = CSR_INI_SET_MASK;
        return trans;
 out_free_ict:
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 77db0886c6e2..9c771b3e9918 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -292,6 +292,12 @@ process_start:
                        while ((skb = skb_dequeue(&adapter->usb_rx_data_q)))
                                mwifiex_handle_rx_packet(adapter, skb);
+                /* Check for event */
+                if (adapter->event_received) {
+                        adapter->event_received = false;
+                        mwifiex_process_event(adapter);
+                }
                /* Check for Cmd Resp */
                if (adapter->cmd_resp_received) {
                        adapter->cmd_resp_received = false;
@@ -304,12 +310,6 @@ process_start:
                        }
                }
-                /* Check for event */
-                if (adapter->event_received) {
-                        adapter->event_received = false;
-                        mwifiex_process_event(adapter);
-                }
                /* Check if we need to confirm Sleep Request
                   received previously */
                if (adapter->ps_state == PS_STATE_PRE_SLEEP) {
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 894270611f2c..536c14aa71f3 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -60,9 +60,10 @@ int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
        int status;
        /* Wait for completion */
-        status = wait_event_interruptible(adapter->cmd_wait_q.wait,
+        status = wait_event_interruptible_timeout(adapter->cmd_wait_q.wait,
-                                          *(cmd_queued->condition));
+                                                  *(cmd_queued->condition),
-        if (status) {
+                                                  (12 * HZ));
+        if (status <= 0) {
                dev_err(adapter->dev, "cmd_wait_q terminated: %d\n", status);
                mwifiex_cancel_all_pending_cmd(adapter);
                return status;
diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c
index 1a8d32138593..cf61d6e3eaa7 100644
--- a/drivers/net/wireless/rsi/rsi_91x_core.c
+++ b/drivers/net/wireless/rsi/rsi_91x_core.c
@@ -88,7 +88,7 @@ static u8 rsi_core_determine_hal_queue(struct rsi_common *common)
        bool recontend_queue = false;
        u32 q_len = 0;
        u8 q_num = INVALID_QUEUE;
-        u8 ii, min = 0;
+        u8 ii = 0, min = 0;
        if (skb_queue_len(&common->tx_queue[MGMT_SOFT_Q])) {
                if (!common->mgmt_q_block)
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 73694295648f..1b28cda6ca88 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -841,16 +841,6 @@ int rsi_set_channel(struct rsi_common *common, u16 channel)
        rsi_dbg(MGMT_TX_ZONE,
                "%s: Sending scan req frame\n", __func__);
-        skb = dev_alloc_skb(FRAME_DESC_SZ);
-        if (!skb) {
-                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
-                        __func__);
-                return -ENOMEM;
-        }
-        memset(skb->data, 0, FRAME_DESC_SZ);
-        mgmt_frame = (struct rsi_mac_frame *)skb->data;
        if (common->band == IEEE80211_BAND_5GHZ) {
                if ((channel >= 36) && (channel <= 64))
                        channel = ((channel - 32) / 4);
@@ -868,6 +858,16 @@ int rsi_set_channel(struct rsi_common *common, u16 channel)
                }
        }
+        skb = dev_alloc_skb(FRAME_DESC_SZ);
+        if (!skb) {
+                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+                        __func__);
+                return -ENOMEM;
+        }
+        memset(skb->data, 0, FRAME_DESC_SZ);
+        mgmt_frame = (struct rsi_mac_frame *)skb->data;
        mgmt_frame->desc_word[0] = cpu_to_le16(RSI_WIFI_MGMT_Q << 12);
        mgmt_frame->desc_word[1] = cpu_to_le16(SCAN_REQUEST);
        mgmt_frame->desc_word[4] = cpu_to_le16(channel);
@@ -966,6 +966,7 @@ static int rsi_send_auto_rate_request(struct rsi_common *common)
        if (!selected_rates) {
                rsi_dbg(ERR_ZONE, "%s: Failed in allocation of mem\n",
                        __func__);
+                dev_kfree_skb(skb);
                return -ENOMEM;
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ddeb5a709aa3..a87ee9b6585a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -621,20 +621,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                      bss_conf->bssid);
        /*
-         * Update the beacon. This is only required on USB devices. PCI
-         * devices fetch beacons periodically.
-         */
-        if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
-                rt2x00queue_update_beacon(rt2x00dev, vif);
-        /*
         * Start/stop beaconing.
         */
        if (changes & BSS_CHANGED_BEACON_ENABLED) {
                if (!bss_conf->enable_beacon && intf->enable_beacon) {
-                        rt2x00queue_clear_beacon(rt2x00dev, vif);
                        rt2x00dev->intf_beaconing--;
                        intf->enable_beacon = false;
+                        /*
+                         * Clear beacon in the H/W for this vif. This is needed
+                         * to disable beaconing on this particular interface
+                         * and keep it running on other interfaces.
+                         */
+                        rt2x00queue_clear_beacon(rt2x00dev, vif);
                        if (rt2x00dev->intf_beaconing == 0) {
                                /*
@@ -645,11 +643,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                rt2x00queue_stop_queue(rt2x00dev->bcn);
                                mutex_unlock(&intf->beacon_skb_mutex);
                        }
                } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
                        rt2x00dev->intf_beaconing++;
                        intf->enable_beacon = true;
+                        /*
+                         * Upload beacon to the H/W. This is only required on
+                         * USB devices. PCI devices fetch beacons periodically.
+                         */
+                        if (rt2x00_is_usb(rt2x00dev))
+                                rt2x00queue_update_beacon(rt2x00dev, vif);
                        if (rt2x00dev->intf_beaconing == 1) {
                                /*
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index 06ef47cd6203..5b4c225396f2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -293,7 +293,7 @@ static void _rtl88ee_translate_rx_signal_stuff(struct ieee80211_hw *hw,
        u8 *psaddr;
        __le16 fc;
        u16 type, ufc;
-        bool match_bssid, packet_toself, packet_beacon, addr;
+        bool match_bssid, packet_toself, packet_beacon = false, addr;
        tmp_buf = skb->data + pstatus->rx_drvinfo_size + pstatus->rx_bufshift;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 68b5c7e92cfb..07cb06da6729 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
        err = _rtl92cu_init_mac(hw);
        if (err) {
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n");
-                return err;
+                goto exit;
        }
        err = rtl92c_download_fw(hw);
        if (err) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 36b48be8329c..2b3c78baa9f8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -49,6 +49,12 @@ static u8 _rtl92se_map_hwqueue_to_fwqueue(struct sk_buff *skb,	u8 skb_queue)
        if (ieee80211_is_nullfunc(fc))
                return QSLT_HIGH;
+        /* Kernel commit 1bf4bbb4024dcdab changed EAPOL packets to use
+         * queue V0 at priority 7; however, the RTL8192SE appears to have
+         * that queue at priority 6
+         */
+        if (skb->priority == 7)
+                return QSLT_VO;
        return skb->priority;
 }
diff --git a/drivers/net/wireless/ti/wl18xx/event.h b/drivers/net/wireless/ti/wl18xx/event.h
index 398f3d2c0a6c..a76e98eb8372 100644
--- a/drivers/net/wireless/ti/wl18xx/event.h
+++ b/drivers/net/wireless/ti/wl18xx/event.h
@@ -68,6 +68,26 @@ struct wl18xx_event_mailbox {
        /* bitmap of inactive stations (by HLID) */
        __le32 inactive_sta_bitmap;
+        /* rx BA win size indicated by RX_BA_WIN_SIZE_CHANGE_EVENT_ID */
+        u8 rx_ba_role_id;
+        u8 rx_ba_link_id;
+        u8 rx_ba_win_size;
+        u8 padding;
+        /* smart config */
+        u8 sc_ssid_len;
+        u8 sc_pwd_len;
+        u8 sc_token_len;
+        u8 padding1;
+        u8 sc_ssid[32];
+        u8 sc_pwd[32];
+        u8 sc_token[32];
+        /* smart config sync channel */
+        u8 sc_sync_channel;
+        u8 sc_sync_band;
+        u8 padding2[2];
 } __packed;
 int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 1f9a36031b06..16d10281798d 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -158,6 +158,11 @@ EXPORT_SYMBOL_GPL(wlcore_event_channel_switch);
 void wlcore_event_dummy_packet(struct wl1271 *wl)
 {
+        if (wl->plt) {
+                wl1271_info("Got DUMMY_PACKET event in PLT mode.  FW bug, ignoring.");
+                return;
+        }
        wl1271_debug(DEBUG_EVENT, "DUMMY_PACKET_ID_EVENT_ID");
        wl1271_tx_dummy_packet(wl);
 }
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 630a3fcf65bc..0d4a285cbd7e 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -226,7 +226,7 @@ int xenvif_map_frontend_rings(struct xenvif *vif,
                              grant_ref_t rx_ring_ref);
 /* Check for SKBs from frontend and schedule backend processing */
-void xenvif_check_rx_xenvif(struct xenvif *vif);
+void xenvif_napi_schedule_or_enable_events(struct xenvif *vif);
 /* Prevent the device from generating any further traffic. */
 void xenvif_carrier_off(struct xenvif *vif);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index ef05c5c49d41..20e9defa1060 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -75,32 +75,8 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
        work_done = xenvif_tx_action(vif, budget);
        if (work_done < budget) {
-                int more_to_do = 0;
+                napi_complete(napi);
-                unsigned long flags;
+                xenvif_napi_schedule_or_enable_events(vif);
-                /* It is necessary to disable IRQ before calling
-                 * RING_HAS_UNCONSUMED_REQUESTS. Otherwise we might
-                 * lose event from the frontend.
-                 *
-                 * Consider:
-                 *   RING_HAS_UNCONSUMED_REQUESTS
-                 *   <frontend generates event to trigger napi_schedule>
-                 *   __napi_complete
-                 *
-                 * This handler is still in scheduled state so the
-                 * event has no effect at all. After __napi_complete
-                 * this handler is descheduled and cannot get
-                 * scheduled again. We lose event in this case and the ring
-                 * will be completely stalled.
-                 */
-                local_irq_save(flags);
-                RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, more_to_do);
-                if (!more_to_do)
-                        __napi_complete(napi);
-                local_irq_restore(flags);
        }
        return work_done;
@@ -194,7 +170,7 @@ static void xenvif_up(struct xenvif *vif)
        enable_irq(vif->tx_irq);
        if (vif->tx_irq != vif->rx_irq)
                enable_irq(vif->rx_irq);
-        xenvif_check_rx_xenvif(vif);
+        xenvif_napi_schedule_or_enable_events(vif);
 }
 static void xenvif_down(struct xenvif *vif)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 76665405c5aa..7367208ee8cd 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -104,7 +104,7 @@ static inline unsigned long idx_to_kaddr(struct xenvif *vif,
 /* Find the containing VIF's structure from a pointer in pending_tx_info array
 */
-static inline struct xenvif* ubuf_to_vif(struct ubuf_info *ubuf)
+static inline struct xenvif *ubuf_to_vif(const struct ubuf_info *ubuf)
 {
        u16 pending_idx = ubuf->desc;
        struct pending_tx_info *temp =
@@ -323,6 +323,35 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
 }
 /*
+ * Find the grant ref for a given frag in a chain of struct ubuf_info's
+ * skb: the skb itself
+ * i: the frag's number
+ * ubuf: a pointer to an element in the chain. It should not be NULL
+ *
+ * Returns a pointer to the element in the chain where the page were found. If
+ * not found, returns NULL.
+ * See the definition of callback_struct in common.h for more details about
+ * the chain.
+ */
+static const struct ubuf_info *xenvif_find_gref(const struct sk_buff *const skb,
+                                                const int i,
+                                                const struct ubuf_info *ubuf)
+{
+        struct xenvif *foreign_vif = ubuf_to_vif(ubuf);
+        do {
+                u16 pending_idx = ubuf->desc;
+                if (skb_shinfo(skb)->frags[i].page.p ==
+                    foreign_vif->mmap_pages[pending_idx])
+                        break;
+                ubuf = (struct ubuf_info *) ubuf->ctx;
+        } while (ubuf);
+        return ubuf;
+}
+/*
 * Prepare an SKB to be transmitted to the frontend.
 *
 * This function is responsible for allocating grant operations, meta
@@ -346,9 +375,8 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        int head = 1;
        int old_meta_prod;
        int gso_type;
-        struct ubuf_info *ubuf = skb_shinfo(skb)->destructor_arg;
+        const struct ubuf_info *ubuf = skb_shinfo(skb)->destructor_arg;
-        grant_ref_t foreign_grefs[MAX_SKB_FRAGS];
+        const struct ubuf_info *const head_ubuf = ubuf;
-        struct xenvif *foreign_vif = NULL;
        old_meta_prod = npo->meta_prod;
@@ -386,19 +414,6 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        npo->copy_off = 0;
        npo->copy_gref = req->gref;
-        if ((skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) &&
-                 (ubuf->callback == &xenvif_zerocopy_callback)) {
-                int i = 0;
-                foreign_vif = ubuf_to_vif(ubuf);
-                do {
-                        u16 pending_idx = ubuf->desc;
-                        foreign_grefs[i++] =
-                                foreign_vif->pending_tx_info[pending_idx].req.gref;
-                        ubuf = (struct ubuf_info *) ubuf->ctx;
-                } while (ubuf);
-        }
        data = skb->data;
        while (data < skb_tail_pointer(skb)) {
                unsigned int offset = offset_in_page(data);
@@ -415,13 +430,60 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        }
        for (i = 0; i < nr_frags; i++) {
+                /* This variable also signals whether foreign_gref has a real
+                 * value or not.
+                 */
+                struct xenvif *foreign_vif = NULL;
+                grant_ref_t foreign_gref;
+                if ((skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) &&
+                        (ubuf->callback == &xenvif_zerocopy_callback)) {
+                        const struct ubuf_info *const startpoint = ubuf;
+                        /* Ideally ubuf points to the chain element which
+                         * belongs to this frag. Or if frags were removed from
+                         * the beginning, then shortly before it.
+                         */
+                        ubuf = xenvif_find_gref(skb, i, ubuf);
+                        /* Try again from the beginning of the list, if we
+                         * haven't tried from there. This only makes sense in
+                         * the unlikely event of reordering the original frags.
+                         * For injected local pages it's an unnecessary second
+                         * run.
+                         */
+                        if (unlikely(!ubuf) && startpoint != head_ubuf)
+                                ubuf = xenvif_find_gref(skb, i, head_ubuf);
+                        if (likely(ubuf)) {
+                                u16 pending_idx = ubuf->desc;
+                                foreign_vif = ubuf_to_vif(ubuf);
+                                foreign_gref = foreign_vif->pending_tx_info[pending_idx].req.gref;
+                                /* Just a safety measure. If this was the last
+                                 * element on the list, the for loop will
+                                 * iterate again if a local page were added to
+                                 * the end. Using head_ubuf here prevents the
+                                 * second search on the chain. Or the original
+                                 * frags changed order, but that's less likely.
+                                 * In any way, ubuf shouldn't be NULL.
+                                 */
+                                ubuf = ubuf->ctx ?
+                                        (struct ubuf_info *) ubuf->ctx :
+                                        head_ubuf;
+                        } else
+                                /* This frag was a local page, added to the
+                                 * array after the skb left netback.
+                                 */
+                                ubuf = head_ubuf;
+                }
                xenvif_gop_frag_copy(vif, skb, npo,
                                     skb_frag_page(&skb_shinfo(skb)->frags[i]),
                                     skb_frag_size(&skb_shinfo(skb)->frags[i]),
                                     skb_shinfo(skb)->frags[i].page_offset,
                                     &head,
                                     foreign_vif,
-                                     foreign_grefs[i]);
+                                     foreign_vif ? foreign_gref : UINT_MAX);
        }
        return npo->meta_prod - old_meta_prod;
@@ -654,7 +716,7 @@ done:
                notify_remote_via_irq(vif->rx_irq);
 }
-void xenvif_check_rx_xenvif(struct xenvif *vif)
+void xenvif_napi_schedule_or_enable_events(struct xenvif *vif)
 {
        int more_to_do;
@@ -688,7 +750,7 @@ static void tx_credit_callback(unsigned long data)
 {
        struct xenvif *vif = (struct xenvif *)data;
        tx_add_credit(vif);
-        xenvif_check_rx_xenvif(vif);
+        xenvif_napi_schedule_or_enable_events(vif);
 }
 static void xenvif_tx_err(struct xenvif *vif,
diff --git a/drivers/of/base.c b/drivers/of/base.c
index f72d19b7e5d2..32e969d95319 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1828,17 +1828,17 @@ int of_update_property(struct device_node *np, struct property *newprop)
                next = &(*next)->next;
        }
        raw_spin_unlock_irqrestore(&devtree_lock, flags);
-        if (rc)
+        if (!found)
-                return rc;
+                return -ENODEV;
+        /* At early boot, bail out and defer setup to of_init() */
+        if (!of_kset)
+                return found ? 0 : -ENODEV;
        /* Update the sysfs attribute */
-        if (oldprop)
+        sysfs_remove_bin_file(&np->kobj, &oldprop->attr);
-                sysfs_remove_bin_file(&np->kobj, &oldprop->attr);
        __of_add_property_sysfs(np, newprop);
-        if (!found)
-                return -ENODEV;
        return 0;
 }
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index fa16a912a927..7a2ef7bb8022 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -491,7 +491,7 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,
 * in /reserved-memory matches the values supported by the current implementation,
 * also check if ranges property has been provided
 */
-static int __reserved_mem_check_root(unsigned long node)
+static int __init __reserved_mem_check_root(unsigned long node)
 {
        __be32 *prop;
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 9bcf2cf19357..5aeb89411350 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -364,7 +364,7 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
                memset(r, 0, sizeof(*r));
                /*
-                 * Get optional "interrupts-names" property to add a name
+                 * Get optional "interrupt-names" property to add a name
                 * to the resource.
                 */
                of_property_read_string_index(dev, "interrupt-names", index,
@@ -380,6 +380,32 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
 EXPORT_SYMBOL_GPL(of_irq_to_resource);
 /**
+ * of_irq_get - Decode a node's IRQ and return it as a Linux irq number
+ * @dev: pointer to device tree node
+ * @index: zero-based index of the irq
+ *
+ * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
+ * is not yet created.
+ *
+ */
+int of_irq_get(struct device_node *dev, int index)
+{
+        int rc;
+        struct of_phandle_args oirq;
+        struct irq_domain *domain;
+        rc = of_irq_parse_one(dev, index, &oirq);
+        if (rc)
+                return rc;
+        domain = irq_find_host(oirq.np);
+        if (!domain)
+                return -EPROBE_DEFER;
+        return irq_create_of_mapping(&oirq);
+}
+/**
 * of_irq_count - Count the number of IRQs a node uses
 * @dev: pointer to device tree node
 */
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 404d1daebefa..bd47fbc53dc9 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -168,7 +168,9 @@ struct platform_device *of_device_alloc(struct device_node *np,
                        rc = of_address_to_resource(np, i, res);
                        WARN_ON(rc);
                }
-                WARN_ON(of_irq_to_resource_table(np, res, num_irq) != num_irq);
+                if (of_irq_to_resource_table(np, res, num_irq) != num_irq)
+                        pr_debug("not all legacy IRQ resources mapped for %s\n",
+                                 np->name);
        }
        dev->dev.of_node = of_node_get(np);
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index ae4450070503..fe70b86bcffb 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
+#include <linux/of_platform.h>
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
@@ -427,6 +428,36 @@ static void __init of_selftest_match_node(void)
        }
 }
+static void __init of_selftest_platform_populate(void)
+{
+        int irq;
+        struct device_node *np;
+        struct platform_device *pdev;
+        np = of_find_node_by_path("/testcase-data");
+        of_platform_populate(np, of_default_bus_match_table, NULL, NULL);
+        /* Test that a missing irq domain returns -EPROBE_DEFER */
+        np = of_find_node_by_path("/testcase-data/testcase-device1");
+        pdev = of_find_device_by_node(np);
+        if (!pdev)
+                selftest(0, "device 1 creation failed\n");
+        irq = platform_get_irq(pdev, 0);
+        if (irq != -EPROBE_DEFER)
+                selftest(0, "device deferred probe failed - %d\n", irq);
+        /* Test that a parsing failure does not return -EPROBE_DEFER */
+        np = of_find_node_by_path("/testcase-data/testcase-device2");
+        pdev = of_find_device_by_node(np);
+        if (!pdev)
+                selftest(0, "device 2 creation failed\n");
+        irq = platform_get_irq(pdev, 0);
+        if (irq >= 0 || irq == -EPROBE_DEFER)
+                selftest(0, "device parsing error failed - %d\n", irq);
+        selftest(1, "passed");
+}
 static int __init of_selftest(void)
 {
        struct device_node *np;
@@ -445,6 +476,7 @@ static int __init of_selftest(void)
        of_selftest_parse_interrupts();
        of_selftest_parse_interrupts_extended();
        of_selftest_match_node();
+        of_selftest_platform_populate();
        pr_info("end of selftest - %i passed, %i failed\n",
                selftest_results.passed, selftest_results.failed);
        return 0;
diff --git a/drivers/of/testcase-data/tests-interrupts.dtsi b/drivers/of/testcase-data/tests-interrupts.dtsi
index c843720bd3e5..da4695f60351 100644
--- a/drivers/of/testcase-data/tests-interrupts.dtsi
+++ b/drivers/of/testcase-data/tests-interrupts.dtsi
@@ -54,5 +54,18 @@
                                                      <&test_intmap1 1 2>;
                        };
                };
+                testcase-device1 {
+                        compatible = "testcase-device";
+                        interrupt-parent = <&test_intc0>;
+                        interrupts = <1>;
+                };
+                testcase-device2 {
+                        compatible = "testcase-device";
+                        interrupt-parent = <&test_intc2>;
+                        interrupts = <1>; /* invalid specifier - too short */
+                };
        };
 };
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index d3d1cfd51e09..e384e2534594 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -293,6 +293,58 @@ static int mvebu_pcie_hw_wr_conf(struct mvebu_pcie_port *port,
        return PCIBIOS_SUCCESSFUL;
 }
+/*
+ * Remove windows, starting from the largest ones to the smallest
+ * ones.
+ */
+static void mvebu_pcie_del_windows(struct mvebu_pcie_port *port,
+                                   phys_addr_t base, size_t size)
+{
+        while (size) {
+                size_t sz = 1 << (fls(size) - 1);
+                mvebu_mbus_del_window(base, sz);
+                base += sz;
+                size -= sz;
+        }
+}
+/*
+ * MBus windows can only have a power of two size, but PCI BARs do not
+ * have this constraint. Therefore, we have to split the PCI BAR into
+ * areas each having a power of two size. We start from the largest
+ * one (i.e highest order bit set in the size).
+ */
+static void mvebu_pcie_add_windows(struct mvebu_pcie_port *port,
+                                   unsigned int target, unsigned int attribute,
+                                   phys_addr_t base, size_t size,
+                                   phys_addr_t remap)
+{
+        size_t size_mapped = 0;
+        while (size) {
+                size_t sz = 1 << (fls(size) - 1);
+                int ret;
+                ret = mvebu_mbus_add_window_remap_by_id(target, attribute, base,
+                                                        sz, remap);
+                if (ret) {
+                        dev_err(&port->pcie->pdev->dev,
+                                "Could not create MBus window at 0x%x, size 0x%x: %d\n",
+                                base, sz, ret);
+                        mvebu_pcie_del_windows(port, base - size_mapped,
+                                               size_mapped);
+                        return;
+                }
+                size -= sz;
+                size_mapped += sz;
+                base += sz;
+                if (remap != MVEBU_MBUS_NO_REMAP)
+                        remap += sz;
+        }
+}
 static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
 {
        phys_addr_t iobase;
@@ -304,8 +356,8 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
                /* If a window was configured, remove it */
                if (port->iowin_base) {
-                        mvebu_mbus_del_window(port->iowin_base,
+                        mvebu_pcie_del_windows(port, port->iowin_base,
-                                              port->iowin_size);
+                                               port->iowin_size);
                        port->iowin_base = 0;
                        port->iowin_size = 0;
                }
@@ -331,11 +383,11 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
        port->iowin_base = port->pcie->io.start + iobase;
        port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
                            (port->bridge.iolimitupper << 16)) -
-                            iobase);
+                            iobase) + 1;
-        mvebu_mbus_add_window_remap_by_id(port->io_target, port->io_attr,
+        mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
-                                          port->iowin_base, port->iowin_size,
+                               port->iowin_base, port->iowin_size,
-                                          iobase);
+                               iobase);
 }
 static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
@@ -346,8 +398,8 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
                /* If a window was configured, remove it */
                if (port->memwin_base) {
-                        mvebu_mbus_del_window(port->memwin_base,
+                        mvebu_pcie_del_windows(port, port->memwin_base,
-                                              port->memwin_size);
+                                               port->memwin_size);
                        port->memwin_base = 0;
                        port->memwin_size = 0;
                }
@@ -364,10 +416,11 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port)
        port->memwin_base  = ((port->bridge.membase & 0xFFF0) << 16);
        port->memwin_size  =
                (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) -
-                port->memwin_base;
+                port->memwin_base + 1;
-        mvebu_mbus_add_window_by_id(port->mem_target, port->mem_attr,
+        mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr,
-                                    port->memwin_base, port->memwin_size);
+                               port->memwin_base, port->memwin_size,
+                               MVEBU_MBUS_NO_REMAP);
 }
 /*
@@ -743,14 +796,21 @@ static resource_size_t mvebu_pcie_align_resource(struct pci_dev *dev,
        /*
         * On the PCI-to-PCI bridge side, the I/O windows must have at
-         * least a 64 KB size and be aligned on their size, and the
+         * least a 64 KB size and the memory windows must have at
-         * memory windows must have at least a 1 MB size and be
+         * least a 1 MB size. Moreover, MBus windows need to have a
-         * aligned on their size
+         * base address aligned on their size, and their size must be
+         * a power of two. This means that if the BAR doesn't have a
+         * power of two size, several MBus windows will actually be
+         * created. We need to ensure that the biggest MBus window
+         * (which will be the first one) is aligned on its size, which
+         * explains the rounddown_pow_of_two() being done here.
         */
        if (res->flags & IORESOURCE_IO)
-                return round_up(start, max_t(resource_size_t, SZ_64K, size));
+                return round_up(start, max_t(resource_size_t, SZ_64K,
+                                             rounddown_pow_of_two(size)));
        else if (res->flags & IORESOURCE_MEM)
-                return round_up(start, max_t(resource_size_t, SZ_1M, size));
+                return round_up(start, max_t(resource_size_t, SZ_1M,
+                                             rounddown_pow_of_two(size)));
        else
                return start;
 }
diff --git a/drivers/pci/host/pci-rcar-gen2.c b/drivers/pci/host/pci-rcar-gen2.c
index fd3e3ab56509..4fe349dcaf59 100644
--- a/drivers/pci/host/pci-rcar-gen2.c
+++ b/drivers/pci/host/pci-rcar-gen2.c
@@ -15,6 +15,7 @@
 #include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/of_pci.h>
 #include <linux/pci.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
@@ -180,8 +181,13 @@ static int rcar_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
        struct pci_sys_data *sys = dev->bus->sysdata;
        struct rcar_pci_priv *priv = sys->private_data;
+        int irq;
+        irq = of_irq_parse_and_map_pci(dev, slot, pin);
+        if (!irq)
+                irq = priv->irq;
-        return priv->irq;
+        return irq;
 }
 #ifdef CONFIG_PCI_DEBUG
diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
index 330f7e3a32dd..083cf37ca047 100644
--- a/drivers/pci/host/pci-tegra.c
+++ b/drivers/pci/host/pci-tegra.c
@@ -639,10 +639,15 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
 static int tegra_pcie_map_irq(const struct pci_dev *pdev, u8 slot, u8 pin)
 {
        struct tegra_pcie *pcie = sys_to_pcie(pdev->bus->sysdata);
+        int irq;
        tegra_cpuidle_pcie_irqs_in_use();
-        return pcie->irq;
+        irq = of_irq_parse_and_map_pci(pdev, slot, pin);
+        if (!irq)
+                irq = pcie->irq;
+        return irq;
 }
 static void tegra_pcie_add_bus(struct pci_bus *bus)
diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
index 509a29d84509..c4e373294476 100644
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/msi.h>
 #include <linux/of_address.h>
+#include <linux/of_pci.h>
 #include <linux/pci.h>
 #include <linux/pci_regs.h>
 #include <linux/types.h>
@@ -490,7 +491,7 @@ int __init dw_pcie_host_init(struct pcie_port *pp)
        dw_pci.nr_controllers = 1;
        dw_pci.private_data = (void **)&pp;
-        pci_common_init(&dw_pci);
+        pci_common_init_dev(pp->dev, &dw_pci);
        pci_assign_unassigned_resources();
 #ifdef CONFIG_PCI_DOMAINS
        dw_pci.domain++;
@@ -520,13 +521,13 @@ static void dw_pcie_prog_viewport_cfg1(struct pcie_port *pp, u32 busdev)
        dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX1,
                          PCIE_ATU_VIEWPORT);
        dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_CFG1, PCIE_ATU_CR1);
-        dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
        dw_pcie_writel_rc(pp, pp->cfg1_base, PCIE_ATU_LOWER_BASE);
        dw_pcie_writel_rc(pp, (pp->cfg1_base >> 32), PCIE_ATU_UPPER_BASE);
        dw_pcie_writel_rc(pp, pp->cfg1_base + pp->config.cfg1_size - 1,
                          PCIE_ATU_LIMIT);
        dw_pcie_writel_rc(pp, busdev, PCIE_ATU_LOWER_TARGET);
        dw_pcie_writel_rc(pp, 0, PCIE_ATU_UPPER_TARGET);
+        dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
 }
 static void dw_pcie_prog_viewport_mem_outbound(struct pcie_port *pp)
@@ -535,7 +536,6 @@ static void dw_pcie_prog_viewport_mem_outbound(struct pcie_port *pp)
        dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX0,
                          PCIE_ATU_VIEWPORT);
        dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_MEM, PCIE_ATU_CR1);
-        dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
        dw_pcie_writel_rc(pp, pp->mem_base, PCIE_ATU_LOWER_BASE);
        dw_pcie_writel_rc(pp, (pp->mem_base >> 32), PCIE_ATU_UPPER_BASE);
        dw_pcie_writel_rc(pp, pp->mem_base + pp->config.mem_size - 1,
@@ -543,6 +543,7 @@ static void dw_pcie_prog_viewport_mem_outbound(struct pcie_port *pp)
        dw_pcie_writel_rc(pp, pp->config.mem_bus_addr, PCIE_ATU_LOWER_TARGET);
        dw_pcie_writel_rc(pp, upper_32_bits(pp->config.mem_bus_addr),
                          PCIE_ATU_UPPER_TARGET);
+        dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
 }
 static void dw_pcie_prog_viewport_io_outbound(struct pcie_port *pp)
@@ -551,7 +552,6 @@ static void dw_pcie_prog_viewport_io_outbound(struct pcie_port *pp)
        dw_pcie_writel_rc(pp, PCIE_ATU_REGION_OUTBOUND | PCIE_ATU_REGION_INDEX1,
                          PCIE_ATU_VIEWPORT);
        dw_pcie_writel_rc(pp, PCIE_ATU_TYPE_IO, PCIE_ATU_CR1);
-        dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
        dw_pcie_writel_rc(pp, pp->io_base, PCIE_ATU_LOWER_BASE);
        dw_pcie_writel_rc(pp, (pp->io_base >> 32), PCIE_ATU_UPPER_BASE);
        dw_pcie_writel_rc(pp, pp->io_base + pp->config.io_size - 1,
@@ -559,6 +559,7 @@ static void dw_pcie_prog_viewport_io_outbound(struct pcie_port *pp)
        dw_pcie_writel_rc(pp, pp->config.io_bus_addr, PCIE_ATU_LOWER_TARGET);
        dw_pcie_writel_rc(pp, upper_32_bits(pp->config.io_bus_addr),
                          PCIE_ATU_UPPER_TARGET);
+        dw_pcie_writel_rc(pp, PCIE_ATU_ENABLE, PCIE_ATU_CR2);
 }
 static int dw_pcie_rd_other_conf(struct pcie_port *pp, struct pci_bus *bus,
@@ -723,7 +724,7 @@ static struct pci_bus *dw_pcie_scan_bus(int nr, struct pci_sys_data *sys)
        if (pp) {
                pp->root_bus_nr = sys->busnr;
-                bus = pci_scan_root_bus(NULL, sys->busnr, &dw_pcie_ops,
+                bus = pci_scan_root_bus(pp->dev, sys->busnr, &dw_pcie_ops,
                                        sys, &sys->resources);
        } else {
                bus = NULL;
@@ -736,8 +737,13 @@ static struct pci_bus *dw_pcie_scan_bus(int nr, struct pci_sys_data *sys)
 static int dw_pcie_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
        struct pcie_port *pp = sys_to_pcie(dev->bus->sysdata);
+        int irq;
+        irq = of_irq_parse_and_map_pci(dev, slot, pin);
+        if (!irq)
+                irq = pp->irq;
-        return pp->irq;
+        return irq;
 }
 static void dw_pcie_add_bus(struct pci_bus *bus)
@@ -764,7 +770,7 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
        u32 membase;
        u32 memlimit;
-        /* set the number of lines as 4 */
+        /* set the number of lanes */
        dw_pcie_readl_rc(pp, PCIE_PORT_LINK_CONTROL, &val);
        val &= ~PORT_LINK_MODE_MASK;
        switch (pp->lanes) {
diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
index 58499277903a..6efc2ec5e4db 100644
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -282,8 +282,8 @@ static int board_added(struct slot *p_slot)
                return WRONG_BUS_FREQUENCY;
        }
-        bsp = ctrl->pci_dev->bus->cur_bus_speed;
+        bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
-        msp = ctrl->pci_dev->bus->max_bus_speed;
+        msp = ctrl->pci_dev->subordinate->max_bus_speed;
        /* Check if there are other slots or devices on the same bus */
        if (!list_empty(&ctrl->pci_dev->subordinate->devices))
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 7325d43bf030..759475ef6ff3 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3067,7 +3067,8 @@ int pci_wait_for_pending_transaction(struct pci_dev *dev)
        if (!pci_is_pcie(dev))
                return 1;
-        return pci_wait_for_pending(dev, PCI_EXP_DEVSTA, PCI_EXP_DEVSTA_TRPND);
+        return pci_wait_for_pending(dev, pci_pcie_cap(dev) + PCI_EXP_DEVSTA,
+                                    PCI_EXP_DEVSTA_TRPND);
 }
 EXPORT_SYMBOL(pci_wait_for_pending_transaction);
@@ -3109,7 +3110,7 @@ static int pci_af_flr(struct pci_dev *dev, int probe)
                return 0;
        /* Wait for Transaction Pending bit clean */
-        if (pci_wait_for_pending(dev, PCI_AF_STATUS, PCI_AF_STATUS_TP))
+        if (pci_wait_for_pending(dev, pos + PCI_AF_STATUS, PCI_AF_STATUS_TP))
                goto clear;
        dev_err(&dev->dev, "transaction is not cleared; "
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index 3bb05f17b9b4..4906c27fa3bd 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -33,6 +33,7 @@ config PHY_MVEBU_SATA
 config OMAP_CONTROL_PHY
        tristate "OMAP CONTROL PHY Driver"
+        depends on ARCH_OMAP2PLUS || COMPILE_TEST
        help
          Enable this to add support for the PHY part present in the control
          module. This driver has API to power on the USB2 PHY and to write to
diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
index 2faf78edc864..7728518572a4 100644
--- a/drivers/phy/Makefile
+++ b/drivers/phy/Makefile
@@ -13,8 +13,9 @@ obj-$(CONFIG_TI_PIPE3)			+= phy-ti-pipe3.o
 obj-$(CONFIG_TWL4030_USB)               += phy-twl4030-usb.o
 obj-$(CONFIG_PHY_EXYNOS5250_SATA)       += phy-exynos5250-sata.o
 obj-$(CONFIG_PHY_SUN4I_USB)             += phy-sun4i-usb.o
-obj-$(CONFIG_PHY_SAMSUNG_USB2)          += phy-samsung-usb2.o
+obj-$(CONFIG_PHY_SAMSUNG_USB2)          += phy-exynos-usb2.o
-obj-$(CONFIG_PHY_EXYNOS4210_USB2)       += phy-exynos4210-usb2.o
+phy-exynos-usb2-y                       += phy-samsung-usb2.o
-obj-$(CONFIG_PHY_EXYNOS4X12_USB2)       += phy-exynos4x12-usb2.o
+phy-exynos-usb2-$(CONFIG_PHY_EXYNOS4210_USB2)   += phy-exynos4210-usb2.o
-obj-$(CONFIG_PHY_EXYNOS5250_USB2)       += phy-exynos5250-usb2.o
+phy-exynos-usb2-$(CONFIG_PHY_EXYNOS4X12_USB2)   += phy-exynos4x12-usb2.o
+phy-exynos-usb2-$(CONFIG_PHY_EXYNOS5250_USB2)   += phy-exynos5250-usb2.o
 obj-$(CONFIG_PHY_XGENE)                 += phy-xgene.o
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 623b71c54b3e..c64a2f3b2d62 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -64,6 +64,9 @@ static struct phy *phy_lookup(struct device *device, const char *port)
        class_dev_iter_init(&iter, phy_class, NULL, NULL);
        while ((dev = class_dev_iter_next(&iter))) {
                phy = to_phy(dev);
+                if (!phy->init_data)
+                        continue;
                count = phy->init_data->num_consumers;
                consumers = phy->init_data->consumers;
                while (count--) {
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index e49324032611..e00c02d0a094 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -104,16 +104,16 @@ config PINCTRL_BCM2835
        select PINMUX
        select PINCONF
-config PINCTRL_CAPRI
+config PINCTRL_BCM281XX
-        bool "Broadcom Capri pinctrl driver"
+        bool "Broadcom BCM281xx pinctrl driver"
        depends on OF
        select PINMUX
        select PINCONF
        select GENERIC_PINCONF
        select REGMAP_MMIO
        help
-          Say Y here to support Broadcom Capri pinctrl driver, which is used for
+          Say Y here to support Broadcom BCM281xx pinctrl driver, which is used
-          the BCM281xx SoC family, including BCM11130, BCM11140, BCM11351,
+          for the BCM281xx SoC family, including BCM11130, BCM11140, BCM11351,
          BCM28145, and BCM28155 SoCs.  This driver requires the pinctrl
          framework.  GPIO is provided by a separate GPIO driver.
diff --git a/drivers/pinctrl/Makefile b/drivers/pinctrl/Makefile
index 4b835880cf80..6d3fd62b9ae8 100644
--- a/drivers/pinctrl/Makefile
+++ b/drivers/pinctrl/Makefile
@@ -21,7 +21,7 @@ obj-$(CONFIG_PINCTRL_BF60x)	+= pinctrl-adi2-bf60x.o
 obj-$(CONFIG_PINCTRL_AT91)      += pinctrl-at91.o
 obj-$(CONFIG_PINCTRL_BCM2835)   += pinctrl-bcm2835.o
 obj-$(CONFIG_PINCTRL_BAYTRAIL)  += pinctrl-baytrail.o
-obj-$(CONFIG_PINCTRL_CAPRI)     += pinctrl-capri.o
+obj-$(CONFIG_PINCTRL_BCM281XX)  += pinctrl-bcm281xx.o
 obj-$(CONFIG_PINCTRL_IMX)       += pinctrl-imx.o
 obj-$(CONFIG_PINCTRL_IMX1_CORE) += pinctrl-imx1-core.o
 obj-$(CONFIG_PINCTRL_IMX27)     += pinctrl-imx27.o
diff --git a/drivers/pinctrl/pinctrl-as3722.c b/drivers/pinctrl/pinctrl-as3722.c
index 92ed4b2e3c07..c862f9c0e9ce 100644
--- a/drivers/pinctrl/pinctrl-as3722.c
+++ b/drivers/pinctrl/pinctrl-as3722.c
@@ -64,7 +64,6 @@ struct as3722_pin_function {
 };
 struct as3722_gpio_pin_control {
-        bool enable_gpio_invert;
        unsigned mode_prop;
        int io_function;
 };
@@ -320,10 +319,8 @@ static int as3722_pinctrl_gpio_set_direction(struct pinctrl_dev *pctldev,
                return mode;
        }
-        if (as_pci->gpio_control[offset].enable_gpio_invert)
+        return as3722_update_bits(as3722, AS3722_GPIOn_CONTROL_REG(offset),
-                mode |= AS3722_GPIO_INV;
+                                AS3722_GPIO_MODE_MASK, mode);
-        return as3722_write(as3722, AS3722_GPIOn_CONTROL_REG(offset), mode);
 }
 static const struct pinmux_ops as3722_pinmux_ops = {
@@ -496,10 +493,18 @@ static void as3722_gpio_set(struct gpio_chip *chip, unsigned offset,
 {
        struct as3722_pctrl_info *as_pci = to_as_pci(chip);
        struct as3722 *as3722 = as_pci->as3722;
-        int en_invert = as_pci->gpio_control[offset].enable_gpio_invert;
+        int en_invert;
        u32 val;
        int ret;
+        ret = as3722_read(as3722, AS3722_GPIOn_CONTROL_REG(offset), &val);
+        if (ret < 0) {
+                dev_err(as_pci->dev,
+                        "GPIO_CONTROL%d_REG read failed: %d\n", offset, ret);
+                return;
+        }
+        en_invert = !!(val & AS3722_GPIO_INV);
        if (value)
                val = (en_invert) ? 0 : AS3722_GPIOn_SIGNAL(offset);
        else
diff --git a/drivers/pinctrl/pinctrl-bcm281xx.c b/drivers/pinctrl/pinctrl-bcm281xx.c
new file mode 100644
index 000000000000..3bed792b2c03
--- /dev/null
+++ b/drivers/pinctrl/pinctrl-bcm281xx.c
@@ -0,0 +1,1461 @@
+/*
+ * Copyright (C) 2013 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation version 2.
+ *
+ * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+ * kind, whether express or implied; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pinctrl/pinctrl.h>
+#include <linux/pinctrl/pinmux.h>
+#include <linux/pinctrl/pinconf.h>
+#include <linux/pinctrl/pinconf-generic.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include "core.h"
+#include "pinctrl-utils.h"
+/* BCM281XX Pin Control Registers Definitions */
+/* Function Select bits are the same for all pin control registers */
+#define BCM281XX_PIN_REG_F_SEL_MASK             0x0700
+#define BCM281XX_PIN_REG_F_SEL_SHIFT            8
+/* Standard pin register */
+#define BCM281XX_STD_PIN_REG_DRV_STR_MASK       0x0007
+#define BCM281XX_STD_PIN_REG_DRV_STR_SHIFT      0
+#define BCM281XX_STD_PIN_REG_INPUT_DIS_MASK     0x0008
+#define BCM281XX_STD_PIN_REG_INPUT_DIS_SHIFT    3
+#define BCM281XX_STD_PIN_REG_SLEW_MASK          0x0010
+#define BCM281XX_STD_PIN_REG_SLEW_SHIFT         4
+#define BCM281XX_STD_PIN_REG_PULL_UP_MASK       0x0020
+#define BCM281XX_STD_PIN_REG_PULL_UP_SHIFT      5
+#define BCM281XX_STD_PIN_REG_PULL_DN_MASK       0x0040
+#define BCM281XX_STD_PIN_REG_PULL_DN_SHIFT      6
+#define BCM281XX_STD_PIN_REG_HYST_MASK          0x0080
+#define BCM281XX_STD_PIN_REG_HYST_SHIFT         7
+/* I2C pin register */
+#define BCM281XX_I2C_PIN_REG_INPUT_DIS_MASK     0x0004
+#define BCM281XX_I2C_PIN_REG_INPUT_DIS_SHIFT    2
+#define BCM281XX_I2C_PIN_REG_SLEW_MASK          0x0008
+#define BCM281XX_I2C_PIN_REG_SLEW_SHIFT         3
+#define BCM281XX_I2C_PIN_REG_PULL_UP_STR_MASK   0x0070
+#define BCM281XX_I2C_PIN_REG_PULL_UP_STR_SHIFT  4
+/* HDMI pin register */
+#define BCM281XX_HDMI_PIN_REG_INPUT_DIS_MASK    0x0008
+#define BCM281XX_HDMI_PIN_REG_INPUT_DIS_SHIFT   3
+#define BCM281XX_HDMI_PIN_REG_MODE_MASK         0x0010
+#define BCM281XX_HDMI_PIN_REG_MODE_SHIFT        4
+/**
+ * bcm281xx_pin_type - types of pin register
+ */
+enum bcm281xx_pin_type {
+        BCM281XX_PIN_TYPE_UNKNOWN = 0,
+        BCM281XX_PIN_TYPE_STD,
+        BCM281XX_PIN_TYPE_I2C,
+        BCM281XX_PIN_TYPE_HDMI,
+};
+static enum bcm281xx_pin_type std_pin = BCM281XX_PIN_TYPE_STD;
+static enum bcm281xx_pin_type i2c_pin = BCM281XX_PIN_TYPE_I2C;
+static enum bcm281xx_pin_type hdmi_pin = BCM281XX_PIN_TYPE_HDMI;
+/**
+ * bcm281xx_pin_function- define pin function
+ */
+struct bcm281xx_pin_function {
+        const char *name;
+        const char * const *groups;
+        const unsigned ngroups;
+};
+/**
+ * bcm281xx_pinctrl_data - Broadcom-specific pinctrl data
+ * @reg_base - base of pinctrl registers
+ */
+struct bcm281xx_pinctrl_data {
+        void __iomem *reg_base;
+        /* List of all pins */
+        const struct pinctrl_pin_desc *pins;
+        const unsigned npins;
+        const struct bcm281xx_pin_function *functions;
+        const unsigned nfunctions;
+        struct regmap *regmap;
+};
+/*
+ * Pin number definition.  The order here must be the same as defined in the
+ * PADCTRLREG block in the RDB.
+ */
+#define BCM281XX_PIN_ADCSYNC            0
+#define BCM281XX_PIN_BAT_RM             1
+#define BCM281XX_PIN_BSC1_SCL           2
+#define BCM281XX_PIN_BSC1_SDA           3
+#define BCM281XX_PIN_BSC2_SCL           4
+#define BCM281XX_PIN_BSC2_SDA           5
+#define BCM281XX_PIN_CLASSGPWR          6
+#define BCM281XX_PIN_CLK_CX8            7
+#define BCM281XX_PIN_CLKOUT_0           8
+#define BCM281XX_PIN_CLKOUT_1           9
+#define BCM281XX_PIN_CLKOUT_2           10
+#define BCM281XX_PIN_CLKOUT_3           11
+#define BCM281XX_PIN_CLKREQ_IN_0        12
+#define BCM281XX_PIN_CLKREQ_IN_1        13
+#define BCM281XX_PIN_CWS_SYS_REQ1       14
+#define BCM281XX_PIN_CWS_SYS_REQ2       15
+#define BCM281XX_PIN_CWS_SYS_REQ3       16
+#define BCM281XX_PIN_DIGMIC1_CLK        17
+#define BCM281XX_PIN_DIGMIC1_DQ         18
+#define BCM281XX_PIN_DIGMIC2_CLK        19
+#define BCM281XX_PIN_DIGMIC2_DQ         20
+#define BCM281XX_PIN_GPEN13             21
+#define BCM281XX_PIN_GPEN14             22
+#define BCM281XX_PIN_GPEN15             23
+#define BCM281XX_PIN_GPIO00             24
+#define BCM281XX_PIN_GPIO01             25
+#define BCM281XX_PIN_GPIO02             26
+#define BCM281XX_PIN_GPIO03             27
+#define BCM281XX_PIN_GPIO04             28
+#define BCM281XX_PIN_GPIO05             29
+#define BCM281XX_PIN_GPIO06             30
+#define BCM281XX_PIN_GPIO07             31
+#define BCM281XX_PIN_GPIO08             32
+#define BCM281XX_PIN_GPIO09             33
+#define BCM281XX_PIN_GPIO10             34
+#define BCM281XX_PIN_GPIO11             35
+#define BCM281XX_PIN_GPIO12             36
+#define BCM281XX_PIN_GPIO13             37
+#define BCM281XX_PIN_GPIO14             38
+#define BCM281XX_PIN_GPS_PABLANK        39
+#define BCM281XX_PIN_GPS_TMARK          40
+#define BCM281XX_PIN_HDMI_SCL           41
+#define BCM281XX_PIN_HDMI_SDA           42
+#define BCM281XX_PIN_IC_DM              43
+#define BCM281XX_PIN_IC_DP              44
+#define BCM281XX_PIN_KP_COL_IP_0        45
+#define BCM281XX_PIN_KP_COL_IP_1        46
+#define BCM281XX_PIN_KP_COL_IP_2        47
+#define BCM281XX_PIN_KP_COL_IP_3        48
+#define BCM281XX_PIN_KP_ROW_OP_0        49
+#define BCM281XX_PIN_KP_ROW_OP_1        50
+#define BCM281XX_PIN_KP_ROW_OP_2        51
+#define BCM281XX_PIN_KP_ROW_OP_3        52
+#define BCM281XX_PIN_LCD_B_0            53
+#define BCM281XX_PIN_LCD_B_1            54
+#define BCM281XX_PIN_LCD_B_2            55
+#define BCM281XX_PIN_LCD_B_3            56
+#define BCM281XX_PIN_LCD_B_4            57
+#define BCM281XX_PIN_LCD_B_5            58
+#define BCM281XX_PIN_LCD_B_6            59
+#define BCM281XX_PIN_LCD_B_7            60
+#define BCM281XX_PIN_LCD_G_0            61
+#define BCM281XX_PIN_LCD_G_1            62
+#define BCM281XX_PIN_LCD_G_2            63
+#define BCM281XX_PIN_LCD_G_3            64
+#define BCM281XX_PIN_LCD_G_4            65
+#define BCM281XX_PIN_LCD_G_5            66
+#define BCM281XX_PIN_LCD_G_6            67
+#define BCM281XX_PIN_LCD_G_7            68
+#define BCM281XX_PIN_LCD_HSYNC          69
+#define BCM281XX_PIN_LCD_OE             70
+#define BCM281XX_PIN_LCD_PCLK           71
+#define BCM281XX_PIN_LCD_R_0            72
+#define BCM281XX_PIN_LCD_R_1            73
+#define BCM281XX_PIN_LCD_R_2            74
+#define BCM281XX_PIN_LCD_R_3            75
+#define BCM281XX_PIN_LCD_R_4            76
+#define BCM281XX_PIN_LCD_R_5            77
+#define BCM281XX_PIN_LCD_R_6            78
+#define BCM281XX_PIN_LCD_R_7            79
+#define BCM281XX_PIN_LCD_VSYNC          80
+#define BCM281XX_PIN_MDMGPIO0           81
+#define BCM281XX_PIN_MDMGPIO1           82
+#define BCM281XX_PIN_MDMGPIO2           83
+#define BCM281XX_PIN_MDMGPIO3           84
+#define BCM281XX_PIN_MDMGPIO4           85
+#define BCM281XX_PIN_MDMGPIO5           86
+#define BCM281XX_PIN_MDMGPIO6           87
+#define BCM281XX_PIN_MDMGPIO7           88
+#define BCM281XX_PIN_MDMGPIO8           89
+#define BCM281XX_PIN_MPHI_DATA_0        90
+#define BCM281XX_PIN_MPHI_DATA_1        91
+#define BCM281XX_PIN_MPHI_DATA_2        92
+#define BCM281XX_PIN_MPHI_DATA_3        93
+#define BCM281XX_PIN_MPHI_DATA_4        94
+#define BCM281XX_PIN_MPHI_DATA_5        95
+#define BCM281XX_PIN_MPHI_DATA_6        96
+#define BCM281XX_PIN_MPHI_DATA_7        97
+#define BCM281XX_PIN_MPHI_DATA_8        98
+#define BCM281XX_PIN_MPHI_DATA_9        99
+#define BCM281XX_PIN_MPHI_DATA_10       100
+#define BCM281XX_PIN_MPHI_DATA_11       101
+#define BCM281XX_PIN_MPHI_DATA_12       102
+#define BCM281XX_PIN_MPHI_DATA_13       103
+#define BCM281XX_PIN_MPHI_DATA_14       104
+#define BCM281XX_PIN_MPHI_DATA_15       105
+#define BCM281XX_PIN_MPHI_HA0           106
+#define BCM281XX_PIN_MPHI_HAT0          107
+#define BCM281XX_PIN_MPHI_HAT1          108
+#define BCM281XX_PIN_MPHI_HCE0_N        109
+#define BCM281XX_PIN_MPHI_HCE1_N        110
+#define BCM281XX_PIN_MPHI_HRD_N         111
+#define BCM281XX_PIN_MPHI_HWR_N         112
+#define BCM281XX_PIN_MPHI_RUN0          113
+#define BCM281XX_PIN_MPHI_RUN1          114
+#define BCM281XX_PIN_MTX_SCAN_CLK       115
+#define BCM281XX_PIN_MTX_SCAN_DATA      116
+#define BCM281XX_PIN_NAND_AD_0          117
+#define BCM281XX_PIN_NAND_AD_1          118
+#define BCM281XX_PIN_NAND_AD_2          119
+#define BCM281XX_PIN_NAND_AD_3          120
+#define BCM281XX_PIN_NAND_AD_4          121
+#define BCM281XX_PIN_NAND_AD_5          122
+#define BCM281XX_PIN_NAND_AD_6          123
+#define BCM281XX_PIN_NAND_AD_7          124
+#define BCM281XX_PIN_NAND_ALE           125
+#define BCM281XX_PIN_NAND_CEN_0         126
+#define BCM281XX_PIN_NAND_CEN_1         127
+#define BCM281XX_PIN_NAND_CLE           128
+#define BCM281XX_PIN_NAND_OEN           129
+#define BCM281XX_PIN_NAND_RDY_0         130
+#define BCM281XX_PIN_NAND_RDY_1         131
+#define BCM281XX_PIN_NAND_WEN           132
+#define BCM281XX_PIN_NAND_WP            133
+#define BCM281XX_PIN_PC1                134
+#define BCM281XX_PIN_PC2                135
+#define BCM281XX_PIN_PMU_INT            136
+#define BCM281XX_PIN_PMU_SCL            137
+#define BCM281XX_PIN_PMU_SDA            138
+#define BCM281XX_PIN_RFST2G_MTSLOTEN3G  139
+#define BCM281XX_PIN_RGMII_0_RX_CTL     140
+#define BCM281XX_PIN_RGMII_0_RXC        141
+#define BCM281XX_PIN_RGMII_0_RXD_0      142
+#define BCM281XX_PIN_RGMII_0_RXD_1      143
+#define BCM281XX_PIN_RGMII_0_RXD_2      144
+#define BCM281XX_PIN_RGMII_0_RXD_3      145
+#define BCM281XX_PIN_RGMII_0_TX_CTL     146
+#define BCM281XX_PIN_RGMII_0_TXC        147
+#define BCM281XX_PIN_RGMII_0_TXD_0      148
+#define BCM281XX_PIN_RGMII_0_TXD_1      149
+#define BCM281XX_PIN_RGMII_0_TXD_2      150
+#define BCM281XX_PIN_RGMII_0_TXD_3      151
+#define BCM281XX_PIN_RGMII_1_RX_CTL     152
+#define BCM281XX_PIN_RGMII_1_RXC        153
+#define BCM281XX_PIN_RGMII_1_RXD_0      154
+#define BCM281XX_PIN_RGMII_1_RXD_1      155
+#define BCM281XX_PIN_RGMII_1_RXD_2      156
+#define BCM281XX_PIN_RGMII_1_RXD_3      157
+#define BCM281XX_PIN_RGMII_1_TX_CTL     158
+#define BCM281XX_PIN_RGMII_1_TXC        159
+#define BCM281XX_PIN_RGMII_1_TXD_0      160
+#define BCM281XX_PIN_RGMII_1_TXD_1      161
+#define BCM281XX_PIN_RGMII_1_TXD_2      162
+#define BCM281XX_PIN_RGMII_1_TXD_3      163
+#define BCM281XX_PIN_RGMII_GPIO_0       164
+#define BCM281XX_PIN_RGMII_GPIO_1       165
+#define BCM281XX_PIN_RGMII_GPIO_2       166
+#define BCM281XX_PIN_RGMII_GPIO_3       167
+#define BCM281XX_PIN_RTXDATA2G_TXDATA3G1        168
+#define BCM281XX_PIN_RTXEN2G_TXDATA3G2  169
+#define BCM281XX_PIN_RXDATA3G0          170
+#define BCM281XX_PIN_RXDATA3G1          171
+#define BCM281XX_PIN_RXDATA3G2          172
+#define BCM281XX_PIN_SDIO1_CLK          173
+#define BCM281XX_PIN_SDIO1_CMD          174
+#define BCM281XX_PIN_SDIO1_DATA_0       175
+#define BCM281XX_PIN_SDIO1_DATA_1       176
+#define BCM281XX_PIN_SDIO1_DATA_2       177
+#define BCM281XX_PIN_SDIO1_DATA_3       178
+#define BCM281XX_PIN_SDIO4_CLK          179
+#define BCM281XX_PIN_SDIO4_CMD          180
+#define BCM281XX_PIN_SDIO4_DATA_0       181
+#define BCM281XX_PIN_SDIO4_DATA_1       182
+#define BCM281XX_PIN_SDIO4_DATA_2       183
+#define BCM281XX_PIN_SDIO4_DATA_3       184
+#define BCM281XX_PIN_SIM_CLK            185
+#define BCM281XX_PIN_SIM_DATA           186
+#define BCM281XX_PIN_SIM_DET            187
+#define BCM281XX_PIN_SIM_RESETN         188
+#define BCM281XX_PIN_SIM2_CLK           189
+#define BCM281XX_PIN_SIM2_DATA          190
+#define BCM281XX_PIN_SIM2_DET           191
+#define BCM281XX_PIN_SIM2_RESETN        192
+#define BCM281XX_PIN_SRI_C              193
+#define BCM281XX_PIN_SRI_D              194
+#define BCM281XX_PIN_SRI_E              195
+#define BCM281XX_PIN_SSP_EXTCLK         196
+#define BCM281XX_PIN_SSP0_CLK           197
+#define BCM281XX_PIN_SSP0_FS            198
+#define BCM281XX_PIN_SSP0_RXD           199
+#define BCM281XX_PIN_SSP0_TXD           200
+#define BCM281XX_PIN_SSP2_CLK           201
+#define BCM281XX_PIN_SSP2_FS_0          202
+#define BCM281XX_PIN_SSP2_FS_1          203
+#define BCM281XX_PIN_SSP2_FS_2          204
+#define BCM281XX_PIN_SSP2_FS_3          205
+#define BCM281XX_PIN_SSP2_RXD_0         206
+#define BCM281XX_PIN_SSP2_RXD_1         207
+#define BCM281XX_PIN_SSP2_TXD_0         208
+#define BCM281XX_PIN_SSP2_TXD_1         209
+#define BCM281XX_PIN_SSP3_CLK           210
+#define BCM281XX_PIN_SSP3_FS            211
+#define BCM281XX_PIN_SSP3_RXD           212
+#define BCM281XX_PIN_SSP3_TXD           213
+#define BCM281XX_PIN_SSP4_CLK           214
+#define BCM281XX_PIN_SSP4_FS            215
+#define BCM281XX_PIN_SSP4_RXD           216
+#define BCM281XX_PIN_SSP4_TXD           217
+#define BCM281XX_PIN_SSP5_CLK           218
+#define BCM281XX_PIN_SSP5_FS            219
+#define BCM281XX_PIN_SSP5_RXD           220
+#define BCM281XX_PIN_SSP5_TXD           221
+#define BCM281XX_PIN_SSP6_CLK           222
+#define BCM281XX_PIN_SSP6_FS            223
+#define BCM281XX_PIN_SSP6_RXD           224
+#define BCM281XX_PIN_SSP6_TXD           225
+#define BCM281XX_PIN_STAT_1             226
+#define BCM281XX_PIN_STAT_2             227
+#define BCM281XX_PIN_SYSCLKEN           228
+#define BCM281XX_PIN_TRACECLK           229
+#define BCM281XX_PIN_TRACEDT00          230
+#define BCM281XX_PIN_TRACEDT01          231
+#define BCM281XX_PIN_TRACEDT02          232
+#define BCM281XX_PIN_TRACEDT03          233
+#define BCM281XX_PIN_TRACEDT04          234
+#define BCM281XX_PIN_TRACEDT05          235
+#define BCM281XX_PIN_TRACEDT06          236
+#define BCM281XX_PIN_TRACEDT07          237
+#define BCM281XX_PIN_TRACEDT08          238
+#define BCM281XX_PIN_TRACEDT09          239
+#define BCM281XX_PIN_TRACEDT10          240
+#define BCM281XX_PIN_TRACEDT11          241
+#define BCM281XX_PIN_TRACEDT12          242
+#define BCM281XX_PIN_TRACEDT13          243
+#define BCM281XX_PIN_TRACEDT14          244
+#define BCM281XX_PIN_TRACEDT15          245
+#define BCM281XX_PIN_TXDATA3G0          246
+#define BCM281XX_PIN_TXPWRIND           247
+#define BCM281XX_PIN_UARTB1_UCTS        248
+#define BCM281XX_PIN_UARTB1_URTS        249
+#define BCM281XX_PIN_UARTB1_URXD        250
+#define BCM281XX_PIN_UARTB1_UTXD        251
+#define BCM281XX_PIN_UARTB2_URXD        252
+#define BCM281XX_PIN_UARTB2_UTXD        253
+#define BCM281XX_PIN_UARTB3_UCTS        254
+#define BCM281XX_PIN_UARTB3_URTS        255
+#define BCM281XX_PIN_UARTB3_URXD        256
+#define BCM281XX_PIN_UARTB3_UTXD        257
+#define BCM281XX_PIN_UARTB4_UCTS        258
+#define BCM281XX_PIN_UARTB4_URTS        259
+#define BCM281XX_PIN_UARTB4_URXD        260
+#define BCM281XX_PIN_UARTB4_UTXD        261
+#define BCM281XX_PIN_VC_CAM1_SCL        262
+#define BCM281XX_PIN_VC_CAM1_SDA        263
+#define BCM281XX_PIN_VC_CAM2_SCL        264
+#define BCM281XX_PIN_VC_CAM2_SDA        265
+#define BCM281XX_PIN_VC_CAM3_SCL        266
+#define BCM281XX_PIN_VC_CAM3_SDA        267
+#define BCM281XX_PIN_DESC(a, b, c) \
+        { .number = a, .name = b, .drv_data = &c##_pin }
+/*
+ * Pin description definition.  The order here must be the same as defined in
+ * the PADCTRLREG block in the RDB, since the pin number is used as an index
+ * into this array.
+ */
+static const struct pinctrl_pin_desc bcm281xx_pinctrl_pins[] = {
+        BCM281XX_PIN_DESC(BCM281XX_PIN_ADCSYNC, "adcsync", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_BAT_RM, "bat_rm", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_BSC1_SCL, "bsc1_scl", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_BSC1_SDA, "bsc1_sda", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_BSC2_SCL, "bsc2_scl", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_BSC2_SDA, "bsc2_sda", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLASSGPWR, "classgpwr", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLK_CX8, "clk_cx8", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLKOUT_0, "clkout_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLKOUT_1, "clkout_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLKOUT_2, "clkout_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLKOUT_3, "clkout_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLKREQ_IN_0, "clkreq_in_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CLKREQ_IN_1, "clkreq_in_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CWS_SYS_REQ1, "cws_sys_req1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CWS_SYS_REQ2, "cws_sys_req2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_CWS_SYS_REQ3, "cws_sys_req3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_DIGMIC1_CLK, "digmic1_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_DIGMIC1_DQ, "digmic1_dq", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_DIGMIC2_CLK, "digmic2_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_DIGMIC2_DQ, "digmic2_dq", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPEN13, "gpen13", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPEN14, "gpen14", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPEN15, "gpen15", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO00, "gpio00", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO01, "gpio01", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO02, "gpio02", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO03, "gpio03", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO04, "gpio04", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO05, "gpio05", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO06, "gpio06", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO07, "gpio07", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO08, "gpio08", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO09, "gpio09", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO10, "gpio10", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO11, "gpio11", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO12, "gpio12", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO13, "gpio13", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPIO14, "gpio14", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPS_PABLANK, "gps_pablank", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_GPS_TMARK, "gps_tmark", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_HDMI_SCL, "hdmi_scl", hdmi),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_HDMI_SDA, "hdmi_sda", hdmi),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_IC_DM, "ic_dm", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_IC_DP, "ic_dp", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_COL_IP_0, "kp_col_ip_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_COL_IP_1, "kp_col_ip_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_COL_IP_2, "kp_col_ip_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_COL_IP_3, "kp_col_ip_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_ROW_OP_0, "kp_row_op_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_ROW_OP_1, "kp_row_op_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_ROW_OP_2, "kp_row_op_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_KP_ROW_OP_3, "kp_row_op_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_0, "lcd_b_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_1, "lcd_b_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_2, "lcd_b_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_3, "lcd_b_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_4, "lcd_b_4", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_5, "lcd_b_5", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_6, "lcd_b_6", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_B_7, "lcd_b_7", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_0, "lcd_g_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_1, "lcd_g_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_2, "lcd_g_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_3, "lcd_g_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_4, "lcd_g_4", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_5, "lcd_g_5", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_6, "lcd_g_6", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_G_7, "lcd_g_7", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_HSYNC, "lcd_hsync", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_OE, "lcd_oe", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_PCLK, "lcd_pclk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_0, "lcd_r_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_1, "lcd_r_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_2, "lcd_r_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_3, "lcd_r_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_4, "lcd_r_4", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_5, "lcd_r_5", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_6, "lcd_r_6", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_R_7, "lcd_r_7", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_LCD_VSYNC, "lcd_vsync", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO0, "mdmgpio0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO1, "mdmgpio1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO2, "mdmgpio2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO3, "mdmgpio3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO4, "mdmgpio4", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO5, "mdmgpio5", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO6, "mdmgpio6", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO7, "mdmgpio7", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MDMGPIO8, "mdmgpio8", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_0, "mphi_data_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_1, "mphi_data_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_2, "mphi_data_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_3, "mphi_data_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_4, "mphi_data_4", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_5, "mphi_data_5", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_6, "mphi_data_6", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_7, "mphi_data_7", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_8, "mphi_data_8", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_9, "mphi_data_9", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_10, "mphi_data_10", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_11, "mphi_data_11", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_12, "mphi_data_12", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_13, "mphi_data_13", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_14, "mphi_data_14", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_DATA_15, "mphi_data_15", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_HA0, "mphi_ha0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_HAT0, "mphi_hat0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_HAT1, "mphi_hat1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_HCE0_N, "mphi_hce0_n", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_HCE1_N, "mphi_hce1_n", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_HRD_N, "mphi_hrd_n", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_HWR_N, "mphi_hwr_n", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_RUN0, "mphi_run0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MPHI_RUN1, "mphi_run1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MTX_SCAN_CLK, "mtx_scan_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_MTX_SCAN_DATA, "mtx_scan_data", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_0, "nand_ad_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_1, "nand_ad_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_2, "nand_ad_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_3, "nand_ad_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_4, "nand_ad_4", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_5, "nand_ad_5", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_6, "nand_ad_6", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_AD_7, "nand_ad_7", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_ALE, "nand_ale", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_CEN_0, "nand_cen_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_CEN_1, "nand_cen_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_CLE, "nand_cle", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_OEN, "nand_oen", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_RDY_0, "nand_rdy_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_RDY_1, "nand_rdy_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_WEN, "nand_wen", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_NAND_WP, "nand_wp", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_PC1, "pc1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_PC2, "pc2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_PMU_INT, "pmu_int", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_PMU_SCL, "pmu_scl", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_PMU_SDA, "pmu_sda", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RFST2G_MTSLOTEN3G, "rfst2g_mtsloten3g",
+                std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_RX_CTL, "rgmii_0_rx_ctl", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_RXC, "rgmii_0_rxc", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_RXD_0, "rgmii_0_rxd_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_RXD_1, "rgmii_0_rxd_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_RXD_2, "rgmii_0_rxd_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_RXD_3, "rgmii_0_rxd_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_TX_CTL, "rgmii_0_tx_ctl", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_TXC, "rgmii_0_txc", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_TXD_0, "rgmii_0_txd_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_TXD_1, "rgmii_0_txd_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_TXD_2, "rgmii_0_txd_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_0_TXD_3, "rgmii_0_txd_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_RX_CTL, "rgmii_1_rx_ctl", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_RXC, "rgmii_1_rxc", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_RXD_0, "rgmii_1_rxd_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_RXD_1, "rgmii_1_rxd_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_RXD_2, "rgmii_1_rxd_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_RXD_3, "rgmii_1_rxd_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_TX_CTL, "rgmii_1_tx_ctl", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_TXC, "rgmii_1_txc", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_TXD_0, "rgmii_1_txd_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_TXD_1, "rgmii_1_txd_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_TXD_2, "rgmii_1_txd_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_1_TXD_3, "rgmii_1_txd_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_GPIO_0, "rgmii_gpio_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_GPIO_1, "rgmii_gpio_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_GPIO_2, "rgmii_gpio_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RGMII_GPIO_3, "rgmii_gpio_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RTXDATA2G_TXDATA3G1,
+                "rtxdata2g_txdata3g1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RTXEN2G_TXDATA3G2, "rtxen2g_txdata3g2",
+                std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RXDATA3G0, "rxdata3g0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RXDATA3G1, "rxdata3g1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_RXDATA3G2, "rxdata3g2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO1_CLK, "sdio1_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO1_CMD, "sdio1_cmd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO1_DATA_0, "sdio1_data_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO1_DATA_1, "sdio1_data_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO1_DATA_2, "sdio1_data_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO1_DATA_3, "sdio1_data_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO4_CLK, "sdio4_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO4_CMD, "sdio4_cmd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO4_DATA_0, "sdio4_data_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO4_DATA_1, "sdio4_data_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO4_DATA_2, "sdio4_data_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SDIO4_DATA_3, "sdio4_data_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM_CLK, "sim_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM_DATA, "sim_data", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM_DET, "sim_det", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM_RESETN, "sim_resetn", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM2_CLK, "sim2_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM2_DATA, "sim2_data", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM2_DET, "sim2_det", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SIM2_RESETN, "sim2_resetn", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SRI_C, "sri_c", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SRI_D, "sri_d", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SRI_E, "sri_e", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP_EXTCLK, "ssp_extclk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP0_CLK, "ssp0_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP0_FS, "ssp0_fs", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP0_RXD, "ssp0_rxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP0_TXD, "ssp0_txd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_CLK, "ssp2_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_FS_0, "ssp2_fs_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_FS_1, "ssp2_fs_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_FS_2, "ssp2_fs_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_FS_3, "ssp2_fs_3", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_RXD_0, "ssp2_rxd_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_RXD_1, "ssp2_rxd_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_TXD_0, "ssp2_txd_0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP2_TXD_1, "ssp2_txd_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP3_CLK, "ssp3_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP3_FS, "ssp3_fs", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP3_RXD, "ssp3_rxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP3_TXD, "ssp3_txd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP4_CLK, "ssp4_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP4_FS, "ssp4_fs", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP4_RXD, "ssp4_rxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP4_TXD, "ssp4_txd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP5_CLK, "ssp5_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP5_FS, "ssp5_fs", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP5_RXD, "ssp5_rxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP5_TXD, "ssp5_txd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP6_CLK, "ssp6_clk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP6_FS, "ssp6_fs", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP6_RXD, "ssp6_rxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SSP6_TXD, "ssp6_txd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_STAT_1, "stat_1", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_STAT_2, "stat_2", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_SYSCLKEN, "sysclken", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACECLK, "traceclk", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT00, "tracedt00", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT01, "tracedt01", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT02, "tracedt02", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT03, "tracedt03", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT04, "tracedt04", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT05, "tracedt05", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT06, "tracedt06", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT07, "tracedt07", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT08, "tracedt08", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT09, "tracedt09", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT10, "tracedt10", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT11, "tracedt11", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT12, "tracedt12", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT13, "tracedt13", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT14, "tracedt14", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TRACEDT15, "tracedt15", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TXDATA3G0, "txdata3g0", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_TXPWRIND, "txpwrind", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB1_UCTS, "uartb1_ucts", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB1_URTS, "uartb1_urts", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB1_URXD, "uartb1_urxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB1_UTXD, "uartb1_utxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB2_URXD, "uartb2_urxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB2_UTXD, "uartb2_utxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB3_UCTS, "uartb3_ucts", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB3_URTS, "uartb3_urts", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB3_URXD, "uartb3_urxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB3_UTXD, "uartb3_utxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB4_UCTS, "uartb4_ucts", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB4_URTS, "uartb4_urts", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB4_URXD, "uartb4_urxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_UARTB4_UTXD, "uartb4_utxd", std),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_VC_CAM1_SCL, "vc_cam1_scl", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_VC_CAM1_SDA, "vc_cam1_sda", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_VC_CAM2_SCL, "vc_cam2_scl", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_VC_CAM2_SDA, "vc_cam2_sda", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_VC_CAM3_SCL, "vc_cam3_scl", i2c),
+        BCM281XX_PIN_DESC(BCM281XX_PIN_VC_CAM3_SDA, "vc_cam3_sda", i2c),
+};
+static const char * const bcm281xx_alt_groups[] = {
+        "adcsync",
+        "bat_rm",
+        "bsc1_scl",
+        "bsc1_sda",
+        "bsc2_scl",
+        "bsc2_sda",
+        "classgpwr",
+        "clk_cx8",
+        "clkout_0",
+        "clkout_1",
+        "clkout_2",
+        "clkout_3",
+        "clkreq_in_0",
+        "clkreq_in_1",
+        "cws_sys_req1",
+        "cws_sys_req2",
+        "cws_sys_req3",
+        "digmic1_clk",
+        "digmic1_dq",
+        "digmic2_clk",
+        "digmic2_dq",
+        "gpen13",
+        "gpen14",
+        "gpen15",
+        "gpio00",
+        "gpio01",
+        "gpio02",
+        "gpio03",
+        "gpio04",
+        "gpio05",
+        "gpio06",
+        "gpio07",
+        "gpio08",
+        "gpio09",
+        "gpio10",
+        "gpio11",
+        "gpio12",
+        "gpio13",
+        "gpio14",
+        "gps_pablank",
+        "gps_tmark",
+        "hdmi_scl",
+        "hdmi_sda",
+        "ic_dm",
+        "ic_dp",
+        "kp_col_ip_0",
+        "kp_col_ip_1",
+        "kp_col_ip_2",
+        "kp_col_ip_3",
+        "kp_row_op_0",
+        "kp_row_op_1",
+        "kp_row_op_2",
+        "kp_row_op_3",
+        "lcd_b_0",
+        "lcd_b_1",
+        "lcd_b_2",
+        "lcd_b_3",
+        "lcd_b_4",
+        "lcd_b_5",
+        "lcd_b_6",
+        "lcd_b_7",
+        "lcd_g_0",
+        "lcd_g_1",
+        "lcd_g_2",
+        "lcd_g_3",
+        "lcd_g_4",
+        "lcd_g_5",
+        "lcd_g_6",
+        "lcd_g_7",
+        "lcd_hsync",
+        "lcd_oe",
+        "lcd_pclk",
+        "lcd_r_0",
+        "lcd_r_1",
+        "lcd_r_2",
+        "lcd_r_3",
+        "lcd_r_4",
+        "lcd_r_5",
+        "lcd_r_6",
+        "lcd_r_7",
+        "lcd_vsync",
+        "mdmgpio0",
+        "mdmgpio1",
+        "mdmgpio2",
+        "mdmgpio3",
+        "mdmgpio4",
+        "mdmgpio5",
+        "mdmgpio6",
+        "mdmgpio7",
+        "mdmgpio8",
+        "mphi_data_0",
+        "mphi_data_1",
+        "mphi_data_2",
+        "mphi_data_3",
+        "mphi_data_4",
+        "mphi_data_5",
+        "mphi_data_6",
+        "mphi_data_7",
+        "mphi_data_8",
+        "mphi_data_9",
+        "mphi_data_10",
+        "mphi_data_11",
+        "mphi_data_12",
+        "mphi_data_13",
+        "mphi_data_14",
+        "mphi_data_15",
+        "mphi_ha0",
+        "mphi_hat0",
+        "mphi_hat1",
+        "mphi_hce0_n",
+        "mphi_hce1_n",
+        "mphi_hrd_n",
+        "mphi_hwr_n",
+        "mphi_run0",
+        "mphi_run1",
+        "mtx_scan_clk",
+        "mtx_scan_data",
+        "nand_ad_0",
+        "nand_ad_1",
+        "nand_ad_2",
+        "nand_ad_3",
+        "nand_ad_4",
+        "nand_ad_5",
+        "nand_ad_6",
+        "nand_ad_7",
+        "nand_ale",
+        "nand_cen_0",
+        "nand_cen_1",
+        "nand_cle",
+        "nand_oen",
+        "nand_rdy_0",
+        "nand_rdy_1",
+        "nand_wen",
+        "nand_wp",
+        "pc1",
+        "pc2",
+        "pmu_int",
+        "pmu_scl",
+        "pmu_sda",
+        "rfst2g_mtsloten3g",
+        "rgmii_0_rx_ctl",
+        "rgmii_0_rxc",
+        "rgmii_0_rxd_0",
+        "rgmii_0_rxd_1",
+        "rgmii_0_rxd_2",
+        "rgmii_0_rxd_3",
+        "rgmii_0_tx_ctl",
+        "rgmii_0_txc",
+        "rgmii_0_txd_0",
+        "rgmii_0_txd_1",
+        "rgmii_0_txd_2",
+        "rgmii_0_txd_3",
+        "rgmii_1_rx_ctl",
+        "rgmii_1_rxc",
+        "rgmii_1_rxd_0",
+        "rgmii_1_rxd_1",
+        "rgmii_1_rxd_2",
+        "rgmii_1_rxd_3",
+        "rgmii_1_tx_ctl",
+        "rgmii_1_txc",
+        "rgmii_1_txd_0",
+        "rgmii_1_txd_1",
+        "rgmii_1_txd_2",
+        "rgmii_1_txd_3",
+        "rgmii_gpio_0",
+        "rgmii_gpio_1",
+        "rgmii_gpio_2",
+        "rgmii_gpio_3",
+        "rtxdata2g_txdata3g1",
+        "rtxen2g_txdata3g2",
+        "rxdata3g0",
+        "rxdata3g1",
+        "rxdata3g2",
+        "sdio1_clk",
+        "sdio1_cmd",
+        "sdio1_data_0",
+        "sdio1_data_1",
+        "sdio1_data_2",
+        "sdio1_data_3",
+        "sdio4_clk",
+        "sdio4_cmd",
+        "sdio4_data_0",
+        "sdio4_data_1",
+        "sdio4_data_2",
+        "sdio4_data_3",
+        "sim_clk",
+        "sim_data",
+        "sim_det",
+        "sim_resetn",
+        "sim2_clk",
+        "sim2_data",
+        "sim2_det",
+        "sim2_resetn",
+        "sri_c",
+        "sri_d",
+        "sri_e",
+        "ssp_extclk",
+        "ssp0_clk",
+        "ssp0_fs",
+        "ssp0_rxd",
+        "ssp0_txd",
+        "ssp2_clk",
+        "ssp2_fs_0",
+        "ssp2_fs_1",
+        "ssp2_fs_2",
+        "ssp2_fs_3",
+        "ssp2_rxd_0",
+        "ssp2_rxd_1",
+        "ssp2_txd_0",
+        "ssp2_txd_1",
+        "ssp3_clk",
+        "ssp3_fs",
+        "ssp3_rxd",
+        "ssp3_txd",
+        "ssp4_clk",
+        "ssp4_fs",
+        "ssp4_rxd",
+        "ssp4_txd",
+        "ssp5_clk",
+        "ssp5_fs",
+        "ssp5_rxd",
+        "ssp5_txd",
+        "ssp6_clk",
+        "ssp6_fs",
+        "ssp6_rxd",
+        "ssp6_txd",
+        "stat_1",
+        "stat_2",
+        "sysclken",
+        "traceclk",
+        "tracedt00",
+        "tracedt01",
+        "tracedt02",
+        "tracedt03",
+        "tracedt04",
+        "tracedt05",
+        "tracedt06",
+        "tracedt07",
+        "tracedt08",
+        "tracedt09",
+        "tracedt10",
+        "tracedt11",
+        "tracedt12",
+        "tracedt13",
+        "tracedt14",
+        "tracedt15",
+        "txdata3g0",
+        "txpwrind",
+        "uartb1_ucts",
+        "uartb1_urts",
+        "uartb1_urxd",
+        "uartb1_utxd",
+        "uartb2_urxd",
+        "uartb2_utxd",
+        "uartb3_ucts",
+        "uartb3_urts",
+        "uartb3_urxd",
+        "uartb3_utxd",
+        "uartb4_ucts",
+        "uartb4_urts",
+        "uartb4_urxd",
+        "uartb4_utxd",
+        "vc_cam1_scl",
+        "vc_cam1_sda",
+        "vc_cam2_scl",
+        "vc_cam2_sda",
+        "vc_cam3_scl",
+        "vc_cam3_sda",
+};
+/* Every pin can implement all ALT1-ALT4 functions */
+#define BCM281XX_PIN_FUNCTION(fcn_name)                 \
+{                                                       \
+        .name = #fcn_name,                              \
+        .groups = bcm281xx_alt_groups,                  \
+        .ngroups = ARRAY_SIZE(bcm281xx_alt_groups),     \
+}
+static const struct bcm281xx_pin_function bcm281xx_functions[] = {
+        BCM281XX_PIN_FUNCTION(alt1),
+        BCM281XX_PIN_FUNCTION(alt2),
+        BCM281XX_PIN_FUNCTION(alt3),
+        BCM281XX_PIN_FUNCTION(alt4),
+};
+static struct bcm281xx_pinctrl_data bcm281xx_pinctrl = {
+        .pins = bcm281xx_pinctrl_pins,
+        .npins = ARRAY_SIZE(bcm281xx_pinctrl_pins),
+        .functions = bcm281xx_functions,
+        .nfunctions = ARRAY_SIZE(bcm281xx_functions),
+};
+static inline enum bcm281xx_pin_type pin_type_get(struct pinctrl_dev *pctldev,
+                                                  unsigned pin)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        if (pin >= pdata->npins)
+                return BCM281XX_PIN_TYPE_UNKNOWN;
+        return *(enum bcm281xx_pin_type *)(pdata->pins[pin].drv_data);
+}
+#define BCM281XX_PIN_SHIFT(type, param) \
+        (BCM281XX_ ## type ## _PIN_REG_ ## param ## _SHIFT)
+#define BCM281XX_PIN_MASK(type, param) \
+        (BCM281XX_ ## type ## _PIN_REG_ ## param ## _MASK)
+/*
+ * This helper function is used to build up the value and mask used to write to
+ * a pin register, but does not actually write to the register.
+ */
+static inline void bcm281xx_pin_update(u32 *reg_val, u32 *reg_mask,
+                                       u32 param_val, u32 param_shift,
+                                       u32 param_mask)
+{
+        *reg_val &= ~param_mask;
+        *reg_val |= (param_val << param_shift) & param_mask;
+        *reg_mask |= param_mask;
+}
+static struct regmap_config bcm281xx_pinctrl_regmap_config = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+        .max_register = BCM281XX_PIN_VC_CAM3_SDA,
+};
+static int bcm281xx_pinctrl_get_groups_count(struct pinctrl_dev *pctldev)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        return pdata->npins;
+}
+static const char *bcm281xx_pinctrl_get_group_name(struct pinctrl_dev *pctldev,
+                                                   unsigned group)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        return pdata->pins[group].name;
+}
+static int bcm281xx_pinctrl_get_group_pins(struct pinctrl_dev *pctldev,
+                                           unsigned group,
+                                           const unsigned **pins,
+                                           unsigned *num_pins)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        *pins = &pdata->pins[group].number;
+        *num_pins = 1;
+        return 0;
+}
+static void bcm281xx_pinctrl_pin_dbg_show(struct pinctrl_dev *pctldev,
+                                          struct seq_file *s,
+                                          unsigned offset)
+{
+        seq_printf(s, " %s", dev_name(pctldev->dev));
+}
+static struct pinctrl_ops bcm281xx_pinctrl_ops = {
+        .get_groups_count = bcm281xx_pinctrl_get_groups_count,
+        .get_group_name = bcm281xx_pinctrl_get_group_name,
+        .get_group_pins = bcm281xx_pinctrl_get_group_pins,
+        .pin_dbg_show = bcm281xx_pinctrl_pin_dbg_show,
+        .dt_node_to_map = pinconf_generic_dt_node_to_map_pin,
+        .dt_free_map = pinctrl_utils_dt_free_map,
+};
+static int bcm281xx_pinctrl_get_fcns_count(struct pinctrl_dev *pctldev)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        return pdata->nfunctions;
+}
+static const char *bcm281xx_pinctrl_get_fcn_name(struct pinctrl_dev *pctldev,
+                                                 unsigned function)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        return pdata->functions[function].name;
+}
+static int bcm281xx_pinctrl_get_fcn_groups(struct pinctrl_dev *pctldev,
+                                           unsigned function,
+                                           const char * const **groups,
+                                           unsigned * const num_groups)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        *groups = pdata->functions[function].groups;
+        *num_groups = pdata->functions[function].ngroups;
+        return 0;
+}
+static int bcm281xx_pinmux_enable(struct pinctrl_dev *pctldev,
+                                  unsigned function,
+                                  unsigned group)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        const struct bcm281xx_pin_function *f = &pdata->functions[function];
+        u32 offset = 4 * pdata->pins[group].number;
+        int rc = 0;
+        dev_dbg(pctldev->dev,
+                "%s(): Enable function %s (%d) of pin %s (%d) @offset 0x%x.\n",
+                __func__, f->name, function, pdata->pins[group].name,
+                pdata->pins[group].number, offset);
+        rc = regmap_update_bits(pdata->regmap, offset,
+                BCM281XX_PIN_REG_F_SEL_MASK,
+                function << BCM281XX_PIN_REG_F_SEL_SHIFT);
+        if (rc)
+                dev_err(pctldev->dev,
+                        "Error updating register for pin %s (%d).\n",
+                        pdata->pins[group].name, pdata->pins[group].number);
+        return rc;
+}
+static struct pinmux_ops bcm281xx_pinctrl_pinmux_ops = {
+        .get_functions_count = bcm281xx_pinctrl_get_fcns_count,
+        .get_function_name = bcm281xx_pinctrl_get_fcn_name,
+        .get_function_groups = bcm281xx_pinctrl_get_fcn_groups,
+        .enable = bcm281xx_pinmux_enable,
+};
+static int bcm281xx_pinctrl_pin_config_get(struct pinctrl_dev *pctldev,
+                                           unsigned pin,
+                                           unsigned long *config)
+{
+        return -ENOTSUPP;
+}
+/* Goes through the configs and update register val/mask */
+static int bcm281xx_std_pin_update(struct pinctrl_dev *pctldev,
+                                   unsigned pin,
+                                   unsigned long *configs,
+                                   unsigned num_configs,
+                                   u32 *val,
+                                   u32 *mask)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        int i;
+        enum pin_config_param param;
+        u16 arg;
+        for (i = 0; i < num_configs; i++) {
+                param = pinconf_to_config_param(configs[i]);
+                arg = pinconf_to_config_argument(configs[i]);
+                switch (param) {
+                case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+                        arg = (arg >= 1 ? 1 : 0);
+                        bcm281xx_pin_update(val, mask, arg,
+                                BCM281XX_PIN_SHIFT(STD, HYST),
+                                BCM281XX_PIN_MASK(STD, HYST));
+                        break;
+                /*
+                 * The pin bias can only be one of pull-up, pull-down, or
+                 * disable.  The user does not need to specify a value for the
+                 * property, and the default value from pinconf-generic is
+                 * ignored.
+                 */
+                case PIN_CONFIG_BIAS_DISABLE:
+                        bcm281xx_pin_update(val, mask, 0,
+                                BCM281XX_PIN_SHIFT(STD, PULL_UP),
+                                BCM281XX_PIN_MASK(STD, PULL_UP));
+                        bcm281xx_pin_update(val, mask, 0,
+                                BCM281XX_PIN_SHIFT(STD, PULL_DN),
+                                BCM281XX_PIN_MASK(STD, PULL_DN));
+                        break;
+                case PIN_CONFIG_BIAS_PULL_UP:
+                        bcm281xx_pin_update(val, mask, 1,
+                                BCM281XX_PIN_SHIFT(STD, PULL_UP),
+                                BCM281XX_PIN_MASK(STD, PULL_UP));
+                        bcm281xx_pin_update(val, mask, 0,
+                                BCM281XX_PIN_SHIFT(STD, PULL_DN),
+                                BCM281XX_PIN_MASK(STD, PULL_DN));
+                        break;
+                case PIN_CONFIG_BIAS_PULL_DOWN:
+                        bcm281xx_pin_update(val, mask, 0,
+                                BCM281XX_PIN_SHIFT(STD, PULL_UP),
+                                BCM281XX_PIN_MASK(STD, PULL_UP));
+                        bcm281xx_pin_update(val, mask, 1,
+                                BCM281XX_PIN_SHIFT(STD, PULL_DN),
+                                BCM281XX_PIN_MASK(STD, PULL_DN));
+                        break;
+                case PIN_CONFIG_SLEW_RATE:
+                        arg = (arg >= 1 ? 1 : 0);
+                        bcm281xx_pin_update(val, mask, arg,
+                                BCM281XX_PIN_SHIFT(STD, SLEW),
+                                BCM281XX_PIN_MASK(STD, SLEW));
+                        break;
+                case PIN_CONFIG_INPUT_ENABLE:
+                        /* inversed since register is for input _disable_ */
+                        arg = (arg >= 1 ? 0 : 1);
+                        bcm281xx_pin_update(val, mask, arg,
+                                BCM281XX_PIN_SHIFT(STD, INPUT_DIS),
+                                BCM281XX_PIN_MASK(STD, INPUT_DIS));
+                        break;
+                case PIN_CONFIG_DRIVE_STRENGTH:
+                        /* Valid range is 2-16 mA, even numbers only */
+                        if ((arg < 2) || (arg > 16) || (arg % 2)) {
+                                dev_err(pctldev->dev,
+                                        "Invalid Drive Strength value (%d) for "
+                                        "pin %s (%d). Valid values are "
+                                        "(2..16) mA, even numbers only.\n",
+                                        arg, pdata->pins[pin].name, pin);
+                                return -EINVAL;
+                        }
+                        bcm281xx_pin_update(val, mask, (arg/2)-1,
+                                BCM281XX_PIN_SHIFT(STD, DRV_STR),
+                                BCM281XX_PIN_MASK(STD, DRV_STR));
+                        break;
+                default:
+                        dev_err(pctldev->dev,
+                                "Unrecognized pin config %d for pin %s (%d).\n",
+                                param, pdata->pins[pin].name, pin);
+                        return -EINVAL;
+                } /* switch config */
+        } /* for each config */
+        return 0;
+}
+/*
+ * The pull-up strength for an I2C pin is represented by bits 4-6 in the
+ * register with the following mapping:
+ *   0b000: No pull-up
+ *   0b001: 1200 Ohm
+ *   0b010: 1800 Ohm
+ *   0b011: 720 Ohm
+ *   0b100: 2700 Ohm
+ *   0b101: 831 Ohm
+ *   0b110: 1080 Ohm
+ *   0b111: 568 Ohm
+ * This array maps pull-up strength in Ohms to register values (1+index).
+ */
+static const u16 bcm281xx_pullup_map[] = {
+        1200, 1800, 720, 2700, 831, 1080, 568
+};
+/* Goes through the configs and update register val/mask */
+static int bcm281xx_i2c_pin_update(struct pinctrl_dev *pctldev,
+                                   unsigned pin,
+                                   unsigned long *configs,
+                                   unsigned num_configs,
+                                   u32 *val,
+                                   u32 *mask)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        int i, j;
+        enum pin_config_param param;
+        u16 arg;
+        for (i = 0; i < num_configs; i++) {
+                param = pinconf_to_config_param(configs[i]);
+                arg = pinconf_to_config_argument(configs[i]);
+                switch (param) {
+                case PIN_CONFIG_BIAS_PULL_UP:
+                        for (j = 0; j < ARRAY_SIZE(bcm281xx_pullup_map); j++)
+                                if (bcm281xx_pullup_map[j] == arg)
+                                        break;
+                        if (j == ARRAY_SIZE(bcm281xx_pullup_map)) {
+                                dev_err(pctldev->dev,
+                                        "Invalid pull-up value (%d) for pin %s "
+                                        "(%d). Valid values are 568, 720, 831, "
+                                        "1080, 1200, 1800, 2700 Ohms.\n",
+                                        arg, pdata->pins[pin].name, pin);
+                                return -EINVAL;
+                        }
+                        bcm281xx_pin_update(val, mask, j+1,
+                                BCM281XX_PIN_SHIFT(I2C, PULL_UP_STR),
+                                BCM281XX_PIN_MASK(I2C, PULL_UP_STR));
+                        break;
+                case PIN_CONFIG_BIAS_DISABLE:
+                        bcm281xx_pin_update(val, mask, 0,
+                                BCM281XX_PIN_SHIFT(I2C, PULL_UP_STR),
+                                BCM281XX_PIN_MASK(I2C, PULL_UP_STR));
+                        break;
+                case PIN_CONFIG_SLEW_RATE:
+                        arg = (arg >= 1 ? 1 : 0);
+                        bcm281xx_pin_update(val, mask, arg,
+                                BCM281XX_PIN_SHIFT(I2C, SLEW),
+                                BCM281XX_PIN_MASK(I2C, SLEW));
+                        break;
+                case PIN_CONFIG_INPUT_ENABLE:
+                        /* inversed since register is for input _disable_ */
+                        arg = (arg >= 1 ? 0 : 1);
+                        bcm281xx_pin_update(val, mask, arg,
+                                BCM281XX_PIN_SHIFT(I2C, INPUT_DIS),
+                                BCM281XX_PIN_MASK(I2C, INPUT_DIS));
+                        break;
+                default:
+                        dev_err(pctldev->dev,
+                                "Unrecognized pin config %d for pin %s (%d).\n",
+                                param, pdata->pins[pin].name, pin);
+                        return -EINVAL;
+                } /* switch config */
+        } /* for each config */
+        return 0;
+}
+/* Goes through the configs and update register val/mask */
+static int bcm281xx_hdmi_pin_update(struct pinctrl_dev *pctldev,
+                                    unsigned pin,
+                                    unsigned long *configs,
+                                    unsigned num_configs,
+                                    u32 *val,
+                                    u32 *mask)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        int i;
+        enum pin_config_param param;
+        u16 arg;
+        for (i = 0; i < num_configs; i++) {
+                param = pinconf_to_config_param(configs[i]);
+                arg = pinconf_to_config_argument(configs[i]);
+                switch (param) {
+                case PIN_CONFIG_SLEW_RATE:
+                        arg = (arg >= 1 ? 1 : 0);
+                        bcm281xx_pin_update(val, mask, arg,
+                                BCM281XX_PIN_SHIFT(HDMI, MODE),
+                                BCM281XX_PIN_MASK(HDMI, MODE));
+                        break;
+                case PIN_CONFIG_INPUT_ENABLE:
+                        /* inversed since register is for input _disable_ */
+                        arg = (arg >= 1 ? 0 : 1);
+                        bcm281xx_pin_update(val, mask, arg,
+                                BCM281XX_PIN_SHIFT(HDMI, INPUT_DIS),
+                                BCM281XX_PIN_MASK(HDMI, INPUT_DIS));
+                        break;
+                default:
+                        dev_err(pctldev->dev,
+                                "Unrecognized pin config %d for pin %s (%d).\n",
+                                param, pdata->pins[pin].name, pin);
+                        return -EINVAL;
+                } /* switch config */
+        } /* for each config */
+        return 0;
+}
+static int bcm281xx_pinctrl_pin_config_set(struct pinctrl_dev *pctldev,
+                                           unsigned pin,
+                                           unsigned long *configs,
+                                           unsigned num_configs)
+{
+        struct bcm281xx_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
+        enum bcm281xx_pin_type pin_type;
+        u32 offset = 4 * pin;
+        u32 cfg_val, cfg_mask;
+        int rc;
+        cfg_val = 0;
+        cfg_mask = 0;
+        pin_type = pin_type_get(pctldev, pin);
+        /* Different pins have different configuration options */
+        switch (pin_type) {
+        case BCM281XX_PIN_TYPE_STD:
+                rc = bcm281xx_std_pin_update(pctldev, pin, configs,
+                        num_configs, &cfg_val, &cfg_mask);
+                break;
+        case BCM281XX_PIN_TYPE_I2C:
+                rc = bcm281xx_i2c_pin_update(pctldev, pin, configs,
+                        num_configs, &cfg_val, &cfg_mask);
+                break;
+        case BCM281XX_PIN_TYPE_HDMI:
+                rc = bcm281xx_hdmi_pin_update(pctldev, pin, configs,
+                        num_configs, &cfg_val, &cfg_mask);
+                break;
+        default:
+                dev_err(pctldev->dev, "Unknown pin type for pin %s (%d).\n",
+                        pdata->pins[pin].name, pin);
+                return -EINVAL;
+        } /* switch pin type */
+        if (rc)
+                return rc;
+        dev_dbg(pctldev->dev,
+                "%s(): Set pin %s (%d) with config 0x%x, mask 0x%x\n",
+                __func__, pdata->pins[pin].name, pin, cfg_val, cfg_mask);
+        rc = regmap_update_bits(pdata->regmap, offset, cfg_mask, cfg_val);
+        if (rc) {
+                dev_err(pctldev->dev,
+                        "Error updating register for pin %s (%d).\n",
+                        pdata->pins[pin].name, pin);
+                return rc;
+        }
+        return 0;
+}
+static struct pinconf_ops bcm281xx_pinctrl_pinconf_ops = {
+        .pin_config_get = bcm281xx_pinctrl_pin_config_get,
+        .pin_config_set = bcm281xx_pinctrl_pin_config_set,
+};
+static struct pinctrl_desc bcm281xx_pinctrl_desc = {
+        /* name, pins, npins members initialized in probe function */
+        .pctlops = &bcm281xx_pinctrl_ops,
+        .pmxops = &bcm281xx_pinctrl_pinmux_ops,
+        .confops = &bcm281xx_pinctrl_pinconf_ops,
+        .owner = THIS_MODULE,
+};
+int __init bcm281xx_pinctrl_probe(struct platform_device *pdev)
+{
+        struct bcm281xx_pinctrl_data *pdata = &bcm281xx_pinctrl;
+        struct resource *res;
+        struct pinctrl_dev *pctl;
+        /* So far We can assume there is only 1 bank of registers */
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "Missing MEM resource\n");
+                return -ENODEV;
+        }
+        pdata->reg_base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(pdata->reg_base)) {
+                dev_err(&pdev->dev, "Failed to ioremap MEM resource\n");
+                return -ENODEV;
+        }
+        /* Initialize the dynamic part of pinctrl_desc */
+        pdata->regmap = devm_regmap_init_mmio(&pdev->dev, pdata->reg_base,
+                &bcm281xx_pinctrl_regmap_config);
+        if (IS_ERR(pdata->regmap)) {
+                dev_err(&pdev->dev, "Regmap MMIO init failed.\n");
+                return -ENODEV;
+        }
+        bcm281xx_pinctrl_desc.name = dev_name(&pdev->dev);
+        bcm281xx_pinctrl_desc.pins = bcm281xx_pinctrl.pins;
+        bcm281xx_pinctrl_desc.npins = bcm281xx_pinctrl.npins;
+        pctl = pinctrl_register(&bcm281xx_pinctrl_desc,
+                                &pdev->dev,
+                                pdata);
+        if (!pctl) {
+                dev_err(&pdev->dev, "Failed to register pinctrl\n");
+                return -ENODEV;
+        }
+        platform_set_drvdata(pdev, pdata);
+        return 0;
+}
+static struct of_device_id bcm281xx_pinctrl_of_match[] = {
+        { .compatible = "brcm,bcm11351-pinctrl", },
+        { },
+};
+static struct platform_driver bcm281xx_pinctrl_driver = {
+        .driver = {
+                .name = "bcm281xx-pinctrl",
+                .owner = THIS_MODULE,
+                .of_match_table = bcm281xx_pinctrl_of_match,
+        },
+};
+module_platform_driver_probe(bcm281xx_pinctrl_driver, bcm281xx_pinctrl_probe);
+MODULE_AUTHOR("Broadcom Corporation <bcm-kernel-feedback-list@broadcom.com>");
+MODULE_AUTHOR("Sherman Yin <syin@broadcom.com>");
+MODULE_DESCRIPTION("Broadcom BCM281xx pinctrl driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/pinctrl/pinctrl-capri.c b/drivers/pinctrl/pinctrl-capri.c
deleted file mode 100644
index eb2500212147..000000000000
--- a/drivers/pinctrl/pinctrl-capri.c
+++ /dev/null
@@ -1,1454 +0,0 @@
-/*
- * Copyright (C) 2013 Broadcom Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation version 2.
- *
- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
- * kind, whether express or implied; without even the implied warranty
- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-#include <linux/err.h>
-#include <linux/io.h>
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/platform_device.h>
-#include <linux/pinctrl/pinctrl.h>
-#include <linux/pinctrl/pinmux.h>
-#include <linux/pinctrl/pinconf.h>
-#include <linux/pinctrl/pinconf-generic.h>
-#include <linux/regmap.h>
-#include <linux/slab.h>
-#include "core.h"
-#include "pinctrl-utils.h"
-/* Capri Pin Control Registers Definitions */
-/* Function Select bits are the same for all pin control registers */
-#define CAPRI_PIN_REG_F_SEL_MASK                0x0700
-#define CAPRI_PIN_REG_F_SEL_SHIFT               8
-/* Standard pin register */
-#define CAPRI_STD_PIN_REG_DRV_STR_MASK          0x0007
-#define CAPRI_STD_PIN_REG_DRV_STR_SHIFT         0
-#define CAPRI_STD_PIN_REG_INPUT_DIS_MASK        0x0008
-#define CAPRI_STD_PIN_REG_INPUT_DIS_SHIFT       3
-#define CAPRI_STD_PIN_REG_SLEW_MASK             0x0010
-#define CAPRI_STD_PIN_REG_SLEW_SHIFT            4
-#define CAPRI_STD_PIN_REG_PULL_UP_MASK          0x0020
-#define CAPRI_STD_PIN_REG_PULL_UP_SHIFT         5
-#define CAPRI_STD_PIN_REG_PULL_DN_MASK          0x0040
-#define CAPRI_STD_PIN_REG_PULL_DN_SHIFT         6
-#define CAPRI_STD_PIN_REG_HYST_MASK             0x0080
-#define CAPRI_STD_PIN_REG_HYST_SHIFT            7
-/* I2C pin register */
-#define CAPRI_I2C_PIN_REG_INPUT_DIS_MASK        0x0004
-#define CAPRI_I2C_PIN_REG_INPUT_DIS_SHIFT       2
-#define CAPRI_I2C_PIN_REG_SLEW_MASK             0x0008
-#define CAPRI_I2C_PIN_REG_SLEW_SHIFT            3
-#define CAPRI_I2C_PIN_REG_PULL_UP_STR_MASK      0x0070
-#define CAPRI_I2C_PIN_REG_PULL_UP_STR_SHIFT     4
-/* HDMI pin register */
-#define CAPRI_HDMI_PIN_REG_INPUT_DIS_MASK       0x0008
-#define CAPRI_HDMI_PIN_REG_INPUT_DIS_SHIFT      3
-#define CAPRI_HDMI_PIN_REG_MODE_MASK            0x0010
-#define CAPRI_HDMI_PIN_REG_MODE_SHIFT           4
-/**
- * capri_pin_type - types of pin register
- */
-enum capri_pin_type {
-        CAPRI_PIN_TYPE_UNKNOWN = 0,
-        CAPRI_PIN_TYPE_STD,
-        CAPRI_PIN_TYPE_I2C,
-        CAPRI_PIN_TYPE_HDMI,
-};
-static enum capri_pin_type std_pin = CAPRI_PIN_TYPE_STD;
-static enum capri_pin_type i2c_pin = CAPRI_PIN_TYPE_I2C;
-static enum capri_pin_type hdmi_pin = CAPRI_PIN_TYPE_HDMI;
-/**
- * capri_pin_function- define pin function
- */
-struct capri_pin_function {
-        const char *name;
-        const char * const *groups;
-        const unsigned ngroups;
-};
-/**
- * capri_pinctrl_data - Broadcom-specific pinctrl data
- * @reg_base - base of pinctrl registers
- */
-struct capri_pinctrl_data {
-        void __iomem *reg_base;
-        /* List of all pins */
-        const struct pinctrl_pin_desc *pins;
-        const unsigned npins;
-        const struct capri_pin_function *functions;
-        const unsigned nfunctions;
-        struct regmap *regmap;
-};
-/*
- * Pin number definition.  The order here must be the same as defined in the
- * PADCTRLREG block in the RDB.
- */
-#define CAPRI_PIN_ADCSYNC               0
-#define CAPRI_PIN_BAT_RM                1
-#define CAPRI_PIN_BSC1_SCL              2
-#define CAPRI_PIN_BSC1_SDA              3
-#define CAPRI_PIN_BSC2_SCL              4
-#define CAPRI_PIN_BSC2_SDA              5
-#define CAPRI_PIN_CLASSGPWR             6
-#define CAPRI_PIN_CLK_CX8               7
-#define CAPRI_PIN_CLKOUT_0              8
-#define CAPRI_PIN_CLKOUT_1              9
-#define CAPRI_PIN_CLKOUT_2              10
-#define CAPRI_PIN_CLKOUT_3              11
-#define CAPRI_PIN_CLKREQ_IN_0           12
-#define CAPRI_PIN_CLKREQ_IN_1           13
-#define CAPRI_PIN_CWS_SYS_REQ1          14
-#define CAPRI_PIN_CWS_SYS_REQ2          15
-#define CAPRI_PIN_CWS_SYS_REQ3          16
-#define CAPRI_PIN_DIGMIC1_CLK           17
-#define CAPRI_PIN_DIGMIC1_DQ            18
-#define CAPRI_PIN_DIGMIC2_CLK           19
-#define CAPRI_PIN_DIGMIC2_DQ            20
-#define CAPRI_PIN_GPEN13                21
-#define CAPRI_PIN_GPEN14                22
-#define CAPRI_PIN_GPEN15                23
-#define CAPRI_PIN_GPIO00                24
-#define CAPRI_PIN_GPIO01                25
-#define CAPRI_PIN_GPIO02                26
-#define CAPRI_PIN_GPIO03                27
-#define CAPRI_PIN_GPIO04                28
-#define CAPRI_PIN_GPIO05                29
-#define CAPRI_PIN_GPIO06                30
-#define CAPRI_PIN_GPIO07                31
-#define CAPRI_PIN_GPIO08                32
-#define CAPRI_PIN_GPIO09                33
-#define CAPRI_PIN_GPIO10                34
-#define CAPRI_PIN_GPIO11                35
-#define CAPRI_PIN_GPIO12                36
-#define CAPRI_PIN_GPIO13                37
-#define CAPRI_PIN_GPIO14                38
-#define CAPRI_PIN_GPS_PABLANK           39
-#define CAPRI_PIN_GPS_TMARK             40
-#define CAPRI_PIN_HDMI_SCL              41
-#define CAPRI_PIN_HDMI_SDA              42
-#define CAPRI_PIN_IC_DM                 43
-#define CAPRI_PIN_IC_DP                 44
-#define CAPRI_PIN_KP_COL_IP_0           45
-#define CAPRI_PIN_KP_COL_IP_1           46
-#define CAPRI_PIN_KP_COL_IP_2           47
-#define CAPRI_PIN_KP_COL_IP_3           48
-#define CAPRI_PIN_KP_ROW_OP_0           49
-#define CAPRI_PIN_KP_ROW_OP_1           50
-#define CAPRI_PIN_KP_ROW_OP_2           51
-#define CAPRI_PIN_KP_ROW_OP_3           52
-#define CAPRI_PIN_LCD_B_0               53
-#define CAPRI_PIN_LCD_B_1               54
-#define CAPRI_PIN_LCD_B_2               55
-#define CAPRI_PIN_LCD_B_3               56
-#define CAPRI_PIN_LCD_B_4               57
-#define CAPRI_PIN_LCD_B_5               58
-#define CAPRI_PIN_LCD_B_6               59
-#define CAPRI_PIN_LCD_B_7               60
-#define CAPRI_PIN_LCD_G_0               61
-#define CAPRI_PIN_LCD_G_1               62
-#define CAPRI_PIN_LCD_G_2               63
-#define CAPRI_PIN_LCD_G_3               64
-#define CAPRI_PIN_LCD_G_4               65
-#define CAPRI_PIN_LCD_G_5               66
-#define CAPRI_PIN_LCD_G_6               67
-#define CAPRI_PIN_LCD_G_7               68
-#define CAPRI_PIN_LCD_HSYNC             69
-#define CAPRI_PIN_LCD_OE                70
-#define CAPRI_PIN_LCD_PCLK              71
-#define CAPRI_PIN_LCD_R_0               72
-#define CAPRI_PIN_LCD_R_1               73
-#define CAPRI_PIN_LCD_R_2               74
-#define CAPRI_PIN_LCD_R_3               75
-#define CAPRI_PIN_LCD_R_4               76
-#define CAPRI_PIN_LCD_R_5               77
-#define CAPRI_PIN_LCD_R_6               78
-#define CAPRI_PIN_LCD_R_7               79
-#define CAPRI_PIN_LCD_VSYNC             80
-#define CAPRI_PIN_MDMGPIO0              81
-#define CAPRI_PIN_MDMGPIO1              82
-#define CAPRI_PIN_MDMGPIO2              83
-#define CAPRI_PIN_MDMGPIO3              84
-#define CAPRI_PIN_MDMGPIO4              85
-#define CAPRI_PIN_MDMGPIO5              86
-#define CAPRI_PIN_MDMGPIO6              87
-#define CAPRI_PIN_MDMGPIO7              88
-#define CAPRI_PIN_MDMGPIO8              89
-#define CAPRI_PIN_MPHI_DATA_0           90
-#define CAPRI_PIN_MPHI_DATA_1           91
-#define CAPRI_PIN_MPHI_DATA_2           92
-#define CAPRI_PIN_MPHI_DATA_3           93
-#define CAPRI_PIN_MPHI_DATA_4           94
-#define CAPRI_PIN_MPHI_DATA_5           95
-#define CAPRI_PIN_MPHI_DATA_6           96
-#define CAPRI_PIN_MPHI_DATA_7           97
-#define CAPRI_PIN_MPHI_DATA_8           98
-#define CAPRI_PIN_MPHI_DATA_9           99
-#define CAPRI_PIN_MPHI_DATA_10          100
-#define CAPRI_PIN_MPHI_DATA_11          101
-#define CAPRI_PIN_MPHI_DATA_12          102
-#define CAPRI_PIN_MPHI_DATA_13          103
-#define CAPRI_PIN_MPHI_DATA_14          104
-#define CAPRI_PIN_MPHI_DATA_15          105
-#define CAPRI_PIN_MPHI_HA0              106
-#define CAPRI_PIN_MPHI_HAT0             107
-#define CAPRI_PIN_MPHI_HAT1             108
-#define CAPRI_PIN_MPHI_HCE0_N           109
-#define CAPRI_PIN_MPHI_HCE1_N           110
-#define CAPRI_PIN_MPHI_HRD_N            111
-#define CAPRI_PIN_MPHI_HWR_N            112
-#define CAPRI_PIN_MPHI_RUN0             113
-#define CAPRI_PIN_MPHI_RUN1             114
-#define CAPRI_PIN_MTX_SCAN_CLK          115
-#define CAPRI_PIN_MTX_SCAN_DATA         116
-#define CAPRI_PIN_NAND_AD_0             117
-#define CAPRI_PIN_NAND_AD_1             118
-#define CAPRI_PIN_NAND_AD_2             119
-#define CAPRI_PIN_NAND_AD_3             120
-#define CAPRI_PIN_NAND_AD_4             121
-#define CAPRI_PIN_NAND_AD_5             122
-#define CAPRI_PIN_NAND_AD_6             123
-#define CAPRI_PIN_NAND_AD_7             124
-#define CAPRI_PIN_NAND_ALE              125
-#define CAPRI_PIN_NAND_CEN_0            126
-#define CAPRI_PIN_NAND_CEN_1            127
-#define CAPRI_PIN_NAND_CLE              128
-#define CAPRI_PIN_NAND_OEN              129
-#define CAPRI_PIN_NAND_RDY_0            130
-#define CAPRI_PIN_NAND_RDY_1            131
-#define CAPRI_PIN_NAND_WEN              132
-#define CAPRI_PIN_NAND_WP               133
-#define CAPRI_PIN_PC1                   134
-#define CAPRI_PIN_PC2                   135
-#define CAPRI_PIN_PMU_INT               136
-#define CAPRI_PIN_PMU_SCL               137
-#define CAPRI_PIN_PMU_SDA               138
-#define CAPRI_PIN_RFST2G_MTSLOTEN3G     139
-#define CAPRI_PIN_RGMII_0_RX_CTL        140
-#define CAPRI_PIN_RGMII_0_RXC           141
-#define CAPRI_PIN_RGMII_0_RXD_0         142
-#define CAPRI_PIN_RGMII_0_RXD_1         143
-#define CAPRI_PIN_RGMII_0_RXD_2         144
-#define CAPRI_PIN_RGMII_0_RXD_3         145
-#define CAPRI_PIN_RGMII_0_TX_CTL        146
-#define CAPRI_PIN_RGMII_0_TXC           147
-#define CAPRI_PIN_RGMII_0_TXD_0         148
-#define CAPRI_PIN_RGMII_0_TXD_1         149
-#define CAPRI_PIN_RGMII_0_TXD_2         150
-#define CAPRI_PIN_RGMII_0_TXD_3         151
-#define CAPRI_PIN_RGMII_1_RX_CTL        152
-#define CAPRI_PIN_RGMII_1_RXC           153
-#define CAPRI_PIN_RGMII_1_RXD_0         154
-#define CAPRI_PIN_RGMII_1_RXD_1         155
-#define CAPRI_PIN_RGMII_1_RXD_2         156
-#define CAPRI_PIN_RGMII_1_RXD_3         157
-#define CAPRI_PIN_RGMII_1_TX_CTL        158
-#define CAPRI_PIN_RGMII_1_TXC           159
-#define CAPRI_PIN_RGMII_1_TXD_0         160
-#define CAPRI_PIN_RGMII_1_TXD_1         161
-#define CAPRI_PIN_RGMII_1_TXD_2         162
-#define CAPRI_PIN_RGMII_1_TXD_3         163
-#define CAPRI_PIN_RGMII_GPIO_0          164
-#define CAPRI_PIN_RGMII_GPIO_1          165
-#define CAPRI_PIN_RGMII_GPIO_2          166
-#define CAPRI_PIN_RGMII_GPIO_3          167
-#define CAPRI_PIN_RTXDATA2G_TXDATA3G1   168
-#define CAPRI_PIN_RTXEN2G_TXDATA3G2     169
-#define CAPRI_PIN_RXDATA3G0             170
-#define CAPRI_PIN_RXDATA3G1             171
-#define CAPRI_PIN_RXDATA3G2             172
-#define CAPRI_PIN_SDIO1_CLK             173
-#define CAPRI_PIN_SDIO1_CMD             174
-#define CAPRI_PIN_SDIO1_DATA_0          175
-#define CAPRI_PIN_SDIO1_DATA_1          176
-#define CAPRI_PIN_SDIO1_DATA_2          177
-#define CAPRI_PIN_SDIO1_DATA_3          178
-#define CAPRI_PIN_SDIO4_CLK             179
-#define CAPRI_PIN_SDIO4_CMD             180
-#define CAPRI_PIN_SDIO4_DATA_0          181
-#define CAPRI_PIN_SDIO4_DATA_1          182
-#define CAPRI_PIN_SDIO4_DATA_2          183
-#define CAPRI_PIN_SDIO4_DATA_3          184
-#define CAPRI_PIN_SIM_CLK               185
-#define CAPRI_PIN_SIM_DATA              186
-#define CAPRI_PIN_SIM_DET               187
-#define CAPRI_PIN_SIM_RESETN            188
-#define CAPRI_PIN_SIM2_CLK              189
-#define CAPRI_PIN_SIM2_DATA             190
-#define CAPRI_PIN_SIM2_DET              191
-#define CAPRI_PIN_SIM2_RESETN           192
-#define CAPRI_PIN_SRI_C                 193
-#define CAPRI_PIN_SRI_D                 194
-#define CAPRI_PIN_SRI_E                 195
-#define CAPRI_PIN_SSP_EXTCLK            196
-#define CAPRI_PIN_SSP0_CLK              197
-#define CAPRI_PIN_SSP0_FS               198
-#define CAPRI_PIN_SSP0_RXD              199
-#define CAPRI_PIN_SSP0_TXD              200
-#define CAPRI_PIN_SSP2_CLK              201
-#define CAPRI_PIN_SSP2_FS_0             202
-#define CAPRI_PIN_SSP2_FS_1             203
-#define CAPRI_PIN_SSP2_FS_2             204
-#define CAPRI_PIN_SSP2_FS_3             205
-#define CAPRI_PIN_SSP2_RXD_0            206
-#define CAPRI_PIN_SSP2_RXD_1            207
-#define CAPRI_PIN_SSP2_TXD_0            208
-#define CAPRI_PIN_SSP2_TXD_1            209
-#define CAPRI_PIN_SSP3_CLK              210
-#define CAPRI_PIN_SSP3_FS               211
-#define CAPRI_PIN_SSP3_RXD              212
-#define CAPRI_PIN_SSP3_TXD              213
-#define CAPRI_PIN_SSP4_CLK              214
-#define CAPRI_PIN_SSP4_FS               215
-#define CAPRI_PIN_SSP4_RXD              216
-#define CAPRI_PIN_SSP4_TXD              217
-#define CAPRI_PIN_SSP5_CLK              218
-#define CAPRI_PIN_SSP5_FS               219
-#define CAPRI_PIN_SSP5_RXD              220
-#define CAPRI_PIN_SSP5_TXD              221
-#define CAPRI_PIN_SSP6_CLK              222
-#define CAPRI_PIN_SSP6_FS               223
-#define CAPRI_PIN_SSP6_RXD              224
-#define CAPRI_PIN_SSP6_TXD              225
-#define CAPRI_PIN_STAT_1                226
-#define CAPRI_PIN_STAT_2                227
-#define CAPRI_PIN_SYSCLKEN              228
-#define CAPRI_PIN_TRACECLK              229
-#define CAPRI_PIN_TRACEDT00             230
-#define CAPRI_PIN_TRACEDT01             231
-#define CAPRI_PIN_TRACEDT02             232
-#define CAPRI_PIN_TRACEDT03             233
-#define CAPRI_PIN_TRACEDT04             234
-#define CAPRI_PIN_TRACEDT05             235
-#define CAPRI_PIN_TRACEDT06             236
-#define CAPRI_PIN_TRACEDT07             237
-#define CAPRI_PIN_TRACEDT08             238
-#define CAPRI_PIN_TRACEDT09             239
-#define CAPRI_PIN_TRACEDT10             240
-#define CAPRI_PIN_TRACEDT11             241
-#define CAPRI_PIN_TRACEDT12             242
-#define CAPRI_PIN_TRACEDT13             243
-#define CAPRI_PIN_TRACEDT14             244
-#define CAPRI_PIN_TRACEDT15             245
-#define CAPRI_PIN_TXDATA3G0             246
-#define CAPRI_PIN_TXPWRIND              247
-#define CAPRI_PIN_UARTB1_UCTS           248
-#define CAPRI_PIN_UARTB1_URTS           249
-#define CAPRI_PIN_UARTB1_URXD           250
-#define CAPRI_PIN_UARTB1_UTXD           251
-#define CAPRI_PIN_UARTB2_URXD           252
-#define CAPRI_PIN_UARTB2_UTXD           253
-#define CAPRI_PIN_UARTB3_UCTS           254
-#define CAPRI_PIN_UARTB3_URTS           255
-#define CAPRI_PIN_UARTB3_URXD           256
-#define CAPRI_PIN_UARTB3_UTXD           257
-#define CAPRI_PIN_UARTB4_UCTS           258
-#define CAPRI_PIN_UARTB4_URTS           259
-#define CAPRI_PIN_UARTB4_URXD           260
-#define CAPRI_PIN_UARTB4_UTXD           261
-#define CAPRI_PIN_VC_CAM1_SCL           262
-#define CAPRI_PIN_VC_CAM1_SDA           263
-#define CAPRI_PIN_VC_CAM2_SCL           264
-#define CAPRI_PIN_VC_CAM2_SDA           265
-#define CAPRI_PIN_VC_CAM3_SCL           266
-#define CAPRI_PIN_VC_CAM3_SDA           267
-#define CAPRI_PIN_DESC(a, b, c) \
-        { .number = a, .name = b, .drv_data = &c##_pin }
-/*
- * Pin description definition.  The order here must be the same as defined in
- * the PADCTRLREG block in the RDB, since the pin number is used as an index
- * into this array.
- */
-static const struct pinctrl_pin_desc capri_pinctrl_pins[] = {
-        CAPRI_PIN_DESC(CAPRI_PIN_ADCSYNC, "adcsync", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_BAT_RM, "bat_rm", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_BSC1_SCL, "bsc1_scl", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_BSC1_SDA, "bsc1_sda", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_BSC2_SCL, "bsc2_scl", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_BSC2_SDA, "bsc2_sda", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLASSGPWR, "classgpwr", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLK_CX8, "clk_cx8", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLKOUT_0, "clkout_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLKOUT_1, "clkout_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLKOUT_2, "clkout_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLKOUT_3, "clkout_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLKREQ_IN_0, "clkreq_in_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CLKREQ_IN_1, "clkreq_in_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CWS_SYS_REQ1, "cws_sys_req1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CWS_SYS_REQ2, "cws_sys_req2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_CWS_SYS_REQ3, "cws_sys_req3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_DIGMIC1_CLK, "digmic1_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_DIGMIC1_DQ, "digmic1_dq", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_DIGMIC2_CLK, "digmic2_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_DIGMIC2_DQ, "digmic2_dq", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPEN13, "gpen13", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPEN14, "gpen14", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPEN15, "gpen15", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO00, "gpio00", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO01, "gpio01", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO02, "gpio02", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO03, "gpio03", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO04, "gpio04", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO05, "gpio05", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO06, "gpio06", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO07, "gpio07", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO08, "gpio08", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO09, "gpio09", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO10, "gpio10", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO11, "gpio11", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO12, "gpio12", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO13, "gpio13", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPIO14, "gpio14", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPS_PABLANK, "gps_pablank", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_GPS_TMARK, "gps_tmark", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_HDMI_SCL, "hdmi_scl", hdmi),
-        CAPRI_PIN_DESC(CAPRI_PIN_HDMI_SDA, "hdmi_sda", hdmi),
-        CAPRI_PIN_DESC(CAPRI_PIN_IC_DM, "ic_dm", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_IC_DP, "ic_dp", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_COL_IP_0, "kp_col_ip_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_COL_IP_1, "kp_col_ip_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_COL_IP_2, "kp_col_ip_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_COL_IP_3, "kp_col_ip_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_ROW_OP_0, "kp_row_op_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_ROW_OP_1, "kp_row_op_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_ROW_OP_2, "kp_row_op_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_KP_ROW_OP_3, "kp_row_op_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_0, "lcd_b_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_1, "lcd_b_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_2, "lcd_b_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_3, "lcd_b_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_4, "lcd_b_4", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_5, "lcd_b_5", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_6, "lcd_b_6", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_B_7, "lcd_b_7", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_0, "lcd_g_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_1, "lcd_g_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_2, "lcd_g_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_3, "lcd_g_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_4, "lcd_g_4", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_5, "lcd_g_5", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_6, "lcd_g_6", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_G_7, "lcd_g_7", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_HSYNC, "lcd_hsync", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_OE, "lcd_oe", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_PCLK, "lcd_pclk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_0, "lcd_r_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_1, "lcd_r_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_2, "lcd_r_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_3, "lcd_r_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_4, "lcd_r_4", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_5, "lcd_r_5", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_6, "lcd_r_6", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_R_7, "lcd_r_7", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_LCD_VSYNC, "lcd_vsync", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO0, "mdmgpio0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO1, "mdmgpio1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO2, "mdmgpio2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO3, "mdmgpio3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO4, "mdmgpio4", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO5, "mdmgpio5", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO6, "mdmgpio6", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO7, "mdmgpio7", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MDMGPIO8, "mdmgpio8", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_0, "mphi_data_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_1, "mphi_data_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_2, "mphi_data_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_3, "mphi_data_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_4, "mphi_data_4", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_5, "mphi_data_5", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_6, "mphi_data_6", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_7, "mphi_data_7", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_8, "mphi_data_8", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_9, "mphi_data_9", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_10, "mphi_data_10", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_11, "mphi_data_11", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_12, "mphi_data_12", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_13, "mphi_data_13", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_14, "mphi_data_14", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_DATA_15, "mphi_data_15", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_HA0, "mphi_ha0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_HAT0, "mphi_hat0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_HAT1, "mphi_hat1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_HCE0_N, "mphi_hce0_n", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_HCE1_N, "mphi_hce1_n", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_HRD_N, "mphi_hrd_n", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_HWR_N, "mphi_hwr_n", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_RUN0, "mphi_run0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MPHI_RUN1, "mphi_run1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MTX_SCAN_CLK, "mtx_scan_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_MTX_SCAN_DATA, "mtx_scan_data", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_0, "nand_ad_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_1, "nand_ad_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_2, "nand_ad_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_3, "nand_ad_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_4, "nand_ad_4", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_5, "nand_ad_5", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_6, "nand_ad_6", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_AD_7, "nand_ad_7", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_ALE, "nand_ale", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_CEN_0, "nand_cen_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_CEN_1, "nand_cen_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_CLE, "nand_cle", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_OEN, "nand_oen", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_RDY_0, "nand_rdy_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_RDY_1, "nand_rdy_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_WEN, "nand_wen", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_NAND_WP, "nand_wp", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_PC1, "pc1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_PC2, "pc2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_PMU_INT, "pmu_int", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_PMU_SCL, "pmu_scl", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_PMU_SDA, "pmu_sda", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_RFST2G_MTSLOTEN3G, "rfst2g_mtsloten3g", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_RX_CTL, "rgmii_0_rx_ctl", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_RXC, "rgmii_0_rxc", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_RXD_0, "rgmii_0_rxd_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_RXD_1, "rgmii_0_rxd_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_RXD_2, "rgmii_0_rxd_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_RXD_3, "rgmii_0_rxd_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_TX_CTL, "rgmii_0_tx_ctl", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_TXC, "rgmii_0_txc", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_TXD_0, "rgmii_0_txd_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_TXD_1, "rgmii_0_txd_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_TXD_2, "rgmii_0_txd_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_0_TXD_3, "rgmii_0_txd_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_RX_CTL, "rgmii_1_rx_ctl", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_RXC, "rgmii_1_rxc", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_RXD_0, "rgmii_1_rxd_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_RXD_1, "rgmii_1_rxd_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_RXD_2, "rgmii_1_rxd_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_RXD_3, "rgmii_1_rxd_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_TX_CTL, "rgmii_1_tx_ctl", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_TXC, "rgmii_1_txc", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_TXD_0, "rgmii_1_txd_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_TXD_1, "rgmii_1_txd_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_TXD_2, "rgmii_1_txd_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_1_TXD_3, "rgmii_1_txd_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_GPIO_0, "rgmii_gpio_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_GPIO_1, "rgmii_gpio_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_GPIO_2, "rgmii_gpio_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RGMII_GPIO_3, "rgmii_gpio_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RTXDATA2G_TXDATA3G1, "rtxdata2g_txdata3g1",
-                std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RTXEN2G_TXDATA3G2, "rtxen2g_txdata3g2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RXDATA3G0, "rxdata3g0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RXDATA3G1, "rxdata3g1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_RXDATA3G2, "rxdata3g2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO1_CLK, "sdio1_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO1_CMD, "sdio1_cmd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO1_DATA_0, "sdio1_data_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO1_DATA_1, "sdio1_data_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO1_DATA_2, "sdio1_data_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO1_DATA_3, "sdio1_data_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO4_CLK, "sdio4_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO4_CMD, "sdio4_cmd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO4_DATA_0, "sdio4_data_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO4_DATA_1, "sdio4_data_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO4_DATA_2, "sdio4_data_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SDIO4_DATA_3, "sdio4_data_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM_CLK, "sim_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM_DATA, "sim_data", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM_DET, "sim_det", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM_RESETN, "sim_resetn", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM2_CLK, "sim2_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM2_DATA, "sim2_data", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM2_DET, "sim2_det", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SIM2_RESETN, "sim2_resetn", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SRI_C, "sri_c", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SRI_D, "sri_d", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SRI_E, "sri_e", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP_EXTCLK, "ssp_extclk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP0_CLK, "ssp0_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP0_FS, "ssp0_fs", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP0_RXD, "ssp0_rxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP0_TXD, "ssp0_txd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_CLK, "ssp2_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_FS_0, "ssp2_fs_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_FS_1, "ssp2_fs_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_FS_2, "ssp2_fs_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_FS_3, "ssp2_fs_3", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_RXD_0, "ssp2_rxd_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_RXD_1, "ssp2_rxd_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_TXD_0, "ssp2_txd_0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP2_TXD_1, "ssp2_txd_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP3_CLK, "ssp3_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP3_FS, "ssp3_fs", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP3_RXD, "ssp3_rxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP3_TXD, "ssp3_txd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP4_CLK, "ssp4_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP4_FS, "ssp4_fs", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP4_RXD, "ssp4_rxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP4_TXD, "ssp4_txd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP5_CLK, "ssp5_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP5_FS, "ssp5_fs", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP5_RXD, "ssp5_rxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP5_TXD, "ssp5_txd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP6_CLK, "ssp6_clk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP6_FS, "ssp6_fs", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP6_RXD, "ssp6_rxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SSP6_TXD, "ssp6_txd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_STAT_1, "stat_1", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_STAT_2, "stat_2", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_SYSCLKEN, "sysclken", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACECLK, "traceclk", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT00, "tracedt00", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT01, "tracedt01", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT02, "tracedt02", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT03, "tracedt03", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT04, "tracedt04", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT05, "tracedt05", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT06, "tracedt06", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT07, "tracedt07", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT08, "tracedt08", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT09, "tracedt09", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT10, "tracedt10", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT11, "tracedt11", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT12, "tracedt12", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT13, "tracedt13", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT14, "tracedt14", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TRACEDT15, "tracedt15", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TXDATA3G0, "txdata3g0", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_TXPWRIND, "txpwrind", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB1_UCTS, "uartb1_ucts", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB1_URTS, "uartb1_urts", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB1_URXD, "uartb1_urxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB1_UTXD, "uartb1_utxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB2_URXD, "uartb2_urxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB2_UTXD, "uartb2_utxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB3_UCTS, "uartb3_ucts", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB3_URTS, "uartb3_urts", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB3_URXD, "uartb3_urxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB3_UTXD, "uartb3_utxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB4_UCTS, "uartb4_ucts", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB4_URTS, "uartb4_urts", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB4_URXD, "uartb4_urxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_UARTB4_UTXD, "uartb4_utxd", std),
-        CAPRI_PIN_DESC(CAPRI_PIN_VC_CAM1_SCL, "vc_cam1_scl", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_VC_CAM1_SDA, "vc_cam1_sda", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_VC_CAM2_SCL, "vc_cam2_scl", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_VC_CAM2_SDA, "vc_cam2_sda", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_VC_CAM3_SCL, "vc_cam3_scl", i2c),
-        CAPRI_PIN_DESC(CAPRI_PIN_VC_CAM3_SDA, "vc_cam3_sda", i2c),
-};
-static const char * const capri_alt_groups[] = {
-        "adcsync",
-        "bat_rm",
-        "bsc1_scl",
-        "bsc1_sda",
-        "bsc2_scl",
-        "bsc2_sda",
-        "classgpwr",
-        "clk_cx8",
-        "clkout_0",
-        "clkout_1",
-        "clkout_2",
-        "clkout_3",
-        "clkreq_in_0",
-        "clkreq_in_1",
-        "cws_sys_req1",
-        "cws_sys_req2",
-        "cws_sys_req3",
-        "digmic1_clk",
-        "digmic1_dq",
-        "digmic2_clk",
-        "digmic2_dq",
-        "gpen13",
-        "gpen14",
-        "gpen15",
-        "gpio00",
-        "gpio01",
-        "gpio02",
-        "gpio03",
-        "gpio04",
-        "gpio05",
-        "gpio06",
-        "gpio07",
-        "gpio08",
-        "gpio09",
-        "gpio10",
-        "gpio11",
-        "gpio12",
-        "gpio13",
-        "gpio14",
-        "gps_pablank",
-        "gps_tmark",
-        "hdmi_scl",
-        "hdmi_sda",
-        "ic_dm",
-        "ic_dp",
-        "kp_col_ip_0",
-        "kp_col_ip_1",
-        "kp_col_ip_2",
-        "kp_col_ip_3",
-        "kp_row_op_0",
-        "kp_row_op_1",
-        "kp_row_op_2",
-        "kp_row_op_3",
-        "lcd_b_0",
-        "lcd_b_1",
-        "lcd_b_2",
-        "lcd_b_3",
-        "lcd_b_4",
-        "lcd_b_5",
-        "lcd_b_6",
-        "lcd_b_7",
-        "lcd_g_0",
-        "lcd_g_1",
-        "lcd_g_2",
-        "lcd_g_3",
-        "lcd_g_4",
-        "lcd_g_5",
-        "lcd_g_6",
-        "lcd_g_7",
-        "lcd_hsync",
-        "lcd_oe",
-        "lcd_pclk",
-        "lcd_r_0",
-        "lcd_r_1",
-        "lcd_r_2",
-        "lcd_r_3",
-        "lcd_r_4",
-        "lcd_r_5",
-        "lcd_r_6",
-        "lcd_r_7",
-        "lcd_vsync",
-        "mdmgpio0",
-        "mdmgpio1",
-        "mdmgpio2",
-        "mdmgpio3",
-        "mdmgpio4",
-        "mdmgpio5",
-        "mdmgpio6",
-        "mdmgpio7",
-        "mdmgpio8",
-        "mphi_data_0",
-        "mphi_data_1",
-        "mphi_data_2",
-        "mphi_data_3",
-        "mphi_data_4",
-        "mphi_data_5",
-        "mphi_data_6",
-        "mphi_data_7",
-        "mphi_data_8",
-        "mphi_data_9",
-        "mphi_data_10",
-        "mphi_data_11",
-        "mphi_data_12",
-        "mphi_data_13",
-        "mphi_data_14",
-        "mphi_data_15",
-        "mphi_ha0",
-        "mphi_hat0",
-        "mphi_hat1",
-        "mphi_hce0_n",
-        "mphi_hce1_n",
-        "mphi_hrd_n",
-        "mphi_hwr_n",
-        "mphi_run0",
-        "mphi_run1",
-        "mtx_scan_clk",
-        "mtx_scan_data",
-        "nand_ad_0",
-        "nand_ad_1",
-        "nand_ad_2",
-        "nand_ad_3",
-        "nand_ad_4",
-        "nand_ad_5",
-        "nand_ad_6",
-        "nand_ad_7",
-        "nand_ale",
-        "nand_cen_0",
-        "nand_cen_1",
-        "nand_cle",
-        "nand_oen",
-        "nand_rdy_0",
-        "nand_rdy_1",
-        "nand_wen",
-        "nand_wp",
-        "pc1",
-        "pc2",
-        "pmu_int",
-        "pmu_scl",
-        "pmu_sda",
-        "rfst2g_mtsloten3g",
-        "rgmii_0_rx_ctl",
-        "rgmii_0_rxc",
-        "rgmii_0_rxd_0",
-        "rgmii_0_rxd_1",
-        "rgmii_0_rxd_2",
-        "rgmii_0_rxd_3",
-        "rgmii_0_tx_ctl",
-        "rgmii_0_txc",
-        "rgmii_0_txd_0",
-        "rgmii_0_txd_1",
-        "rgmii_0_txd_2",
-        "rgmii_0_txd_3",
-        "rgmii_1_rx_ctl",
-        "rgmii_1_rxc",
-        "rgmii_1_rxd_0",
-        "rgmii_1_rxd_1",
-        "rgmii_1_rxd_2",
-        "rgmii_1_rxd_3",
-        "rgmii_1_tx_ctl",
-        "rgmii_1_txc",
-        "rgmii_1_txd_0",
-        "rgmii_1_txd_1",
-        "rgmii_1_txd_2",
-        "rgmii_1_txd_3",
-        "rgmii_gpio_0",
-        "rgmii_gpio_1",
-        "rgmii_gpio_2",
-        "rgmii_gpio_3",
-        "rtxdata2g_txdata3g1",
-        "rtxen2g_txdata3g2",
-        "rxdata3g0",
-        "rxdata3g1",
-        "rxdata3g2",
-        "sdio1_clk",
-        "sdio1_cmd",
-        "sdio1_data_0",
-        "sdio1_data_1",
-        "sdio1_data_2",
-        "sdio1_data_3",
-        "sdio4_clk",
-        "sdio4_cmd",
-        "sdio4_data_0",
-        "sdio4_data_1",
-        "sdio4_data_2",
-        "sdio4_data_3",
-        "sim_clk",
-        "sim_data",
-        "sim_det",
-        "sim_resetn",
-        "sim2_clk",
-        "sim2_data",
-        "sim2_det",
-        "sim2_resetn",
-        "sri_c",
-        "sri_d",
-        "sri_e",
-        "ssp_extclk",
-        "ssp0_clk",
-        "ssp0_fs",
-        "ssp0_rxd",
-        "ssp0_txd",
-        "ssp2_clk",
-        "ssp2_fs_0",
-        "ssp2_fs_1",
-        "ssp2_fs_2",
-        "ssp2_fs_3",
-        "ssp2_rxd_0",
-        "ssp2_rxd_1",
-        "ssp2_txd_0",
-        "ssp2_txd_1",
-        "ssp3_clk",
-        "ssp3_fs",
-        "ssp3_rxd",
-        "ssp3_txd",
-        "ssp4_clk",
-        "ssp4_fs",
-        "ssp4_rxd",
-        "ssp4_txd",
-        "ssp5_clk",
-        "ssp5_fs",
-        "ssp5_rxd",
-        "ssp5_txd",
-        "ssp6_clk",
-        "ssp6_fs",
-        "ssp6_rxd",
-        "ssp6_txd",
-        "stat_1",
-        "stat_2",
-        "sysclken",
-        "traceclk",
-        "tracedt00",
-        "tracedt01",
-        "tracedt02",
-        "tracedt03",
-        "tracedt04",
-        "tracedt05",
-        "tracedt06",
-        "tracedt07",
-        "tracedt08",
-        "tracedt09",
-        "tracedt10",
-        "tracedt11",
-        "tracedt12",
-        "tracedt13",
-        "tracedt14",
-        "tracedt15",
-        "txdata3g0",
-        "txpwrind",
-        "uartb1_ucts",
-        "uartb1_urts",
-        "uartb1_urxd",
-        "uartb1_utxd",
-        "uartb2_urxd",
-        "uartb2_utxd",
-        "uartb3_ucts",
-        "uartb3_urts",
-        "uartb3_urxd",
-        "uartb3_utxd",
-        "uartb4_ucts",
-        "uartb4_urts",
-        "uartb4_urxd",
-        "uartb4_utxd",
-        "vc_cam1_scl",
-        "vc_cam1_sda",
-        "vc_cam2_scl",
-        "vc_cam2_sda",
-        "vc_cam3_scl",
-        "vc_cam3_sda",
-};
-/* Every pin can implement all ALT1-ALT4 functions */
-#define CAPRI_PIN_FUNCTION(fcn_name)                    \
-{                                                       \
-        .name = #fcn_name,                              \
-        .groups = capri_alt_groups,                     \
-        .ngroups = ARRAY_SIZE(capri_alt_groups),        \
-}
-static const struct capri_pin_function capri_functions[] = {
-        CAPRI_PIN_FUNCTION(alt1),
-        CAPRI_PIN_FUNCTION(alt2),
-        CAPRI_PIN_FUNCTION(alt3),
-        CAPRI_PIN_FUNCTION(alt4),
-};
-static struct capri_pinctrl_data capri_pinctrl = {
-        .pins = capri_pinctrl_pins,
-        .npins = ARRAY_SIZE(capri_pinctrl_pins),
-        .functions = capri_functions,
-        .nfunctions = ARRAY_SIZE(capri_functions),
-};
-static inline enum capri_pin_type pin_type_get(struct pinctrl_dev *pctldev,
-                                               unsigned pin)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        if (pin >= pdata->npins)
-                return CAPRI_PIN_TYPE_UNKNOWN;
-        return *(enum capri_pin_type *)(pdata->pins[pin].drv_data);
-}
-#define CAPRI_PIN_SHIFT(type, param) \
-        (CAPRI_ ## type ## _PIN_REG_ ## param ## _SHIFT)
-#define CAPRI_PIN_MASK(type, param) \
-        (CAPRI_ ## type ## _PIN_REG_ ## param ## _MASK)
-/*
- * This helper function is used to build up the value and mask used to write to
- * a pin register, but does not actually write to the register.
- */
-static inline void capri_pin_update(u32 *reg_val, u32 *reg_mask, u32 param_val,
-                                    u32 param_shift, u32 param_mask)
-{
-        *reg_val &= ~param_mask;
-        *reg_val |= (param_val << param_shift) & param_mask;
-        *reg_mask |= param_mask;
-}
-static struct regmap_config capri_pinctrl_regmap_config = {
-        .reg_bits = 32,
-        .reg_stride = 4,
-        .val_bits = 32,
-        .max_register = CAPRI_PIN_VC_CAM3_SDA,
-};
-static int capri_pinctrl_get_groups_count(struct pinctrl_dev *pctldev)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        return pdata->npins;
-}
-static const char *capri_pinctrl_get_group_name(struct pinctrl_dev *pctldev,
-                                                unsigned group)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        return pdata->pins[group].name;
-}
-static int capri_pinctrl_get_group_pins(struct pinctrl_dev *pctldev,
-                                        unsigned group,
-                                        const unsigned **pins,
-                                        unsigned *num_pins)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        *pins = &pdata->pins[group].number;
-        *num_pins = 1;
-        return 0;
-}
-static void capri_pinctrl_pin_dbg_show(struct pinctrl_dev *pctldev,
-                                       struct seq_file *s,
-                                       unsigned offset)
-{
-        seq_printf(s, " %s", dev_name(pctldev->dev));
-}
-static struct pinctrl_ops capri_pinctrl_ops = {
-        .get_groups_count = capri_pinctrl_get_groups_count,
-        .get_group_name = capri_pinctrl_get_group_name,
-        .get_group_pins = capri_pinctrl_get_group_pins,
-        .pin_dbg_show = capri_pinctrl_pin_dbg_show,
-        .dt_node_to_map = pinconf_generic_dt_node_to_map_pin,
-        .dt_free_map = pinctrl_utils_dt_free_map,
-};
-static int capri_pinctrl_get_fcns_count(struct pinctrl_dev *pctldev)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        return pdata->nfunctions;
-}
-static const char *capri_pinctrl_get_fcn_name(struct pinctrl_dev *pctldev,
-                                              unsigned function)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        return pdata->functions[function].name;
-}
-static int capri_pinctrl_get_fcn_groups(struct pinctrl_dev *pctldev,
-                                        unsigned function,
-                                        const char * const **groups,
-                                        unsigned * const num_groups)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        *groups = pdata->functions[function].groups;
-        *num_groups = pdata->functions[function].ngroups;
-        return 0;
-}
-static int capri_pinmux_enable(struct pinctrl_dev *pctldev,
-                               unsigned function,
-                               unsigned group)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        const struct capri_pin_function *f = &pdata->functions[function];
-        u32 offset = 4 * pdata->pins[group].number;
-        int rc = 0;
-        dev_dbg(pctldev->dev,
-                "%s(): Enable function %s (%d) of pin %s (%d) @offset 0x%x.\n",
-                __func__, f->name, function, pdata->pins[group].name,
-                pdata->pins[group].number, offset);
-        rc = regmap_update_bits(pdata->regmap, offset, CAPRI_PIN_REG_F_SEL_MASK,
-                        function << CAPRI_PIN_REG_F_SEL_SHIFT);
-        if (rc)
-                dev_err(pctldev->dev,
-                        "Error updating register for pin %s (%d).\n",
-                        pdata->pins[group].name, pdata->pins[group].number);
-        return rc;
-}
-static struct pinmux_ops capri_pinctrl_pinmux_ops = {
-        .get_functions_count = capri_pinctrl_get_fcns_count,
-        .get_function_name = capri_pinctrl_get_fcn_name,
-        .get_function_groups = capri_pinctrl_get_fcn_groups,
-        .enable = capri_pinmux_enable,
-};
-static int capri_pinctrl_pin_config_get(struct pinctrl_dev *pctldev,
-                                        unsigned pin,
-                                        unsigned long *config)
-{
-        return -ENOTSUPP;
-}
-/* Goes through the configs and update register val/mask */
-static int capri_std_pin_update(struct pinctrl_dev *pctldev,
-                                unsigned pin,
-                                unsigned long *configs,
-                                unsigned num_configs,
-                                u32 *val,
-                                u32 *mask)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        int i;
-        enum pin_config_param param;
-        u16 arg;
-        for (i = 0; i < num_configs; i++) {
-                param = pinconf_to_config_param(configs[i]);
-                arg = pinconf_to_config_argument(configs[i]);
-                switch (param) {
-                case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
-                        arg = (arg >= 1 ? 1 : 0);
-                        capri_pin_update(val, mask, arg,
-                                        CAPRI_PIN_SHIFT(STD, HYST),
-                                        CAPRI_PIN_MASK(STD, HYST));
-                        break;
-                /*
-                 * The pin bias can only be one of pull-up, pull-down, or
-                 * disable.  The user does not need to specify a value for the
-                 * property, and the default value from pinconf-generic is
-                 * ignored.
-                 */
-                case PIN_CONFIG_BIAS_DISABLE:
-                        capri_pin_update(val, mask, 0,
-                                        CAPRI_PIN_SHIFT(STD, PULL_UP),
-                                        CAPRI_PIN_MASK(STD, PULL_UP));
-                        capri_pin_update(val, mask, 0,
-                                        CAPRI_PIN_SHIFT(STD, PULL_DN),
-                                        CAPRI_PIN_MASK(STD, PULL_DN));
-                        break;
-                case PIN_CONFIG_BIAS_PULL_UP:
-                        capri_pin_update(val, mask, 1,
-                                        CAPRI_PIN_SHIFT(STD, PULL_UP),
-                                        CAPRI_PIN_MASK(STD, PULL_UP));
-                        capri_pin_update(val, mask, 0,
-                                        CAPRI_PIN_SHIFT(STD, PULL_DN),
-                                        CAPRI_PIN_MASK(STD, PULL_DN));
-                        break;
-                case PIN_CONFIG_BIAS_PULL_DOWN:
-                        capri_pin_update(val, mask, 0,
-                                        CAPRI_PIN_SHIFT(STD, PULL_UP),
-                                        CAPRI_PIN_MASK(STD, PULL_UP));
-                        capri_pin_update(val, mask, 1,
-                                        CAPRI_PIN_SHIFT(STD, PULL_DN),
-                                        CAPRI_PIN_MASK(STD, PULL_DN));
-                        break;
-                case PIN_CONFIG_SLEW_RATE:
-                        arg = (arg >= 1 ? 1 : 0);
-                        capri_pin_update(val, mask, arg,
-                                        CAPRI_PIN_SHIFT(STD, SLEW),
-                                        CAPRI_PIN_MASK(STD, SLEW));
-                        break;
-                case PIN_CONFIG_INPUT_ENABLE:
-                        /* inversed since register is for input _disable_ */
-                        arg = (arg >= 1 ? 0 : 1);
-                        capri_pin_update(val, mask, arg,
-                                        CAPRI_PIN_SHIFT(STD, INPUT_DIS),
-                                        CAPRI_PIN_MASK(STD, INPUT_DIS));
-                        break;
-                case PIN_CONFIG_DRIVE_STRENGTH:
-                        /* Valid range is 2-16 mA, even numbers only */
-                        if ((arg < 2) || (arg > 16) || (arg % 2)) {
-                                dev_err(pctldev->dev,
-                                        "Invalid Drive Strength value (%d) for "
-                                        "pin %s (%d). Valid values are "
-                                        "(2..16) mA, even numbers only.\n",
-                                        arg, pdata->pins[pin].name, pin);
-                                return -EINVAL;
-                        }
-                        capri_pin_update(val, mask, (arg/2)-1,
-                                        CAPRI_PIN_SHIFT(STD, DRV_STR),
-                                        CAPRI_PIN_MASK(STD, DRV_STR));
-                        break;
-                default:
-                        dev_err(pctldev->dev,
-                                "Unrecognized pin config %d for pin %s (%d).\n",
-                                param, pdata->pins[pin].name, pin);
-                        return -EINVAL;
-                } /* switch config */
-        } /* for each config */
-        return 0;
-}
-/*
- * The pull-up strength for an I2C pin is represented by bits 4-6 in the
- * register with the following mapping:
- *   0b000: No pull-up
- *   0b001: 1200 Ohm
- *   0b010: 1800 Ohm
- *   0b011: 720 Ohm
- *   0b100: 2700 Ohm
- *   0b101: 831 Ohm
- *   0b110: 1080 Ohm
- *   0b111: 568 Ohm
- * This array maps pull-up strength in Ohms to register values (1+index).
- */
-static const u16 capri_pullup_map[] = {1200, 1800, 720, 2700, 831, 1080, 568};
-/* Goes through the configs and update register val/mask */
-static int capri_i2c_pin_update(struct pinctrl_dev *pctldev,
-                                unsigned pin,
-                                unsigned long *configs,
-                                unsigned num_configs,
-                                u32 *val,
-                                u32 *mask)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        int i, j;
-        enum pin_config_param param;
-        u16 arg;
-        for (i = 0; i < num_configs; i++) {
-                param = pinconf_to_config_param(configs[i]);
-                arg = pinconf_to_config_argument(configs[i]);
-                switch (param) {
-                case PIN_CONFIG_BIAS_PULL_UP:
-                        for (j = 0; j < ARRAY_SIZE(capri_pullup_map); j++)
-                                if (capri_pullup_map[j] == arg)
-                                        break;
-                        if (j == ARRAY_SIZE(capri_pullup_map)) {
-                                dev_err(pctldev->dev,
-                                        "Invalid pull-up value (%d) for pin %s "
-                                        "(%d). Valid values are 568, 720, 831, "
-                                        "1080, 1200, 1800, 2700 Ohms.\n",
-                                        arg, pdata->pins[pin].name, pin);
-                                return -EINVAL;
-                        }
-                        capri_pin_update(val, mask, j+1,
-                                        CAPRI_PIN_SHIFT(I2C, PULL_UP_STR),
-                                        CAPRI_PIN_MASK(I2C, PULL_UP_STR));
-                        break;
-                case PIN_CONFIG_BIAS_DISABLE:
-                        capri_pin_update(val, mask, 0,
-                                        CAPRI_PIN_SHIFT(I2C, PULL_UP_STR),
-                                        CAPRI_PIN_MASK(I2C, PULL_UP_STR));
-                        break;
-                case PIN_CONFIG_SLEW_RATE:
-                        arg = (arg >= 1 ? 1 : 0);
-                        capri_pin_update(val, mask, arg,
-                                        CAPRI_PIN_SHIFT(I2C, SLEW),
-                                        CAPRI_PIN_MASK(I2C, SLEW));
-                        break;
-                case PIN_CONFIG_INPUT_ENABLE:
-                        /* inversed since register is for input _disable_ */
-                        arg = (arg >= 1 ? 0 : 1);
-                        capri_pin_update(val, mask, arg,
-                                        CAPRI_PIN_SHIFT(I2C, INPUT_DIS),
-                                        CAPRI_PIN_MASK(I2C, INPUT_DIS));
-                        break;
-                default:
-                        dev_err(pctldev->dev,
-                                "Unrecognized pin config %d for pin %s (%d).\n",
-                                param, pdata->pins[pin].name, pin);
-                        return -EINVAL;
-                } /* switch config */
-        } /* for each config */
-        return 0;
-}
-/* Goes through the configs and update register val/mask */
-static int capri_hdmi_pin_update(struct pinctrl_dev *pctldev,
-                                 unsigned pin,
-                                 unsigned long *configs,
-                                 unsigned num_configs,
-                                 u32 *val,
-                                 u32 *mask)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        int i;
-        enum pin_config_param param;
-        u16 arg;
-        for (i = 0; i < num_configs; i++) {
-                param = pinconf_to_config_param(configs[i]);
-                arg = pinconf_to_config_argument(configs[i]);
-                switch (param) {
-                case PIN_CONFIG_SLEW_RATE:
-                        arg = (arg >= 1 ? 1 : 0);
-                        capri_pin_update(val, mask, arg,
-                                        CAPRI_PIN_SHIFT(HDMI, MODE),
-                                        CAPRI_PIN_MASK(HDMI, MODE));
-                        break;
-                case PIN_CONFIG_INPUT_ENABLE:
-                        /* inversed since register is for input _disable_ */
-                        arg = (arg >= 1 ? 0 : 1);
-                        capri_pin_update(val, mask, arg,
-                                        CAPRI_PIN_SHIFT(HDMI, INPUT_DIS),
-                                        CAPRI_PIN_MASK(HDMI, INPUT_DIS));
-                        break;
-                default:
-                        dev_err(pctldev->dev,
-                                "Unrecognized pin config %d for pin %s (%d).\n",
-                                param, pdata->pins[pin].name, pin);
-                        return -EINVAL;
-                } /* switch config */
-        } /* for each config */
-        return 0;
-}
-static int capri_pinctrl_pin_config_set(struct pinctrl_dev *pctldev,
-                                        unsigned pin,
-                                        unsigned long *configs,
-                                        unsigned num_configs)
-{
-        struct capri_pinctrl_data *pdata = pinctrl_dev_get_drvdata(pctldev);
-        enum capri_pin_type pin_type;
-        u32 offset = 4 * pin;
-        u32 cfg_val, cfg_mask;
-        int rc;
-        cfg_val = 0;
-        cfg_mask = 0;
-        pin_type = pin_type_get(pctldev, pin);
-        /* Different pins have different configuration options */
-        switch (pin_type) {
-        case CAPRI_PIN_TYPE_STD:
-                rc = capri_std_pin_update(pctldev, pin, configs, num_configs,
-                        &cfg_val, &cfg_mask);
-                break;
-        case CAPRI_PIN_TYPE_I2C:
-                rc = capri_i2c_pin_update(pctldev, pin, configs, num_configs,
-                        &cfg_val, &cfg_mask);
-                break;
-        case CAPRI_PIN_TYPE_HDMI:
-                rc = capri_hdmi_pin_update(pctldev, pin, configs, num_configs,
-                        &cfg_val, &cfg_mask);
-                break;
-        default:
-                dev_err(pctldev->dev, "Unknown pin type for pin %s (%d).\n",
-                        pdata->pins[pin].name, pin);
-                return -EINVAL;
-        } /* switch pin type */
-        if (rc)
-                return rc;
-        dev_dbg(pctldev->dev,
-                "%s(): Set pin %s (%d) with config 0x%x, mask 0x%x\n",
-                __func__, pdata->pins[pin].name, pin, cfg_val, cfg_mask);
-        rc = regmap_update_bits(pdata->regmap, offset, cfg_mask, cfg_val);
-        if (rc) {
-                dev_err(pctldev->dev,
-                        "Error updating register for pin %s (%d).\n",
-                        pdata->pins[pin].name, pin);
-                return rc;
-        }
-        return 0;
-}
-static struct pinconf_ops capri_pinctrl_pinconf_ops = {
-        .pin_config_get = capri_pinctrl_pin_config_get,
-        .pin_config_set = capri_pinctrl_pin_config_set,
-};
-static struct pinctrl_desc capri_pinctrl_desc = {
-        /* name, pins, npins members initialized in probe function */
-        .pctlops = &capri_pinctrl_ops,
-        .pmxops = &capri_pinctrl_pinmux_ops,
-        .confops = &capri_pinctrl_pinconf_ops,
-        .owner = THIS_MODULE,
-};
-int __init capri_pinctrl_probe(struct platform_device *pdev)
-{
-        struct capri_pinctrl_data *pdata = &capri_pinctrl;
-        struct resource *res;
-        struct pinctrl_dev *pctl;
-        /* So far We can assume there is only 1 bank of registers */
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(&pdev->dev, "Missing MEM resource\n");
-                return -ENODEV;
-        }
-        pdata->reg_base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(pdata->reg_base)) {
-                dev_err(&pdev->dev, "Failed to ioremap MEM resource\n");
-                return -ENODEV;
-        }
-        /* Initialize the dynamic part of pinctrl_desc */
-        pdata->regmap = devm_regmap_init_mmio(&pdev->dev, pdata->reg_base,
-                &capri_pinctrl_regmap_config);
-        if (IS_ERR(pdata->regmap)) {
-                dev_err(&pdev->dev, "Regmap MMIO init failed.\n");
-                return -ENODEV;
-        }
-        capri_pinctrl_desc.name = dev_name(&pdev->dev);
-        capri_pinctrl_desc.pins = capri_pinctrl.pins;
-        capri_pinctrl_desc.npins = capri_pinctrl.npins;
-        pctl = pinctrl_register(&capri_pinctrl_desc,
-                                &pdev->dev,
-                                pdata);
-        if (!pctl) {
-                dev_err(&pdev->dev, "Failed to register pinctrl\n");
-                return -ENODEV;
-        }
-        platform_set_drvdata(pdev, pdata);
-        return 0;
-}
-static struct of_device_id capri_pinctrl_of_match[] = {
-        { .compatible = "brcm,bcm11351-pinctrl", },
-        { },
-};
-static struct platform_driver capri_pinctrl_driver = {
-        .driver = {
-                .name = "bcm-capri-pinctrl",
-                .owner = THIS_MODULE,
-                .of_match_table = capri_pinctrl_of_match,
-        },
-};
-module_platform_driver_probe(capri_pinctrl_driver, capri_pinctrl_probe);
-MODULE_AUTHOR("Sherman Yin <syin@broadcom.com>");
-MODULE_DESCRIPTION("Broadcom Capri pinctrl driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/pinctrl/pinctrl-msm.c b/drivers/pinctrl/pinctrl-msm.c
index 38d579b47f31..e43fbce56598 100644
--- a/drivers/pinctrl/pinctrl-msm.c
+++ b/drivers/pinctrl/pinctrl-msm.c
@@ -665,7 +665,10 @@ static void msm_gpio_irq_ack(struct irq_data *d)
        spin_lock_irqsave(&pctrl->lock, flags);
        val = readl(pctrl->regs + g->intr_status_reg);
-        val &= ~BIT(g->intr_status_bit);
+        if (g->intr_ack_high)
+                val |= BIT(g->intr_status_bit);
+        else
+                val &= ~BIT(g->intr_status_bit);
        writel(val, pctrl->regs + g->intr_status_reg);
        if (test_bit(d->hwirq, pctrl->dual_edge_irqs))
@@ -744,6 +747,7 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type)
                        break;
                case IRQ_TYPE_EDGE_BOTH:
                        val |= BIT(g->intr_detection_bit);
+                        val |= BIT(g->intr_polarity_bit);
                        break;
                case IRQ_TYPE_LEVEL_LOW:
                        break;
diff --git a/drivers/pinctrl/pinctrl-msm.h b/drivers/pinctrl/pinctrl-msm.h
index 8fbe9fb19f36..6e26f1b676d7 100644
--- a/drivers/pinctrl/pinctrl-msm.h
+++ b/drivers/pinctrl/pinctrl-msm.h
@@ -84,6 +84,7 @@ struct msm_pingroup {
        unsigned intr_enable_bit:5;
        unsigned intr_status_bit:5;
+        unsigned intr_ack_high:1;
        unsigned intr_target_bit:5;
        unsigned intr_raw_status_bit:5;
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index 208341fd57d2..8f6f16ef73f3 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -877,7 +877,6 @@ static void nmk_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
        struct nmk_gpio_chip *nmk_chip = container_of(chip, struct nmk_gpio_chip, chip);
        u32 status;
-        pr_err("PLONK IRQ %d\n", irq);
        clk_enable(nmk_chip->clk);
        status = readl(nmk_chip->addr + NMK_GPIO_IS);
        clk_disable(nmk_chip->clk);
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index 46dddc159286..96c60d230c13 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -342,7 +342,7 @@ static const struct pinctrl_ops rockchip_pctrl_ops = {
 * @pin: pin to change
 * @mux: new mux function to set
 */
-static void rockchip_set_mux(struct rockchip_pin_bank *bank, int pin, int mux)
+static int rockchip_set_mux(struct rockchip_pin_bank *bank, int pin, int mux)
 {
        struct rockchip_pinctrl *info = bank->drvdata;
        void __iomem *reg = info->reg_base + info->ctrl->mux_offset;
@@ -350,6 +350,20 @@ static void rockchip_set_mux(struct rockchip_pin_bank *bank, int pin, int mux)
        u8 bit;
        u32 data;
+        /*
+         * The first 16 pins of rk3188_bank0 are always gpios and do not have
+         * a mux register at all.
+         */
+        if (bank->bank_type == RK3188_BANK0 && pin < 16) {
+                if (mux != RK_FUNC_GPIO) {
+                        dev_err(info->dev,
+                                "pin %d only supports a gpio mux\n", pin);
+                        return -ENOTSUPP;
+                } else {
+                        return 0;
+                }
+        }
        dev_dbg(info->dev, "setting mux of GPIO%d-%d to %d\n",
                                                bank->bank_num, pin, mux);
@@ -365,6 +379,8 @@ static void rockchip_set_mux(struct rockchip_pin_bank *bank, int pin, int mux)
        writel(data, reg);
        spin_unlock_irqrestore(&bank->slock, flags);
+        return 0;
 }
 #define RK2928_PULL_OFFSET              0x118
@@ -560,7 +576,7 @@ static int rockchip_pmx_enable(struct pinctrl_dev *pctldev, unsigned selector,
        const unsigned int *pins = info->groups[group].pins;
        const struct rockchip_pin_config *data = info->groups[group].data;
        struct rockchip_pin_bank *bank;
-        int cnt;
+        int cnt, ret = 0;
        dev_dbg(info->dev, "enable function %s group %s\n",
                info->functions[selector].name, info->groups[group].name);
@@ -571,8 +587,18 @@ static int rockchip_pmx_enable(struct pinctrl_dev *pctldev, unsigned selector,
         */
        for (cnt = 0; cnt < info->groups[group].npins; cnt++) {
                bank = pin_to_bank(info, pins[cnt]);
-                rockchip_set_mux(bank, pins[cnt] - bank->pin_base,
+                ret = rockchip_set_mux(bank, pins[cnt] - bank->pin_base,
-                                 data[cnt].func);
+                                       data[cnt].func);
+                if (ret)
+                        break;
+        }
+        if (ret) {
+                /* revert the already done pin settings */
+                for (cnt--; cnt >= 0; cnt--)
+                        rockchip_set_mux(bank, pins[cnt] - bank->pin_base, 0);
+                return ret;
        }
        return 0;
@@ -607,7 +633,7 @@ static int rockchip_pmx_gpio_set_direction(struct pinctrl_dev *pctldev,
        struct rockchip_pinctrl *info = pinctrl_dev_get_drvdata(pctldev);
        struct rockchip_pin_bank *bank;
        struct gpio_chip *chip;
-        int pin;
+        int pin, ret;
        u32 data;
        chip = range->gc;
@@ -617,7 +643,9 @@ static int rockchip_pmx_gpio_set_direction(struct pinctrl_dev *pctldev,
        dev_dbg(info->dev, "gpio_direction for pin %u as %s-%d to %s\n",
                 offset, range->name, pin, input ? "input" : "output");
-        rockchip_set_mux(bank, pin, RK_FUNC_GPIO);
+        ret = rockchip_set_mux(bank, pin, RK_FUNC_GPIO);
+        if (ret < 0)
+                return ret;
        data = readl_relaxed(bank->reg_base + GPIO_SWPORT_DDR);
        /* set bit to 1 for output, 0 for input */
@@ -1144,9 +1172,13 @@ static int rockchip_irq_set_type(struct irq_data *d, unsigned int type)
        u32 polarity;
        u32 level;
        u32 data;
+        int ret;
        /* make sure the pin is configured as gpio input */
-        rockchip_set_mux(bank, d->hwirq, RK_FUNC_GPIO);
+        ret = rockchip_set_mux(bank, d->hwirq, RK_FUNC_GPIO);
+        if (ret < 0)
+                return ret;
        data = readl_relaxed(bank->reg_base + GPIO_SWPORT_DDR);
        data &= ~mask;
        writel_relaxed(data, bank->reg_base + GPIO_SWPORT_DDR);
@@ -1534,7 +1566,7 @@ static struct rockchip_pin_ctrl rk3188_pin_ctrl = {
                .nr_banks               = ARRAY_SIZE(rk3188_pin_banks),
                .label                  = "RK3188-GPIO",
                .type                   = RK3188,
-                .mux_offset             = 0x68,
+                .mux_offset             = 0x60,
                .pull_calc_reg          = rk3188_calc_pull_reg_and_bit,
 };
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 81075f2a1d3f..2960557bfed9 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -810,6 +810,7 @@ static const struct pinconf_ops pcs_pinconf_ops = {
 static int pcs_add_pin(struct pcs_device *pcs, unsigned offset,
                unsigned pin_pos)
 {
+        struct pcs_soc_data *pcs_soc = &pcs->socdata;
        struct pinctrl_pin_desc *pin;
        struct pcs_name *pn;
        int i;
@@ -821,6 +822,18 @@ static int pcs_add_pin(struct pcs_device *pcs, unsigned offset,
                return -ENOMEM;
        }
+        if (pcs_soc->irq_enable_mask) {
+                unsigned val;
+                val = pcs->read(pcs->base + offset);
+                if (val & pcs_soc->irq_enable_mask) {
+                        dev_dbg(pcs->dev, "irq enabled at boot for pin at %lx (%x), clearing\n",
+                                (unsigned long)pcs->res->start + offset, val);
+                        val &= ~pcs_soc->irq_enable_mask;
+                        pcs->write(val, pcs->base + offset);
+                }
+        }
        pin = &pcs->pins.pa[i];
        pn = &pcs->names[i];
        sprintf(pn->name, "%lx.%d",
diff --git a/drivers/pinctrl/pinctrl-tb10x.c b/drivers/pinctrl/pinctrl-tb10x.c
index c5e0f6973a3b..26ca6855f478 100644
--- a/drivers/pinctrl/pinctrl-tb10x.c
+++ b/drivers/pinctrl/pinctrl-tb10x.c
@@ -629,9 +629,8 @@ static int tb10x_gpio_request_enable(struct pinctrl_dev *pctl,
         */
        for (i = 0; i < state->pinfuncgrpcnt; i++) {
                const struct tb10x_pinfuncgrp *pfg = &state->pingroups[i];
-                unsigned int port = pfg->port;
                unsigned int mode = pfg->mode;
-                int j;
+                int j, port = pfg->port;
                /*
                 * Skip pin groups which are always mapped and don't need
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7790.c b/drivers/pinctrl/sh-pfc/pfc-r8a7790.c
index 48093719167a..f5cd3f961808 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7790.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7790.c
@@ -4794,8 +4794,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                FN_MSIOF0_SCK_B, 0,
                /* IP5_23_21 [3] */
                FN_WE1_N, FN_IERX, FN_CAN1_RX, FN_VI1_G4,
-                FN_VI1_G4_B, FN_VI2_R6, FN_SCIFA0_CTS_N_B,
+                FN_VI1_G4_B, FN_VI2_R6, FN_SCIFA0_CTS_N_B, FN_IERX_C,
-                FN_IERX_C, 0,
                /* IP5_20_18 [3] */
                FN_WE0_N, FN_IECLK, FN_CAN_CLK,
                FN_VI2_VSYNC_N, FN_SCIFA0_TXD_B, FN_VI2_VSYNC_N_B, 0, 0,
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 5186d70c49d4..7868bf3a0f91 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -5288,7 +5288,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                /* SEL_SCIF3 [2] */
                FN_SEL_SCIF3_0, FN_SEL_SCIF3_1, FN_SEL_SCIF3_2, FN_SEL_SCIF3_3,
                /* SEL_IEB [2] */
-                FN_SEL_IEB_0, FN_SEL_IEB_1, FN_SEL_IEB_2,
+                FN_SEL_IEB_0, FN_SEL_IEB_1, FN_SEL_IEB_2, 0,
                /* SEL_MMC [1] */
                FN_SEL_MMC_0, FN_SEL_MMC_1,
                /* SEL_SCIF5 [1] */
diff --git a/drivers/pinctrl/vt8500/pinctrl-wmt.c b/drivers/pinctrl/vt8500/pinctrl-wmt.c
index 9802b67040cc..2c61281bebd7 100644
--- a/drivers/pinctrl/vt8500/pinctrl-wmt.c
+++ b/drivers/pinctrl/vt8500/pinctrl-wmt.c
@@ -523,17 +523,6 @@ static int wmt_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
                return GPIOF_DIR_IN;
 }
-static int wmt_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
-{
-        return pinctrl_gpio_direction_input(chip->base + offset);
-}
-static int wmt_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
-                                     int value)
-{
-        return pinctrl_gpio_direction_output(chip->base + offset);
-}
 static int wmt_gpio_get_value(struct gpio_chip *chip, unsigned offset)
 {
        struct wmt_pinctrl_data *data = dev_get_drvdata(chip->dev);
@@ -568,6 +557,18 @@ static void wmt_gpio_set_value(struct gpio_chip *chip, unsigned offset,
                wmt_clearbits(data, reg_data_out, BIT(bit));
 }
+static int wmt_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+{
+        return pinctrl_gpio_direction_input(chip->base + offset);
+}
+static int wmt_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
+                                     int value)
+{
+        wmt_gpio_set_value(chip, offset, value);
+        return pinctrl_gpio_direction_output(chip->base + offset);
+}
 static struct gpio_chip wmt_gpio_chip = {
        .label = "gpio-wmt",
        .owner = THIS_MODULE,
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index 9f611cbbc294..c31aa07b3ba5 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -83,8 +83,7 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
 {
        struct acpi_device *acpi_dev;
        acpi_handle handle;
-        struct acpi_buffer buffer;
+        int ret = 0;
-        int ret;
        pnp_dbg(&dev->dev, "set resources\n");
@@ -97,19 +96,26 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
        if (WARN_ON_ONCE(acpi_dev != dev->data))
                dev->data = acpi_dev;
-        ret = pnpacpi_build_resource_template(dev, &buffer);
+        if (acpi_has_method(handle, METHOD_NAME__SRS)) {
-        if (ret)
+                struct acpi_buffer buffer;
-                return ret;
-        ret = pnpacpi_encode_resources(dev, &buffer);
+                ret = pnpacpi_build_resource_template(dev, &buffer);
-        if (ret) {
+                if (ret)
+                        return ret;
+                ret = pnpacpi_encode_resources(dev, &buffer);
+                if (!ret) {
+                        acpi_status status;
+                        status = acpi_set_current_resources(handle, &buffer);
+                        if (ACPI_FAILURE(status))
+                                ret = -EIO;
+                }
                kfree(buffer.pointer);
-                return ret;
        }
-        if (ACPI_FAILURE(acpi_set_current_resources(handle, &buffer)))
+        if (!ret && acpi_bus_power_manageable(handle))
-                ret = -EINVAL;
-        else if (acpi_bus_power_manageable(handle))
                ret = acpi_bus_set_power(handle, ACPI_STATE_D0);
-        kfree(buffer.pointer);
        return ret;
 }
@@ -117,7 +123,7 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
 {
        struct acpi_device *acpi_dev;
        acpi_handle handle;
-        int ret;
+        acpi_status status;
        dev_dbg(&dev->dev, "disable resources\n");
@@ -128,13 +134,15 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
        }
        /* acpi_unregister_gsi(pnp_irq(dev, 0)); */
-        ret = 0;
        if (acpi_bus_power_manageable(handle))
                acpi_bus_set_power(handle, ACPI_STATE_D3_COLD);
-                /* continue even if acpi_bus_set_power() fails */
-        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL)))
+        /* continue even if acpi_bus_set_power() fails */
-                ret = -ENODEV;
+        status = acpi_evaluate_object(handle, "_DIS", NULL, NULL);
-        return ret;
+        if (ACPI_FAILURE(status) && status != AE_NOT_FOUND)
+                return -ENODEV;
+        return 0;
 }
 #ifdef CONFIG_ACPI_SLEEP
diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
index deb7f4bcdb7b..438d4c72c7b3 100644
--- a/drivers/pnp/pnpbios/bioscalls.c
+++ b/drivers/pnp/pnpbios/bioscalls.c
@@ -37,7 +37,7 @@ __visible struct {
 * kernel begins at offset 3GB...
 */
-asmlinkage void pnp_bios_callfunc(void);
+asmlinkage __visible void pnp_bios_callfunc(void);
 __asm__(".text                  \n"
        __ALIGN_STR "\n"
diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
index 258fef272ea7..ebf0d6710b5a 100644
--- a/drivers/pnp/quirks.c
+++ b/drivers/pnp/quirks.c
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/pci.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/pnp.h>
@@ -334,6 +335,81 @@ static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
 }
 #endif
+#ifdef CONFIG_PCI
+/* Device IDs of parts that have 32KB MCH space */
+static const unsigned int mch_quirk_devices[] = {
+        0x0154, /* Ivy Bridge */
+        0x0c00, /* Haswell */
+};
+static struct pci_dev *get_intel_host(void)
+{
+        int i;
+        struct pci_dev *host;
+        for (i = 0; i < ARRAY_SIZE(mch_quirk_devices); i++) {
+                host = pci_get_device(PCI_VENDOR_ID_INTEL, mch_quirk_devices[i],
+                                      NULL);
+                if (host)
+                        return host;
+        }
+        return NULL;
+}
+static void quirk_intel_mch(struct pnp_dev *dev)
+{
+        struct pci_dev *host;
+        u32 addr_lo, addr_hi;
+        struct pci_bus_region region;
+        struct resource mch;
+        struct pnp_resource *pnp_res;
+        struct resource *res;
+        host = get_intel_host();
+        if (!host)
+                return;
+        /*
+         * MCHBAR is not an architected PCI BAR, so MCH space is usually
+         * reported as a PNP0C02 resource.  The MCH space was originally
+         * 16KB, but is 32KB in newer parts.  Some BIOSes still report a
+         * PNP0C02 resource that is only 16KB, which means the rest of the
+         * MCH space is consumed but unreported.
+         */
+        /*
+         * Read MCHBAR for Host Member Mapped Register Range Base
+         * https://www-ssl.intel.com/content/www/us/en/processors/core/4th-gen-core-family-desktop-vol-2-datasheet
+         * Sec 3.1.12.
+         */
+        pci_read_config_dword(host, 0x48, &addr_lo);
+        region.start = addr_lo & ~0x7fff;
+        pci_read_config_dword(host, 0x4c, &addr_hi);
+        region.start |= (u64) addr_hi << 32;
+        region.end = region.start + 32*1024 - 1;
+        memset(&mch, 0, sizeof(mch));
+        mch.flags = IORESOURCE_MEM;
+        pcibios_bus_to_resource(host->bus, &mch, &region);
+        list_for_each_entry(pnp_res, &dev->resources, list) {
+                res = &pnp_res->res;
+                if (res->end < mch.start || res->start > mch.end)
+                        continue;       /* no overlap */
+                if (res->start == mch.start && res->end == mch.end)
+                        continue;       /* exact match */
+                dev_info(&dev->dev, FW_BUG "PNP resource %pR covers only part of %s Intel MCH; extending to %pR\n",
+                         res, pci_name(host), &mch);
+                res->start = mch.start;
+                res->end = mch.end;
+                break;
+        }
+        pci_dev_put(host);
+}
+#endif
 /*
 *  PnP Quirks
 *  Cards or devices that need some tweaking due to incomplete resource info
@@ -364,6 +440,9 @@ static struct pnp_fixup pnp_fixups[] = {
 #ifdef CONFIG_AMD_NB
        {"PNP0c01", quirk_amd_mmconfig_area},
 #endif
+#ifdef CONFIG_PCI
+        {"PNP0c02", quirk_intel_mch},
+#endif
        {""}
 };
diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c
index 476aa495c110..b95cf71ed695 100644
--- a/drivers/power/reset/vexpress-poweroff.c
+++ b/drivers/power/reset/vexpress-poweroff.c
@@ -11,7 +11,7 @@
 * Copyright (C) 2012 ARM Limited
 */
-#include <linux/jiffies.h>
+#include <linux/delay.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
@@ -23,17 +23,12 @@
 static void vexpress_reset_do(struct device *dev, const char *what)
 {
        int err = -ENOENT;
-        struct vexpress_config_func *func =
+        struct vexpress_config_func *func = dev_get_drvdata(dev);
-                        vexpress_config_func_get_by_dev(dev);
        if (func) {
-                unsigned long timeout;
                err = vexpress_config_write(func, 0, 0);
+                if (!err)
-                timeout = jiffies + HZ;
+                        mdelay(1000);
-                while (time_before(jiffies, timeout))
-                        cpu_relax();
        }
        dev_emerg(dev, "Unable to %s (%d)\n", what, err);
@@ -96,12 +91,18 @@ static int vexpress_reset_probe(struct platform_device *pdev)
        enum vexpress_reset_func func;
        const struct of_device_id *match =
                        of_match_device(vexpress_reset_of_match, &pdev->dev);
+        struct vexpress_config_func *config_func;
        if (match)
                func = (enum vexpress_reset_func)match->data;
        else
                func = pdev->id_entry->driver_data;
+        config_func = vexpress_config_func_get_by_dev(&pdev->dev);
+        if (!config_func)
+                return -EINVAL;
+        dev_set_drvdata(&pdev->dev, config_func);
        switch (func) {
        case FUNC_SHUTDOWN:
                vexpress_power_off_device = &pdev->dev;
diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
index 6963bdf54175..6aea373547f6 100644
--- a/drivers/ptp/Kconfig
+++ b/drivers/ptp/Kconfig
@@ -6,6 +6,7 @@ menu "PTP clock support"
 config PTP_1588_CLOCK
        tristate "PTP clock support"
+        depends on NET
        select PPS
        select NET_PTP_CLASSIFY
        help
@@ -74,7 +75,7 @@ config DP83640_PHY
 config PTP_1588_CLOCK_PCH
        tristate "Intel PCH EG20T as PTP clock"
        depends on X86 || COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && NET
        select PTP_1588_CLOCK
        help
          This driver adds support for using the PCH EG20T as a PTP
diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c
index 8ad26b8bf418..cb2d4f0f9711 100644
--- a/drivers/pwm/pwm-spear.c
+++ b/drivers/pwm/pwm-spear.c
@@ -2,7 +2,7 @@
 * ST Microelectronics SPEAr Pulse Width Modulator driver
 *
 * Copyright (C) 2012 ST Microelectronics
- * Shiraz Hashim <shiraz.hashim@st.com>
+ * Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
@@ -264,6 +264,6 @@ static struct platform_driver spear_pwm_driver = {
 module_platform_driver(spear_pwm_driver);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Shiraz Hashim <shiraz.hashim@st.com>");
+MODULE_AUTHOR("Shiraz Hashim <shiraz.linux.kernel@gmail.com>");
 MODULE_AUTHOR("Viresh Kumar <viresh.kumar@linaro.com>");
 MODULE_ALIAS("platform:spear-pwm");
diff --git a/drivers/regulator/pbias-regulator.c b/drivers/regulator/pbias-regulator.c
index ded3b3574209..6d38be3d970c 100644
--- a/drivers/regulator/pbias-regulator.c
+++ b/drivers/regulator/pbias-regulator.c
@@ -38,66 +38,24 @@ struct pbias_reg_info {
 struct pbias_regulator_data {
        struct regulator_desc desc;
        void __iomem *pbias_addr;
-        unsigned int pbias_reg;
        struct regulator_dev *dev;
        struct regmap *syscon;
        const struct pbias_reg_info *info;
        int voltage;
 };
-static int pbias_regulator_set_voltage(struct regulator_dev *dev,
+static const unsigned int pbias_volt_table[] = {
-                        int min_uV, int max_uV, unsigned *selector)
+        1800000,
-{
+        3000000
-        struct pbias_regulator_data *data = rdev_get_drvdata(dev);
+};
-        const struct pbias_reg_info *info = data->info;
-        int ret, vmode;
-        if (min_uV <= 1800000)
-                vmode = 0;
-        else if (min_uV > 1800000)
-                vmode = info->vmode;
-        ret = regmap_update_bits(data->syscon, data->pbias_reg,
-                                                info->vmode, vmode);
-        return ret;
-}
-static int pbias_regulator_get_voltage(struct regulator_dev *rdev)
-{
-        struct pbias_regulator_data *data = rdev_get_drvdata(rdev);
-        const struct pbias_reg_info *info = data->info;
-        int value, voltage;
-        regmap_read(data->syscon, data->pbias_reg, &value);
-        value &= info->vmode;
-        voltage = value ? 3000000 : 1800000;
-        return voltage;
-}
 static int pbias_regulator_enable(struct regulator_dev *rdev)
 {
        struct pbias_regulator_data *data = rdev_get_drvdata(rdev);
        const struct pbias_reg_info *info = data->info;
-        int ret;
-        ret = regmap_update_bits(data->syscon, data->pbias_reg,
-                                        info->enable_mask, info->enable);
-        return ret;
-}
-static int pbias_regulator_disable(struct regulator_dev *rdev)
-{
-        struct pbias_regulator_data *data = rdev_get_drvdata(rdev);
-        const struct pbias_reg_info *info = data->info;
-        int ret;
-        ret = regmap_update_bits(data->syscon, data->pbias_reg,
+        return regmap_update_bits(data->syscon, rdev->desc->enable_reg,
-                                                info->enable_mask, 0);
+                                  info->enable_mask, info->enable);
-        return ret;
 }
 static int pbias_regulator_is_enable(struct regulator_dev *rdev)
@@ -106,17 +64,18 @@ static int pbias_regulator_is_enable(struct regulator_dev *rdev)
        const struct pbias_reg_info *info = data->info;
        int value;
-        regmap_read(data->syscon, data->pbias_reg, &value);
+        regmap_read(data->syscon, rdev->desc->enable_reg, &value);
-        return (value & info->enable_mask) == info->enable_mask;
+        return (value & info->enable_mask) == info->enable;
 }
 static struct regulator_ops pbias_regulator_voltage_ops = {
-        .set_voltage    = pbias_regulator_set_voltage,
+        .list_voltage = regulator_list_voltage_table,
-        .get_voltage    = pbias_regulator_get_voltage,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
-        .enable         = pbias_regulator_enable,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
-        .disable        = pbias_regulator_disable,
+        .enable = pbias_regulator_enable,
-        .is_enabled     = pbias_regulator_is_enable,
+        .disable = regulator_disable_regmap,
+        .is_enabled = pbias_regulator_is_enable,
 };
 static const struct pbias_reg_info pbias_mmc_omap2430 = {
@@ -192,6 +151,7 @@ static int pbias_regulator_probe(struct platform_device *pdev)
        if (IS_ERR(syscon))
                return PTR_ERR(syscon);
+        cfg.regmap = syscon;
        cfg.dev = &pdev->dev;
        for (idx = 0; idx < PBIAS_NUM_REGS && data_idx < count; idx++) {
@@ -207,15 +167,19 @@ static int pbias_regulator_probe(struct platform_device *pdev)
                if (!res)
                        return -EINVAL;
-                drvdata[data_idx].pbias_reg = res->start;
                drvdata[data_idx].syscon = syscon;
                drvdata[data_idx].info = info;
                drvdata[data_idx].desc.name = info->name;
                drvdata[data_idx].desc.owner = THIS_MODULE;
                drvdata[data_idx].desc.type = REGULATOR_VOLTAGE;
                drvdata[data_idx].desc.ops = &pbias_regulator_voltage_ops;
+                drvdata[data_idx].desc.volt_table = pbias_volt_table;
                drvdata[data_idx].desc.n_voltages = 2;
                drvdata[data_idx].desc.enable_time = info->enable_time;
+                drvdata[data_idx].desc.vsel_reg = res->start;
+                drvdata[data_idx].desc.vsel_mask = info->vmode;
+                drvdata[data_idx].desc.enable_reg = res->start;
+                drvdata[data_idx].desc.enable_mask = info->enable_mask;
                cfg.init_data = pbias_matches[idx].init_data;
                cfg.driver_data = &drvdata[data_idx];
diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c
index bd628a6f981d..e5f13c4310fe 100644
--- a/drivers/rtc/rtc-hym8563.c
+++ b/drivers/rtc/rtc-hym8563.c
@@ -569,6 +569,9 @@ static int hym8563_probe(struct i2c_client *client,
        if (IS_ERR(hym8563->rtc))
                return PTR_ERR(hym8563->rtc);
+        /* the hym8563 alarm only supports a minute accuracy */
+        hym8563->rtc->uie_unsupported = 1;
 #ifdef CONFIG_COMMON_CLK
        hym8563_clkout_register_clk(hym8563);
 #endif
diff --git a/drivers/rtc/rtc-pcf8523.c b/drivers/rtc/rtc-pcf8523.c
index 5c8f8226c848..4cdb64be061b 100644
--- a/drivers/rtc/rtc-pcf8523.c
+++ b/drivers/rtc/rtc-pcf8523.c
@@ -206,7 +206,7 @@ static int pcf8523_rtc_read_time(struct device *dev, struct rtc_time *tm)
        tm->tm_hour = bcd2bin(regs[2] & 0x3f);
        tm->tm_mday = bcd2bin(regs[3] & 0x3f);
        tm->tm_wday = regs[4] & 0x7;
-        tm->tm_mon = bcd2bin(regs[5] & 0x1f);
+        tm->tm_mon = bcd2bin(regs[5] & 0x1f) - 1;
        tm->tm_year = bcd2bin(regs[6]) + 100;
        return rtc_valid_tm(tm);
@@ -229,7 +229,7 @@ static int pcf8523_rtc_set_time(struct device *dev, struct rtc_time *tm)
        regs[3] = bin2bcd(tm->tm_hour);
        regs[4] = bin2bcd(tm->tm_mday);
        regs[5] = tm->tm_wday;
-        regs[6] = bin2bcd(tm->tm_mon);
+        regs[6] = bin2bcd(tm->tm_mon + 1);
        regs[7] = bin2bcd(tm->tm_year - 100);
        msg.addr = client->addr;
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 1990285296c6..c316051d9bda 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -1252,7 +1252,7 @@ static __init int sclp_initcall(void)
                return rc;
        sclp_pdev = platform_device_register_simple("sclp", -1, NULL, 0);
-        rc = PTR_RET(sclp_pdev);
+        rc = PTR_ERR_OR_ZERO(sclp_pdev);
        if (rc)
                goto fail_platform_driver_unregister;
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 6e8f90f84e49..6e14999f9e8f 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -515,7 +515,7 @@ static int __init sclp_detect_standby_memory(void)
        if (rc)
                goto out;
        sclp_pdev = platform_device_register_simple("sclp_mem", -1, NULL, 0);
-        rc = PTR_RET(sclp_pdev);
+        rc = PTR_ERR_OR_ZERO(sclp_pdev);
        if (rc)
                goto out_driver;
        sclp_add_standby_memory();
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index 4eed38cd0af6..cd9c91909596 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -97,13 +97,16 @@ static void sclp_vt220_pm_event_fn(struct sclp_register *reg,
 static int __sclp_vt220_emit(struct sclp_vt220_request *request);
 static void sclp_vt220_emit_current(void);
-/* Registration structure for our interest in SCLP event buffers */
+/* Registration structure for SCLP output event buffers */
 static struct sclp_register sclp_vt220_register = {
        .send_mask              = EVTYP_VT220MSG_MASK,
+        .pm_event_fn            = sclp_vt220_pm_event_fn,
+};
+/* Registration structure for SCLP input event buffers */
+static struct sclp_register sclp_vt220_register_input = {
        .receive_mask           = EVTYP_VT220MSG_MASK,
-        .state_change_fn        = NULL,
        .receiver_fn            = sclp_vt220_receiver_fn,
-        .pm_event_fn            = sclp_vt220_pm_event_fn,
 };
@@ -715,9 +718,14 @@ static int __init sclp_vt220_tty_init(void)
        rc = tty_register_driver(driver);
        if (rc)
                goto out_init;
+        rc = sclp_register(&sclp_vt220_register_input);
+        if (rc)
+                goto out_reg;
        sclp_vt220_driver = driver;
        return 0;
+out_reg:
+        tty_unregister_driver(driver);
 out_init:
        __sclp_vt220_cleanup();
 out_driver:
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 9f0ea6cb6922..e3bf885f4a6c 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -541,18 +541,27 @@ static void chsc_process_sei_nt0(struct chsc_sei_nt0_area *sei_area)
 static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm)
 {
-        do {
+        static int ntsm_unsupported;
+        while (true) {
                memset(sei, 0, sizeof(*sei));
                sei->request.length = 0x0010;
                sei->request.code = 0x000e;
-                sei->ntsm = ntsm;
+                if (!ntsm_unsupported)
+                        sei->ntsm = ntsm;
                if (chsc(sei))
                        break;
                if (sei->response.code != 0x0001) {
-                        CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n",
+                        CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x, ntsm=%llx)\n",
-                                      sei->response.code);
+                                      sei->response.code, sei->ntsm);
+                        if (sei->response.code == 3 && sei->ntsm) {
+                                /* Fallback for old firmware. */
+                                ntsm_unsupported = 1;
+                                continue;
+                        }
                        break;
                }
@@ -568,7 +577,10 @@ static void chsc_process_event_information(struct chsc_sei *sei, u64 ntsm)
                        CIO_CRW_EVENT(2, "chsc: unhandled nt: %d\n", sei->nt);
                        break;
                }
-        } while (sei->u.nt0_area.flags & 0x80);
+                if (!(sei->u.nt0_area.flags & 0x80))
+                        break;
+        }
 }
 /*
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 8cf4a0c69baf..9a6e4a2cd072 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -7463,6 +7463,10 @@ static void hpsa_put_ctlr_into_performant_mode(struct ctlr_info *h)
        if (hpsa_simple_mode)
                return;
+        trans_support = readl(&(h->cfgtable->TransportSupport));
+        if (!(trans_support & PERFORMANT_MODE))
+                return;
        /* Check for I/O accelerator mode support */
        if (trans_support & CFGTBL_Trans_io_accel1) {
                transMethod |= CFGTBL_Trans_io_accel1 |
@@ -7479,10 +7483,6 @@ static void hpsa_put_ctlr_into_performant_mode(struct ctlr_info *h)
        }
        /* TODO, check that this next line h->nreply_queues is correct */
-        trans_support = readl(&(h->cfgtable->TransportSupport));
-        if (!(trans_support & PERFORMANT_MODE))
-                return;
        h->nreply_queues = h->msix_vector > 0 ? h->msix_vector : 1;
        hpsa_get_max_perf_mode_cmds(h);
        /* Performant mode ring buffer and supporting data structures */
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 7f0af4fcc001..6fd7d40b2c4d 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -8293,7 +8293,6 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state)
        mpt2sas_base_free_resources(ioc);
        pci_save_state(pdev);
-        pci_disable_device(pdev);
        pci_set_power_state(pdev, device_state);
        return 0;
 }
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 771c16bfdbac..f17aa7aa7879 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -189,6 +189,7 @@ scsi_abort_command(struct scsi_cmnd *scmd)
                /*
                 * Retry after abort failed, escalate to next level.
                 */
+                scmd->eh_eflags &= ~SCSI_EH_ABORT_SCHEDULED;
                SCSI_LOG_ERROR_RECOVERY(3,
                        scmd_printk(KERN_INFO, scmd,
                                    "scmd %p previous abort failed\n", scmd));
@@ -920,10 +921,12 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
        ses->prot_op = scmd->prot_op;
        scmd->prot_op = SCSI_PROT_NORMAL;
+        scmd->eh_eflags = 0;
        scmd->cmnd = ses->eh_cmnd;
        memset(scmd->cmnd, 0, BLK_MAX_CDB);
        memset(&scmd->sdb, 0, sizeof(scmd->sdb));
        scmd->request->next_rq = NULL;
+        scmd->result = 0;
        if (sense_bytes) {
                scmd->sdb.length = min_t(unsigned, SCSI_SENSE_BUFFERSIZE,
@@ -1157,6 +1160,15 @@ int scsi_eh_get_sense(struct list_head *work_q,
                                             __func__));
                        break;
                }
+                if (status_byte(scmd->result) != CHECK_CONDITION)
+                        /*
+                         * don't request sense if there's no check condition
+                         * status because the error we're processing isn't one
+                         * that has a sense code (and some devices get
+                         * confused by sense requests out of the blue)
+                         */
+                        continue;
                SCSI_LOG_ERROR_RECOVERY(2, scmd_printk(KERN_INFO, scmd,
                                                  "%s: requesting sense\n",
                                                  current->comm));
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 65a123d9c676..9db097a28a74 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -137,6 +137,7 @@ static void __scsi_queue_insert(struct scsi_cmnd *cmd, int reason, int unbusy)
         * lock such that the kblockd_schedule_work() call happens
         * before blk_cleanup_queue() finishes.
         */
+        cmd->result = 0;
        spin_lock_irqsave(q->queue_lock, flags);
        blk_requeue_request(q, cmd->request);
        kblockd_schedule_work(q, &device->requeue_work);
@@ -1044,6 +1045,7 @@ static int scsi_init_sgtable(struct request *req, struct scsi_data_buffer *sdb,
 */
 int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask)
 {
+        struct scsi_device *sdev = cmd->device;
        struct request *rq = cmd->request;
        int error = scsi_init_sgtable(rq, &cmd->sdb, gfp_mask);
@@ -1091,7 +1093,7 @@ err_exit:
        scsi_release_buffers(cmd);
        cmd->request->special = NULL;
        scsi_put_command(cmd);
-        put_device(&cmd->device->sdev_gendev);
+        put_device(&sdev->sdev_gendev);
        return error;
 }
 EXPORT_SYMBOL(scsi_init_io);
@@ -1273,7 +1275,7 @@ int scsi_prep_return(struct request_queue *q, struct request *req, int ret)
                        struct scsi_cmnd *cmd = req->special;
                        scsi_release_buffers(cmd);
                        scsi_put_command(cmd);
-                        put_device(&cmd->device->sdev_gendev);
+                        put_device(&sdev->sdev_gendev);
                        req->special = NULL;
                }
                break;
diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c
index fe30ea94ffe6..109802f776ed 100644
--- a/drivers/scsi/scsi_netlink.c
+++ b/drivers/scsi/scsi_netlink.c
@@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
                        goto next_msg;
                }
-                if (!capable(CAP_SYS_ADMIN)) {
+                if (!netlink_capable(skb, CAP_SYS_ADMIN)) {
                        err = -EPERM;
                        goto next_msg;
                }
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 1b681427dde0..c341f855fadc 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -1621,8 +1621,6 @@ void sas_rphy_free(struct sas_rphy *rphy)
        list_del(&rphy->list);
        mutex_unlock(&sas_host->lock);
-        sas_bsg_remove(shost, rphy);
        transport_destroy_device(dev);
        put_device(dev);
@@ -1681,6 +1679,7 @@ sas_rphy_remove(struct sas_rphy *rphy)
        }
        sas_rphy_unlink(rphy);
+        sas_bsg_remove(NULL, rphy);
        transport_remove_device(dev);
        device_del(dev);
 }
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 16bfd50cd3fe..db3b494e5926 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -750,8 +750,12 @@ static void __virtscsi_set_affinity(struct virtio_scsi *vscsi, bool affinity)
                vscsi->affinity_hint_set = true;
        } else {
-                for (i = 0; i < vscsi->num_queues; i++)
+                for (i = 0; i < vscsi->num_queues; i++) {
+                        if (!vscsi->req_vqs[i].vq)
+                                continue;
                        virtqueue_set_affinity(vscsi->req_vqs[i].vq, -1);
+                }
                vscsi->affinity_hint_set = false;
        }
diff --git a/drivers/sh/Makefile b/drivers/sh/Makefile
index fc67f564f02c..788ed9b59b4e 100644
--- a/drivers/sh/Makefile
+++ b/drivers/sh/Makefile
@@ -1,10 +1,12 @@
 #
 # Makefile for the SuperH specific drivers.
 #
-obj-y   := intc/
+obj-$(CONFIG_SUPERH)                    += intc/
+obj-$(CONFIG_ARCH_SHMOBILE_LEGACY)      += intc/
+ifneq ($(CONFIG_COMMON_CLK),y)
+obj-$(CONFIG_HAVE_CLK)                  += clk/
+endif
+obj-$(CONFIG_MAPLE)                     += maple/
+obj-$(CONFIG_SUPERHYWAY)                += superhyway/
-obj-$(CONFIG_HAVE_CLK)          += clk/
+obj-y                                   += pm_runtime.o
-obj-$(CONFIG_MAPLE)             += maple/
-obj-$(CONFIG_SUPERHYWAY)        += superhyway/
-obj-y                           += pm_runtime.o
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index 8afa5a4589f2..10c65eb51f85 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -50,8 +50,25 @@ static struct pm_clk_notifier_block platform_bus_notifier = {
        .con_ids = { NULL, },
 };
+static bool default_pm_on;
 static int __init sh_pm_runtime_init(void)
 {
+        if (IS_ENABLED(CONFIG_ARCH_SHMOBILE_MULTI)) {
+                if (!of_machine_is_compatible("renesas,emev2") &&
+                    !of_machine_is_compatible("renesas,r7s72100") &&
+                    !of_machine_is_compatible("renesas,r8a73a4") &&
+                    !of_machine_is_compatible("renesas,r8a7740") &&
+                    !of_machine_is_compatible("renesas,r8a7778") &&
+                    !of_machine_is_compatible("renesas,r8a7779") &&
+                    !of_machine_is_compatible("renesas,r8a7790") &&
+                    !of_machine_is_compatible("renesas,r8a7791") &&
+                    !of_machine_is_compatible("renesas,sh7372") &&
+                    !of_machine_is_compatible("renesas,sh73a0"))
+                        return 0;
+        }
+        default_pm_on = true;
        pm_clk_add_notifier(&platform_bus_type, &platform_bus_notifier);
        return 0;
 }
@@ -59,7 +76,8 @@ core_initcall(sh_pm_runtime_init);
 static int __init sh_pm_runtime_late_init(void)
 {
-        pm_genpd_poweroff_unused();
+        if (default_pm_on)
+                pm_genpd_poweroff_unused();
        return 0;
 }
 late_initcall(sh_pm_runtime_late_init);
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 60f2b41c7310..213b5cbb9dcc 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -91,8 +91,8 @@ config SPI_BFIN5XX
        help
          This is the SPI controller master driver for Blackfin 5xx processor.
-config SPI_BFIN_V3
+config SPI_ADI_V3
-        tristate "SPI controller v3 for Blackfin"
+        tristate "SPI controller v3 for ADI"
        depends on BF60x
        help
          This is the SPI controller v3 master driver
@@ -148,6 +148,13 @@ config SPI_BUTTERFLY
          inexpensive battery powered microcontroller evaluation board.
          This same cable can be used to flash new firmware.
+config SPI_CADENCE
+        tristate "Cadence SPI controller"
+        depends on ARM
+        help
+          This selects the Cadence SPI controller master driver
+          used by Xilinx Zynq.
 config SPI_CLPS711X
        tristate "CLPS711X host SPI controller"
        depends on ARCH_CLPS711X || COMPILE_TEST
@@ -505,7 +512,7 @@ config SPI_TEGRA20_SLINK
 config SPI_TOPCLIFF_PCH
        tristate "Intel EG20T PCH/LAPIS Semicon IOH(ML7213/ML7223/ML7831) SPI"
-        depends on PCI
+        depends on PCI && (X86_32 || COMPILE_TEST)
        help
          SPI driver for the Topcliff PCH (Platform Controller Hub) SPI bus
          used in some x86 embedded processors.
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index bd792669e563..929c9f5eac01 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -18,10 +18,11 @@ obj-$(CONFIG_SPI_BCM2835)		+= spi-bcm2835.o
 obj-$(CONFIG_SPI_BCM63XX)               += spi-bcm63xx.o
 obj-$(CONFIG_SPI_BCM63XX_HSSPI)         += spi-bcm63xx-hsspi.o
 obj-$(CONFIG_SPI_BFIN5XX)               += spi-bfin5xx.o
-obj-$(CONFIG_SPI_BFIN_V3)               += spi-bfin-v3.o
+obj-$(CONFIG_SPI_ADI_V3)                += spi-adi-v3.o
 obj-$(CONFIG_SPI_BFIN_SPORT)            += spi-bfin-sport.o
 obj-$(CONFIG_SPI_BITBANG)               += spi-bitbang.o
 obj-$(CONFIG_SPI_BUTTERFLY)             += spi-butterfly.o
+obj-$(CONFIG_SPI_CADENCE)               += spi-cadence.o
 obj-$(CONFIG_SPI_CLPS711X)              += spi-clps711x.o
 obj-$(CONFIG_SPI_COLDFIRE_QSPI)         += spi-coldfire-qspi.o
 obj-$(CONFIG_SPI_DAVINCI)               += spi-davinci.o
diff --git a/drivers/spi/spi-bfin-v3.c b/drivers/spi/spi-adi-v3.c
index 4089d0e0d84e..dcb2287c7f8a 100644
--- a/drivers/spi/spi-bfin-v3.c
+++ b/drivers/spi/spi-adi-v3.c
@@ -1,7 +1,7 @@
 /*
 * Analog Devices SPI3 controller driver
 *
- * Copyright (c) 2013 Analog Devices Inc.
+ * Copyright (c) 2014 Analog Devices Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -13,6 +13,7 @@
 * GNU General Public License for more details.
 */
+#include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
@@ -26,35 +27,34 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/spi/spi.h>
+#include <linux/spi/adi_spi3.h>
 #include <linux/types.h>
-#include <asm/bfin_spi3.h>
-#include <asm/cacheflush.h>
 #include <asm/dma.h>
 #include <asm/portmux.h>
-enum bfin_spi_state {
+enum adi_spi_state {
        START_STATE,
        RUNNING_STATE,
        DONE_STATE,
        ERROR_STATE
 };
-struct bfin_spi_master;
+struct adi_spi_master;
-struct bfin_spi_transfer_ops {
+struct adi_spi_transfer_ops {
-        void (*write) (struct bfin_spi_master *);
+        void (*write) (struct adi_spi_master *);
-        void (*read) (struct bfin_spi_master *);
+        void (*read) (struct adi_spi_master *);
-        void (*duplex) (struct bfin_spi_master *);
+        void (*duplex) (struct adi_spi_master *);
 };
 /* runtime info for spi master */
-struct bfin_spi_master {
+struct adi_spi_master {
        /* SPI framework hookup */
        struct spi_master *master;
        /* Regs base of SPI controller */
-        struct bfin_spi_regs __iomem *regs;
+        struct adi_spi_regs __iomem *regs;
        /* Pin request list */
        u16 *pin_req;
@@ -65,7 +65,7 @@ struct bfin_spi_master {
        /* Current message transfer state info */
        struct spi_message *cur_msg;
        struct spi_transfer *cur_transfer;
-        struct bfin_spi_device *cur_chip;
+        struct adi_spi_device *cur_chip;
        unsigned transfer_len;
        /* transfer buffer */
@@ -90,12 +90,12 @@ struct bfin_spi_master {
        u32 ssel;
        unsigned long sclk;
-        enum bfin_spi_state state;
+        enum adi_spi_state state;
-        const struct bfin_spi_transfer_ops *ops;
+        const struct adi_spi_transfer_ops *ops;
 };
-struct bfin_spi_device {
+struct adi_spi_device {
        u32 control;
        u32 clock;
        u32 ssel;
@@ -105,17 +105,25 @@ struct bfin_spi_device {
        u32 cs_gpio;
        u32 tx_dummy_val; /* tx value for rx only transfer */
        bool enable_dma;
-        const struct bfin_spi_transfer_ops *ops;
+        const struct adi_spi_transfer_ops *ops;
 };
-static void bfin_spi_enable(struct bfin_spi_master *drv_data)
+static void adi_spi_enable(struct adi_spi_master *drv_data)
 {
-        bfin_write_or(&drv_data->regs->control, SPI_CTL_EN);
+        u32 ctl;
+        ctl = ioread32(&drv_data->regs->control);
+        ctl |= SPI_CTL_EN;
+        iowrite32(ctl, &drv_data->regs->control);
 }
-static void bfin_spi_disable(struct bfin_spi_master *drv_data)
+static void adi_spi_disable(struct adi_spi_master *drv_data)
 {
-        bfin_write_and(&drv_data->regs->control, ~SPI_CTL_EN);
+        u32 ctl;
+        ctl = ioread32(&drv_data->regs->control);
+        ctl &= ~SPI_CTL_EN;
+        iowrite32(ctl, &drv_data->regs->control);
 }
 /* Caculate the SPI_CLOCK register value based on input HZ */
@@ -128,35 +136,43 @@ static u32 hz_to_spi_clock(u32 sclk, u32 speed_hz)
        return spi_clock;
 }
-static int bfin_spi_flush(struct bfin_spi_master *drv_data)
+static int adi_spi_flush(struct adi_spi_master *drv_data)
 {
        unsigned long limit = loops_per_jiffy << 1;
        /* wait for stop and clear stat */
-        while (!(bfin_read(&drv_data->regs->status) & SPI_STAT_SPIF) && --limit)
+        while (!(ioread32(&drv_data->regs->status) & SPI_STAT_SPIF) && --limit)
                cpu_relax();
-        bfin_write(&drv_data->regs->status, 0xFFFFFFFF);
+        iowrite32(0xFFFFFFFF, &drv_data->regs->status);
        return limit;
 }
 /* Chip select operation functions for cs_change flag */
-static void bfin_spi_cs_active(struct bfin_spi_master *drv_data, struct bfin_spi_device *chip)
+static void adi_spi_cs_active(struct adi_spi_master *drv_data, struct adi_spi_device *chip)
 {
-        if (likely(chip->cs < MAX_CTRL_CS))
+        if (likely(chip->cs < MAX_CTRL_CS)) {
-                bfin_write_and(&drv_data->regs->ssel, ~chip->ssel);
+                u32 reg;
-        else
+                reg = ioread32(&drv_data->regs->ssel);
+                reg &= ~chip->ssel;
+                iowrite32(reg, &drv_data->regs->ssel);
+        } else {
                gpio_set_value(chip->cs_gpio, 0);
+        }
 }
-static void bfin_spi_cs_deactive(struct bfin_spi_master *drv_data,
+static void adi_spi_cs_deactive(struct adi_spi_master *drv_data,
-                                struct bfin_spi_device *chip)
+                                struct adi_spi_device *chip)
 {
-        if (likely(chip->cs < MAX_CTRL_CS))
+        if (likely(chip->cs < MAX_CTRL_CS)) {
-                bfin_write_or(&drv_data->regs->ssel, chip->ssel);
+                u32 reg;
-        else
+                reg = ioread32(&drv_data->regs->ssel);
+                reg |= chip->ssel;
+                iowrite32(reg, &drv_data->regs->ssel);
+        } else {
                gpio_set_value(chip->cs_gpio, 1);
+        }
        /* Move delay here for consistency */
        if (chip->cs_chg_udelay)
@@ -164,187 +180,192 @@ static void bfin_spi_cs_deactive(struct bfin_spi_master *drv_data,
 }
 /* enable or disable the pin muxed by GPIO and SPI CS to work as SPI CS */
-static inline void bfin_spi_cs_enable(struct bfin_spi_master *drv_data,
+static inline void adi_spi_cs_enable(struct adi_spi_master *drv_data,
-                                        struct bfin_spi_device *chip)
+                                        struct adi_spi_device *chip)
 {
-        if (chip->cs < MAX_CTRL_CS)
+        if (chip->cs < MAX_CTRL_CS) {
-                bfin_write_or(&drv_data->regs->ssel, chip->ssel >> 8);
+                u32 reg;
+                reg = ioread32(&drv_data->regs->ssel);
+                reg |= chip->ssel >> 8;
+                iowrite32(reg, &drv_data->regs->ssel);
+        }
 }
-static inline void bfin_spi_cs_disable(struct bfin_spi_master *drv_data,
+static inline void adi_spi_cs_disable(struct adi_spi_master *drv_data,
-                                        struct bfin_spi_device *chip)
+                                        struct adi_spi_device *chip)
 {
-        if (chip->cs < MAX_CTRL_CS)
+        if (chip->cs < MAX_CTRL_CS) {
-                bfin_write_and(&drv_data->regs->ssel, ~(chip->ssel >> 8));
+                u32 reg;
+                reg = ioread32(&drv_data->regs->ssel);
+                reg &= ~(chip->ssel >> 8);
+                iowrite32(reg, &drv_data->regs->ssel);
+        }
 }
 /* stop controller and re-config current chip*/
-static void bfin_spi_restore_state(struct bfin_spi_master *drv_data)
+static void adi_spi_restore_state(struct adi_spi_master *drv_data)
 {
-        struct bfin_spi_device *chip = drv_data->cur_chip;
+        struct adi_spi_device *chip = drv_data->cur_chip;
        /* Clear status and disable clock */
-        bfin_write(&drv_data->regs->status, 0xFFFFFFFF);
+        iowrite32(0xFFFFFFFF, &drv_data->regs->status);
-        bfin_write(&drv_data->regs->rx_control, 0x0);
+        iowrite32(0x0, &drv_data->regs->rx_control);
-        bfin_write(&drv_data->regs->tx_control, 0x0);
+        iowrite32(0x0, &drv_data->regs->tx_control);
-        bfin_spi_disable(drv_data);
+        adi_spi_disable(drv_data);
-        SSYNC();
        /* Load the registers */
-        bfin_write(&drv_data->regs->control, chip->control);
+        iowrite32(chip->control, &drv_data->regs->control);
-        bfin_write(&drv_data->regs->clock, chip->clock);
+        iowrite32(chip->clock, &drv_data->regs->clock);
-        bfin_spi_enable(drv_data);
+        adi_spi_enable(drv_data);
        drv_data->tx_num = drv_data->rx_num = 0;
        /* we always choose tx transfer initiate */
-        bfin_write(&drv_data->regs->rx_control, SPI_RXCTL_REN);
+        iowrite32(SPI_RXCTL_REN, &drv_data->regs->rx_control);
-        bfin_write(&drv_data->regs->tx_control,
+        iowrite32(SPI_TXCTL_TEN | SPI_TXCTL_TTI, &drv_data->regs->tx_control);
-                        SPI_TXCTL_TEN | SPI_TXCTL_TTI);
+        adi_spi_cs_active(drv_data, chip);
-        bfin_spi_cs_active(drv_data, chip);
 }
 /* discard invalid rx data and empty rfifo */
-static inline void dummy_read(struct bfin_spi_master *drv_data)
+static inline void dummy_read(struct adi_spi_master *drv_data)
 {
-        while (!(bfin_read(&drv_data->regs->status) & SPI_STAT_RFE))
+        while (!(ioread32(&drv_data->regs->status) & SPI_STAT_RFE))
-                bfin_read(&drv_data->regs->rfifo);
+                ioread32(&drv_data->regs->rfifo);
 }
-static void bfin_spi_u8_write(struct bfin_spi_master *drv_data)
+static void adi_spi_u8_write(struct adi_spi_master *drv_data)
 {
        dummy_read(drv_data);
        while (drv_data->tx < drv_data->tx_end) {
-                bfin_write(&drv_data->regs->tfifo, (*(u8 *)(drv_data->tx++)));
+                iowrite32(*(u8 *)(drv_data->tx++), &drv_data->regs->tfifo);
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                bfin_read(&drv_data->regs->rfifo);
+                ioread32(&drv_data->regs->rfifo);
        }
 }
-static void bfin_spi_u8_read(struct bfin_spi_master *drv_data)
+static void adi_spi_u8_read(struct adi_spi_master *drv_data)
 {
        u32 tx_val = drv_data->cur_chip->tx_dummy_val;
        dummy_read(drv_data);
        while (drv_data->rx < drv_data->rx_end) {
-                bfin_write(&drv_data->regs->tfifo, tx_val);
+                iowrite32(tx_val, &drv_data->regs->tfifo);
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                *(u8 *)(drv_data->rx++) = bfin_read(&drv_data->regs->rfifo);
+                *(u8 *)(drv_data->rx++) = ioread32(&drv_data->regs->rfifo);
        }
 }
-static void bfin_spi_u8_duplex(struct bfin_spi_master *drv_data)
+static void adi_spi_u8_duplex(struct adi_spi_master *drv_data)
 {
        dummy_read(drv_data);
        while (drv_data->rx < drv_data->rx_end) {
-                bfin_write(&drv_data->regs->tfifo, (*(u8 *)(drv_data->tx++)));
+                iowrite32(*(u8 *)(drv_data->tx++), &drv_data->regs->tfifo);
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                *(u8 *)(drv_data->rx++) = bfin_read(&drv_data->regs->rfifo);
+                *(u8 *)(drv_data->rx++) = ioread32(&drv_data->regs->rfifo);
        }
 }
-static const struct bfin_spi_transfer_ops bfin_bfin_spi_transfer_ops_u8 = {
+static const struct adi_spi_transfer_ops adi_spi_transfer_ops_u8 = {
-        .write  = bfin_spi_u8_write,
+        .write  = adi_spi_u8_write,
-        .read   = bfin_spi_u8_read,
+        .read   = adi_spi_u8_read,
-        .duplex = bfin_spi_u8_duplex,
+        .duplex = adi_spi_u8_duplex,
 };
-static void bfin_spi_u16_write(struct bfin_spi_master *drv_data)
+static void adi_spi_u16_write(struct adi_spi_master *drv_data)
 {
        dummy_read(drv_data);
        while (drv_data->tx < drv_data->tx_end) {
-                bfin_write(&drv_data->regs->tfifo, (*(u16 *)drv_data->tx));
+                iowrite32(*(u16 *)drv_data->tx, &drv_data->regs->tfifo);
                drv_data->tx += 2;
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                bfin_read(&drv_data->regs->rfifo);
+                ioread32(&drv_data->regs->rfifo);
        }
 }
-static void bfin_spi_u16_read(struct bfin_spi_master *drv_data)
+static void adi_spi_u16_read(struct adi_spi_master *drv_data)
 {
        u32 tx_val = drv_data->cur_chip->tx_dummy_val;
        dummy_read(drv_data);
        while (drv_data->rx < drv_data->rx_end) {
-                bfin_write(&drv_data->regs->tfifo, tx_val);
+                iowrite32(tx_val, &drv_data->regs->tfifo);
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                *(u16 *)drv_data->rx = bfin_read(&drv_data->regs->rfifo);
+                *(u16 *)drv_data->rx = ioread32(&drv_data->regs->rfifo);
                drv_data->rx += 2;
        }
 }
-static void bfin_spi_u16_duplex(struct bfin_spi_master *drv_data)
+static void adi_spi_u16_duplex(struct adi_spi_master *drv_data)
 {
        dummy_read(drv_data);
        while (drv_data->rx < drv_data->rx_end) {
-                bfin_write(&drv_data->regs->tfifo, (*(u16 *)drv_data->tx));
+                iowrite32(*(u16 *)drv_data->tx, &drv_data->regs->tfifo);
                drv_data->tx += 2;
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                *(u16 *)drv_data->rx = bfin_read(&drv_data->regs->rfifo);
+                *(u16 *)drv_data->rx = ioread32(&drv_data->regs->rfifo);
                drv_data->rx += 2;
        }
 }
-static const struct bfin_spi_transfer_ops bfin_bfin_spi_transfer_ops_u16 = {
+static const struct adi_spi_transfer_ops adi_spi_transfer_ops_u16 = {
-        .write  = bfin_spi_u16_write,
+        .write  = adi_spi_u16_write,
-        .read   = bfin_spi_u16_read,
+        .read   = adi_spi_u16_read,
-        .duplex = bfin_spi_u16_duplex,
+        .duplex = adi_spi_u16_duplex,
 };
-static void bfin_spi_u32_write(struct bfin_spi_master *drv_data)
+static void adi_spi_u32_write(struct adi_spi_master *drv_data)
 {
        dummy_read(drv_data);
        while (drv_data->tx < drv_data->tx_end) {
-                bfin_write(&drv_data->regs->tfifo, (*(u32 *)drv_data->tx));
+                iowrite32(*(u32 *)drv_data->tx, &drv_data->regs->tfifo);
                drv_data->tx += 4;
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                bfin_read(&drv_data->regs->rfifo);
+                ioread32(&drv_data->regs->rfifo);
        }
 }
-static void bfin_spi_u32_read(struct bfin_spi_master *drv_data)
+static void adi_spi_u32_read(struct adi_spi_master *drv_data)
 {
        u32 tx_val = drv_data->cur_chip->tx_dummy_val;
        dummy_read(drv_data);
        while (drv_data->rx < drv_data->rx_end) {
-                bfin_write(&drv_data->regs->tfifo, tx_val);
+                iowrite32(tx_val, &drv_data->regs->tfifo);
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                *(u32 *)drv_data->rx = bfin_read(&drv_data->regs->rfifo);
+                *(u32 *)drv_data->rx = ioread32(&drv_data->regs->rfifo);
                drv_data->rx += 4;
        }
 }
-static void bfin_spi_u32_duplex(struct bfin_spi_master *drv_data)
+static void adi_spi_u32_duplex(struct adi_spi_master *drv_data)
 {
        dummy_read(drv_data);
        while (drv_data->rx < drv_data->rx_end) {
-                bfin_write(&drv_data->regs->tfifo, (*(u32 *)drv_data->tx));
+                iowrite32(*(u32 *)drv_data->tx, &drv_data->regs->tfifo);
                drv_data->tx += 4;
-                while (bfin_read(&drv_data->regs->status) & SPI_STAT_RFE)
+                while (ioread32(&drv_data->regs->status) & SPI_STAT_RFE)
                        cpu_relax();
-                *(u32 *)drv_data->rx = bfin_read(&drv_data->regs->rfifo);
+                *(u32 *)drv_data->rx = ioread32(&drv_data->regs->rfifo);
                drv_data->rx += 4;
        }
 }
-static const struct bfin_spi_transfer_ops bfin_bfin_spi_transfer_ops_u32 = {
+static const struct adi_spi_transfer_ops adi_spi_transfer_ops_u32 = {
-        .write  = bfin_spi_u32_write,
+        .write  = adi_spi_u32_write,
-        .read   = bfin_spi_u32_read,
+        .read   = adi_spi_u32_read,
-        .duplex = bfin_spi_u32_duplex,
+        .duplex = adi_spi_u32_duplex,
 };
 /* test if there is more transfer to be done */
-static void bfin_spi_next_transfer(struct bfin_spi_master *drv)
+static void adi_spi_next_transfer(struct adi_spi_master *drv)
 {
        struct spi_message *msg = drv->cur_msg;
        struct spi_transfer *t = drv->cur_transfer;
@@ -360,15 +381,15 @@ static void bfin_spi_next_transfer(struct bfin_spi_master *drv)
        }
 }
-static void bfin_spi_giveback(struct bfin_spi_master *drv_data)
+static void adi_spi_giveback(struct adi_spi_master *drv_data)
 {
-        struct bfin_spi_device *chip = drv_data->cur_chip;
+        struct adi_spi_device *chip = drv_data->cur_chip;
-        bfin_spi_cs_deactive(drv_data, chip);
+        adi_spi_cs_deactive(drv_data, chip);
        spi_finalize_current_message(drv_data->master);
 }
-static int bfin_spi_setup_transfer(struct bfin_spi_master *drv)
+static int adi_spi_setup_transfer(struct adi_spi_master *drv)
 {
        struct spi_transfer *t = drv->cur_transfer;
        u32 cr, cr_width;
@@ -393,34 +414,33 @@ static int bfin_spi_setup_transfer(struct bfin_spi_master *drv)
        switch (t->bits_per_word) {
        case 8:
                cr_width = SPI_CTL_SIZE08;
-                drv->ops = &bfin_bfin_spi_transfer_ops_u8;
+                drv->ops = &adi_spi_transfer_ops_u8;
                break;
        case 16:
                cr_width = SPI_CTL_SIZE16;
-                drv->ops = &bfin_bfin_spi_transfer_ops_u16;
+                drv->ops = &adi_spi_transfer_ops_u16;
                break;
        case 32:
                cr_width = SPI_CTL_SIZE32;
-                drv->ops = &bfin_bfin_spi_transfer_ops_u32;
+                drv->ops = &adi_spi_transfer_ops_u32;
                break;
        default:
                return -EINVAL;
        }
-        cr = bfin_read(&drv->regs->control) & ~SPI_CTL_SIZE;
+        cr = ioread32(&drv->regs->control) & ~SPI_CTL_SIZE;
        cr |= cr_width;
-        bfin_write(&drv->regs->control, cr);
+        iowrite32(cr, &drv->regs->control);
        /* speed setup */
-        bfin_write(&drv->regs->clock,
+        iowrite32(hz_to_spi_clock(drv->sclk, t->speed_hz), &drv->regs->clock);
-                        hz_to_spi_clock(drv->sclk, t->speed_hz));
        return 0;
 }
-static int bfin_spi_dma_xfer(struct bfin_spi_master *drv_data)
+static int adi_spi_dma_xfer(struct adi_spi_master *drv_data)
 {
        struct spi_transfer *t = drv_data->cur_transfer;
        struct spi_message *msg = drv_data->cur_msg;
-        struct bfin_spi_device *chip = drv_data->cur_chip;
+        struct adi_spi_device *chip = drv_data->cur_chip;
        u32 dma_config;
        unsigned long word_count, word_size;
        void *tx_buf, *rx_buf;
@@ -498,17 +518,16 @@ static int bfin_spi_dma_xfer(struct bfin_spi_master *drv_data)
        set_dma_config(drv_data->rx_dma, dma_config | WNR);
        enable_dma(drv_data->tx_dma);
        enable_dma(drv_data->rx_dma);
-        SSYNC();
-        bfin_write(&drv_data->regs->rx_control, SPI_RXCTL_REN | SPI_RXCTL_RDR_NE);
+        iowrite32(SPI_RXCTL_REN | SPI_RXCTL_RDR_NE,
-        SSYNC();
+                        &drv_data->regs->rx_control);
-        bfin_write(&drv_data->regs->tx_control,
+        iowrite32(SPI_TXCTL_TEN | SPI_TXCTL_TTI | SPI_TXCTL_TDR_NF,
-                        SPI_TXCTL_TEN | SPI_TXCTL_TTI | SPI_TXCTL_TDR_NF);
+                        &drv_data->regs->tx_control);
        return 0;
 }
-static int bfin_spi_pio_xfer(struct bfin_spi_master *drv_data)
+static int adi_spi_pio_xfer(struct adi_spi_master *drv_data)
 {
        struct spi_message *msg = drv_data->cur_msg;
@@ -529,19 +548,19 @@ static int bfin_spi_pio_xfer(struct bfin_spi_master *drv_data)
                        return -EIO;
        }
-        if (!bfin_spi_flush(drv_data))
+        if (!adi_spi_flush(drv_data))
                return -EIO;
        msg->actual_length += drv_data->transfer_len;
        tasklet_schedule(&drv_data->pump_transfers);
        return 0;
 }
-static void bfin_spi_pump_transfers(unsigned long data)
+static void adi_spi_pump_transfers(unsigned long data)
 {
-        struct bfin_spi_master *drv_data = (struct bfin_spi_master *)data;
+        struct adi_spi_master *drv_data = (struct adi_spi_master *)data;
        struct spi_message *msg = NULL;
        struct spi_transfer *t = NULL;
-        struct bfin_spi_device *chip = NULL;
+        struct adi_spi_device *chip = NULL;
        int ret;
        /* Get current state information */
@@ -552,7 +571,7 @@ static void bfin_spi_pump_transfers(unsigned long data)
        /* Handle for abort */
        if (drv_data->state == ERROR_STATE) {
                msg->status = -EIO;
-                bfin_spi_giveback(drv_data);
+                adi_spi_giveback(drv_data);
                return;
        }
@@ -560,14 +579,14 @@ static void bfin_spi_pump_transfers(unsigned long data)
                if (t->delay_usecs)
                        udelay(t->delay_usecs);
                if (t->cs_change)
-                        bfin_spi_cs_deactive(drv_data, chip);
+                        adi_spi_cs_deactive(drv_data, chip);
-                bfin_spi_next_transfer(drv_data);
+                adi_spi_next_transfer(drv_data);
                t = drv_data->cur_transfer;
        }
        /* Handle end of message */
        if (drv_data->state == DONE_STATE) {
                msg->status = 0;
-                bfin_spi_giveback(drv_data);
+                adi_spi_giveback(drv_data);
                return;
        }
@@ -577,34 +596,34 @@ static void bfin_spi_pump_transfers(unsigned long data)
                return;
        }
-        ret = bfin_spi_setup_transfer(drv_data);
+        ret = adi_spi_setup_transfer(drv_data);
        if (ret) {
                msg->status = ret;
-                bfin_spi_giveback(drv_data);
+                adi_spi_giveback(drv_data);
        }
-        bfin_write(&drv_data->regs->status, 0xFFFFFFFF);
+        iowrite32(0xFFFFFFFF, &drv_data->regs->status);
-        bfin_spi_cs_active(drv_data, chip);
+        adi_spi_cs_active(drv_data, chip);
        drv_data->state = RUNNING_STATE;
        if (chip->enable_dma)
-                ret = bfin_spi_dma_xfer(drv_data);
+                ret = adi_spi_dma_xfer(drv_data);
        else
-                ret = bfin_spi_pio_xfer(drv_data);
+                ret = adi_spi_pio_xfer(drv_data);
        if (ret) {
                msg->status = ret;
-                bfin_spi_giveback(drv_data);
+                adi_spi_giveback(drv_data);
        }
 }
-static int bfin_spi_transfer_one_message(struct spi_master *master,
+static int adi_spi_transfer_one_message(struct spi_master *master,
                                        struct spi_message *m)
 {
-        struct bfin_spi_master *drv_data = spi_master_get_devdata(master);
+        struct adi_spi_master *drv_data = spi_master_get_devdata(master);
        drv_data->cur_msg = m;
        drv_data->cur_chip = spi_get_ctldata(drv_data->cur_msg->spi);
-        bfin_spi_restore_state(drv_data);
+        adi_spi_restore_state(drv_data);
        drv_data->state = START_STATE;
        drv_data->cur_transfer = list_entry(drv_data->cur_msg->transfers.next,
@@ -630,15 +649,15 @@ static const u16 ssel[][MAX_SPI_SSEL] = {
        P_SPI2_SSEL6, P_SPI2_SSEL7},
 };
-static int bfin_spi_setup(struct spi_device *spi)
+static int adi_spi_setup(struct spi_device *spi)
 {
-        struct bfin_spi_master *drv_data = spi_master_get_devdata(spi->master);
+        struct adi_spi_master *drv_data = spi_master_get_devdata(spi->master);
-        struct bfin_spi_device *chip = spi_get_ctldata(spi);
+        struct adi_spi_device *chip = spi_get_ctldata(spi);
-        u32 bfin_ctl_reg = SPI_CTL_ODM | SPI_CTL_PSSE;
+        u32 ctl_reg = SPI_CTL_ODM | SPI_CTL_PSSE;
        int ret = -EINVAL;
        if (!chip) {
-                struct bfin_spi3_chip *chip_info = spi->controller_data;
+                struct adi_spi3_chip *chip_info = spi->controller_data;
                chip = kzalloc(sizeof(*chip), GFP_KERNEL);
                if (!chip) {
@@ -646,7 +665,7 @@ static int bfin_spi_setup(struct spi_device *spi)
                        return -ENOMEM;
                }
                if (chip_info) {
-                        if (chip_info->control & ~bfin_ctl_reg) {
+                        if (chip_info->control & ~ctl_reg) {
                                dev_err(&spi->dev,
                                        "do not set bits that the SPI framework manages\n");
                                goto error;
@@ -657,6 +676,7 @@ static int bfin_spi_setup(struct spi_device *spi)
                        chip->enable_dma = chip_info->enable_dma;
                }
                chip->cs = spi->chip_select;
                if (chip->cs < MAX_CTRL_CS) {
                        chip->ssel = (1 << chip->cs) << 8;
                        ret = peripheral_request(ssel[spi->master->bus_num]
@@ -678,7 +698,7 @@ static int bfin_spi_setup(struct spi_device *spi)
        }
        /* force a default base state */
-        chip->control &= bfin_ctl_reg;
+        chip->control &= ctl_reg;
        if (spi->mode & SPI_CPOL)
                chip->control |= SPI_CTL_CPOL;
@@ -692,8 +712,8 @@ static int bfin_spi_setup(struct spi_device *spi)
        chip->clock = hz_to_spi_clock(drv_data->sclk, spi->max_speed_hz);
-        bfin_spi_cs_enable(drv_data, chip);
+        adi_spi_cs_enable(drv_data, chip);
-        bfin_spi_cs_deactive(drv_data, chip);
+        adi_spi_cs_deactive(drv_data, chip);
        return 0;
 error:
@@ -705,10 +725,10 @@ error:
        return ret;
 }
-static void bfin_spi_cleanup(struct spi_device *spi)
+static void adi_spi_cleanup(struct spi_device *spi)
 {
-        struct bfin_spi_device *chip = spi_get_ctldata(spi);
+        struct adi_spi_device *chip = spi_get_ctldata(spi);
-        struct bfin_spi_master *drv_data = spi_master_get_devdata(spi->master);
+        struct adi_spi_master *drv_data = spi_master_get_devdata(spi->master);
        if (!chip)
                return;
@@ -716,7 +736,7 @@ static void bfin_spi_cleanup(struct spi_device *spi)
        if (chip->cs < MAX_CTRL_CS) {
                peripheral_free(ssel[spi->master->bus_num]
                                        [chip->cs-1]);
-                bfin_spi_cs_disable(drv_data, chip);
+                adi_spi_cs_disable(drv_data, chip);
        } else {
                gpio_free(chip->cs_gpio);
        }
@@ -725,10 +745,11 @@ static void bfin_spi_cleanup(struct spi_device *spi)
        spi_set_ctldata(spi, NULL);
 }
-static irqreturn_t bfin_spi_tx_dma_isr(int irq, void *dev_id)
+static irqreturn_t adi_spi_tx_dma_isr(int irq, void *dev_id)
 {
-        struct bfin_spi_master *drv_data = dev_id;
+        struct adi_spi_master *drv_data = dev_id;
        u32 dma_stat = get_dma_curr_irqstat(drv_data->tx_dma);
+        u32 tx_ctl;
        clear_dma_irqstat(drv_data->tx_dma);
        if (dma_stat & DMA_DONE) {
@@ -739,13 +760,15 @@ static irqreturn_t bfin_spi_tx_dma_isr(int irq, void *dev_id)
                if (drv_data->tx)
                        drv_data->state = ERROR_STATE;
        }
-        bfin_write_and(&drv_data->regs->tx_control, ~SPI_TXCTL_TDR_NF);
+        tx_ctl = ioread32(&drv_data->regs->tx_control);
+        tx_ctl &= ~SPI_TXCTL_TDR_NF;
+        iowrite32(tx_ctl, &drv_data->regs->tx_control);
        return IRQ_HANDLED;
 }
-static irqreturn_t bfin_spi_rx_dma_isr(int irq, void *dev_id)
+static irqreturn_t adi_spi_rx_dma_isr(int irq, void *dev_id)
 {
-        struct bfin_spi_master *drv_data = dev_id;
+        struct adi_spi_master *drv_data = dev_id;
        struct spi_message *msg = drv_data->cur_msg;
        u32 dma_stat = get_dma_curr_irqstat(drv_data->rx_dma);
@@ -760,8 +783,8 @@ static irqreturn_t bfin_spi_rx_dma_isr(int irq, void *dev_id)
                dev_err(&drv_data->master->dev,
                                "spi rx dma error: %d\n", dma_stat);
        }
-        bfin_write(&drv_data->regs->tx_control, 0);
+        iowrite32(0, &drv_data->regs->tx_control);
-        bfin_write(&drv_data->regs->rx_control, 0);
+        iowrite32(0, &drv_data->regs->rx_control);
        if (drv_data->rx_num != drv_data->tx_num)
                dev_dbg(&drv_data->master->dev,
                                "dma interrupt missing: tx=%d,rx=%d\n",
@@ -770,15 +793,15 @@ static irqreturn_t bfin_spi_rx_dma_isr(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
-static int bfin_spi_probe(struct platform_device *pdev)
+static int adi_spi_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
-        struct bfin_spi3_master *info = dev_get_platdata(dev);
+        struct adi_spi3_master *info = dev_get_platdata(dev);
        struct spi_master *master;
-        struct bfin_spi_master *drv_data;
+        struct adi_spi_master *drv_data;
        struct resource *mem, *res;
        unsigned int tx_dma, rx_dma;
-        unsigned long sclk;
+        struct clk *sclk;
        int ret;
        if (!info) {
@@ -786,10 +809,10 @@ static int bfin_spi_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        sclk = get_sclk1();
+        sclk = devm_clk_get(dev, "spi");
-        if (!sclk) {
+        if (IS_ERR(sclk)) {
-                dev_err(dev, "can not get sclk1\n");
+                dev_err(dev, "can not get spi clock\n");
-                return -ENXIO;
+                return PTR_ERR(sclk);
        }
        res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
@@ -819,9 +842,9 @@ static int bfin_spi_probe(struct platform_device *pdev)
        master->bus_num = pdev->id;
        master->num_chipselect = info->num_chipselect;
-        master->cleanup = bfin_spi_cleanup;
+        master->cleanup = adi_spi_cleanup;
-        master->setup = bfin_spi_setup;
+        master->setup = adi_spi_setup;
-        master->transfer_one_message = bfin_spi_transfer_one_message;
+        master->transfer_one_message = adi_spi_transfer_one_message;
        master->bits_per_word_mask = SPI_BPW_MASK(32) | SPI_BPW_MASK(16) |
                                     SPI_BPW_MASK(8);
@@ -830,7 +853,7 @@ static int bfin_spi_probe(struct platform_device *pdev)
        drv_data->tx_dma = tx_dma;
        drv_data->rx_dma = rx_dma;
        drv_data->pin_req = info->pin_req;
-        drv_data->sclk = sclk;
+        drv_data->sclk = clk_get_rate(sclk);
        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        drv_data->regs = devm_ioremap_resource(dev, mem);
@@ -845,28 +868,28 @@ static int bfin_spi_probe(struct platform_device *pdev)
                dev_err(dev, "can not request SPI TX DMA channel\n");
                goto err_put_master;
        }
-        set_dma_callback(tx_dma, bfin_spi_tx_dma_isr, drv_data);
+        set_dma_callback(tx_dma, adi_spi_tx_dma_isr, drv_data);
        ret = request_dma(rx_dma, "SPI_RX_DMA");
        if (ret) {
                dev_err(dev, "can not request SPI RX DMA channel\n");
                goto err_free_tx_dma;
        }
-        set_dma_callback(drv_data->rx_dma, bfin_spi_rx_dma_isr, drv_data);
+        set_dma_callback(drv_data->rx_dma, adi_spi_rx_dma_isr, drv_data);
        /* request CLK, MOSI and MISO */
-        ret = peripheral_request_list(drv_data->pin_req, "bfin-spi3");
+        ret = peripheral_request_list(drv_data->pin_req, "adi-spi3");
        if (ret < 0) {
                dev_err(dev, "can not request spi pins\n");
                goto err_free_rx_dma;
        }
-        bfin_write(&drv_data->regs->control, SPI_CTL_MSTR | SPI_CTL_CPHA);
+        iowrite32(SPI_CTL_MSTR | SPI_CTL_CPHA, &drv_data->regs->control);
-        bfin_write(&drv_data->regs->ssel, 0x0000FE00);
+        iowrite32(0x0000FE00, &drv_data->regs->ssel);
-        bfin_write(&drv_data->regs->delay, 0x0);
+        iowrite32(0x0, &drv_data->regs->delay);
        tasklet_init(&drv_data->pump_transfers,
-                        bfin_spi_pump_transfers, (unsigned long)drv_data);
+                        adi_spi_pump_transfers, (unsigned long)drv_data);
        /* register with the SPI framework */
        ret = devm_spi_register_master(dev, master);
        if (ret) {
@@ -888,43 +911,41 @@ err_put_master:
        return ret;
 }
-static int bfin_spi_remove(struct platform_device *pdev)
+static int adi_spi_remove(struct platform_device *pdev)
 {
        struct spi_master *master = platform_get_drvdata(pdev);
-        struct bfin_spi_master *drv_data = spi_master_get_devdata(master);
+        struct adi_spi_master *drv_data = spi_master_get_devdata(master);
-        bfin_spi_disable(drv_data);
+        adi_spi_disable(drv_data);
        peripheral_free_list(drv_data->pin_req);
        free_dma(drv_data->rx_dma);
        free_dma(drv_data->tx_dma);
        return 0;
 }
 #ifdef CONFIG_PM
-static int bfin_spi_suspend(struct device *dev)
+static int adi_spi_suspend(struct device *dev)
 {
        struct spi_master *master = dev_get_drvdata(dev);
-        struct bfin_spi_master *drv_data = spi_master_get_devdata(master);
+        struct adi_spi_master *drv_data = spi_master_get_devdata(master);
        spi_master_suspend(master);
-        drv_data->control = bfin_read(&drv_data->regs->control);
+        drv_data->control = ioread32(&drv_data->regs->control);
-        drv_data->ssel = bfin_read(&drv_data->regs->ssel);
+        drv_data->ssel = ioread32(&drv_data->regs->ssel);
-        bfin_write(&drv_data->regs->control, SPI_CTL_MSTR | SPI_CTL_CPHA);
+        iowrite32(SPI_CTL_MSTR | SPI_CTL_CPHA, &drv_data->regs->control);
-        bfin_write(&drv_data->regs->ssel, 0x0000FE00);
+        iowrite32(0x0000FE00, &drv_data->regs->ssel);
        dma_disable_irq(drv_data->rx_dma);
        dma_disable_irq(drv_data->tx_dma);
        return 0;
 }
-static int bfin_spi_resume(struct device *dev)
+static int adi_spi_resume(struct device *dev)
 {
        struct spi_master *master = dev_get_drvdata(dev);
-        struct bfin_spi_master *drv_data = spi_master_get_devdata(master);
+        struct adi_spi_master *drv_data = spi_master_get_devdata(master);
        int ret = 0;
        /* bootrom may modify spi and dma status when resume in spi boot mode */
@@ -932,8 +953,8 @@ static int bfin_spi_resume(struct device *dev)
        dma_enable_irq(drv_data->rx_dma);
        dma_enable_irq(drv_data->tx_dma);
-        bfin_write(&drv_data->regs->control, drv_data->control);
+        iowrite32(drv_data->control, &drv_data->regs->control);
-        bfin_write(&drv_data->regs->ssel, drv_data->ssel);
+        iowrite32(drv_data->ssel, &drv_data->regs->ssel);
        ret = spi_master_resume(master);
        if (ret) {
@@ -944,21 +965,21 @@ static int bfin_spi_resume(struct device *dev)
        return ret;
 }
 #endif
-static const struct dev_pm_ops bfin_spi_pm_ops = {
+static const struct dev_pm_ops adi_spi_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(bfin_spi_suspend, bfin_spi_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(adi_spi_suspend, adi_spi_resume)
 };
-MODULE_ALIAS("platform:bfin-spi3");
+MODULE_ALIAS("platform:adi-spi3");
-static struct platform_driver bfin_spi_driver = {
+static struct platform_driver adi_spi_driver = {
        .driver = {
-                .name   = "bfin-spi3",
+                .name   = "adi-spi3",
                .owner  = THIS_MODULE,
-                .pm     = &bfin_spi_pm_ops,
+                .pm     = &adi_spi_pm_ops,
        },
-        .remove         = bfin_spi_remove,
+        .remove         = adi_spi_remove,
 };
-module_platform_driver_probe(bfin_spi_driver, bfin_spi_probe);
+module_platform_driver_probe(adi_spi_driver, adi_spi_probe);
 MODULE_DESCRIPTION("Analog Devices SPI3 controller driver");
 MODULE_AUTHOR("Scott Jiang <Scott.Jiang.Linux@gmail.com>");
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 8005f9869481..92a6f0d93233 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -224,7 +224,7 @@ struct atmel_spi {
        struct platform_device  *pdev;
        struct spi_transfer     *current_transfer;
-        unsigned long           current_remaining_bytes;
+        int                     current_remaining_bytes;
        int                     done_status;
        struct completion       xfer_completion;
@@ -874,8 +874,9 @@ atmel_spi_pump_pio_data(struct atmel_spi *as, struct spi_transfer *xfer)
                spi_readl(as, RDR);
        }
        if (xfer->bits_per_word > 8) {
-                as->current_remaining_bytes -= 2;
+                if (as->current_remaining_bytes > 2)
-                if (as->current_remaining_bytes < 0)
+                        as->current_remaining_bytes -= 2;
+                else
                        as->current_remaining_bytes = 0;
        } else {
                as->current_remaining_bytes--;
@@ -1110,13 +1111,18 @@ static int atmel_spi_one_transfer(struct spi_master *master,
                                atmel_spi_next_xfer_pio(master, xfer);
                        } else {
                                as->current_remaining_bytes -= len;
+                                if (as->current_remaining_bytes < 0)
+                                        as->current_remaining_bytes = 0;
                        }
                } else {
                        atmel_spi_next_xfer_pio(master, xfer);
                }
+                /* interrupts are disabled, so free the lock for schedule */
+                atmel_spi_unlock(as);
                ret = wait_for_completion_timeout(&as->xfer_completion,
                                                        SPI_DMA_TIMEOUT);
+                atmel_spi_lock(as);
                if (WARN_ON(ret == 0)) {
                        dev_err(&spi->dev,
                                "spi trasfer timeout, err %d\n", ret);
diff --git a/drivers/spi/spi-bfin5xx.c b/drivers/spi/spi-bfin5xx.c
index 55e57c3eb9bd..ebf720b88a2a 100644
--- a/drivers/spi/spi-bfin5xx.c
+++ b/drivers/spi/spi-bfin5xx.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <linux/gpio.h>
 #include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
new file mode 100644
index 000000000000..bb758978465d
--- /dev/null
+++ b/drivers/spi/spi-cadence.c
@@ -0,0 +1,673 @@
+/*
+ * Cadence SPI controller driver (master mode only)
+ *
+ * Copyright (C) 2008 - 2014 Xilinx, Inc.
+ *
+ * based on Blackfin On-Chip SPI Driver (spi_bfin5xx.c)
+ *
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License version 2 as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of_irq.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+/* Name of this driver */
+#define CDNS_SPI_NAME           "cdns-spi"
+/* Register offset definitions */
+#define CDNS_SPI_CR_OFFSET      0x00 /* Configuration  Register, RW */
+#define CDNS_SPI_ISR_OFFSET     0x04 /* Interrupt Status Register, RO */
+#define CDNS_SPI_IER_OFFSET     0x08 /* Interrupt Enable Register, WO */
+#define CDNS_SPI_IDR_OFFSET     0x0c /* Interrupt Disable Register, WO */
+#define CDNS_SPI_IMR_OFFSET     0x10 /* Interrupt Enabled Mask Register, RO */
+#define CDNS_SPI_ER_OFFSET      0x14 /* Enable/Disable Register, RW */
+#define CDNS_SPI_DR_OFFSET      0x18 /* Delay Register, RW */
+#define CDNS_SPI_TXD_OFFSET     0x1C /* Data Transmit Register, WO */
+#define CDNS_SPI_RXD_OFFSET     0x20 /* Data Receive Register, RO */
+#define CDNS_SPI_SICR_OFFSET    0x24 /* Slave Idle Count Register, RW */
+#define CDNS_SPI_THLD_OFFSET    0x28 /* Transmit FIFO Watermark Register,RW */
+/*
+ * SPI Configuration Register bit Masks
+ *
+ * This register contains various control bits that affect the operation
+ * of the SPI controller
+ */
+#define CDNS_SPI_CR_MANSTRT_MASK        0x00010000 /* Manual TX Start */
+#define CDNS_SPI_CR_CPHA_MASK           0x00000004 /* Clock Phase Control */
+#define CDNS_SPI_CR_CPOL_MASK           0x00000002 /* Clock Polarity Control */
+#define CDNS_SPI_CR_SSCTRL_MASK         0x00003C00 /* Slave Select Mask */
+#define CDNS_SPI_CR_BAUD_DIV_MASK       0x00000038 /* Baud Rate Divisor Mask */
+#define CDNS_SPI_CR_MSTREN_MASK         0x00000001 /* Master Enable Mask */
+#define CDNS_SPI_CR_MANSTRTEN_MASK      0x00008000 /* Manual TX Enable Mask */
+#define CDNS_SPI_CR_SSFORCE_MASK        0x00004000 /* Manual SS Enable Mask */
+#define CDNS_SPI_CR_BAUD_DIV_4_MASK     0x00000008 /* Default Baud Div Mask */
+#define CDNS_SPI_CR_DEFAULT_MASK        (CDNS_SPI_CR_MSTREN_MASK | \
+                                        CDNS_SPI_CR_SSCTRL_MASK | \
+                                        CDNS_SPI_CR_SSFORCE_MASK | \
+                                        CDNS_SPI_CR_BAUD_DIV_4_MASK)
+/*
+ * SPI Configuration Register - Baud rate and slave select
+ *
+ * These are the values used in the calculation of baud rate divisor and
+ * setting the slave select.
+ */
+#define CDNS_SPI_BAUD_DIV_MAX           7 /* Baud rate divisor maximum */
+#define CDNS_SPI_BAUD_DIV_MIN           1 /* Baud rate divisor minimum */
+#define CDNS_SPI_BAUD_DIV_SHIFT         3 /* Baud rate divisor shift in CR */
+#define CDNS_SPI_SS_SHIFT               10 /* Slave Select field shift in CR */
+#define CDNS_SPI_SS0                    0x1 /* Slave Select zero */
+/*
+ * SPI Interrupt Registers bit Masks
+ *
+ * All the four interrupt registers (Status/Mask/Enable/Disable) have the same
+ * bit definitions.
+ */
+#define CDNS_SPI_IXR_TXOW_MASK  0x00000004 /* SPI TX FIFO Overwater */
+#define CDNS_SPI_IXR_MODF_MASK  0x00000002 /* SPI Mode Fault */
+#define CDNS_SPI_IXR_RXNEMTY_MASK 0x00000010 /* SPI RX FIFO Not Empty */
+#define CDNS_SPI_IXR_DEFAULT_MASK       (CDNS_SPI_IXR_TXOW_MASK | \
+                                        CDNS_SPI_IXR_MODF_MASK)
+#define CDNS_SPI_IXR_TXFULL_MASK        0x00000008 /* SPI TX Full */
+#define CDNS_SPI_IXR_ALL_MASK   0x0000007F /* SPI all interrupts */
+/*
+ * SPI Enable Register bit Masks
+ *
+ * This register is used to enable or disable the SPI controller
+ */
+#define CDNS_SPI_ER_ENABLE_MASK 0x00000001 /* SPI Enable Bit Mask */
+#define CDNS_SPI_ER_DISABLE_MASK        0x0 /* SPI Disable Bit Mask */
+/* SPI FIFO depth in bytes */
+#define CDNS_SPI_FIFO_DEPTH     128
+/* Default number of chip select lines */
+#define CDNS_SPI_DEFAULT_NUM_CS         4
+/**
+ * struct cdns_spi - This definition defines spi driver instance
+ * @regs:               Virtual address of the SPI controller registers
+ * @ref_clk:            Pointer to the peripheral clock
+ * @pclk:               Pointer to the APB clock
+ * @speed_hz:           Current SPI bus clock speed in Hz
+ * @txbuf:              Pointer to the TX buffer
+ * @rxbuf:              Pointer to the RX buffer
+ * @tx_bytes:           Number of bytes left to transfer
+ * @rx_bytes:           Number of bytes requested
+ * @dev_busy:           Device busy flag
+ * @is_decoded_cs:      Flag for decoder property set or not
+ */
+struct cdns_spi {
+        void __iomem *regs;
+        struct clk *ref_clk;
+        struct clk *pclk;
+        u32 speed_hz;
+        const u8 *txbuf;
+        u8 *rxbuf;
+        int tx_bytes;
+        int rx_bytes;
+        u8 dev_busy;
+        u32 is_decoded_cs;
+};
+/* Macros for the SPI controller read/write */
+static inline u32 cdns_spi_read(struct cdns_spi *xspi, u32 offset)
+{
+        return readl_relaxed(xspi->regs + offset);
+}
+static inline void cdns_spi_write(struct cdns_spi *xspi, u32 offset, u32 val)
+{
+        writel_relaxed(val, xspi->regs + offset);
+}
+/**
+ * cdns_spi_init_hw - Initialize the hardware and configure the SPI controller
+ * @xspi:       Pointer to the cdns_spi structure
+ *
+ * On reset the SPI controller is configured to be in master mode, baud rate
+ * divisor is set to 4, threshold value for TX FIFO not full interrupt is set
+ * to 1 and size of the word to be transferred as 8 bit.
+ * This function initializes the SPI controller to disable and clear all the
+ * interrupts, enable manual slave select and manual start, deselect all the
+ * chip select lines, and enable the SPI controller.
+ */
+static void cdns_spi_init_hw(struct cdns_spi *xspi)
+{
+        cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
+                       CDNS_SPI_ER_DISABLE_MASK);
+        cdns_spi_write(xspi, CDNS_SPI_IDR_OFFSET,
+                       CDNS_SPI_IXR_ALL_MASK);
+        /* Clear the RX FIFO */
+        while (cdns_spi_read(xspi, CDNS_SPI_ISR_OFFSET) &
+               CDNS_SPI_IXR_RXNEMTY_MASK)
+                cdns_spi_read(xspi, CDNS_SPI_RXD_OFFSET);
+        cdns_spi_write(xspi, CDNS_SPI_ISR_OFFSET,
+                       CDNS_SPI_IXR_ALL_MASK);
+        cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET,
+                       CDNS_SPI_CR_DEFAULT_MASK);
+        cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
+                       CDNS_SPI_ER_ENABLE_MASK);
+}
+/**
+ * cdns_spi_chipselect - Select or deselect the chip select line
+ * @spi:        Pointer to the spi_device structure
+ * @is_on:      Select(0) or deselect (1) the chip select line
+ */
+static void cdns_spi_chipselect(struct spi_device *spi, bool is_high)
+{
+        struct cdns_spi *xspi = spi_master_get_devdata(spi->master);
+        u32 ctrl_reg;
+        ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR_OFFSET);
+        if (is_high) {
+                /* Deselect the slave */
+                ctrl_reg |= CDNS_SPI_CR_SSCTRL_MASK;
+        } else {
+                /* Select the slave */
+                ctrl_reg &= ~CDNS_SPI_CR_SSCTRL_MASK;
+                if (!(xspi->is_decoded_cs))
+                        ctrl_reg |= ((~(CDNS_SPI_SS0 << spi->chip_select)) <<
+                                     CDNS_SPI_SS_SHIFT) &
+                                     CDNS_SPI_CR_SSCTRL_MASK;
+                else
+                        ctrl_reg |= (spi->chip_select << CDNS_SPI_SS_SHIFT) &
+                                     CDNS_SPI_CR_SSCTRL_MASK;
+        }
+        cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET, ctrl_reg);
+}
+/**
+ * cdns_spi_config_clock_mode - Sets clock polarity and phase
+ * @spi:        Pointer to the spi_device structure
+ *
+ * Sets the requested clock polarity and phase.
+ */
+static void cdns_spi_config_clock_mode(struct spi_device *spi)
+{
+        struct cdns_spi *xspi = spi_master_get_devdata(spi->master);
+        u32 ctrl_reg;
+        ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR_OFFSET);
+        /* Set the SPI clock phase and clock polarity */
+        ctrl_reg &= ~(CDNS_SPI_CR_CPHA_MASK | CDNS_SPI_CR_CPOL_MASK);
+        if (spi->mode & SPI_CPHA)
+                ctrl_reg |= CDNS_SPI_CR_CPHA_MASK;
+        if (spi->mode & SPI_CPOL)
+                ctrl_reg |= CDNS_SPI_CR_CPOL_MASK;
+        cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET, ctrl_reg);
+}
+/**
+ * cdns_spi_config_clock_freq - Sets clock frequency
+ * @spi:        Pointer to the spi_device structure
+ * @transfer:   Pointer to the spi_transfer structure which provides
+ *              information about next transfer setup parameters
+ *
+ * Sets the requested clock frequency.
+ * Note: If the requested frequency is not an exact match with what can be
+ * obtained using the prescalar value the driver sets the clock frequency which
+ * is lower than the requested frequency (maximum lower) for the transfer. If
+ * the requested frequency is higher or lower than that is supported by the SPI
+ * controller the driver will set the highest or lowest frequency supported by
+ * controller.
+ */
+static void cdns_spi_config_clock_freq(struct spi_device *spi,
+                                  struct spi_transfer *transfer)
+{
+        struct cdns_spi *xspi = spi_master_get_devdata(spi->master);
+        u32 ctrl_reg, baud_rate_val;
+        unsigned long frequency;
+        frequency = clk_get_rate(xspi->ref_clk);
+        ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR_OFFSET);
+        /* Set the clock frequency */
+        if (xspi->speed_hz != transfer->speed_hz) {
+                /* first valid value is 1 */
+                baud_rate_val = CDNS_SPI_BAUD_DIV_MIN;
+                while ((baud_rate_val < CDNS_SPI_BAUD_DIV_MAX) &&
+                       (frequency / (2 << baud_rate_val)) > transfer->speed_hz)
+                        baud_rate_val++;
+                ctrl_reg &= ~CDNS_SPI_CR_BAUD_DIV_MASK;
+                ctrl_reg |= baud_rate_val << CDNS_SPI_BAUD_DIV_SHIFT;
+                xspi->speed_hz = frequency / (2 << baud_rate_val);
+        }
+        cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET, ctrl_reg);
+}
+/**
+ * cdns_spi_setup_transfer - Configure SPI controller for specified transfer
+ * @spi:        Pointer to the spi_device structure
+ * @transfer:   Pointer to the spi_transfer structure which provides
+ *              information about next transfer setup parameters
+ *
+ * Sets the operational mode of SPI controller for the next SPI transfer and
+ * sets the requested clock frequency.
+ *
+ * Return:      Always 0
+ */
+static int cdns_spi_setup_transfer(struct spi_device *spi,
+                                   struct spi_transfer *transfer)
+{
+        struct cdns_spi *xspi = spi_master_get_devdata(spi->master);
+        cdns_spi_config_clock_freq(spi, transfer);
+        dev_dbg(&spi->dev, "%s, mode %d, %u bits/w, %u clock speed\n",
+                __func__, spi->mode, spi->bits_per_word,
+                xspi->speed_hz);
+        return 0;
+}
+/**
+ * cdns_spi_fill_tx_fifo - Fills the TX FIFO with as many bytes as possible
+ * @xspi:       Pointer to the cdns_spi structure
+ */
+static void cdns_spi_fill_tx_fifo(struct cdns_spi *xspi)
+{
+        unsigned long trans_cnt = 0;
+        while ((trans_cnt < CDNS_SPI_FIFO_DEPTH) &&
+               (xspi->tx_bytes > 0)) {
+                if (xspi->txbuf)
+                        cdns_spi_write(xspi, CDNS_SPI_TXD_OFFSET,
+                                       *xspi->txbuf++);
+                else
+                        cdns_spi_write(xspi, CDNS_SPI_TXD_OFFSET, 0);
+                xspi->tx_bytes--;
+                trans_cnt++;
+        }
+}
+/**
+ * cdns_spi_irq - Interrupt service routine of the SPI controller
+ * @irq:        IRQ number
+ * @dev_id:     Pointer to the xspi structure
+ *
+ * This function handles TX empty and Mode Fault interrupts only.
+ * On TX empty interrupt this function reads the received data from RX FIFO and
+ * fills the TX FIFO if there is any data remaining to be transferred.
+ * On Mode Fault interrupt this function indicates that transfer is completed,
+ * the SPI subsystem will identify the error as the remaining bytes to be
+ * transferred is non-zero.
+ *
+ * Return:      IRQ_HANDLED when handled; IRQ_NONE otherwise.
+ */
+static irqreturn_t cdns_spi_irq(int irq, void *dev_id)
+{
+        struct spi_master *master = dev_id;
+        struct cdns_spi *xspi = spi_master_get_devdata(master);
+        u32 intr_status, status;
+        status = IRQ_NONE;
+        intr_status = cdns_spi_read(xspi, CDNS_SPI_ISR_OFFSET);
+        cdns_spi_write(xspi, CDNS_SPI_ISR_OFFSET, intr_status);
+        if (intr_status & CDNS_SPI_IXR_MODF_MASK) {
+                /* Indicate that transfer is completed, the SPI subsystem will
+                 * identify the error as the remaining bytes to be
+                 * transferred is non-zero
+                 */
+                cdns_spi_write(xspi, CDNS_SPI_IDR_OFFSET,
+                               CDNS_SPI_IXR_DEFAULT_MASK);
+                spi_finalize_current_transfer(master);
+                status = IRQ_HANDLED;
+        } else if (intr_status & CDNS_SPI_IXR_TXOW_MASK) {
+                unsigned long trans_cnt;
+                trans_cnt = xspi->rx_bytes - xspi->tx_bytes;
+                /* Read out the data from the RX FIFO */
+                while (trans_cnt) {
+                        u8 data;
+                        data = cdns_spi_read(xspi, CDNS_SPI_RXD_OFFSET);
+                        if (xspi->rxbuf)
+                                *xspi->rxbuf++ = data;
+                        xspi->rx_bytes--;
+                        trans_cnt--;
+                }
+                if (xspi->tx_bytes) {
+                        /* There is more data to send */
+                        cdns_spi_fill_tx_fifo(xspi);
+                } else {
+                        /* Transfer is completed */
+                        cdns_spi_write(xspi, CDNS_SPI_IDR_OFFSET,
+                                       CDNS_SPI_IXR_DEFAULT_MASK);
+                        spi_finalize_current_transfer(master);
+                }
+                status = IRQ_HANDLED;
+        }
+        return status;
+}
+/**
+ * cdns_transfer_one - Initiates the SPI transfer
+ * @master:     Pointer to spi_master structure
+ * @spi:        Pointer to the spi_device structure
+ * @transfer:   Pointer to the spi_transfer structure which provides
+ *              information about next transfer parameters
+ *
+ * This function fills the TX FIFO, starts the SPI transfer and
+ * returns a positive transfer count so that core will wait for completion.
+ *
+ * Return:      Number of bytes transferred in the last transfer
+ */
+static int cdns_transfer_one(struct spi_master *master,
+                             struct spi_device *spi,
+                             struct spi_transfer *transfer)
+{
+        struct cdns_spi *xspi = spi_master_get_devdata(master);
+        xspi->txbuf = transfer->tx_buf;
+        xspi->rxbuf = transfer->rx_buf;
+        xspi->tx_bytes = transfer->len;
+        xspi->rx_bytes = transfer->len;
+        cdns_spi_setup_transfer(spi, transfer);
+        cdns_spi_fill_tx_fifo(xspi);
+        cdns_spi_write(xspi, CDNS_SPI_IER_OFFSET,
+                       CDNS_SPI_IXR_DEFAULT_MASK);
+        return transfer->len;
+}
+/**
+ * cdns_prepare_transfer_hardware - Prepares hardware for transfer.
+ * @master:     Pointer to the spi_master structure which provides
+ *              information about the controller.
+ *
+ * This function enables SPI master controller.
+ *
+ * Return:      0 always
+ */
+static int cdns_prepare_transfer_hardware(struct spi_master *master)
+{
+        struct cdns_spi *xspi = spi_master_get_devdata(master);
+        cdns_spi_config_clock_mode(master->cur_msg->spi);
+        cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
+                       CDNS_SPI_ER_ENABLE_MASK);
+        return 0;
+}
+/**
+ * cdns_unprepare_transfer_hardware - Relaxes hardware after transfer
+ * @master:     Pointer to the spi_master structure which provides
+ *              information about the controller.
+ *
+ * This function disables the SPI master controller.
+ *
+ * Return:      0 always
+ */
+static int cdns_unprepare_transfer_hardware(struct spi_master *master)
+{
+        struct cdns_spi *xspi = spi_master_get_devdata(master);
+        cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
+                       CDNS_SPI_ER_DISABLE_MASK);
+        return 0;
+}
+/**
+ * cdns_spi_probe - Probe method for the SPI driver
+ * @pdev:       Pointer to the platform_device structure
+ *
+ * This function initializes the driver data structures and the hardware.
+ *
+ * Return:      0 on success and error value on error
+ */
+static int cdns_spi_probe(struct platform_device *pdev)
+{
+        int ret = 0, irq;
+        struct spi_master *master;
+        struct cdns_spi *xspi;
+        struct resource *res;
+        u32 num_cs;
+        master = spi_alloc_master(&pdev->dev, sizeof(*xspi));
+        if (master == NULL)
+                return -ENOMEM;
+        xspi = spi_master_get_devdata(master);
+        master->dev.of_node = pdev->dev.of_node;
+        platform_set_drvdata(pdev, master);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        xspi->regs = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(xspi->regs)) {
+                ret = PTR_ERR(xspi->regs);
+                goto remove_master;
+        }
+        xspi->pclk = devm_clk_get(&pdev->dev, "pclk");
+        if (IS_ERR(xspi->pclk)) {
+                dev_err(&pdev->dev, "pclk clock not found.\n");
+                ret = PTR_ERR(xspi->pclk);
+                goto remove_master;
+        }
+        xspi->ref_clk = devm_clk_get(&pdev->dev, "ref_clk");
+        if (IS_ERR(xspi->ref_clk)) {
+                dev_err(&pdev->dev, "ref_clk clock not found.\n");
+                ret = PTR_ERR(xspi->ref_clk);
+                goto remove_master;
+        }
+        ret = clk_prepare_enable(xspi->pclk);
+        if (ret) {
+                dev_err(&pdev->dev, "Unable to enable APB clock.\n");
+                goto remove_master;
+        }
+        ret = clk_prepare_enable(xspi->ref_clk);
+        if (ret) {
+                dev_err(&pdev->dev, "Unable to enable device clock.\n");
+                goto clk_dis_apb;
+        }
+        /* SPI controller initializations */
+        cdns_spi_init_hw(xspi);
+        irq = platform_get_irq(pdev, 0);
+        if (irq <= 0) {
+                ret = -ENXIO;
+                dev_err(&pdev->dev, "irq number is invalid\n");
+                goto remove_master;
+        }
+        ret = devm_request_irq(&pdev->dev, irq, cdns_spi_irq,
+                               0, pdev->name, master);
+        if (ret != 0) {
+                ret = -ENXIO;
+                dev_err(&pdev->dev, "request_irq failed\n");
+                goto remove_master;
+        }
+        ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
+        if (ret < 0)
+                master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
+        else
+                master->num_chipselect = num_cs;
+        ret = of_property_read_u32(pdev->dev.of_node, "is-decoded-cs",
+                                   &xspi->is_decoded_cs);
+        if (ret < 0)
+                xspi->is_decoded_cs = 0;
+        master->prepare_transfer_hardware = cdns_prepare_transfer_hardware;
+        master->transfer_one = cdns_transfer_one;
+        master->unprepare_transfer_hardware = cdns_unprepare_transfer_hardware;
+        master->set_cs = cdns_spi_chipselect;
+        master->mode_bits = SPI_CPOL | SPI_CPHA;
+        /* Set to default valid value */
+        master->max_speed_hz = clk_get_rate(xspi->ref_clk) / 4;
+        xspi->speed_hz = master->max_speed_hz;
+        master->bits_per_word_mask = SPI_BPW_MASK(8);
+        ret = spi_register_master(master);
+        if (ret) {
+                dev_err(&pdev->dev, "spi_register_master failed\n");
+                goto clk_dis_all;
+        }
+        return ret;
+clk_dis_all:
+        clk_disable_unprepare(xspi->ref_clk);
+clk_dis_apb:
+        clk_disable_unprepare(xspi->pclk);
+remove_master:
+        spi_master_put(master);
+        return ret;
+}
+/**
+ * cdns_spi_remove - Remove method for the SPI driver
+ * @pdev:       Pointer to the platform_device structure
+ *
+ * This function is called if a device is physically removed from the system or
+ * if the driver module is being unloaded. It frees all resources allocated to
+ * the device.
+ *
+ * Return:      0 on success and error value on error
+ */
+static int cdns_spi_remove(struct platform_device *pdev)
+{
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct cdns_spi *xspi = spi_master_get_devdata(master);
+        cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
+                       CDNS_SPI_ER_DISABLE_MASK);
+        clk_disable_unprepare(xspi->ref_clk);
+        clk_disable_unprepare(xspi->pclk);
+        spi_unregister_master(master);
+        return 0;
+}
+/**
+ * cdns_spi_suspend - Suspend method for the SPI driver
+ * @dev:        Address of the platform_device structure
+ *
+ * This function disables the SPI controller and
+ * changes the driver state to "suspend"
+ *
+ * Return:      Always 0
+ */
+static int __maybe_unused cdns_spi_suspend(struct device *dev)
+{
+        struct platform_device *pdev = container_of(dev,
+                        struct platform_device, dev);
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct cdns_spi *xspi = spi_master_get_devdata(master);
+        spi_master_suspend(master);
+        clk_disable_unprepare(xspi->ref_clk);
+        clk_disable_unprepare(xspi->pclk);
+        return 0;
+}
+/**
+ * cdns_spi_resume - Resume method for the SPI driver
+ * @dev:        Address of the platform_device structure
+ *
+ * This function changes the driver state to "ready"
+ *
+ * Return:      0 on success and error value on error
+ */
+static int __maybe_unused cdns_spi_resume(struct device *dev)
+{
+        struct platform_device *pdev = container_of(dev,
+                        struct platform_device, dev);
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct cdns_spi *xspi = spi_master_get_devdata(master);
+        int ret = 0;
+        ret = clk_prepare_enable(xspi->pclk);
+        if (ret) {
+                dev_err(dev, "Cannot enable APB clock.\n");
+                return ret;
+        }
+        ret = clk_prepare_enable(xspi->ref_clk);
+        if (ret) {
+                dev_err(dev, "Cannot enable device clock.\n");
+                clk_disable(xspi->pclk);
+                return ret;
+        }
+        spi_master_resume(master);
+        return 0;
+}
+static SIMPLE_DEV_PM_OPS(cdns_spi_dev_pm_ops, cdns_spi_suspend,
+                         cdns_spi_resume);
+static struct of_device_id cdns_spi_of_match[] = {
+        { .compatible = "xlnx,zynq-spi-r1p6" },
+        { .compatible = "cdns,spi-r1p6" },
+        { /* end of table */ }
+};
+MODULE_DEVICE_TABLE(of, cdns_spi_of_match);
+/* cdns_spi_driver - This structure defines the SPI subsystem platform driver */
+static struct platform_driver cdns_spi_driver = {
+        .probe  = cdns_spi_probe,
+        .remove = cdns_spi_remove,
+        .driver = {
+                .name = CDNS_SPI_NAME,
+                .owner = THIS_MODULE,
+                .of_match_table = cdns_spi_of_match,
+                .pm = &cdns_spi_dev_pm_ops,
+        },
+};
+module_platform_driver(cdns_spi_driver);
+MODULE_AUTHOR("Xilinx, Inc.");
+MODULE_DESCRIPTION("Cadence SPI driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c
index 1492f5ee9aaa..a5cba14ac3d2 100644
--- a/drivers/spi/spi-dw-mmio.c
+++ b/drivers/spi/spi-dw-mmio.c
@@ -16,6 +16,7 @@
 #include <linux/spi/spi.h>
 #include <linux/scatterlist.h>
 #include <linux/module.h>
+#include <linux/of_gpio.h>
 #include "spi-dw.h"
@@ -70,6 +71,27 @@ static int dw_spi_mmio_probe(struct platform_device *pdev)
        dws->num_cs = 4;
        dws->max_freq = clk_get_rate(dwsmmio->clk);
+        if (pdev->dev.of_node) {
+                int i;
+                for (i = 0; i < dws->num_cs; i++) {
+                        int cs_gpio = of_get_named_gpio(pdev->dev.of_node,
+                                        "cs-gpios", i);
+                        if (cs_gpio == -EPROBE_DEFER) {
+                                ret = cs_gpio;
+                                goto out;
+                        }
+                        if (gpio_is_valid(cs_gpio)) {
+                                ret = devm_gpio_request(&pdev->dev, cs_gpio,
+                                                dev_name(&pdev->dev));
+                                if (ret)
+                                        goto out;
+                        }
+                }
+        }
        ret = dw_spi_add_host(&pdev->dev, dws);
        if (ret)
                goto out;
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 712ac5629cd4..29f33143b795 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -24,6 +24,7 @@
 #include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/spi/spi.h>
+#include <linux/gpio.h>
 #include "spi-dw.h"
@@ -36,12 +37,6 @@
 #define DONE_STATE      ((void *)2)
 #define ERROR_STATE     ((void *)-1)
-#define QUEUE_RUNNING   0
-#define QUEUE_STOPPED   1
-#define MRST_SPI_DEASSERT       0
-#define MRST_SPI_ASSERT         1
 /* Slave spi_dev related */
 struct chip_data {
        u16 cr0;
@@ -263,28 +258,22 @@ static int map_dma_buffers(struct dw_spi *dws)
 static void giveback(struct dw_spi *dws)
 {
        struct spi_transfer *last_transfer;
-        unsigned long flags;
        struct spi_message *msg;
-        spin_lock_irqsave(&dws->lock, flags);
        msg = dws->cur_msg;
        dws->cur_msg = NULL;
        dws->cur_transfer = NULL;
        dws->prev_chip = dws->cur_chip;
        dws->cur_chip = NULL;
        dws->dma_mapped = 0;
-        queue_work(dws->workqueue, &dws->pump_messages);
-        spin_unlock_irqrestore(&dws->lock, flags);
        last_transfer = list_last_entry(&msg->transfers, struct spi_transfer,
                                        transfer_list);
-        if (!last_transfer->cs_change && dws->cs_control)
+        if (!last_transfer->cs_change)
-                dws->cs_control(MRST_SPI_DEASSERT);
+                spi_chip_sel(dws, dws->cur_msg->spi, 0);
-        msg->state = NULL;
+        spi_finalize_current_message(dws->master);
-        if (msg->complete)
-                msg->complete(msg->context);
 }
 static void int_error_stop(struct dw_spi *dws, const char *msg)
@@ -502,7 +491,7 @@ static void pump_transfers(unsigned long data)
                        dw_writew(dws, DW_SPI_CTRL0, cr0);
                spi_set_clk(dws, clk_div ? clk_div : chip->clk_div);
-                spi_chip_sel(dws, spi->chip_select);
+                spi_chip_sel(dws, spi, 1);
                /* Set the interrupt mask, for poll mode just disable all int */
                spi_mask_intr(dws, 0xff);
@@ -529,30 +518,12 @@ early_exit:
        return;
 }
-static void pump_messages(struct work_struct *work)
+static int dw_spi_transfer_one_message(struct spi_master *master,
+                struct spi_message *msg)
 {
-        struct dw_spi *dws =
+        struct dw_spi *dws = spi_master_get_devdata(master);
-                container_of(work, struct dw_spi, pump_messages);
-        unsigned long flags;
-        /* Lock queue and check for queue work */
-        spin_lock_irqsave(&dws->lock, flags);
-        if (list_empty(&dws->queue) || dws->run == QUEUE_STOPPED) {
-                dws->busy = 0;
-                spin_unlock_irqrestore(&dws->lock, flags);
-                return;
-        }
-        /* Make sure we are not already running a message */
-        if (dws->cur_msg) {
-                spin_unlock_irqrestore(&dws->lock, flags);
-                return;
-        }
-        /* Extract head of queue */
-        dws->cur_msg = list_entry(dws->queue.next, struct spi_message, queue);
-        list_del_init(&dws->cur_msg->queue);
+        dws->cur_msg = msg;
        /* Initial message state*/
        dws->cur_msg->state = START_STATE;
        dws->cur_transfer = list_entry(dws->cur_msg->transfers.next,
@@ -560,46 +531,9 @@ static void pump_messages(struct work_struct *work)
                                                transfer_list);
        dws->cur_chip = spi_get_ctldata(dws->cur_msg->spi);
-        /* Mark as busy and launch transfers */
+        /* Launch transfers */
        tasklet_schedule(&dws->pump_transfers);
-        dws->busy = 1;
-        spin_unlock_irqrestore(&dws->lock, flags);
-}
-/* spi_device use this to queue in their spi_msg */
-static int dw_spi_transfer(struct spi_device *spi, struct spi_message *msg)
-{
-        struct dw_spi *dws = spi_master_get_devdata(spi->master);
-        unsigned long flags;
-        spin_lock_irqsave(&dws->lock, flags);
-        if (dws->run == QUEUE_STOPPED) {
-                spin_unlock_irqrestore(&dws->lock, flags);
-                return -ESHUTDOWN;
-        }
-        msg->actual_length = 0;
-        msg->status = -EINPROGRESS;
-        msg->state = START_STATE;
-        list_add_tail(&msg->queue, &dws->queue);
-        if (dws->run == QUEUE_RUNNING && !dws->busy) {
-                if (dws->cur_transfer || dws->cur_msg)
-                        queue_work(dws->workqueue,
-                                        &dws->pump_messages);
-                else {
-                        /* If no other data transaction in air, just go */
-                        spin_unlock_irqrestore(&dws->lock, flags);
-                        pump_messages(&dws->pump_messages);
-                        return 0;
-                }
-        }
-        spin_unlock_irqrestore(&dws->lock, flags);
        return 0;
 }
@@ -608,6 +542,7 @@ static int dw_spi_setup(struct spi_device *spi)
 {
        struct dw_spi_chip *chip_info = NULL;
        struct chip_data *chip;
+        int ret;
        /* Only alloc on first setup */
        chip = spi_get_ctldata(spi);
@@ -661,81 +596,13 @@ static int dw_spi_setup(struct spi_device *spi)
                        | (spi->mode  << SPI_MODE_OFFSET)
                        | (chip->tmode << SPI_TMOD_OFFSET);
-        return 0;
+        if (gpio_is_valid(spi->cs_gpio)) {
-}
+                ret = gpio_direction_output(spi->cs_gpio,
+                                !(spi->mode & SPI_CS_HIGH));
-static int init_queue(struct dw_spi *dws)
+                if (ret)
-{
+                        return ret;
-        INIT_LIST_HEAD(&dws->queue);
-        spin_lock_init(&dws->lock);
-        dws->run = QUEUE_STOPPED;
-        dws->busy = 0;
-        tasklet_init(&dws->pump_transfers,
-                        pump_transfers, (unsigned long)dws);
-        INIT_WORK(&dws->pump_messages, pump_messages);
-        dws->workqueue = create_singlethread_workqueue(
-                                        dev_name(dws->master->dev.parent));
-        if (dws->workqueue == NULL)
-                return -EBUSY;
-        return 0;
-}
-static int start_queue(struct dw_spi *dws)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&dws->lock, flags);
-        if (dws->run == QUEUE_RUNNING || dws->busy) {
-                spin_unlock_irqrestore(&dws->lock, flags);
-                return -EBUSY;
        }
-        dws->run = QUEUE_RUNNING;
-        dws->cur_msg = NULL;
-        dws->cur_transfer = NULL;
-        dws->cur_chip = NULL;
-        dws->prev_chip = NULL;
-        spin_unlock_irqrestore(&dws->lock, flags);
-        queue_work(dws->workqueue, &dws->pump_messages);
-        return 0;
-}
-static int stop_queue(struct dw_spi *dws)
-{
-        unsigned long flags;
-        unsigned limit = 50;
-        int status = 0;
-        spin_lock_irqsave(&dws->lock, flags);
-        dws->run = QUEUE_STOPPED;
-        while ((!list_empty(&dws->queue) || dws->busy) && limit--) {
-                spin_unlock_irqrestore(&dws->lock, flags);
-                msleep(10);
-                spin_lock_irqsave(&dws->lock, flags);
-        }
-        if (!list_empty(&dws->queue) || dws->busy)
-                status = -EBUSY;
-        spin_unlock_irqrestore(&dws->lock, flags);
-        return status;
-}
-static int destroy_queue(struct dw_spi *dws)
-{
-        int status;
-        status = stop_queue(dws);
-        if (status != 0)
-                return status;
-        destroy_workqueue(dws->workqueue);
        return 0;
 }
@@ -794,7 +661,7 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
        master->bus_num = dws->bus_num;
        master->num_chipselect = dws->num_cs;
        master->setup = dw_spi_setup;
-        master->transfer = dw_spi_transfer;
+        master->transfer_one_message = dw_spi_transfer_one_message;
        master->max_speed_hz = dws->max_freq;
        /* Basic HW init */
@@ -808,33 +675,21 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
                }
        }
-        /* Initial and start queue */
+        tasklet_init(&dws->pump_transfers, pump_transfers, (unsigned long)dws);
-        ret = init_queue(dws);
-        if (ret) {
-                dev_err(&master->dev, "problem initializing queue\n");
-                goto err_diable_hw;
-        }
-        ret = start_queue(dws);
-        if (ret) {
-                dev_err(&master->dev, "problem starting queue\n");
-                goto err_diable_hw;
-        }
        spi_master_set_devdata(master, dws);
        ret = devm_spi_register_master(dev, master);
        if (ret) {
                dev_err(&master->dev, "problem registering spi master\n");
-                goto err_queue_alloc;
+                goto err_dma_exit;
        }
        mrst_spi_debugfs_init(dws);
        return 0;
-err_queue_alloc:
+err_dma_exit:
-        destroy_queue(dws);
        if (dws->dma_ops && dws->dma_ops->dma_exit)
                dws->dma_ops->dma_exit(dws);
-err_diable_hw:
        spi_enable_chip(dws, 0);
 err_free_master:
        spi_master_put(master);
@@ -844,18 +699,10 @@ EXPORT_SYMBOL_GPL(dw_spi_add_host);
 void dw_spi_remove_host(struct dw_spi *dws)
 {
-        int status = 0;
        if (!dws)
                return;
        mrst_spi_debugfs_remove(dws);
-        /* Remove the queue */
-        status = destroy_queue(dws);
-        if (status != 0)
-                dev_err(&dws->master->dev,
-                        "dw_spi_remove: workqueue will not complete, message memory not freed\n");
        if (dws->dma_ops && dws->dma_ops->dma_exit)
                dws->dma_ops->dma_exit(dws);
        spi_enable_chip(dws, 0);
@@ -868,7 +715,7 @@ int dw_spi_suspend_host(struct dw_spi *dws)
 {
        int ret = 0;
-        ret = stop_queue(dws);
+        ret = spi_master_suspend(dws->master);
        if (ret)
                return ret;
        spi_enable_chip(dws, 0);
@@ -882,7 +729,7 @@ int dw_spi_resume_host(struct dw_spi *dws)
        int ret;
        spi_hw_init(dws);
-        ret = start_queue(dws);
+        ret = spi_master_resume(dws->master);
        if (ret)
                dev_err(&dws->master->dev, "fail to start queue (%d)\n", ret);
        return ret;
diff --git a/drivers/spi/spi-dw.h b/drivers/spi/spi-dw.h
index 587643dae11e..6d2acad34f64 100644
--- a/drivers/spi/spi-dw.h
+++ b/drivers/spi/spi-dw.h
@@ -3,6 +3,7 @@
 #include <linux/io.h>
 #include <linux/scatterlist.h>
+#include <linux/gpio.h>
 /* Register offsets */
 #define DW_SPI_CTRL0                    0x00
@@ -104,14 +105,6 @@ struct dw_spi {
        u16                     bus_num;
        u16                     num_cs;         /* supported slave numbers */
-        /* Driver message queue */
-        struct workqueue_struct *workqueue;
-        struct work_struct      pump_messages;
-        spinlock_t              lock;
-        struct list_head        queue;
-        int                     busy;
-        int                     run;
        /* Message Transfer pump */
        struct tasklet_struct   pump_transfers;
@@ -186,15 +179,20 @@ static inline void spi_set_clk(struct dw_spi *dws, u16 div)
        dw_writel(dws, DW_SPI_BAUDR, div);
 }
-static inline void spi_chip_sel(struct dw_spi *dws, u16 cs)
+static inline void spi_chip_sel(struct dw_spi *dws, struct spi_device *spi,
+                int active)
 {
-        if (cs > dws->num_cs)
+        u16 cs = spi->chip_select;
-                return;
+        int gpio_val = active ? (spi->mode & SPI_CS_HIGH) :
+                !(spi->mode & SPI_CS_HIGH);
        if (dws->cs_control)
-                dws->cs_control(1);
+                dws->cs_control(active);
+        if (gpio_is_valid(spi->cs_gpio))
+                gpio_set_value(spi->cs_gpio, gpio_val);
-        dw_writel(dws, DW_SPI_SER, 1 << cs);
+        if (active)
+                dw_writel(dws, DW_SPI_SER, 1 << cs);
 }
 /* Disable IRQ bits */
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index d565eeee3bd8..5021ddf03f60 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -406,7 +406,7 @@ static irqreturn_t dspi_interrupt(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
-static struct of_device_id fsl_dspi_dt_ids[] = {
+static const struct of_device_id fsl_dspi_dt_ids[] = {
        { .compatible = "fsl,vf610-dspi", .data = NULL, },
        { /* sentinel */ }
 };
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index e767f5831b9c..8ebd724e4c59 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -348,7 +348,7 @@ static void fsl_espi_cmd_trans(struct spi_message *m,
        }
        espi_trans->tx_buf = local_buf;
-        espi_trans->rx_buf = local_buf + espi_trans->n_tx;
+        espi_trans->rx_buf = local_buf;
        fsl_espi_do_trans(m, espi_trans);
        espi_trans->actual_length = espi_trans->len;
@@ -397,7 +397,7 @@ static void fsl_espi_rw_trans(struct spi_message *m,
                espi_trans->n_rx = trans_len;
                espi_trans->len = trans_len + n_tx;
                espi_trans->tx_buf = local_buf;
-                espi_trans->rx_buf = local_buf + n_tx;
+                espi_trans->rx_buf = local_buf;
                fsl_espi_do_trans(m, espi_trans);
                memcpy(rx_buf + pos, espi_trans->rx_buf + n_tx, trans_len);
@@ -458,7 +458,7 @@ static int fsl_espi_setup(struct spi_device *spi)
                return -EINVAL;
        if (!cs) {
-                cs = kzalloc(sizeof *cs, GFP_KERNEL);
+                cs = devm_kzalloc(&spi->dev, sizeof(*cs), GFP_KERNEL);
                if (!cs)
                        return -ENOMEM;
                spi->controller_state = cs;
@@ -586,8 +586,10 @@ static struct spi_master * fsl_espi_probe(struct device *dev,
        struct spi_master *master;
        struct mpc8xxx_spi *mpc8xxx_spi;
        struct fsl_espi_reg *reg_base;
-        u32 regval;
+        struct device_node *nc;
-        int i, ret = 0;
+        const __be32 *prop;
+        u32 regval, csmode;
+        int i, len, ret = 0;
        master = spi_alloc_master(dev, sizeof(struct mpc8xxx_spi));
        if (!master) {
@@ -634,8 +636,32 @@ static struct spi_master * fsl_espi_probe(struct device *dev,
        mpc8xxx_spi_write_reg(&reg_base->event, 0xffffffff);
        /* Init eSPI CS mode register */
-        for (i = 0; i < pdata->max_chipselect; i++)
+        for_each_available_child_of_node(master->dev.of_node, nc) {
-                mpc8xxx_spi_write_reg(&reg_base->csmode[i], CSMODE_INIT_VAL);
+                /* get chip select */
+                prop = of_get_property(nc, "reg", &len);
+                if (!prop || len < sizeof(*prop))
+                        continue;
+                i = be32_to_cpup(prop);
+                if (i < 0 || i >= pdata->max_chipselect)
+                        continue;
+                csmode = CSMODE_INIT_VAL;
+                /* check if CSBEF is set in device tree */
+                prop = of_get_property(nc, "fsl,csbef", &len);
+                if (prop && len >= sizeof(*prop)) {
+                        csmode &= ~(CSMODE_BEF(0xf));
+                        csmode |= CSMODE_BEF(be32_to_cpup(prop));
+                }
+                /* check if CSAFT is set in device tree */
+                prop = of_get_property(nc, "fsl,csaft", &len);
+                if (prop && len >= sizeof(*prop)) {
+                        csmode &= ~(CSMODE_AFT(0xf));
+                        csmode |= CSMODE_AFT(be32_to_cpup(prop));
+                }
+                mpc8xxx_spi_write_reg(&reg_base->csmode[i], csmode);
+                dev_info(dev, "cs=%d, init_csmode=0x%x\n", i, csmode);
+        }
        /* Enable SPI interface */
        regval = pdata->initial_spmode | SPMODE_INIT_VAL | SPMODE_ENABLE;
diff --git a/drivers/spi/spi-fsl-lib.c b/drivers/spi/spi-fsl-lib.c
index e5d45fca3551..95212ea96c8d 100644
--- a/drivers/spi/spi-fsl-lib.c
+++ b/drivers/spi/spi-fsl-lib.c
@@ -99,11 +99,6 @@ int mpc8xxx_spi_transfer(struct spi_device *spi,
        return 0;
 }
-void mpc8xxx_spi_cleanup(struct spi_device *spi)
-{
-        kfree(spi->controller_state);
-}
 const char *mpc8xxx_spi_strmode(unsigned int flags)
 {
        if (flags & SPI_QE_CPU_MODE) {
@@ -134,7 +129,6 @@ int mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
                        | SPI_LSB_FIRST | SPI_LOOP;
        master->transfer = mpc8xxx_spi_transfer;
-        master->cleanup = mpc8xxx_spi_cleanup;
        master->dev.of_node = dev->of_node;
        mpc8xxx_spi = spi_master_get_devdata(master);
diff --git a/drivers/spi/spi-fsl-lib.h b/drivers/spi/spi-fsl-lib.h
index 52db6936778e..2fcbfd01d109 100644
--- a/drivers/spi/spi-fsl-lib.h
+++ b/drivers/spi/spi-fsl-lib.h
@@ -124,7 +124,6 @@ extern struct mpc8xxx_spi_probe_info *to_of_pinfo(
 extern int mpc8xxx_spi_bufs(struct mpc8xxx_spi *mspi,
                struct spi_transfer *t, unsigned int len);
 extern int mpc8xxx_spi_transfer(struct spi_device *spi, struct spi_message *m);
-extern void mpc8xxx_spi_cleanup(struct spi_device *spi);
 extern const char *mpc8xxx_spi_strmode(unsigned int flags);
 extern int mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
                unsigned int irq);
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index b3e7775034db..98ccd231bf00 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -431,7 +431,7 @@ static int fsl_spi_setup(struct spi_device *spi)
                return -EINVAL;
        if (!cs) {
-                cs = kzalloc(sizeof *cs, GFP_KERNEL);
+                cs = devm_kzalloc(&spi->dev, sizeof(*cs), GFP_KERNEL);
                if (!cs)
                        return -ENOMEM;
                spi->controller_state = cs;
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index 09823076df88..9f595535cf27 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -340,7 +340,7 @@ done:
 }
 #ifdef CONFIG_OF
-static struct of_device_id spi_gpio_dt_ids[] = {
+static const struct of_device_id spi_gpio_dt_ids[] = {
        { .compatible = "spi-gpio" },
        {}
 };
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 51d99779682f..66d2ae21e78e 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1111,10 +1111,8 @@ static int pl022_dma_probe(struct pl022 *pl022)
        }
        pl022->dummypage = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!pl022->dummypage) {
+        if (!pl022->dummypage)
-                dev_dbg(&pl022->adev->dev, "no DMA dummypage!\n");
                goto err_no_dummypage;
-        }
        dev_info(&pl022->adev->dev, "setup for DMA on RX %s, TX %s\n",
                 dma_chan_name(pl022->dma_rx_channel),
@@ -1809,11 +1807,8 @@ static int pl022_setup(struct spi_device *spi)
        if (chip == NULL) {
                chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
-                if (!chip) {
+                if (!chip)
-                        dev_err(&spi->dev,
-                                "cannot allocate controller state\n");
                        return -ENOMEM;
-                }
                dev_dbg(&spi->dev,
                        "allocated memory for controller's runtime state\n");
        }
@@ -2050,10 +2045,8 @@ pl022_platform_data_dt_get(struct device *dev)
        }
        pd = devm_kzalloc(dev, sizeof(struct pl022_ssp_controller), GFP_KERNEL);
-        if (!pd) {
+        if (!pd)
-                dev_err(dev, "cannot allocate platform data memory\n");
                return NULL;
-        }
        pd->bus_id = -1;
        pd->enable_dma = 1;
diff --git a/drivers/spi/spi-pxa2xx-dma.c b/drivers/spi/spi-pxa2xx-dma.c
index 713af4806f26..f6759dc0153b 100644
--- a/drivers/spi/spi-pxa2xx-dma.c
+++ b/drivers/spi/spi-pxa2xx-dma.c
@@ -29,18 +29,6 @@ static int pxa2xx_spi_map_dma_buffer(struct driver_data *drv_data,
        struct sg_table *sgt;
        void *buf, *pbuf;
-        /*
-         * Some DMA controllers have problems transferring buffers that are
-         * not multiple of 4 bytes. So we truncate the transfer so that it
-         * is suitable for such controllers, and handle the trailing bytes
-         * manually after the DMA completes.
-         *
-         * REVISIT: It would be better if this information could be
-         * retrieved directly from the DMA device in a similar way than
-         * ->copy_align etc. is done.
-         */
-        len = ALIGN(drv_data->len, 4);
        if (dir == DMA_TO_DEVICE) {
                dmadev = drv_data->tx_chan->device->dev;
                sgt = &drv_data->tx_sgt;
@@ -144,12 +132,8 @@ static void pxa2xx_spi_dma_transfer_complete(struct driver_data *drv_data,
                if (!error) {
                        pxa2xx_spi_unmap_dma_buffers(drv_data);
-                        /* Handle the last bytes of unaligned transfer */
                        drv_data->tx += drv_data->tx_map_len;
-                        drv_data->write(drv_data);
                        drv_data->rx += drv_data->rx_map_len;
-                        drv_data->read(drv_data);
                        msg->actual_length += drv_data->len;
                        msg->state = pxa2xx_spi_next_transfer(drv_data);
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index a07b75814442..901d0e0ba3eb 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -886,11 +886,8 @@ static int setup(struct spi_device *spi)
        chip = spi_get_ctldata(spi);
        if (!chip) {
                chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
-                if (!chip) {
+                if (!chip)
-                        dev_err(&spi->dev,
-                                "failed setup: can't allocate chip data\n");
                        return -ENOMEM;
-                }
                if (drv_data->ssp_type == CE4100_SSP) {
                        if (spi->chip_select > 4) {
@@ -1037,11 +1034,8 @@ pxa2xx_spi_acpi_get_pdata(struct platform_device *pdev)
                return NULL;
        pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
-        if (!pdata) {
+        if (!pdata)
-                dev_err(&pdev->dev,
-                        "failed to allocate memory for platform data\n");
                return NULL;
-        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res)
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index b032e8885e24..fc1de86d3c8a 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -287,7 +287,7 @@ static irqreturn_t spi_qup_qup_irq(int irq, void *dev_id)
        writel_relaxed(opflags, controller->base + QUP_OPERATIONAL);
        if (!xfer) {
-                dev_err_ratelimited(controller->dev, "unexpected irq %x08 %x08 %x08\n",
+                dev_err_ratelimited(controller->dev, "unexpected irq %08x %08x %08x\n",
                                    qup_err, spi_err, opflags);
                return IRQ_HANDLED;
        }
@@ -366,7 +366,7 @@ static int spi_qup_io_config(struct spi_device *spi, struct spi_transfer *xfer)
        n_words = xfer->len / w_size;
        controller->w_size = w_size;
-        if (n_words <= controller->in_fifo_sz) {
+        if (n_words <= (controller->in_fifo_sz / sizeof(u32))) {
                mode = QUP_IO_M_MODE_FIFO;
                writel_relaxed(n_words, controller->base + QUP_MX_READ_CNT);
                writel_relaxed(n_words, controller->base + QUP_MX_WRITE_CNT);
@@ -734,7 +734,7 @@ static int spi_qup_remove(struct platform_device *pdev)
        int ret;
        ret = pm_runtime_get_sync(&pdev->dev);
-        if (ret)
+        if (ret < 0)
                return ret;
        ret = spi_qup_set_state(controller, QUP_STATE_RESET);
@@ -749,7 +749,7 @@ static int spi_qup_remove(struct platform_device *pdev)
        return 0;
 }
-static struct of_device_id spi_qup_dt_match[] = {
+static const struct of_device_id spi_qup_dt_match[] = {
        { .compatible = "qcom,spi-qup-v2.1.1", },
        { .compatible = "qcom,spi-qup-v2.2.1", },
        { }
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 1fb0ad213324..10112745bb17 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -183,8 +183,6 @@
 #define SPBFCR_TXTRG_MASK       0x30    /* Transmit Buffer Data Triggering Number */
 #define SPBFCR_RXTRG_MASK       0x07    /* Receive Buffer Data Triggering Number */
-#define DUMMY_DATA              0x00
 struct rspi_data {
        void __iomem *addr;
        u32 max_speed_hz;
@@ -197,11 +195,6 @@ struct rspi_data {
        int rx_irq, tx_irq;
        const struct spi_ops *ops;
-        /* for dmaengine */
-        struct dma_chan *chan_tx;
-        struct dma_chan *chan_rx;
-        unsigned dma_width_16bit:1;
        unsigned dma_callbacked:1;
        unsigned byte_access:1;
 };
@@ -253,6 +246,8 @@ struct spi_ops {
        int (*transfer_one)(struct spi_master *master, struct spi_device *spi,
                            struct spi_transfer *xfer);
        u16 mode_bits;
+        u16 flags;
+        u16 fifo_size;
 };
 /*
@@ -266,7 +261,8 @@ static int rspi_set_config_register(struct rspi_data *rspi, int access_size)
        rspi_write8(rspi, rspi->sppcr, RSPI_SPPCR);
        /* Sets transfer bit rate */
-        spbr = clk_get_rate(rspi->clk) / (2 * rspi->max_speed_hz) - 1;
+        spbr = DIV_ROUND_UP(clk_get_rate(rspi->clk),
+                            2 * rspi->max_speed_hz) - 1;
        rspi_write8(rspi, clamp(spbr, 0, 255), RSPI_SPBR);
        /* Disable dummy transmission, set 16-bit word access, 1 frame */
@@ -302,7 +298,8 @@ static int rspi_rz_set_config_register(struct rspi_data *rspi, int access_size)
        rspi_write8(rspi, rspi->sppcr, RSPI_SPPCR);
        /* Sets transfer bit rate */
-        spbr = clk_get_rate(rspi->clk) / (2 * rspi->max_speed_hz) - 1;
+        spbr = DIV_ROUND_UP(clk_get_rate(rspi->clk),
+                            2 * rspi->max_speed_hz) - 1;
        rspi_write8(rspi, clamp(spbr, 0, 255), RSPI_SPBR);
        /* Disable dummy transmission, set byte access */
@@ -335,7 +332,7 @@ static int qspi_set_config_register(struct rspi_data *rspi, int access_size)
        rspi_write8(rspi, rspi->sppcr, RSPI_SPPCR);
        /* Sets transfer bit rate */
-        spbr = clk_get_rate(rspi->clk) / (2 * rspi->max_speed_hz);
+        spbr = DIV_ROUND_UP(clk_get_rate(rspi->clk), 2 * rspi->max_speed_hz);
        rspi_write8(rspi, clamp(spbr, 0, 255), RSPI_SPBR);
        /* Disable dummy transmission, set byte access */
@@ -403,11 +400,22 @@ static int rspi_wait_for_interrupt(struct rspi_data *rspi, u8 wait_mask,
        return 0;
 }
+static inline int rspi_wait_for_tx_empty(struct rspi_data *rspi)
+{
+        return rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE);
+}
+static inline int rspi_wait_for_rx_full(struct rspi_data *rspi)
+{
+        return rspi_wait_for_interrupt(rspi, SPSR_SPRF, SPCR_SPRIE);
+}
 static int rspi_data_out(struct rspi_data *rspi, u8 data)
 {
-        if (rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE) < 0) {
+        int error = rspi_wait_for_tx_empty(rspi);
+        if (error < 0) {
                dev_err(&rspi->master->dev, "transmit timeout\n");
-                return -ETIMEDOUT;
+                return error;
        }
        rspi_write_data(rspi, data);
        return 0;
@@ -415,25 +423,36 @@ static int rspi_data_out(struct rspi_data *rspi, u8 data)
 static int rspi_data_in(struct rspi_data *rspi)
 {
+        int error;
        u8 data;
-        if (rspi_wait_for_interrupt(rspi, SPSR_SPRF, SPCR_SPRIE) < 0) {
+        error = rspi_wait_for_rx_full(rspi);
+        if (error < 0) {
                dev_err(&rspi->master->dev, "receive timeout\n");
-                return -ETIMEDOUT;
+                return error;
        }
        data = rspi_read_data(rspi);
        return data;
 }
-static int rspi_data_out_in(struct rspi_data *rspi, u8 data)
+static int rspi_pio_transfer(struct rspi_data *rspi, const u8 *tx, u8 *rx,
+                             unsigned int n)
 {
-        int ret;
+        while (n-- > 0) {
+                if (tx) {
-        ret = rspi_data_out(rspi, data);
+                        int ret = rspi_data_out(rspi, *tx++);
-        if (ret < 0)
+                        if (ret < 0)
-                return ret;
+                                return ret;
+                }
+                if (rx) {
+                        int ret = rspi_data_in(rspi);
+                        if (ret < 0)
+                                return ret;
+                        *rx++ = ret;
+                }
+        }
-        return rspi_data_in(rspi);
+        return 0;
 }
 static void rspi_dma_complete(void *arg)
@@ -444,97 +463,67 @@ static void rspi_dma_complete(void *arg)
        wake_up_interruptible(&rspi->wait);
 }
-static int rspi_dma_map_sg(struct scatterlist *sg, const void *buf,
+static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
-                           unsigned len, struct dma_chan *chan,
+                             struct sg_table *rx)
-                           enum dma_transfer_direction dir)
-{
-        sg_init_table(sg, 1);
-        sg_set_buf(sg, buf, len);
-        sg_dma_len(sg) = len;
-        return dma_map_sg(chan->device->dev, sg, 1, dir);
-}
-static void rspi_dma_unmap_sg(struct scatterlist *sg, struct dma_chan *chan,
-                              enum dma_transfer_direction dir)
 {
-        dma_unmap_sg(chan->device->dev, sg, 1, dir);
+        struct dma_async_tx_descriptor *desc_tx = NULL, *desc_rx = NULL;
-}
+        u8 irq_mask = 0;
+        unsigned int other_irq = 0;
-static void rspi_memory_to_8bit(void *buf, const void *data, unsigned len)
+        dma_cookie_t cookie;
-{
+        int ret;
-        u16 *dst = buf;
-        const u8 *src = data;
-        while (len) {
-                *dst++ = (u16)(*src++);
-                len--;
-        }
-}
-static void rspi_memory_from_8bit(void *buf, const void *data, unsigned len)
-{
-        u8 *dst = buf;
-        const u16 *src = data;
-        while (len) {
-                *dst++ = (u8)*src++;
-                len--;
-        }
-}
-static int rspi_send_dma(struct rspi_data *rspi, struct spi_transfer *t)
+        if (tx) {
-{
+                desc_tx = dmaengine_prep_slave_sg(rspi->master->dma_tx,
-        struct scatterlist sg;
+                                        tx->sgl, tx->nents, DMA_TO_DEVICE,
-        const void *buf = NULL;
+                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-        struct dma_async_tx_descriptor *desc;
+                if (!desc_tx)
-        unsigned int len;
+                        return -EIO;
-        int ret = 0;
-        if (rspi->dma_width_16bit) {
-                void *tmp;
-                /*
-                 * If DMAC bus width is 16-bit, the driver allocates a dummy
-                 * buffer. And, the driver converts original data into the
-                 * DMAC data as the following format:
-                 *  original data: 1st byte, 2nd byte ...
-                 *  DMAC data:     1st byte, dummy, 2nd byte, dummy ...
-                 */
-                len = t->len * 2;
-                tmp = kmalloc(len, GFP_KERNEL);
-                if (!tmp)
-                        return -ENOMEM;
-                rspi_memory_to_8bit(tmp, t->tx_buf, t->len);
-                buf = tmp;
-        } else {
-                len = t->len;
-                buf = t->tx_buf;
-        }
-        if (!rspi_dma_map_sg(&sg, buf, len, rspi->chan_tx, DMA_TO_DEVICE)) {
+                irq_mask |= SPCR_SPTIE;
-                ret = -EFAULT;
-                goto end_nomap;
        }
-        desc = dmaengine_prep_slave_sg(rspi->chan_tx, &sg, 1, DMA_TO_DEVICE,
+        if (rx) {
-                                       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+                desc_rx = dmaengine_prep_slave_sg(rspi->master->dma_rx,
-        if (!desc) {
+                                        rx->sgl, rx->nents, DMA_FROM_DEVICE,
-                ret = -EIO;
+                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                goto end;
+                if (!desc_rx)
+                        return -EIO;
+                irq_mask |= SPCR_SPRIE;
        }
        /*
-         * DMAC needs SPTIE, but if SPTIE is set, this IRQ routine will be
+         * DMAC needs SPxIE, but if SPxIE is set, the IRQ routine will be
         * called. So, this driver disables the IRQ while DMA transfer.
         */
-        disable_irq(rspi->tx_irq);
+        if (tx)
+                disable_irq(other_irq = rspi->tx_irq);
+        if (rx && rspi->rx_irq != other_irq)
+                disable_irq(rspi->rx_irq);
-        rspi_write8(rspi, rspi_read8(rspi, RSPI_SPCR) | SPCR_TXMD, RSPI_SPCR);
+        rspi_enable_irq(rspi, irq_mask);
-        rspi_enable_irq(rspi, SPCR_SPTIE);
        rspi->dma_callbacked = 0;
-        desc->callback = rspi_dma_complete;
+        if (rx) {
-        desc->callback_param = rspi;
+                desc_rx->callback = rspi_dma_complete;
-        dmaengine_submit(desc);
+                desc_rx->callback_param = rspi;
-        dma_async_issue_pending(rspi->chan_tx);
+                cookie = dmaengine_submit(desc_rx);
+                if (dma_submit_error(cookie))
+                        return cookie;
+                dma_async_issue_pending(rspi->master->dma_rx);
+        }
+        if (tx) {
+                if (rx) {
+                        /* No callback */
+                        desc_tx->callback = NULL;
+                } else {
+                        desc_tx->callback = rspi_dma_complete;
+                        desc_tx->callback_param = rspi;
+                }
+                cookie = dmaengine_submit(desc_tx);
+                if (dma_submit_error(cookie))
+                        return cookie;
+                dma_async_issue_pending(rspi->master->dma_tx);
+        }
        ret = wait_event_interruptible_timeout(rspi->wait,
                                               rspi->dma_callbacked, HZ);
@@ -542,15 +531,13 @@ static int rspi_send_dma(struct rspi_data *rspi, struct spi_transfer *t)
                ret = 0;
        else if (!ret)
                ret = -ETIMEDOUT;
-        rspi_disable_irq(rspi, SPCR_SPTIE);
-        enable_irq(rspi->tx_irq);
+        rspi_disable_irq(rspi, irq_mask);
-end:
+        if (tx)
-        rspi_dma_unmap_sg(&sg, rspi->chan_tx, DMA_TO_DEVICE);
+                enable_irq(rspi->tx_irq);
-end_nomap:
+        if (rx && rspi->rx_irq != other_irq)
-        if (rspi->dma_width_16bit)
+                enable_irq(rspi->rx_irq);
-                kfree(buf);
        return ret;
 }
@@ -585,157 +572,37 @@ static void qspi_receive_init(const struct rspi_data *rspi)
        rspi_write8(rspi, 0, QSPI_SPBFCR);
 }
-static int rspi_receive_dma(struct rspi_data *rspi, struct spi_transfer *t)
+static bool __rspi_can_dma(const struct rspi_data *rspi,
+                           const struct spi_transfer *xfer)
 {
-        struct scatterlist sg, sg_dummy;
+        return xfer->len > rspi->ops->fifo_size;
-        void *dummy = NULL, *rx_buf = NULL;
-        struct dma_async_tx_descriptor *desc, *desc_dummy;
-        unsigned int len;
-        int ret = 0;
-        if (rspi->dma_width_16bit) {
-                /*
-                 * If DMAC bus width is 16-bit, the driver allocates a dummy
-                 * buffer. And, finally the driver converts the DMAC data into
-                 * actual data as the following format:
-                 *  DMAC data:   1st byte, dummy, 2nd byte, dummy ...
-                 *  actual data: 1st byte, 2nd byte ...
-                 */
-                len = t->len * 2;
-                rx_buf = kmalloc(len, GFP_KERNEL);
-                if (!rx_buf)
-                        return -ENOMEM;
-         } else {
-                len = t->len;
-                rx_buf = t->rx_buf;
-        }
-        /* prepare dummy transfer to generate SPI clocks */
-        dummy = kzalloc(len, GFP_KERNEL);
-        if (!dummy) {
-                ret = -ENOMEM;
-                goto end_nomap;
-        }
-        if (!rspi_dma_map_sg(&sg_dummy, dummy, len, rspi->chan_tx,
-                             DMA_TO_DEVICE)) {
-                ret = -EFAULT;
-                goto end_nomap;
-        }
-        desc_dummy = dmaengine_prep_slave_sg(rspi->chan_tx, &sg_dummy, 1,
-                        DMA_TO_DEVICE, DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-        if (!desc_dummy) {
-                ret = -EIO;
-                goto end_dummy_mapped;
-        }
-        /* prepare receive transfer */
-        if (!rspi_dma_map_sg(&sg, rx_buf, len, rspi->chan_rx,
-                             DMA_FROM_DEVICE)) {
-                ret = -EFAULT;
-                goto end_dummy_mapped;
-        }
-        desc = dmaengine_prep_slave_sg(rspi->chan_rx, &sg, 1, DMA_FROM_DEVICE,
-                                       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-        if (!desc) {
-                ret = -EIO;
-                goto end;
-        }
-        rspi_receive_init(rspi);
-        /*
-         * DMAC needs SPTIE, but if SPTIE is set, this IRQ routine will be
-         * called. So, this driver disables the IRQ while DMA transfer.
-         */
-        disable_irq(rspi->tx_irq);
-        if (rspi->rx_irq != rspi->tx_irq)
-                disable_irq(rspi->rx_irq);
-        rspi_write8(rspi, rspi_read8(rspi, RSPI_SPCR) & ~SPCR_TXMD, RSPI_SPCR);
-        rspi_enable_irq(rspi, SPCR_SPTIE | SPCR_SPRIE);
-        rspi->dma_callbacked = 0;
-        desc->callback = rspi_dma_complete;
-        desc->callback_param = rspi;
-        dmaengine_submit(desc);
-        dma_async_issue_pending(rspi->chan_rx);
-        desc_dummy->callback = NULL;    /* No callback */
-        dmaengine_submit(desc_dummy);
-        dma_async_issue_pending(rspi->chan_tx);
-        ret = wait_event_interruptible_timeout(rspi->wait,
-                                               rspi->dma_callbacked, HZ);
-        if (ret > 0 && rspi->dma_callbacked)
-                ret = 0;
-        else if (!ret)
-                ret = -ETIMEDOUT;
-        rspi_disable_irq(rspi, SPCR_SPTIE | SPCR_SPRIE);
-        enable_irq(rspi->tx_irq);
-        if (rspi->rx_irq != rspi->tx_irq)
-                enable_irq(rspi->rx_irq);
-end:
-        rspi_dma_unmap_sg(&sg, rspi->chan_rx, DMA_FROM_DEVICE);
-end_dummy_mapped:
-        rspi_dma_unmap_sg(&sg_dummy, rspi->chan_tx, DMA_TO_DEVICE);
-end_nomap:
-        if (rspi->dma_width_16bit) {
-                if (!ret)
-                        rspi_memory_from_8bit(t->rx_buf, rx_buf, t->len);
-                kfree(rx_buf);
-        }
-        kfree(dummy);
-        return ret;
 }
-static int rspi_is_dma(const struct rspi_data *rspi, struct spi_transfer *t)
+static bool rspi_can_dma(struct spi_master *master, struct spi_device *spi,
+                         struct spi_transfer *xfer)
 {
-        if (t->tx_buf && rspi->chan_tx)
+        struct rspi_data *rspi = spi_master_get_devdata(master);
-                return 1;
-        /* If the module receives data by DMAC, it also needs TX DMAC */
-        if (t->rx_buf && rspi->chan_tx && rspi->chan_rx)
-                return 1;
-        return 0;
+        return __rspi_can_dma(rspi, xfer);
 }
-static int rspi_transfer_out_in(struct rspi_data *rspi,
+static int rspi_common_transfer(struct rspi_data *rspi,
                                struct spi_transfer *xfer)
 {
-        int remain = xfer->len, ret;
+        int ret;
-        const u8 *tx_buf = xfer->tx_buf;
-        u8 *rx_buf = xfer->rx_buf;
-        u8 spcr, data;
-        rspi_receive_init(rspi);
-        spcr = rspi_read8(rspi, RSPI_SPCR);
-        if (rx_buf)
-                spcr &= ~SPCR_TXMD;
-        else
-                spcr |= SPCR_TXMD;
-        rspi_write8(rspi, spcr, RSPI_SPCR);
-        while (remain > 0) {
+        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer)) {
-                data = tx_buf ? *tx_buf++ : DUMMY_DATA;
+                /* rx_buf can be NULL on RSPI on SH in TX-only Mode */
-                ret = rspi_data_out(rspi, data);
+                return rspi_dma_transfer(rspi, &xfer->tx_sg,
-                if (ret < 0)
+                                         xfer->rx_buf ? &xfer->rx_sg : NULL);
-                        return ret;
-                if (rx_buf) {
-                        ret = rspi_data_in(rspi);
-                        if (ret < 0)
-                                return ret;
-                        *rx_buf++ = ret;
-                }
-                remain--;
        }
+        ret = rspi_pio_transfer(rspi, xfer->tx_buf, xfer->rx_buf, xfer->len);
+        if (ret < 0)
+                return ret;
        /* Wait for the last transmission */
-        rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE);
+        rspi_wait_for_tx_empty(rspi);
        return 0;
 }
@@ -744,46 +611,18 @@ static int rspi_transfer_one(struct spi_master *master, struct spi_device *spi,
                             struct spi_transfer *xfer)
 {
        struct rspi_data *rspi = spi_master_get_devdata(master);
-        int ret;
+        u8 spcr;
-        if (!rspi_is_dma(rspi, xfer))
+        spcr = rspi_read8(rspi, RSPI_SPCR);
-                return rspi_transfer_out_in(rspi, xfer);
+        if (xfer->rx_buf) {
+                rspi_receive_init(rspi);
-        if (xfer->tx_buf) {
+                spcr &= ~SPCR_TXMD;
-                ret = rspi_send_dma(rspi, xfer);
+        } else {
-                if (ret < 0)
+                spcr |= SPCR_TXMD;
-                        return ret;
-        }
-        if (xfer->rx_buf)
-                return rspi_receive_dma(rspi, xfer);
-        return 0;
-}
-static int rspi_rz_transfer_out_in(struct rspi_data *rspi,
-                                   struct spi_transfer *xfer)
-{
-        int remain = xfer->len, ret;
-        const u8 *tx_buf = xfer->tx_buf;
-        u8 *rx_buf = xfer->rx_buf;
-        u8 data;
-        rspi_rz_receive_init(rspi);
-        while (remain > 0) {
-                data = tx_buf ? *tx_buf++ : DUMMY_DATA;
-                ret = rspi_data_out_in(rspi, data);
-                if (ret < 0)
-                        return ret;
-                if (rx_buf)
-                        *rx_buf++ = ret;
-                remain--;
        }
+        rspi_write8(rspi, spcr, RSPI_SPCR);
-        /* Wait for the last transmission */
+        return rspi_common_transfer(rspi, xfer);
-        rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE);
-        return 0;
 }
 static int rspi_rz_transfer_one(struct spi_master *master,
@@ -791,68 +630,44 @@ static int rspi_rz_transfer_one(struct spi_master *master,
                                struct spi_transfer *xfer)
 {
        struct rspi_data *rspi = spi_master_get_devdata(master);
+        int ret;
-        return rspi_rz_transfer_out_in(rspi, xfer);
+        rspi_rz_receive_init(rspi);
+        return rspi_common_transfer(rspi, xfer);
 }
 static int qspi_transfer_out_in(struct rspi_data *rspi,
                                struct spi_transfer *xfer)
 {
-        int remain = xfer->len, ret;
-        const u8 *tx_buf = xfer->tx_buf;
-        u8 *rx_buf = xfer->rx_buf;
-        u8 data;
        qspi_receive_init(rspi);
-        while (remain > 0) {
+        return rspi_common_transfer(rspi, xfer);
-                data = tx_buf ? *tx_buf++ : DUMMY_DATA;
-                ret = rspi_data_out_in(rspi, data);
-                if (ret < 0)
-                        return ret;
-                if (rx_buf)
-                        *rx_buf++ = ret;
-                remain--;
-        }
-        /* Wait for the last transmission */
-        rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE);
-        return 0;
 }
 static int qspi_transfer_out(struct rspi_data *rspi, struct spi_transfer *xfer)
 {
-        const u8 *buf = xfer->tx_buf;
-        unsigned int i;
        int ret;
-        for (i = 0; i < xfer->len; i++) {
+        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer))
-                ret = rspi_data_out(rspi, *buf++);
+                return rspi_dma_transfer(rspi, &xfer->tx_sg, NULL);
-                if (ret < 0)
-                        return ret;
+        ret = rspi_pio_transfer(rspi, xfer->tx_buf, NULL, xfer->len);
-        }
+        if (ret < 0)
+                return ret;
        /* Wait for the last transmission */
-        rspi_wait_for_interrupt(rspi, SPSR_SPTEF, SPCR_SPTIE);
+        rspi_wait_for_tx_empty(rspi);
        return 0;
 }
 static int qspi_transfer_in(struct rspi_data *rspi, struct spi_transfer *xfer)
 {
-        u8 *buf = xfer->rx_buf;
+        if (rspi->master->can_dma && __rspi_can_dma(rspi, xfer))
-        unsigned int i;
+                return rspi_dma_transfer(rspi, NULL, &xfer->rx_sg);
-        int ret;
-        for (i = 0; i < xfer->len; i++) {
-                ret = rspi_data_in(rspi);
-                if (ret < 0)
-                        return ret;
-                *buf++ = ret;
-        }
-        return 0;
+        return rspi_pio_transfer(rspi, NULL, xfer->rx_buf, xfer->len);
 }
 static int qspi_transfer_one(struct spi_master *master, struct spi_device *spi,
@@ -862,10 +677,10 @@ static int qspi_transfer_one(struct spi_master *master, struct spi_device *spi,
        if (spi->mode & SPI_LOOP) {
                return qspi_transfer_out_in(rspi, xfer);
-        } else if (xfer->tx_buf && xfer->tx_nbits > SPI_NBITS_SINGLE) {
+        } else if (xfer->tx_nbits > SPI_NBITS_SINGLE) {
                /* Quad or Dual SPI Write */
                return qspi_transfer_out(rspi, xfer);
-        } else if (xfer->rx_buf && xfer->rx_nbits > SPI_NBITS_SINGLE) {
+        } else if (xfer->rx_nbits > SPI_NBITS_SINGLE) {
                /* Quad or Dual SPI Read */
                return qspi_transfer_in(rspi, xfer);
        } else {
@@ -1046,65 +861,78 @@ static irqreturn_t rspi_irq_tx(int irq, void *_sr)
        return 0;
 }
-static int rspi_request_dma(struct rspi_data *rspi,
+static struct dma_chan *rspi_request_dma_chan(struct device *dev,
-                                      struct platform_device *pdev)
+                                              enum dma_transfer_direction dir,
+                                              unsigned int id,
+                                              dma_addr_t port_addr)
 {
-        const struct rspi_plat_data *rspi_pd = dev_get_platdata(&pdev->dev);
-        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        dma_cap_mask_t mask;
+        struct dma_chan *chan;
        struct dma_slave_config cfg;
        int ret;
-        if (!res || !rspi_pd)
+        dma_cap_zero(mask);
-                return 0;       /* The driver assumes no error. */
+        dma_cap_set(DMA_SLAVE, mask);
-        rspi->dma_width_16bit = rspi_pd->dma_width_16bit;
+        chan = dma_request_channel(mask, shdma_chan_filter,
+                                   (void *)(unsigned long)id);
-        /* If the module receives data by DMAC, it also needs TX DMAC */
+        if (!chan) {
-        if (rspi_pd->dma_rx_id && rspi_pd->dma_tx_id) {
+                dev_warn(dev, "dma_request_channel failed\n");
-                dma_cap_zero(mask);
+                return NULL;
-                dma_cap_set(DMA_SLAVE, mask);
-                rspi->chan_rx = dma_request_channel(mask, shdma_chan_filter,
-                                                    (void *)rspi_pd->dma_rx_id);
-                if (rspi->chan_rx) {
-                        cfg.slave_id = rspi_pd->dma_rx_id;
-                        cfg.direction = DMA_DEV_TO_MEM;
-                        cfg.dst_addr = 0;
-                        cfg.src_addr = res->start + RSPI_SPDR;
-                        ret = dmaengine_slave_config(rspi->chan_rx, &cfg);
-                        if (!ret)
-                                dev_info(&pdev->dev, "Use DMA when rx.\n");
-                        else
-                                return ret;
-                }
        }
-        if (rspi_pd->dma_tx_id) {
-                dma_cap_zero(mask);
+        memset(&cfg, 0, sizeof(cfg));
-                dma_cap_set(DMA_SLAVE, mask);
+        cfg.slave_id = id;
-                rspi->chan_tx = dma_request_channel(mask, shdma_chan_filter,
+        cfg.direction = dir;
-                                                    (void *)rspi_pd->dma_tx_id);
+        if (dir == DMA_MEM_TO_DEV)
-                if (rspi->chan_tx) {
+                cfg.dst_addr = port_addr;
-                        cfg.slave_id = rspi_pd->dma_tx_id;
+        else
-                        cfg.direction = DMA_MEM_TO_DEV;
+                cfg.src_addr = port_addr;
-                        cfg.dst_addr = res->start + RSPI_SPDR;
-                        cfg.src_addr = 0;
+        ret = dmaengine_slave_config(chan, &cfg);
-                        ret = dmaengine_slave_config(rspi->chan_tx, &cfg);
+        if (ret) {
-                        if (!ret)
+                dev_warn(dev, "dmaengine_slave_config failed %d\n", ret);
-                                dev_info(&pdev->dev, "Use DMA when tx\n");
+                dma_release_channel(chan);
-                        else
+                return NULL;
-                                return ret;
-                }
        }
+        return chan;
+}
+static int rspi_request_dma(struct device *dev, struct spi_master *master,
+                            const struct resource *res)
+{
+        const struct rspi_plat_data *rspi_pd = dev_get_platdata(dev);
+        if (!rspi_pd || !rspi_pd->dma_rx_id || !rspi_pd->dma_tx_id)
+                return 0;       /* The driver assumes no error. */
+        master->dma_rx = rspi_request_dma_chan(dev, DMA_DEV_TO_MEM,
+                                               rspi_pd->dma_rx_id,
+                                               res->start + RSPI_SPDR);
+        if (!master->dma_rx)
+                return -ENODEV;
+        master->dma_tx = rspi_request_dma_chan(dev, DMA_MEM_TO_DEV,
+                                               rspi_pd->dma_tx_id,
+                                               res->start + RSPI_SPDR);
+        if (!master->dma_tx) {
+                dma_release_channel(master->dma_rx);
+                master->dma_rx = NULL;
+                return -ENODEV;
+        }
+        master->can_dma = rspi_can_dma;
+        dev_info(dev, "DMA available");
        return 0;
 }
 static void rspi_release_dma(struct rspi_data *rspi)
 {
-        if (rspi->chan_tx)
+        if (rspi->master->dma_tx)
-                dma_release_channel(rspi->chan_tx);
+                dma_release_channel(rspi->master->dma_tx);
-        if (rspi->chan_rx)
+        if (rspi->master->dma_rx)
-                dma_release_channel(rspi->chan_rx);
+                dma_release_channel(rspi->master->dma_rx);
 }
 static int rspi_remove(struct platform_device *pdev)
@@ -1118,23 +946,29 @@ static int rspi_remove(struct platform_device *pdev)
 }
 static const struct spi_ops rspi_ops = {
-        .set_config_register =          rspi_set_config_register,
+        .set_config_register =  rspi_set_config_register,
-        .transfer_one =                 rspi_transfer_one,
+        .transfer_one =         rspi_transfer_one,
-        .mode_bits =                    SPI_CPHA | SPI_CPOL | SPI_LOOP,
+        .mode_bits =            SPI_CPHA | SPI_CPOL | SPI_LOOP,
+        .flags =                SPI_MASTER_MUST_TX,
+        .fifo_size =            8,
 };
 static const struct spi_ops rspi_rz_ops = {
-        .set_config_register =          rspi_rz_set_config_register,
+        .set_config_register =  rspi_rz_set_config_register,
-        .transfer_one =                 rspi_rz_transfer_one,
+        .transfer_one =         rspi_rz_transfer_one,
-        .mode_bits =                    SPI_CPHA | SPI_CPOL | SPI_LOOP,
+        .mode_bits =            SPI_CPHA | SPI_CPOL | SPI_LOOP,
+        .flags =                SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX,
+        .fifo_size =            8,      /* 8 for TX, 32 for RX */
 };
 static const struct spi_ops qspi_ops = {
-        .set_config_register =          qspi_set_config_register,
+        .set_config_register =  qspi_set_config_register,
-        .transfer_one =                 qspi_transfer_one,
+        .transfer_one =         qspi_transfer_one,
-        .mode_bits =                    SPI_CPHA | SPI_CPOL | SPI_LOOP |
+        .mode_bits =            SPI_CPHA | SPI_CPOL | SPI_LOOP |
-                                        SPI_TX_DUAL | SPI_TX_QUAD |
+                                SPI_TX_DUAL | SPI_TX_QUAD |
-                                        SPI_RX_DUAL | SPI_RX_QUAD,
+                                SPI_RX_DUAL | SPI_RX_QUAD,
+        .flags =                SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX,
+        .fifo_size =            32,
 };
 #ifdef CONFIG_OF
@@ -1254,6 +1088,7 @@ static int rspi_probe(struct platform_device *pdev)
        master->prepare_message = rspi_prepare_message;
        master->unprepare_message = rspi_unprepare_message;
        master->mode_bits = ops->mode_bits;
+        master->flags = ops->flags;
        master->dev.of_node = pdev->dev.of_node;
        ret = platform_get_irq_byname(pdev, "rx");
@@ -1291,11 +1126,9 @@ static int rspi_probe(struct platform_device *pdev)
                goto error2;
        }
-        ret = rspi_request_dma(rspi, pdev);
+        ret = rspi_request_dma(&pdev->dev, master, res);
-        if (ret < 0) {
+        if (ret < 0)
-                dev_err(&pdev->dev, "rspi_request_dma failed.\n");
+                dev_warn(&pdev->dev, "DMA not available, using PIO\n");
-                goto error3;
-        }
        ret = devm_spi_register_master(&pdev->dev, master);
        if (ret < 0) {
diff --git a/drivers/spi/spi-s3c24xx.c b/drivers/spi/spi-s3c24xx.c
index bed23384dfab..381d4af149fc 100644
--- a/drivers/spi/spi-s3c24xx.c
+++ b/drivers/spi/spi-s3c24xx.c
@@ -183,11 +183,11 @@ static int s3c24xx_spi_setup(struct spi_device *spi)
        /* allocate settings on the first call */
        if (!cs) {
-                cs = kzalloc(sizeof(struct s3c24xx_spi_devstate), GFP_KERNEL);
+                cs = devm_kzalloc(&spi->dev,
-                if (!cs) {
+                                  sizeof(struct s3c24xx_spi_devstate),
-                        dev_err(&spi->dev, "no memory for controller state\n");
+                                  GFP_KERNEL);
+                if (!cs)
                        return -ENOMEM;
-                }
                cs->spcon = SPCON_DEFAULT;
                cs->hz = -1;
@@ -209,11 +209,6 @@ static int s3c24xx_spi_setup(struct spi_device *spi)
        return 0;
 }
-static void s3c24xx_spi_cleanup(struct spi_device *spi)
-{
-        kfree(spi->controller_state);
-}
 static inline unsigned int hw_txbyte(struct s3c24xx_spi *hw, int count)
 {
        return hw->tx ? hw->tx[count] : 0;
@@ -543,7 +538,6 @@ static int s3c24xx_spi_probe(struct platform_device *pdev)
        hw->bitbang.txrx_bufs      = s3c24xx_spi_txrx;
        hw->master->setup  = s3c24xx_spi_setup;
-        hw->master->cleanup = s3c24xx_spi_cleanup;
        dev_dbg(hw->dev, "bitbang at %p\n", &hw->bitbang);
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index f19cd97855e8..affcfd6fe76b 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -773,7 +773,6 @@ static struct s3c64xx_spi_csinfo *s3c64xx_get_slave_ctrldata(
        cs = kzalloc(sizeof(*cs), GFP_KERNEL);
        if (!cs) {
-                dev_err(&spi->dev, "could not allocate memory for controller data\n");
                of_node_put(data_np);
                return ERR_PTR(-ENOMEM);
        }
@@ -987,10 +986,8 @@ static struct s3c64xx_spi_info *s3c64xx_spi_parse_dt(struct device *dev)
        u32 temp;
        sci = devm_kzalloc(dev, sizeof(*sci), GFP_KERNEL);
-        if (!sci) {
+        if (!sci)
-                dev_err(dev, "memory allocation for spi_info failed\n");
                return ERR_PTR(-ENOMEM);
-        }
        if (of_property_read_u32(dev->of_node, "samsung,spi-src-clk", &temp)) {
                dev_warn(dev, "spi bus clock parent not specified, using clock at index 0 as parent\n");
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index 9009456bdf4d..c8e795ef2e13 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -244,9 +244,9 @@ static int hspi_probe(struct platform_device *pdev)
                return -ENOMEM;
        }
-        clk = clk_get(NULL, "shyway_clk");
+        clk = clk_get(&pdev->dev, NULL);
        if (IS_ERR(clk)) {
-                dev_err(&pdev->dev, "shyway_clk is required\n");
+                dev_err(&pdev->dev, "couldn't get clock\n");
                ret = -EINVAL;
                goto error0;
        }
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index e850d03e7190..45b09142afe2 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -642,10 +642,8 @@ static struct sh_msiof_spi_info *sh_msiof_spi_parse_dt(struct device *dev)
        u32 num_cs = 1;
        info = devm_kzalloc(dev, sizeof(struct sh_msiof_spi_info), GFP_KERNEL);
-        if (!info) {
+        if (!info)
-                dev_err(dev, "failed to allocate setup data\n");
                return NULL;
-        }
        /* Parse the MSIOF properties */
        of_property_read_u32(np, "num-cs", &num_cs);
diff --git a/drivers/spi/spi-sirf.c b/drivers/spi/spi-sirf.c
index 1a77ad52812f..95ac276eaafe 100644
--- a/drivers/spi/spi-sirf.c
+++ b/drivers/spi/spi-sirf.c
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/clk.h>
+#include <linux/completion.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/of.h>
@@ -85,6 +86,7 @@
 #define SIRFSOC_SPI_TX_DONE             BIT(1)
 #define SIRFSOC_SPI_RX_OFLOW            BIT(2)
 #define SIRFSOC_SPI_TX_UFLOW            BIT(3)
+#define SIRFSOC_SPI_RX_IO_DMA           BIT(4)
 #define SIRFSOC_SPI_RX_FIFO_FULL        BIT(6)
 #define SIRFSOC_SPI_TXFIFO_EMPTY        BIT(7)
 #define SIRFSOC_SPI_RXFIFO_THD_REACH    BIT(8)
@@ -264,41 +266,34 @@ static irqreturn_t spi_sirfsoc_irq(int irq, void *dev_id)
 {
        struct sirfsoc_spi *sspi = dev_id;
        u32 spi_stat = readl(sspi->base + SIRFSOC_SPI_INT_STATUS);
-        writel(spi_stat, sspi->base + SIRFSOC_SPI_INT_STATUS);
        if (sspi->tx_by_cmd && (spi_stat & SIRFSOC_SPI_FRM_END)) {
                complete(&sspi->tx_done);
                writel(0x0, sspi->base + SIRFSOC_SPI_INT_EN);
+                writel(SIRFSOC_SPI_INT_MASK_ALL,
+                                sspi->base + SIRFSOC_SPI_INT_STATUS);
                return IRQ_HANDLED;
        }
        /* Error Conditions */
        if (spi_stat & SIRFSOC_SPI_RX_OFLOW ||
                        spi_stat & SIRFSOC_SPI_TX_UFLOW) {
+                complete(&sspi->tx_done);
                complete(&sspi->rx_done);
                writel(0x0, sspi->base + SIRFSOC_SPI_INT_EN);
+                writel(SIRFSOC_SPI_INT_MASK_ALL,
+                                sspi->base + SIRFSOC_SPI_INT_STATUS);
+                return IRQ_HANDLED;
        }
+        if (spi_stat & SIRFSOC_SPI_TXFIFO_EMPTY)
+                complete(&sspi->tx_done);
+        while (!(readl(sspi->base + SIRFSOC_SPI_INT_STATUS) &
+                SIRFSOC_SPI_RX_IO_DMA))
+                cpu_relax();
+        complete(&sspi->rx_done);
+        writel(0x0, sspi->base + SIRFSOC_SPI_INT_EN);
+        writel(SIRFSOC_SPI_INT_MASK_ALL,
+                        sspi->base + SIRFSOC_SPI_INT_STATUS);
-        if (spi_stat & (SIRFSOC_SPI_FRM_END
-                        | SIRFSOC_SPI_RXFIFO_THD_REACH))
-                while (!((readl(sspi->base + SIRFSOC_SPI_RXFIFO_STATUS)
-                                & SIRFSOC_SPI_FIFO_EMPTY)) &&
-                                sspi->left_rx_word)
-                        sspi->rx_word(sspi);
-        if (spi_stat & (SIRFSOC_SPI_FIFO_EMPTY
-                        | SIRFSOC_SPI_TXFIFO_THD_REACH))
-                while (!((readl(sspi->base + SIRFSOC_SPI_TXFIFO_STATUS)
-                                & SIRFSOC_SPI_FIFO_FULL)) &&
-                                sspi->left_tx_word)
-                        sspi->tx_word(sspi);
-        /* Received all words */
-        if ((sspi->left_rx_word == 0) && (sspi->left_tx_word == 0)) {
-                complete(&sspi->rx_done);
-                writel(0x0, sspi->base + SIRFSOC_SPI_INT_EN);
-        }
        return IRQ_HANDLED;
 }
@@ -309,59 +304,51 @@ static void spi_sirfsoc_dma_fini_callback(void *data)
        complete(dma_complete);
 }
-static int spi_sirfsoc_transfer(struct spi_device *spi, struct spi_transfer *t)
+static int spi_sirfsoc_cmd_transfer(struct spi_device *spi,
+        struct spi_transfer *t)
 {
        struct sirfsoc_spi *sspi;
        int timeout = t->len * 10;
-        sspi = spi_master_get_devdata(spi->master);
+        u32 cmd;
-        sspi->tx = t->tx_buf ? t->tx_buf : sspi->dummypage;
-        sspi->rx = t->rx_buf ? t->rx_buf : sspi->dummypage;
-        sspi->left_tx_word = sspi->left_rx_word = t->len / sspi->word_width;
-        reinit_completion(&sspi->rx_done);
-        reinit_completion(&sspi->tx_done);
-        writel(SIRFSOC_SPI_INT_MASK_ALL, sspi->base + SIRFSOC_SPI_INT_STATUS);
+        sspi = spi_master_get_devdata(spi->master);
+        memcpy(&cmd, sspi->tx, t->len);
-        /*
+        if (sspi->word_width == 1 && !(spi->mode & SPI_LSB_FIRST))
-         * fill tx_buf into command register and wait for its completion
+                cmd = cpu_to_be32(cmd) >>
-         */
+                        ((SIRFSOC_MAX_CMD_BYTES - t->len) * 8);
-        if (sspi->tx_by_cmd) {
+        if (sspi->word_width == 2 && t->len == 4 &&
-                u32 cmd;
+                        (!(spi->mode & SPI_LSB_FIRST)))
-                memcpy(&cmd, sspi->tx, t->len);
+                cmd = ((cmd & 0xffff) << 16) | (cmd >> 16);
+        writel(cmd, sspi->base + SIRFSOC_SPI_CMD);
-                if (sspi->word_width == 1 && !(spi->mode & SPI_LSB_FIRST))
+        writel(SIRFSOC_SPI_FRM_END_INT_EN,
-                        cmd = cpu_to_be32(cmd) >>
+                sspi->base + SIRFSOC_SPI_INT_EN);
-                                ((SIRFSOC_MAX_CMD_BYTES - t->len) * 8);
+        writel(SIRFSOC_SPI_CMD_TX_EN,
-                if (sspi->word_width == 2 && t->len == 4 &&
+                sspi->base + SIRFSOC_SPI_TX_RX_EN);
-                                (!(spi->mode & SPI_LSB_FIRST)))
+        if (wait_for_completion_timeout(&sspi->tx_done, timeout) == 0) {
-                        cmd = ((cmd & 0xffff) << 16) | (cmd >> 16);
+                dev_err(&spi->dev, "cmd transfer timeout\n");
+                return 0;
-                writel(cmd, sspi->base + SIRFSOC_SPI_CMD);
+        }
-                writel(SIRFSOC_SPI_FRM_END_INT_EN,
-                        sspi->base + SIRFSOC_SPI_INT_EN);
-                writel(SIRFSOC_SPI_CMD_TX_EN,
-                        sspi->base + SIRFSOC_SPI_TX_RX_EN);
-                if (wait_for_completion_timeout(&sspi->tx_done, timeout) == 0) {
+        return t->len;
-                        dev_err(&spi->dev, "transfer timeout\n");
+}
-                        return 0;
-                }
-                return t->len;
+static void spi_sirfsoc_dma_transfer(struct spi_device *spi,
-        }
+        struct spi_transfer *t)
+{
+        struct sirfsoc_spi *sspi;
+        struct dma_async_tx_descriptor *rx_desc, *tx_desc;
+        int timeout = t->len * 10;
-        if (sspi->left_tx_word == 1) {
+        sspi = spi_master_get_devdata(spi->master);
-                writel(readl(sspi->base + SIRFSOC_SPI_CTRL) |
+        writel(SIRFSOC_SPI_FIFO_RESET, sspi->base + SIRFSOC_SPI_RXFIFO_OP);
-                        SIRFSOC_SPI_ENA_AUTO_CLR,
+        writel(SIRFSOC_SPI_FIFO_RESET, sspi->base + SIRFSOC_SPI_TXFIFO_OP);
-                        sspi->base + SIRFSOC_SPI_CTRL);
+        writel(SIRFSOC_SPI_FIFO_START, sspi->base + SIRFSOC_SPI_RXFIFO_OP);
-                writel(0, sspi->base + SIRFSOC_SPI_TX_DMA_IO_LEN);
+        writel(SIRFSOC_SPI_FIFO_START, sspi->base + SIRFSOC_SPI_TXFIFO_OP);
-                writel(0, sspi->base + SIRFSOC_SPI_RX_DMA_IO_LEN);
+        writel(0, sspi->base + SIRFSOC_SPI_INT_EN);
-        } else if ((sspi->left_tx_word > 1) && (sspi->left_tx_word <
+        writel(SIRFSOC_SPI_INT_MASK_ALL, sspi->base + SIRFSOC_SPI_INT_STATUS);
-                                SIRFSOC_SPI_DAT_FRM_LEN_MAX)) {
+        if (sspi->left_tx_word < SIRFSOC_SPI_DAT_FRM_LEN_MAX) {
                writel(readl(sspi->base + SIRFSOC_SPI_CTRL) |
-                                SIRFSOC_SPI_MUL_DAT_MODE |
+                        SIRFSOC_SPI_ENA_AUTO_CLR | SIRFSOC_SPI_MUL_DAT_MODE,
-                                SIRFSOC_SPI_ENA_AUTO_CLR,
                        sspi->base + SIRFSOC_SPI_CTRL);
                writel(sspi->left_tx_word - 1,
                                sspi->base + SIRFSOC_SPI_TX_DMA_IO_LEN);
@@ -373,76 +360,122 @@ static int spi_sirfsoc_transfer(struct spi_device *spi, struct spi_transfer *t)
                writel(0, sspi->base + SIRFSOC_SPI_TX_DMA_IO_LEN);
                writel(0, sspi->base + SIRFSOC_SPI_RX_DMA_IO_LEN);
        }
+        sspi->dst_start = dma_map_single(&spi->dev, sspi->rx, t->len,
-        writel(SIRFSOC_SPI_FIFO_RESET, sspi->base + SIRFSOC_SPI_RXFIFO_OP);
+                                        (t->tx_buf != t->rx_buf) ?
-        writel(SIRFSOC_SPI_FIFO_RESET, sspi->base + SIRFSOC_SPI_TXFIFO_OP);
+                                        DMA_FROM_DEVICE : DMA_BIDIRECTIONAL);
-        writel(SIRFSOC_SPI_FIFO_START, sspi->base + SIRFSOC_SPI_RXFIFO_OP);
+        rx_desc = dmaengine_prep_slave_single(sspi->rx_chan,
-        writel(SIRFSOC_SPI_FIFO_START, sspi->base + SIRFSOC_SPI_TXFIFO_OP);
+                sspi->dst_start, t->len, DMA_DEV_TO_MEM,
+                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-        if (IS_DMA_VALID(t)) {
+        rx_desc->callback = spi_sirfsoc_dma_fini_callback;
-                struct dma_async_tx_descriptor *rx_desc, *tx_desc;
+        rx_desc->callback_param = &sspi->rx_done;
-                sspi->dst_start = dma_map_single(&spi->dev, sspi->rx, t->len, DMA_FROM_DEVICE);
+        sspi->src_start = dma_map_single(&spi->dev, (void *)sspi->tx, t->len,
-                rx_desc = dmaengine_prep_slave_single(sspi->rx_chan,
+                                        (t->tx_buf != t->rx_buf) ?
-                        sspi->dst_start, t->len, DMA_DEV_TO_MEM,
+                                        DMA_TO_DEVICE : DMA_BIDIRECTIONAL);
-                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+        tx_desc = dmaengine_prep_slave_single(sspi->tx_chan,
-                rx_desc->callback = spi_sirfsoc_dma_fini_callback;
+                sspi->src_start, t->len, DMA_MEM_TO_DEV,
-                rx_desc->callback_param = &sspi->rx_done;
+                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+        tx_desc->callback = spi_sirfsoc_dma_fini_callback;
-                sspi->src_start = dma_map_single(&spi->dev, (void *)sspi->tx, t->len, DMA_TO_DEVICE);
+        tx_desc->callback_param = &sspi->tx_done;
-                tx_desc = dmaengine_prep_slave_single(sspi->tx_chan,
-                        sspi->src_start, t->len, DMA_MEM_TO_DEV,
+        dmaengine_submit(tx_desc);
-                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+        dmaengine_submit(rx_desc);
-                tx_desc->callback = spi_sirfsoc_dma_fini_callback;
+        dma_async_issue_pending(sspi->tx_chan);
-                tx_desc->callback_param = &sspi->tx_done;
+        dma_async_issue_pending(sspi->rx_chan);
+        writel(SIRFSOC_SPI_RX_EN | SIRFSOC_SPI_TX_EN,
-                dmaengine_submit(tx_desc);
+                        sspi->base + SIRFSOC_SPI_TX_RX_EN);
-                dmaengine_submit(rx_desc);
+        if (wait_for_completion_timeout(&sspi->rx_done, timeout) == 0) {
-                dma_async_issue_pending(sspi->tx_chan);
-                dma_async_issue_pending(sspi->rx_chan);
-        } else {
-                /* Send the first word to trigger the whole tx/rx process */
-                sspi->tx_word(sspi);
-                writel(SIRFSOC_SPI_RX_OFLOW_INT_EN | SIRFSOC_SPI_TX_UFLOW_INT_EN |
-                        SIRFSOC_SPI_RXFIFO_THD_INT_EN | SIRFSOC_SPI_TXFIFO_THD_INT_EN |
-                        SIRFSOC_SPI_FRM_END_INT_EN | SIRFSOC_SPI_RXFIFO_FULL_INT_EN |
-                        SIRFSOC_SPI_TXFIFO_EMPTY_INT_EN, sspi->base + SIRFSOC_SPI_INT_EN);
-        }
-        writel(SIRFSOC_SPI_RX_EN | SIRFSOC_SPI_TX_EN, sspi->base + SIRFSOC_SPI_TX_RX_EN);
-        if (!IS_DMA_VALID(t)) { /* for PIO */
-                if (wait_for_completion_timeout(&sspi->rx_done, timeout) == 0)
-                        dev_err(&spi->dev, "transfer timeout\n");
-        } else if (wait_for_completion_timeout(&sspi->rx_done, timeout) == 0) {
                dev_err(&spi->dev, "transfer timeout\n");
                dmaengine_terminate_all(sspi->rx_chan);
        } else
                sspi->left_rx_word = 0;
        /*
         * we only wait tx-done event if transferring by DMA. for PIO,
         * we get rx data by writing tx data, so if rx is done, tx has
         * done earlier
         */
-        if (IS_DMA_VALID(t)) {
+        if (wait_for_completion_timeout(&sspi->tx_done, timeout) == 0) {
-                if (wait_for_completion_timeout(&sspi->tx_done, timeout) == 0) {
+                dev_err(&spi->dev, "transfer timeout\n");
-                        dev_err(&spi->dev, "transfer timeout\n");
+                dmaengine_terminate_all(sspi->tx_chan);
-                        dmaengine_terminate_all(sspi->tx_chan);
-                }
-        }
-        if (IS_DMA_VALID(t)) {
-                dma_unmap_single(&spi->dev, sspi->src_start, t->len, DMA_TO_DEVICE);
-                dma_unmap_single(&spi->dev, sspi->dst_start, t->len, DMA_FROM_DEVICE);
        }
+        dma_unmap_single(&spi->dev, sspi->src_start, t->len, DMA_TO_DEVICE);
+        dma_unmap_single(&spi->dev, sspi->dst_start, t->len, DMA_FROM_DEVICE);
        /* TX, RX FIFO stop */
        writel(0, sspi->base + SIRFSOC_SPI_RXFIFO_OP);
        writel(0, sspi->base + SIRFSOC_SPI_TXFIFO_OP);
-        writel(0, sspi->base + SIRFSOC_SPI_TX_RX_EN);
+        if (sspi->left_tx_word >= SIRFSOC_SPI_DAT_FRM_LEN_MAX)
-        writel(0, sspi->base + SIRFSOC_SPI_INT_EN);
+                writel(0, sspi->base + SIRFSOC_SPI_TX_RX_EN);
+}
+static void spi_sirfsoc_pio_transfer(struct spi_device *spi,
+                struct spi_transfer *t)
+{
+        struct sirfsoc_spi *sspi;
+        int timeout = t->len * 10;
+        sspi = spi_master_get_devdata(spi->master);
+        do {
+                writel(SIRFSOC_SPI_FIFO_RESET,
+                        sspi->base + SIRFSOC_SPI_RXFIFO_OP);
+                writel(SIRFSOC_SPI_FIFO_RESET,
+                        sspi->base + SIRFSOC_SPI_TXFIFO_OP);
+                writel(SIRFSOC_SPI_FIFO_START,
+                        sspi->base + SIRFSOC_SPI_RXFIFO_OP);
+                writel(SIRFSOC_SPI_FIFO_START,
+                        sspi->base + SIRFSOC_SPI_TXFIFO_OP);
+                writel(0, sspi->base + SIRFSOC_SPI_INT_EN);
+                writel(SIRFSOC_SPI_INT_MASK_ALL,
+                        sspi->base + SIRFSOC_SPI_INT_STATUS);
+                writel(readl(sspi->base + SIRFSOC_SPI_CTRL) |
+                        SIRFSOC_SPI_MUL_DAT_MODE | SIRFSOC_SPI_ENA_AUTO_CLR,
+                        sspi->base + SIRFSOC_SPI_CTRL);
+                writel(min(sspi->left_tx_word, (u32)(256 / sspi->word_width))
+                                - 1, sspi->base + SIRFSOC_SPI_TX_DMA_IO_LEN);
+                writel(min(sspi->left_rx_word, (u32)(256 / sspi->word_width))
+                                - 1, sspi->base + SIRFSOC_SPI_RX_DMA_IO_LEN);
+                while (!((readl(sspi->base + SIRFSOC_SPI_TXFIFO_STATUS)
+                        & SIRFSOC_SPI_FIFO_FULL)) && sspi->left_tx_word)
+                        sspi->tx_word(sspi);
+                writel(SIRFSOC_SPI_TXFIFO_EMPTY_INT_EN |
+                        SIRFSOC_SPI_TX_UFLOW_INT_EN |
+                        SIRFSOC_SPI_RX_OFLOW_INT_EN,
+                        sspi->base + SIRFSOC_SPI_INT_EN);
+                writel(SIRFSOC_SPI_RX_EN | SIRFSOC_SPI_TX_EN,
+                        sspi->base + SIRFSOC_SPI_TX_RX_EN);
+                if (!wait_for_completion_timeout(&sspi->tx_done, timeout) ||
+                        !wait_for_completion_timeout(&sspi->rx_done, timeout)) {
+                        dev_err(&spi->dev, "transfer timeout\n");
+                        break;
+                }
+                while (!((readl(sspi->base + SIRFSOC_SPI_RXFIFO_STATUS)
+                        & SIRFSOC_SPI_FIFO_EMPTY)) && sspi->left_rx_word)
+                        sspi->rx_word(sspi);
+                writel(0, sspi->base + SIRFSOC_SPI_RXFIFO_OP);
+                writel(0, sspi->base + SIRFSOC_SPI_TXFIFO_OP);
+        } while (sspi->left_tx_word != 0 || sspi->left_rx_word != 0);
+}
+static int spi_sirfsoc_transfer(struct spi_device *spi, struct spi_transfer *t)
+{
+        struct sirfsoc_spi *sspi;
+        sspi = spi_master_get_devdata(spi->master);
+        sspi->tx = t->tx_buf ? t->tx_buf : sspi->dummypage;
+        sspi->rx = t->rx_buf ? t->rx_buf : sspi->dummypage;
+        sspi->left_tx_word = sspi->left_rx_word = t->len / sspi->word_width;
+        reinit_completion(&sspi->rx_done);
+        reinit_completion(&sspi->tx_done);
+        /*
+         * in the transfer, if transfer data using command register with rx_buf
+         * null, just fill command data into command register and wait for its
+         * completion.
+         */
+        if (sspi->tx_by_cmd)
+                spi_sirfsoc_cmd_transfer(spi, t);
+        else if (IS_DMA_VALID(t))
+                spi_sirfsoc_dma_transfer(spi, t);
+        else
+                spi_sirfsoc_pio_transfer(spi, t);
        return t->len - sspi->left_rx_word * sspi->word_width;
 }
@@ -470,7 +503,16 @@ static void spi_sirfsoc_chipselect(struct spi_device *spi, int value)
                writel(regval, sspi->base + SIRFSOC_SPI_CTRL);
        } else {
                int gpio = sspi->chipselect[spi->chip_select];
-                gpio_direction_output(gpio, spi->mode & SPI_CS_HIGH ? 0 : 1);
+                switch (value) {
+                case BITBANG_CS_ACTIVE:
+                        gpio_direction_output(gpio,
+                                        spi->mode & SPI_CS_HIGH ? 1 : 0);
+                        break;
+                case BITBANG_CS_INACTIVE:
+                        gpio_direction_output(gpio,
+                                        spi->mode & SPI_CS_HIGH ? 0 : 1);
+                        break;
+                }
        }
 }
@@ -503,7 +545,8 @@ spi_sirfsoc_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
                break;
        case 12:
        case 16:
-                regval |= (bits_per_word ==  12) ? SIRFSOC_SPI_TRAN_DAT_FORMAT_12 :
+                regval |= (bits_per_word ==  12) ?
+                        SIRFSOC_SPI_TRAN_DAT_FORMAT_12 :
                        SIRFSOC_SPI_TRAN_DAT_FORMAT_16;
                sspi->rx_word = spi_sirfsoc_rx_word_u16;
                sspi->tx_word = spi_sirfsoc_tx_word_u16;
@@ -531,8 +574,8 @@ spi_sirfsoc_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
                regval |= SIRFSOC_SPI_CLK_IDLE_STAT;
        /*
-         * Data should be driven at least 1/2 cycle before the fetch edge to make
+         * Data should be driven at least 1/2 cycle before the fetch edge
-         * sure that data gets stable at the fetch edge.
+         * to make sure that data gets stable at the fetch edge.
         */
        if (((spi->mode & SPI_CPOL) && (spi->mode & SPI_CPHA)) ||
            (!(spi->mode & SPI_CPOL) && !(spi->mode & SPI_CPHA)))
@@ -559,16 +602,24 @@ spi_sirfsoc_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
                regval &= ~SIRFSOC_SPI_CMD_MODE;
                sspi->tx_by_cmd = false;
        }
+        /*
+         * set spi controller in RISC chipselect mode, we are controlling CS by
+         * software BITBANG_CS_ACTIVE and BITBANG_CS_INACTIVE.
+         */
+        regval |= SIRFSOC_SPI_CS_IO_MODE;
        writel(regval, sspi->base + SIRFSOC_SPI_CTRL);
        if (IS_DMA_VALID(t)) {
                /* Enable DMA mode for RX, TX */
                writel(0, sspi->base + SIRFSOC_SPI_TX_DMA_IO_CTRL);
-                writel(SIRFSOC_SPI_RX_DMA_FLUSH, sspi->base + SIRFSOC_SPI_RX_DMA_IO_CTRL);
+                writel(SIRFSOC_SPI_RX_DMA_FLUSH,
+                        sspi->base + SIRFSOC_SPI_RX_DMA_IO_CTRL);
        } else {
                /* Enable IO mode for RX, TX */
-                writel(SIRFSOC_SPI_IO_MODE_SEL, sspi->base + SIRFSOC_SPI_TX_DMA_IO_CTRL);
+                writel(SIRFSOC_SPI_IO_MODE_SEL,
-                writel(SIRFSOC_SPI_IO_MODE_SEL, sspi->base + SIRFSOC_SPI_RX_DMA_IO_CTRL);
+                        sspi->base + SIRFSOC_SPI_TX_DMA_IO_CTRL);
+                writel(SIRFSOC_SPI_IO_MODE_SEL,
+                        sspi->base + SIRFSOC_SPI_RX_DMA_IO_CTRL);
        }
        return 0;
@@ -598,7 +649,8 @@ static int spi_sirfsoc_probe(struct platform_device *pdev)
                goto err_cs;
        }
-        master = spi_alloc_master(&pdev->dev, sizeof(*sspi) + sizeof(int) * num_cs);
+        master = spi_alloc_master(&pdev->dev,
+                        sizeof(*sspi) + sizeof(int) * num_cs);
        if (!master) {
                dev_err(&pdev->dev, "Unable to allocate SPI master\n");
                return -ENOMEM;
@@ -794,8 +846,7 @@ static struct platform_driver spi_sirfsoc_driver = {
        .remove = spi_sirfsoc_remove,
 };
 module_platform_driver(spi_sirfsoc_driver);
 MODULE_DESCRIPTION("SiRF SoC SPI master driver");
-MODULE_AUTHOR("Zhiwu Song <Zhiwu.Song@csr.com>, "
+MODULE_AUTHOR("Zhiwu Song <Zhiwu.Song@csr.com>");
-                "Barry Song <Baohua.Song@csr.com>");
+MODULE_AUTHOR("Barry Song <Baohua.Song@csr.com>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 400649595505..e4a85ada861d 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -1012,7 +1012,7 @@ static irqreturn_t tegra_spi_isr(int irq, void *context_data)
        return IRQ_WAKE_THREAD;
 }
-static struct of_device_id tegra_spi_of_match[] = {
+static const struct of_device_id tegra_spi_of_match[] = {
        { .compatible = "nvidia,tegra114-spi", },
        {}
 };
diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index 47869ea636e1..3548ce25c08f 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -419,7 +419,7 @@ static irqreturn_t tegra_sflash_isr(int irq, void *context_data)
        return handle_cpu_based_xfer(tsd);
 }
-static struct of_device_id tegra_sflash_of_match[] = {
+static const struct of_device_id tegra_sflash_of_match[] = {
        { .compatible = "nvidia,tegra20-sflash", },
        {}
 };
diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index e3c1b93e45d1..0b9e32e9f493 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -1001,7 +1001,7 @@ static const struct tegra_slink_chip_data tegra20_spi_cdata = {
        .cs_hold_time = false,
 };
-static struct of_device_id tegra_slink_of_match[] = {
+static const struct of_device_id tegra_slink_of_match[] = {
        { .compatible = "nvidia,tegra30-slink", .data = &tegra30_spi_cdata, },
        { .compatible = "nvidia,tegra20-slink", .data = &tegra20_spi_cdata, },
        {}
diff --git a/drivers/spi/spi-tle62x0.c b/drivers/spi/spi-tle62x0.c
index 2d4010d80824..daf5aa1c24c3 100644
--- a/drivers/spi/spi-tle62x0.c
+++ b/drivers/spi/spi-tle62x0.c
@@ -253,10 +253,8 @@ static int tle62x0_probe(struct spi_device *spi)
        }
        st = kzalloc(sizeof(struct tle62x0_state), GFP_KERNEL);
-        if (st == NULL) {
+        if (st == NULL)
-                dev_err(&spi->dev, "no memory for device state\n");
                return -ENOMEM;
-        }
        st->us = spi;
        st->nr_gpio = pdata->gpio_count;
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index f406b30af961..f05abf89c067 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -1578,14 +1578,11 @@ static int pch_spi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        struct pch_pd_dev_save *pd_dev_save;
        pd_dev_save = kzalloc(sizeof(struct pch_pd_dev_save), GFP_KERNEL);
-        if (!pd_dev_save) {
+        if (!pd_dev_save)
-                dev_err(&pdev->dev, "%s Can't allocate pd_dev_sav\n", __func__);
                return -ENOMEM;
-        }
        board_dat = kzalloc(sizeof(struct pch_spi_board_data), GFP_KERNEL);
        if (!board_dat) {
-                dev_err(&pdev->dev, "%s Can't allocate board_dat\n", __func__);
                retval = -ENOMEM;
                goto err_no_mem;
        }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 4eb9bf02996c..d4f9670b51bc 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -580,6 +580,7 @@ static void spi_set_cs(struct spi_device *spi, bool enable)
                spi->master->set_cs(spi, !enable);
 }
+#ifdef CONFIG_HAS_DMA
 static int spi_map_buf(struct spi_master *master, struct device *dev,
                       struct sg_table *sgt, void *buf, size_t len,
                       enum dma_data_direction dir)
@@ -637,55 +638,12 @@ static void spi_unmap_buf(struct spi_master *master, struct device *dev,
        }
 }
-static int spi_map_msg(struct spi_master *master, struct spi_message *msg)
+static int __spi_map_msg(struct spi_master *master, struct spi_message *msg)
 {
        struct device *tx_dev, *rx_dev;
        struct spi_transfer *xfer;
-        void *tmp;
-        unsigned int max_tx, max_rx;
        int ret;
-        if (master->flags & (SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX)) {
-                max_tx = 0;
-                max_rx = 0;
-                list_for_each_entry(xfer, &msg->transfers, transfer_list) {
-                        if ((master->flags & SPI_MASTER_MUST_TX) &&
-                            !xfer->tx_buf)
-                                max_tx = max(xfer->len, max_tx);
-                        if ((master->flags & SPI_MASTER_MUST_RX) &&
-                            !xfer->rx_buf)
-                                max_rx = max(xfer->len, max_rx);
-                }
-                if (max_tx) {
-                        tmp = krealloc(master->dummy_tx, max_tx,
-                                       GFP_KERNEL | GFP_DMA);
-                        if (!tmp)
-                                return -ENOMEM;
-                        master->dummy_tx = tmp;
-                        memset(tmp, 0, max_tx);
-                }
-                if (max_rx) {
-                        tmp = krealloc(master->dummy_rx, max_rx,
-                                       GFP_KERNEL | GFP_DMA);
-                        if (!tmp)
-                                return -ENOMEM;
-                        master->dummy_rx = tmp;
-                }
-                if (max_tx || max_rx) {
-                        list_for_each_entry(xfer, &msg->transfers,
-                                            transfer_list) {
-                                if (!xfer->tx_buf)
-                                        xfer->tx_buf = master->dummy_tx;
-                                if (!xfer->rx_buf)
-                                        xfer->rx_buf = master->dummy_rx;
-                        }
-                }
-        }
        if (!master->can_dma)
                return 0;
@@ -742,6 +700,69 @@ static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
        return 0;
 }
+#else /* !CONFIG_HAS_DMA */
+static inline int __spi_map_msg(struct spi_master *master,
+                                struct spi_message *msg)
+{
+        return 0;
+}
+static inline int spi_unmap_msg(struct spi_master *master,
+                                struct spi_message *msg)
+{
+        return 0;
+}
+#endif /* !CONFIG_HAS_DMA */
+static int spi_map_msg(struct spi_master *master, struct spi_message *msg)
+{
+        struct spi_transfer *xfer;
+        void *tmp;
+        unsigned int max_tx, max_rx;
+        if (master->flags & (SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX)) {
+                max_tx = 0;
+                max_rx = 0;
+                list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+                        if ((master->flags & SPI_MASTER_MUST_TX) &&
+                            !xfer->tx_buf)
+                                max_tx = max(xfer->len, max_tx);
+                        if ((master->flags & SPI_MASTER_MUST_RX) &&
+                            !xfer->rx_buf)
+                                max_rx = max(xfer->len, max_rx);
+                }
+                if (max_tx) {
+                        tmp = krealloc(master->dummy_tx, max_tx,
+                                       GFP_KERNEL | GFP_DMA);
+                        if (!tmp)
+                                return -ENOMEM;
+                        master->dummy_tx = tmp;
+                        memset(tmp, 0, max_tx);
+                }
+                if (max_rx) {
+                        tmp = krealloc(master->dummy_rx, max_rx,
+                                       GFP_KERNEL | GFP_DMA);
+                        if (!tmp)
+                                return -ENOMEM;
+                        master->dummy_rx = tmp;
+                }
+                if (max_tx || max_rx) {
+                        list_for_each_entry(xfer, &msg->transfers,
+                                            transfer_list) {
+                                if (!xfer->tx_buf)
+                                        xfer->tx_buf = master->dummy_tx;
+                                if (!xfer->rx_buf)
+                                        xfer->rx_buf = master->dummy_rx;
+                        }
+                }
+        }
+        return __spi_map_msg(master, msg);
+}
 /*
 * spi_transfer_one_message - Default implementation of transfer_one_message()
@@ -775,7 +796,7 @@ static int spi_transfer_one_message(struct spi_master *master,
                if (ret > 0) {
                        ret = 0;
                        ms = xfer->len * 8 * 1000 / xfer->speed_hz;
-                        ms += 10; /* some tolerance */
+                        ms += ms + 100; /* some tolerance */
                        ms = wait_for_completion_timeout(&master->xfer_completion,
                                                         msecs_to_jiffies(ms));
@@ -1151,7 +1172,6 @@ static int spi_master_initialize_queue(struct spi_master *master)
 {
        int ret;
-        master->queued = true;
        master->transfer = spi_queued_transfer;
        if (!master->transfer_one_message)
                master->transfer_one_message = spi_transfer_one_message;
@@ -1162,6 +1182,7 @@ static int spi_master_initialize_queue(struct spi_master *master)
                dev_err(&master->dev, "problem initializing queue\n");
                goto err_init_queue;
        }
+        master->queued = true;
        ret = spi_start_queue(master);
        if (ret) {
                dev_err(&master->dev, "problem starting queue\n");
@@ -1171,8 +1192,8 @@ static int spi_master_initialize_queue(struct spi_master *master)
        return 0;
 err_start_queue:
-err_init_queue:
        spi_destroy_queue(master);
+err_init_queue:
        return ret;
 }
@@ -1234,6 +1255,8 @@ static void of_register_spi_devices(struct spi_master *master)
                        spi->mode |= SPI_CS_HIGH;
                if (of_find_property(nc, "spi-3wire", NULL))
                        spi->mode |= SPI_3WIRE;
+                if (of_find_property(nc, "spi-lsb-first", NULL))
+                        spi->mode |= SPI_LSB_FIRST;
                /* Device DUAL/QUAD mode */
                if (!of_property_read_u32(nc, "spi-tx-bus-width", &value)) {
@@ -1247,11 +1270,10 @@ static void of_register_spi_devices(struct spi_master *master)
                                spi->mode |= SPI_TX_QUAD;
                                break;
                        default:
-                                dev_err(&master->dev,
+                                dev_warn(&master->dev,
-                                        "spi-tx-bus-width %d not supported\n",
+                                         "spi-tx-bus-width %d not supported\n",
-                                        value);
+                                         value);
-                                spi_dev_put(spi);
+                                break;
-                                continue;
                        }
                }
@@ -1266,11 +1288,10 @@ static void of_register_spi_devices(struct spi_master *master)
                                spi->mode |= SPI_RX_QUAD;
                                break;
                        default:
-                                dev_err(&master->dev,
+                                dev_warn(&master->dev,
-                                        "spi-rx-bus-width %d not supported\n",
+                                         "spi-rx-bus-width %d not supported\n",
-                                        value);
+                                         value);
-                                spi_dev_put(spi);
+                                break;
-                                continue;
                        }
                }
@@ -1756,7 +1777,7 @@ EXPORT_SYMBOL_GPL(spi_busnum_to_master);
 */
 int spi_setup(struct spi_device *spi)
 {
-        unsigned        bad_bits;
+        unsigned        bad_bits, ugly_bits;
        int             status = 0;
        /* check mode to prevent that DUAL and QUAD set at the same time
@@ -1776,6 +1797,15 @@ int spi_setup(struct spi_device *spi)
         * that aren't supported with their current master
         */
        bad_bits = spi->mode & ~spi->master->mode_bits;
+        ugly_bits = bad_bits &
+                    (SPI_TX_DUAL | SPI_TX_QUAD | SPI_RX_DUAL | SPI_RX_QUAD);
+        if (ugly_bits) {
+                dev_warn(&spi->dev,
+                         "setup: ignoring unsupported mode bits %x\n",
+                         ugly_bits);
+                spi->mode &= ~ugly_bits;
+                bad_bits &= ~ugly_bits;
+        }
        if (bad_bits) {
                dev_err(&spi->dev, "setup: unsupported mode bits %x\n",
                        bad_bits);
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index ea5efb426f75..22365f140bec 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -40,8 +40,6 @@ source "drivers/staging/olpc_dcon/Kconfig"
 source "drivers/staging/panel/Kconfig"
-source "drivers/staging/rtl8187se/Kconfig"
 source "drivers/staging/rtl8192u/Kconfig"
 source "drivers/staging/rtl8192e/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 86e020c2ad0d..fbe84ed2d048 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_PRISM2_USB)	+= wlan-ng/
 obj-$(CONFIG_COMEDI)            += comedi/
 obj-$(CONFIG_FB_OLPC_DCON)      += olpc_dcon/
 obj-$(CONFIG_PANEL)             += panel/
-obj-$(CONFIG_R8187SE)           += rtl8187se/
 obj-$(CONFIG_RTL8192U)          += rtl8192u/
 obj-$(CONFIG_RTL8192E)          += rtl8192e/
 obj-$(CONFIG_R8712U)            += rtl8712/
diff --git a/drivers/staging/comedi/comedi_buf.c b/drivers/staging/comedi/comedi_buf.c
index 924fce977985..257595016161 100644
--- a/drivers/staging/comedi/comedi_buf.c
+++ b/drivers/staging/comedi/comedi_buf.c
@@ -61,6 +61,8 @@ static void __comedi_buf_free(struct comedi_device *dev,
                              struct comedi_subdevice *s)
 {
        struct comedi_async *async = s->async;
+        struct comedi_buf_map *bm;
+        unsigned long flags;
        if (async->prealloc_buf) {
                vunmap(async->prealloc_buf);
@@ -68,8 +70,11 @@ static void __comedi_buf_free(struct comedi_device *dev,
                async->prealloc_bufsz = 0;
        }
-        comedi_buf_map_put(async->buf_map);
+        spin_lock_irqsave(&s->spin_lock, flags);
+        bm = async->buf_map;
        async->buf_map = NULL;
+        spin_unlock_irqrestore(&s->spin_lock, flags);
+        comedi_buf_map_put(bm);
 }
 static void __comedi_buf_alloc(struct comedi_device *dev,
@@ -80,6 +85,7 @@ static void __comedi_buf_alloc(struct comedi_device *dev,
        struct page **pages = NULL;
        struct comedi_buf_map *bm;
        struct comedi_buf_page *buf;
+        unsigned long flags;
        unsigned i;
        if (!IS_ENABLED(CONFIG_HAS_DMA) && s->async_dma_dir != DMA_NONE) {
@@ -92,8 +98,10 @@ static void __comedi_buf_alloc(struct comedi_device *dev,
        if (!bm)
                return;
-        async->buf_map = bm;
        kref_init(&bm->refcount);
+        spin_lock_irqsave(&s->spin_lock, flags);
+        async->buf_map = bm;
+        spin_unlock_irqrestore(&s->spin_lock, flags);
        bm->dma_dir = s->async_dma_dir;
        if (bm->dma_dir != DMA_NONE)
                /* Need ref to hardware device to free buffer later. */
@@ -127,7 +135,9 @@ static void __comedi_buf_alloc(struct comedi_device *dev,
                pages[i] = virt_to_page(buf->virt_addr);
        }
+        spin_lock_irqsave(&s->spin_lock, flags);
        bm->n_pages = i;
+        spin_unlock_irqrestore(&s->spin_lock, flags);
        /* vmap the prealloc_buf if all the pages were allocated */
        if (i == n_pages)
@@ -150,6 +160,29 @@ int comedi_buf_map_put(struct comedi_buf_map *bm)
        return 1;
 }
+/* returns s->async->buf_map and increments its kref refcount */
+struct comedi_buf_map *
+comedi_buf_map_from_subdev_get(struct comedi_subdevice *s)
+{
+        struct comedi_async *async = s->async;
+        struct comedi_buf_map *bm = NULL;
+        unsigned long flags;
+        if (!async)
+                return NULL;
+        spin_lock_irqsave(&s->spin_lock, flags);
+        bm = async->buf_map;
+        /* only want it if buffer pages allocated */
+        if (bm && bm->n_pages)
+                comedi_buf_map_get(bm);
+        else
+                bm = NULL;
+        spin_unlock_irqrestore(&s->spin_lock, flags);
+        return bm;
+}
 bool comedi_buf_is_mmapped(struct comedi_async *async)
 {
        struct comedi_buf_map *bm = async->buf_map;
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index ea6dc36d753b..acc80197e35e 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1926,14 +1926,21 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
        struct comedi_device *dev = file->private_data;
        struct comedi_subdevice *s;
        struct comedi_async *async;
-        struct comedi_buf_map *bm;
+        struct comedi_buf_map *bm = NULL;
        unsigned long start = vma->vm_start;
        unsigned long size;
        int n_pages;
        int i;
        int retval;
-        mutex_lock(&dev->mutex);
+        /*
+         * 'trylock' avoids circular dependency with current->mm->mmap_sem
+         * and down-reading &dev->attach_lock should normally succeed without
+         * contention unless the device is in the process of being attached
+         * or detached.
+         */
+        if (!down_read_trylock(&dev->attach_lock))
+                return -EAGAIN;
        if (!dev->attached) {
                dev_dbg(dev->class_dev, "no driver attached\n");
@@ -1973,7 +1980,9 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
        }
        n_pages = size >> PAGE_SHIFT;
-        bm = async->buf_map;
+        /* get reference to current buf map (if any) */
+        bm = comedi_buf_map_from_subdev_get(s);
        if (!bm || n_pages > bm->n_pages) {
                retval = -EINVAL;
                goto done;
@@ -1997,7 +2006,8 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
        retval = 0;
 done:
-        mutex_unlock(&dev->mutex);
+        up_read(&dev->attach_lock);
+        comedi_buf_map_put(bm); /* put reference to buf map - okay if NULL */
        return retval;
 }
diff --git a/drivers/staging/comedi/comedi_internal.h b/drivers/staging/comedi/comedi_internal.h
index 9a746570f161..a492f2d2436e 100644
--- a/drivers/staging/comedi/comedi_internal.h
+++ b/drivers/staging/comedi/comedi_internal.h
@@ -19,6 +19,8 @@ void comedi_buf_reset(struct comedi_async *async);
 bool comedi_buf_is_mmapped(struct comedi_async *async);
 void comedi_buf_map_get(struct comedi_buf_map *bm);
 int comedi_buf_map_put(struct comedi_buf_map *bm);
+struct comedi_buf_map *comedi_buf_map_from_subdev_get(
+                struct comedi_subdevice *s);
 unsigned int comedi_buf_write_n_allocated(struct comedi_async *async);
 void comedi_device_cancel_all(struct comedi_device *dev);
diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index 71db683098d6..b59af0303581 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -493,7 +493,7 @@ static void usbduxsub_ao_isoc_irq(struct urb *urb)
                        /* pointer to the DA */
                        *datap++ = val & 0xff;
                        *datap++ = (val >> 8) & 0xff;
-                        *datap++ = chan;
+                        *datap++ = chan << 6;
                        devpriv->ao_readback[chan] = val;
                        s->async->events |= COMEDI_CB_BLOCK;
@@ -1040,11 +1040,8 @@ static int usbdux_ao_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
        /* set current channel of the running acquisition to zero */
        s->async->cur_chan = 0;
-        for (i = 0; i < cmd->chanlist_len; ++i) {
+        for (i = 0; i < cmd->chanlist_len; ++i)
-                unsigned int chan = CR_CHAN(cmd->chanlist[i]);
+                devpriv->ao_chanlist[i] = CR_CHAN(cmd->chanlist[i]);
-                devpriv->ao_chanlist[i] = chan << 6;
-        }
        /* we count in steps of 1ms (125us) */
        /* 125us mode not used yet */
diff --git a/drivers/staging/goldfish/goldfish_audio.c b/drivers/staging/goldfish/goldfish_audio.c
index f96dcec740ae..7ac2602242f1 100644
--- a/drivers/staging/goldfish/goldfish_audio.c
+++ b/drivers/staging/goldfish/goldfish_audio.c
@@ -334,6 +334,7 @@ static int goldfish_audio_probe(struct platform_device *pdev)
        return 0;
 err_misc_register_failed:
+        free_irq(data->irq, data);
 err_request_irq_failed:
        dma_free_coherent(&pdev->dev, COMBINED_BUFFER_SIZE,
                                        data->buffer_virt, data->buffer_phys);
diff --git a/drivers/staging/gs_fpgaboot/Makefile b/drivers/staging/gs_fpgaboot/Makefile
index 34cb606e0e3d..d2f0211ba540 100644
--- a/drivers/staging/gs_fpgaboot/Makefile
+++ b/drivers/staging/gs_fpgaboot/Makefile
@@ -1,4 +1,2 @@
 gs_fpga-y       += gs_fpgaboot.o io.o
 obj-$(CONFIG_GS_FPGABOOT)       += gs_fpga.o
-ccflags-$(CONFIG_GS_FPGA_DEBUG) := -DDEBUG
diff --git a/drivers/staging/gs_fpgaboot/gs_fpgaboot.c b/drivers/staging/gs_fpgaboot/gs_fpgaboot.c
index 89bc84d833e6..7506900c9b8d 100644
--- a/drivers/staging/gs_fpgaboot/gs_fpgaboot.c
+++ b/drivers/staging/gs_fpgaboot/gs_fpgaboot.c
@@ -373,7 +373,6 @@ static int __init gs_fpgaboot_init(void)
        r = -1;
        pr_info("FPGA DOWNLOAD --->\n");
-        pr_info("built at %s UTC\n", __TIMESTAMP__);
        pr_info("FPGA image file name: %s\n", file);
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 11fb95201545..dae8d1a9038e 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -1526,7 +1526,7 @@ static int mxs_lradc_probe(struct platform_device *pdev)
        struct resource *iores;
        int ret = 0, touch_ret;
        int i, s;
-        unsigned int scale_uv;
+        uint64_t scale_uv;
        /* Allocate the IIO device. */
        iio = devm_iio_device_alloc(dev, sizeof(*lradc));
diff --git a/drivers/staging/iio/resolver/ad2s1200.c b/drivers/staging/iio/resolver/ad2s1200.c
index 36eedd8a0ea9..017d2f8379b7 100644
--- a/drivers/staging/iio/resolver/ad2s1200.c
+++ b/drivers/staging/iio/resolver/ad2s1200.c
@@ -70,6 +70,7 @@ static int ad2s1200_read_raw(struct iio_dev *indio_dev,
                vel = (((s16)(st->rx[0])) << 4) | ((st->rx[1] & 0xF0) >> 4);
                vel = (vel << 4) >> 4;
                *val = vel;
+                break;
        default:
                mutex_unlock(&st->lock);
                return -EINVAL;
@@ -106,7 +107,7 @@ static int ad2s1200_probe(struct spi_device *spi)
        int pn, ret = 0;
        unsigned short *pins = spi->dev.platform_data;
-        for (pn = 0; pn < AD2S1200_PN; pn++)
+        for (pn = 0; pn < AD2S1200_PN; pn++) {
                ret = devm_gpio_request_one(&spi->dev, pins[pn], GPIOF_DIR_OUT,
                                            DRV_NAME);
                if (ret) {
@@ -114,6 +115,7 @@ static int ad2s1200_probe(struct spi_device *spi)
                                                        pins[pn]);
                        return ret;
                }
+        }
        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
        if (!indio_dev)
                return -ENOMEM;
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 4144a75e5f71..c270c9ae6d27 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -517,7 +517,7 @@ int imx_drm_encoder_get_mux_id(struct device_node *node,
                of_node_put(port);
                if (port == imx_crtc->port) {
                        ret = of_graph_parse_endpoint(ep, &endpoint);
-                        return ret ? ret : endpoint.id;
+                        return ret ? ret : endpoint.port;
                }
        } while (ep);
@@ -675,6 +675,11 @@ static int imx_drm_platform_probe(struct platform_device *pdev)
                        if (!remote || !of_device_is_available(remote)) {
                                of_node_put(remote);
                                continue;
+                        } else if (!of_device_is_available(remote->parent)) {
+                                dev_warn(&pdev->dev, "parent device of %s is not available\n",
+                                         remote->full_name);
+                                of_node_put(remote);
+                                continue;
                        }
                        ret = imx_drm_add_component(&pdev->dev, remote);
diff --git a/drivers/staging/imx-drm/imx-tve.c b/drivers/staging/imx-drm/imx-tve.c
index 575533f4fd64..a23f4f773146 100644
--- a/drivers/staging/imx-drm/imx-tve.c
+++ b/drivers/staging/imx-drm/imx-tve.c
@@ -582,7 +582,7 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
        tve->dev = dev;
        spin_lock_init(&tve->lock);
-        ddc_node = of_parse_phandle(np, "i2c-ddc-bus", 0);
+        ddc_node = of_parse_phandle(np, "ddc-i2c-bus", 0);
        if (ddc_node) {
                tve->ddc = of_find_i2c_adapter_by_node(ddc_node);
                of_node_put(ddc_node);
diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c
index 8c101cbbee97..acc8184c46cd 100644
--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
+++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
@@ -1247,9 +1247,18 @@ static int vpfe_stop_streaming(struct vb2_queue *vq)
        struct vpfe_fh *fh = vb2_get_drv_priv(vq);
        struct vpfe_video_device *video = fh->video;
-        if (!vb2_is_streaming(vq))
-                return 0;
        /* release all active buffers */
+        if (video->cur_frm == video->next_frm) {
+                vb2_buffer_done(&video->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (video->cur_frm != NULL)
+                        vb2_buffer_done(&video->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (video->next_frm != NULL)
+                        vb2_buffer_done(&video->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
        while (!list_empty(&video->dma_queue)) {
                video->next_frm = list_entry(video->dma_queue.next,
                                                struct vpfe_cap_buffer, list);
diff --git a/drivers/staging/media/sn9c102/sn9c102_devtable.h b/drivers/staging/media/sn9c102/sn9c102_devtable.h
index b3d2cc729657..4ba569258498 100644
--- a/drivers/staging/media/sn9c102/sn9c102_devtable.h
+++ b/drivers/staging/media/sn9c102/sn9c102_devtable.h
@@ -48,10 +48,8 @@ static const struct usb_device_id sn9c102_id_table[] = {
        { SN9C102_USB_DEVICE(0x0c45, 0x600d, BRIDGE_SN9C102), },
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x6011, BRIDGE_SN9C102), }, OV6650 */
        { SN9C102_USB_DEVICE(0x0c45, 0x6019, BRIDGE_SN9C102), },
-#endif
        { SN9C102_USB_DEVICE(0x0c45, 0x6024, BRIDGE_SN9C102), },
        { SN9C102_USB_DEVICE(0x0c45, 0x6025, BRIDGE_SN9C102), },
-#if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
        { SN9C102_USB_DEVICE(0x0c45, 0x6028, BRIDGE_SN9C102), },
        { SN9C102_USB_DEVICE(0x0c45, 0x6029, BRIDGE_SN9C102), },
        { SN9C102_USB_DEVICE(0x0c45, 0x602a, BRIDGE_SN9C102), },
diff --git a/drivers/staging/rtl8187se/Kconfig b/drivers/staging/rtl8187se/Kconfig
deleted file mode 100644
index ff8d41ebca36..000000000000
--- a/drivers/staging/rtl8187se/Kconfig
+++ /dev/null
@@ -1,10 +0,0 @@
-config R8187SE
-        tristate "RealTek RTL8187SE Wireless LAN NIC driver"
-        depends on PCI && WLAN
-        depends on m
-        select WIRELESS_EXT
-        select WEXT_PRIV
-        select EEPROM_93CX6
-        select CRYPTO
-        ---help---
-          If built as a module, it will be called r8187se.ko.
diff --git a/drivers/staging/rtl8187se/Makefile b/drivers/staging/rtl8187se/Makefile
deleted file mode 100644
index 91d1aa2830c9..000000000000
--- a/drivers/staging/rtl8187se/Makefile
+++ /dev/null
@@ -1,38 +0,0 @@
-#ccflags-y += -DCONFIG_IEEE80211_NOWEP=y
-#ccflags-y += -std=gnu89
-#ccflags-y += -O2
-#CC            = gcc
-ccflags-y := -DSW_ANTE
-ccflags-y += -DTX_TRACK
-ccflags-y += -DHIGH_POWER
-ccflags-y += -DSW_DIG
-ccflags-y += -DRATE_ADAPT
-#enable it for legacy power save, disable it for leisure power save
-ccflags-y += -DENABLE_LPS
-#ccflags-y := -mhard-float -DCONFIG_FORCE_HARD_FLOAT=y
-r8187se-y :=                    \
-                r8180_core.o            \
-                r8180_wx.o              \
-                r8180_rtl8225z2.o       \
-                r8185b_init.o           \
-                r8180_dm.o              \
-                ieee80211/dot11d.o                      \
-                ieee80211/ieee80211_softmac.o           \
-                ieee80211/ieee80211_rx.o                \
-                ieee80211/ieee80211_tx.o                \
-                ieee80211/ieee80211_wx.o                \
-                ieee80211/ieee80211_module.o            \
-                ieee80211/ieee80211_softmac_wx.o        \
-                ieee80211/ieee80211_crypt.o             \
-                ieee80211/ieee80211_crypt_tkip.o        \
-                ieee80211/ieee80211_crypt_ccmp.o        \
-                ieee80211/ieee80211_crypt_wep.o
-obj-$(CONFIG_R8187SE)   += r8187se.o
diff --git a/drivers/staging/rtl8187se/Module.symvers b/drivers/staging/rtl8187se/Module.symvers
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/drivers/staging/rtl8187se/Module.symvers
+++ /dev/null
diff --git a/drivers/staging/rtl8187se/TODO b/drivers/staging/rtl8187se/TODO
deleted file mode 100644
index 704949a9da0d..000000000000
--- a/drivers/staging/rtl8187se/TODO
+++ /dev/null
@@ -1,13 +0,0 @@
-TODO:
- prepare private ieee80211 stack for merge with rtl8192su's version:
-  - add hwsec_active flag to struct ieee80211_device
-  - add bHwSec flag to cb_desc structure
- switch to use shared "librtl" instead of private ieee80211 stack
- switch to use LIB80211
- switch to use MAC80211
- use kernel coding style
- checkpatch.pl fixes
- sparse fixes
- integrate with drivers/net/wireless/rtl818x
-Please send any patches to Greg Kroah-Hartman <greg@kroah.com>.
diff --git a/drivers/staging/rtl8187se/ieee80211/dot11d.c b/drivers/staging/rtl8187se/ieee80211/dot11d.c
deleted file mode 100644
index 4483c2c0307c..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/dot11d.c
+++ /dev/null
@@ -1,189 +0,0 @@
-#include "dot11d.h"
-void Dot11d_Init(struct ieee80211_device *ieee)
-{
-        PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(ieee);
-        pDot11dInfo->bEnabled = 0;
-        pDot11dInfo->State = DOT11D_STATE_NONE;
-        pDot11dInfo->CountryIeLen = 0;
-        memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
-        memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
-        RESET_CIE_WATCHDOG(ieee);
-        netdev_info(ieee->dev, "Dot11d_Init()\n");
-}
-/* Reset to the state as we are just entering a regulatory domain. */
-void Dot11d_Reset(struct ieee80211_device *ieee)
-{
-        u32 i;
-        PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(ieee);
-        /* Clear old channel map */
-        memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
-        memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
-        /* Set new channel map */
-        for (i = 1; i <= 11; i++)
-                (pDot11dInfo->channel_map)[i] = 1;
-        for (i = 12; i <= 14; i++)
-                (pDot11dInfo->channel_map)[i] = 2;
-        pDot11dInfo->State = DOT11D_STATE_NONE;
-        pDot11dInfo->CountryIeLen = 0;
-        RESET_CIE_WATCHDOG(ieee);
-}
-/*
- * Description:
- *      Update country IE from Beacon or Probe Response and configure PHY for
- *      operation in the regulatory domain.
- *
- * TODO:
- *      Configure Tx power.
- *
- * Assumption:
- *      1. IS_DOT11D_ENABLE() is TRUE.
- *      2. Input IE is an valid one.
- */
-void Dot11d_UpdateCountryIe(struct ieee80211_device *dev, u8 *pTaddr,
-                            u16 CoutryIeLen, u8 *pCoutryIe)
-{
-        PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
-        u8 i, j, NumTriples, MaxChnlNum;
-        u8 index, MaxTxPowerInDbm;
-        PCHNL_TXPOWER_TRIPLE pTriple;
-        if ((CoutryIeLen - 3)%3 != 0) {
-                netdev_info(dev->dev, "Dot11d_UpdateCountryIe(): Invalid country IE, skip it........1\n");
-                Dot11d_Reset(dev);
-                return;
-        }
-        memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
-        memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
-        MaxChnlNum = 0;
-        NumTriples = (CoutryIeLen - 3) / 3; /* skip 3-byte country string. */
-        pTriple = (PCHNL_TXPOWER_TRIPLE)(pCoutryIe + 3);
-        for (i = 0; i < NumTriples; i++) {
-                if (MaxChnlNum >= pTriple->FirstChnl) {
-                        /*
-                         * It is not in a monotonically increasing order,
-                         * so stop processing.
-                         */
-                        netdev_info(dev->dev,
-                                    "Dot11d_UpdateCountryIe(): Invalid country IE, skip it........1\n");
-                        Dot11d_Reset(dev);
-                        return;
-                }
-                if (MAX_CHANNEL_NUMBER <
-                    (pTriple->FirstChnl + pTriple->NumChnls)) {
-                        /*
-                         * It is not a valid set of channel id,
-                         * so stop processing
-                         */
-                        netdev_info(dev->dev,
-                                    "Dot11d_UpdateCountryIe(): Invalid country IE, skip it........2\n");
-                        Dot11d_Reset(dev);
-                        return;
-                }
-                for (j = 0; j < pTriple->NumChnls; j++) {
-                        index = pTriple->FirstChnl + j;
-                        pDot11dInfo->channel_map[index] = 1;
-                        MaxTxPowerInDbm = pTriple->MaxTxPowerInDbm;
-                        pDot11dInfo->MaxTxPwrDbmList[index] = MaxTxPowerInDbm;
-                        MaxChnlNum = pTriple->FirstChnl + j;
-                }
-                pTriple = (PCHNL_TXPOWER_TRIPLE)((u8 *)pTriple + 3);
-        }
-#if 1
-        netdev_info(dev->dev, "Channel List:");
-        for (i = 1; i <= MAX_CHANNEL_NUMBER; i++)
-                if (pDot11dInfo->channel_map[i] > 0)
-                        netdev_info(dev->dev, " %d", i);
-        netdev_info(dev->dev, "\n");
-#endif
-        UPDATE_CIE_SRC(dev, pTaddr);
-        pDot11dInfo->CountryIeLen = CoutryIeLen;
-        memcpy(pDot11dInfo->CountryIeBuf, pCoutryIe, CoutryIeLen);
-        pDot11dInfo->State = DOT11D_STATE_LEARNED;
-}
-u8 DOT11D_GetMaxTxPwrInDbm(struct ieee80211_device *dev, u8 Channel)
-{
-        PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
-        u8 MaxTxPwrInDbm = 255;
-        if (MAX_CHANNEL_NUMBER < Channel) {
-                netdev_info(dev->dev, "DOT11D_GetMaxTxPwrInDbm(): Invalid Channel\n");
-                return MaxTxPwrInDbm;
-        }
-        if (pDot11dInfo->channel_map[Channel])
-                MaxTxPwrInDbm = pDot11dInfo->MaxTxPwrDbmList[Channel];
-        return MaxTxPwrInDbm;
-}
-void DOT11D_ScanComplete(struct ieee80211_device *dev)
-{
-        PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
-        switch (pDot11dInfo->State) {
-        case DOT11D_STATE_LEARNED:
-                pDot11dInfo->State = DOT11D_STATE_DONE;
-                break;
-        case DOT11D_STATE_DONE:
-                if (GET_CIE_WATCHDOG(dev) == 0) {
-                        /* Reset country IE if previous one is gone. */
-                        Dot11d_Reset(dev);
-                }
-                break;
-        case DOT11D_STATE_NONE:
-                break;
-        }
-}
-int IsLegalChannel(struct ieee80211_device *dev, u8 channel)
-{
-        PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
-        if (MAX_CHANNEL_NUMBER < channel) {
-                netdev_info(dev->dev, "IsLegalChannel(): Invalid Channel\n");
-                return 0;
-        }
-        if (pDot11dInfo->channel_map[channel] > 0)
-                return 1;
-        return 0;
-}
-int ToLegalChannel(struct ieee80211_device *dev, u8 channel)
-{
-        PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
-        u8 default_chn = 0;
-        u32 i = 0;
-        for (i = 1; i <= MAX_CHANNEL_NUMBER; i++) {
-                if (pDot11dInfo->channel_map[i] > 0) {
-                        default_chn = i;
-                        break;
-                }
-        }
-        if (MAX_CHANNEL_NUMBER < channel) {
-                netdev_info(dev->dev, "IsLegalChannel(): Invalid Channel\n");
-                return default_chn;
-        }
-        if (pDot11dInfo->channel_map[channel] > 0)
-                return channel;
-        return default_chn;
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/dot11d.h b/drivers/staging/rtl8187se/ieee80211/dot11d.h
deleted file mode 100644
index f996691307bf..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/dot11d.h
+++ /dev/null
@@ -1,71 +0,0 @@
-#ifndef __INC_DOT11D_H
-#define __INC_DOT11D_H
-#include "ieee80211.h"
-/* #define ENABLE_DOT11D */
-/* #define DOT11D_MAX_CHNL_NUM 83 */
-typedef struct _CHNL_TXPOWER_TRIPLE {
-        u8 FirstChnl;
-        u8  NumChnls;
-        u8  MaxTxPowerInDbm;
-} CHNL_TXPOWER_TRIPLE, *PCHNL_TXPOWER_TRIPLE;
-typedef enum _DOT11D_STATE {
-        DOT11D_STATE_NONE = 0,
-        DOT11D_STATE_LEARNED,
-        DOT11D_STATE_DONE,
-} DOT11D_STATE;
-typedef struct _RT_DOT11D_INFO {
-        /* DECLARE_RT_OBJECT(RT_DOT12D_INFO); */
-        bool bEnabled; /* dot11MultiDomainCapabilityEnabled */
-        u16 CountryIeLen; /* > 0 if CountryIeBuf[] contains valid country information element. */
-        u8  CountryIeBuf[MAX_IE_LEN];
-        u8  CountryIeSrcAddr[6]; /* Source AP of the country IE. */
-        u8  CountryIeWatchdog;
-        u8  channel_map[MAX_CHANNEL_NUMBER+1];  /* !!!Value 0: Invalid, 1: Valid (active scan), 2: Valid (passive scan) */
-        /* u8  ChnlListLen; // #Bytes valid in ChnlList[]. */
-        /* u8  ChnlList[DOT11D_MAX_CHNL_NUM]; */
-        u8  MaxTxPwrDbmList[MAX_CHANNEL_NUMBER+1];
-        DOT11D_STATE State;
-} RT_DOT11D_INFO, *PRT_DOT11D_INFO;
-#define eqMacAddr(a, b) (((a)[0] == (b)[0] && (a)[1] == (b)[1] && (a)[2] == (b)[2] && (a)[3] == (b)[3] && (a)[4] == (b)[4] && (a)[5] == (b)[5]) ? 1:0)
-#define cpMacAddr(des, src) ((des)[0] = (src)[0], (des)[1] = (src)[1], (des)[2] = (src)[2], (des)[3] = (src)[3], (des)[4] = (src)[4], (des)[5] = (src)[5])
-#define GET_DOT11D_INFO(__pIeeeDev) ((PRT_DOT11D_INFO)((__pIeeeDev)->pDot11dInfo))
-#define IS_DOT11D_ENABLE(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->bEnabled
-#define IS_COUNTRY_IE_VALID(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen > 0)
-#define IS_EQUAL_CIE_SRC(__pIeeeDev, __pTa) eqMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
-#define UPDATE_CIE_SRC(__pIeeeDev, __pTa) cpMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
-#define IS_COUNTRY_IE_CHANGED(__pIeeeDev, __Ie) \
-        (((__Ie).Length == 0 || (__Ie).Length != GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen) ? \
-        FALSE : \
-        (!memcmp(GET_DOT11D_INFO(__pIeeeDev)->CountryIeBuf, (__Ie).Octet, (__Ie).Length)))
-#define CIE_WATCHDOG_TH 1
-#define GET_CIE_WATCHDOG(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->CountryIeWatchdog
-#define RESET_CIE_WATCHDOG(__pIeeeDev) GET_CIE_WATCHDOG(__pIeeeDev) = 0
-#define UPDATE_CIE_WATCHDOG(__pIeeeDev) ++GET_CIE_WATCHDOG(__pIeeeDev)
-#define IS_DOT11D_STATE_DONE(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->State == DOT11D_STATE_DONE)
-void Dot11d_Init(struct ieee80211_device *dev);
-void Dot11d_Reset(struct ieee80211_device *dev);
-void Dot11d_UpdateCountryIe(struct ieee80211_device *dev, u8 *pTaddr,
-                            u16 CoutryIeLen, u8 *pCoutryIe);
-u8 DOT11D_GetMaxTxPwrInDbm(struct ieee80211_device *dev, u8 Channel);
-void DOT11D_ScanComplete(struct ieee80211_device *dev);
-int IsLegalChannel(struct ieee80211_device *dev, u8 channel);
-int ToLegalChannel(struct ieee80211_device *dev, u8 channel);
-#endif /*  #ifndef __INC_DOT11D_H */
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211.h b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
deleted file mode 100644
index d1763b7b8f27..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211.h
+++ /dev/null
@@ -1,1496 +0,0 @@
-/*
- * Merged with mainline ieee80211.h in Aug 2004.  Original ieee802_11
- * remains copyright by the original authors
- *
- * Portions of the merged code are based on Host AP (software wireless
- * LAN access point) driver for Intersil Prism2/2.5/3.
- *
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * Adaption to a generic IEEE 802.11 stack by James Ketrenos
- * <jketreno@linux.intel.com>
- * Copyright (c) 2004, Intel Corporation
- *
- * Modified for Realtek's wi-fi cards by Andrea Merello
- * <andrea.merello@gmail.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-#ifndef IEEE80211_H
-#define IEEE80211_H
-#include <linux/if_ether.h> /* ETH_ALEN */
-#include <linux/kernel.h>   /* ARRAY_SIZE */
-#include <linux/jiffies.h>
-#include <linux/timer.h>
-#include <linux/sched.h>
-#include <linux/semaphore.h>
-#include <linux/wireless.h>
-#include <linux/ieee80211.h>
-#include <linux/interrupt.h>
-#define KEY_TYPE_NA             0x0
-#define KEY_TYPE_WEP40          0x1
-#define KEY_TYPE_TKIP           0x2
-#define KEY_TYPE_CCMP           0x4
-#define KEY_TYPE_WEP104         0x5
-#define aSifsTime                                       10
-#define MGMT_QUEUE_NUM 5
-#define IEEE_CMD_SET_WPA_PARAM                  1
-#define IEEE_CMD_SET_WPA_IE                     2
-#define IEEE_CMD_SET_ENCRYPTION                 3
-#define IEEE_CMD_MLME                           4
-#define IEEE_PARAM_WPA_ENABLED                  1
-#define IEEE_PARAM_TKIP_COUNTERMEASURES         2
-#define IEEE_PARAM_DROP_UNENCRYPTED             3
-#define IEEE_PARAM_PRIVACY_INVOKED              4
-#define IEEE_PARAM_AUTH_ALGS                    5
-#define IEEE_PARAM_IEEE_802_1X                  6
-//It should consistent with the driver_XXX.c
-//   David, 2006.9.26
-#define IEEE_PARAM_WPAX_SELECT                  7
-//Added for notify the encryption type selection
-//   David, 2006.9.26
-#define IEEE_PROTO_WPA                          1
-#define IEEE_PROTO_RSN                          2
-//Added for notify the encryption type selection
-//   David, 2006.9.26
-#define IEEE_WPAX_USEGROUP                      0
-#define IEEE_WPAX_WEP40                         1
-#define IEEE_WPAX_TKIP                          2
-#define IEEE_WPAX_WRAP                          3
-#define IEEE_WPAX_CCMP                          4
-#define IEEE_WPAX_WEP104                        5
-#define IEEE_KEY_MGMT_IEEE8021X                 1
-#define IEEE_KEY_MGMT_PSK                       2
-#define IEEE_MLME_STA_DEAUTH                    1
-#define IEEE_MLME_STA_DISASSOC                  2
-#define IEEE_CRYPT_ERR_UNKNOWN_ALG              2
-#define IEEE_CRYPT_ERR_UNKNOWN_ADDR             3
-#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED                4
-#define IEEE_CRYPT_ERR_KEY_SET_FAILED           5
-#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED                6
-#define IEEE_CRYPT_ERR_CARD_CONF_FAILED         7
-#define IEEE_CRYPT_ALG_NAME_LEN                 16
-extern int ieee80211_crypto_tkip_init(void);
-extern void ieee80211_crypto_tkip_exit(void);
-//by amy for ps
-typedef struct ieee_param {
-        u32 cmd;
-        u8 sta_addr[ETH_ALEN];
-        union {
-                struct {
-                        u8 name;
-                        u32 value;
-                } wpa_param;
-                struct {
-                        u32 len;
-                        u8 reserved[32];
-                        u8 data[0];
-                } wpa_ie;
-                struct{
-                        int command;
-                        int reason_code;
-                } mlme;
-                struct {
-                        u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
-                        u8 set_tx;
-                        u32 err;
-                        u8 idx;
-                        u8 seq[8]; /* sequence counter (set: RX, get: TX) */
-                        u16 key_len;
-                        u8 key[0];
-                } crypt;
-        } u;
-}ieee_param;
-#define MSECS(t) msecs_to_jiffies(t)
-#define msleep_interruptible_rtl  msleep_interruptible
-#define IEEE80211_DATA_LEN              2304
-/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
-   6.2.1.1.2.
-   The figure in section 7.1.2 suggests a body size of up to 2312
-   bytes is allowed, which is a bit confusing, I suspect this
-   represents the 2304 bytes of real data, plus a possible 8 bytes of
-   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
-#define IEEE80211_3ADDR_LEN 24
-#define IEEE80211_4ADDR_LEN 30
-#define IEEE80211_FCS_LEN    4
-#define IEEE80211_HLEN                  IEEE80211_4ADDR_LEN
-#define IEEE80211_FRAME_LEN             (IEEE80211_DATA_LEN + IEEE80211_HLEN)
-#define IEEE80211_MGMT_HDR_LEN 24
-#define IEEE80211_DATA_HDR3_LEN 24
-#define IEEE80211_DATA_HDR4_LEN 30
-#define MIN_FRAG_THRESHOLD     256U
-#define MAX_FRAG_THRESHOLD     2346U
-/* Frame control field constants */
-#define IEEE80211_FCTL_DSTODS           0x0300 //added by david
-#define IEEE80211_FCTL_WEP              0x4000
-/* debug macros */
-#ifdef CONFIG_IEEE80211_DEBUG
-extern u32 ieee80211_debug_level;
-#define IEEE80211_DEBUG(level, fmt, args...) \
-do { if (ieee80211_debug_level & (level)) \
-  printk(KERN_DEBUG "ieee80211: %c %s " fmt, \
-         in_interrupt() ? 'I' : 'U', __func__ , ## args); } while (0)
-#else
-#define IEEE80211_DEBUG(level, fmt, args...) do {} while (0)
-#endif  /* CONFIG_IEEE80211_DEBUG */
-/*
- * To use the debug system;
- *
- * If you are defining a new debug classification, simply add it to the #define
- * list here in the form of:
- *
- * #define IEEE80211_DL_xxxx VALUE
- *
- * shifting value to the left one bit from the previous entry.  xxxx should be
- * the name of the classification (for example, WEP)
- *
- * You then need to either add a IEEE80211_xxxx_DEBUG() macro definition for your
- * classification, or use IEEE80211_DEBUG(IEEE80211_DL_xxxx, ...) whenever you want
- * to send output to that classification.
- *
- * To add your debug level to the list of levels seen when you perform
- *
- * % cat /proc/net/ipw/debug_level
- *
- * you simply need to add your entry to the ipw_debug_levels array.
- *
- * If you do not see debug_level in /proc/net/ipw then you do not have
- * CONFIG_IEEE80211_DEBUG defined in your kernel configuration
- *
- */
-#define IEEE80211_DL_INFO          (1<<0)
-#define IEEE80211_DL_WX            (1<<1)
-#define IEEE80211_DL_SCAN          (1<<2)
-#define IEEE80211_DL_STATE         (1<<3)
-#define IEEE80211_DL_MGMT          (1<<4)
-#define IEEE80211_DL_FRAG          (1<<5)
-#define IEEE80211_DL_EAP           (1<<6)
-#define IEEE80211_DL_DROP          (1<<7)
-#define IEEE80211_DL_TX            (1<<8)
-#define IEEE80211_DL_RX            (1<<9)
-#define IEEE80211_ERROR(f, a...) printk(KERN_ERR "ieee80211: " f, ## a)
-#define IEEE80211_WARNING(f, a...) printk(KERN_WARNING "ieee80211: " f, ## a)
-#define IEEE80211_DEBUG_INFO(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_INFO, f, ## a)
-#define IEEE80211_DEBUG_WX(f, a...)     IEEE80211_DEBUG(IEEE80211_DL_WX, f, ## a)
-#define IEEE80211_DEBUG_SCAN(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_SCAN, f, ## a)
-//#define IEEE_DEBUG_SCAN  IEEE80211_WARNING
-#define IEEE80211_DEBUG_STATE(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_STATE, f, ## a)
-#define IEEE80211_DEBUG_MGMT(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_MGMT, f, ## a)
-#define IEEE80211_DEBUG_FRAG(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_FRAG, f, ## a)
-#define IEEE80211_DEBUG_EAP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_EAP, f, ## a)
-#define IEEE80211_DEBUG_DROP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_DROP, f, ## a)
-#define IEEE80211_DEBUG_TX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_TX, f, ## a)
-#define IEEE80211_DEBUG_RX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_RX, f, ## a)
-#include <linux/netdevice.h>
-#include <linux/if_arp.h> /* ARPHRD_ETHER */
-#ifndef WIRELESS_SPY
-#define WIRELESS_SPY            // enable iwspy support
-#endif
-#include <net/iw_handler.h>     // new driver API
-#ifndef ETH_P_PAE
-#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
-#endif /* ETH_P_PAE */
-#define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */
-#ifndef ETH_P_80211_RAW
-#define ETH_P_80211_RAW (ETH_P_ECONET + 1)
-#endif
-/* IEEE 802.11 defines */
-#define P80211_OUI_LEN 3
-struct ieee80211_snap_hdr {
-        u8    dsap;   /* always 0xAA */
-        u8    ssap;   /* always 0xAA */
-        u8    ctrl;   /* always 0x03 */
-        u8    oui[P80211_OUI_LEN];    /* organizational universal id */
-} __attribute__ ((packed));
-#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
-#define WLAN_FC_GET_TYPE(fc) ((fc) & IEEE80211_FCTL_FTYPE)
-#define WLAN_FC_GET_STYPE(fc) ((fc) & IEEE80211_FCTL_STYPE)
-#define WLAN_GET_SEQ_FRAG(seq) ((seq) & IEEE80211_SCTL_FRAG)
-#define WLAN_GET_SEQ_SEQ(seq)  ((seq) & IEEE80211_SCTL_SEQ)
-#define WLAN_CAPABILITY_BSS (1<<0)
-#define WLAN_CAPABILITY_SHORT_SLOT (1<<10)
-#define IEEE80211_STATMASK_SIGNAL (1<<0)
-#define IEEE80211_STATMASK_RSSI (1<<1)
-#define IEEE80211_STATMASK_NOISE (1<<2)
-#define IEEE80211_STATMASK_RATE (1<<3)
-#define IEEE80211_STATMASK_WEMASK 0x7
-#define IEEE80211_CCK_MODULATION    (1<<0)
-#define IEEE80211_OFDM_MODULATION   (1<<1)
-#define IEEE80211_24GHZ_BAND     (1<<0)
-#define IEEE80211_52GHZ_BAND     (1<<1)
-#define IEEE80211_CCK_RATE_LEN                  4
-#define IEEE80211_CCK_RATE_1MB                  0x02
-#define IEEE80211_CCK_RATE_2MB                  0x04
-#define IEEE80211_CCK_RATE_5MB                  0x0B
-#define IEEE80211_CCK_RATE_11MB                 0x16
-#define IEEE80211_OFDM_RATE_LEN                 8
-#define IEEE80211_OFDM_RATE_6MB                 0x0C
-#define IEEE80211_OFDM_RATE_9MB                 0x12
-#define IEEE80211_OFDM_RATE_12MB                0x18
-#define IEEE80211_OFDM_RATE_18MB                0x24
-#define IEEE80211_OFDM_RATE_24MB                0x30
-#define IEEE80211_OFDM_RATE_36MB                0x48
-#define IEEE80211_OFDM_RATE_48MB                0x60
-#define IEEE80211_OFDM_RATE_54MB                0x6C
-#define IEEE80211_BASIC_RATE_MASK               0x80
-#define IEEE80211_CCK_RATE_1MB_MASK             (1<<0)
-#define IEEE80211_CCK_RATE_2MB_MASK             (1<<1)
-#define IEEE80211_CCK_RATE_5MB_MASK             (1<<2)
-#define IEEE80211_CCK_RATE_11MB_MASK            (1<<3)
-#define IEEE80211_OFDM_RATE_6MB_MASK            (1<<4)
-#define IEEE80211_OFDM_RATE_9MB_MASK            (1<<5)
-#define IEEE80211_OFDM_RATE_12MB_MASK           (1<<6)
-#define IEEE80211_OFDM_RATE_18MB_MASK           (1<<7)
-#define IEEE80211_OFDM_RATE_24MB_MASK           (1<<8)
-#define IEEE80211_OFDM_RATE_36MB_MASK           (1<<9)
-#define IEEE80211_OFDM_RATE_48MB_MASK           (1<<10)
-#define IEEE80211_OFDM_RATE_54MB_MASK           (1<<11)
-#define IEEE80211_CCK_RATES_MASK                0x0000000F
-#define IEEE80211_CCK_BASIC_RATES_MASK  (IEEE80211_CCK_RATE_1MB_MASK | \
-        IEEE80211_CCK_RATE_2MB_MASK)
-#define IEEE80211_CCK_DEFAULT_RATES_MASK        (IEEE80211_CCK_BASIC_RATES_MASK | \
-        IEEE80211_CCK_RATE_5MB_MASK | \
-        IEEE80211_CCK_RATE_11MB_MASK)
-#define IEEE80211_OFDM_RATES_MASK               0x00000FF0
-#define IEEE80211_OFDM_BASIC_RATES_MASK (IEEE80211_OFDM_RATE_6MB_MASK | \
-        IEEE80211_OFDM_RATE_12MB_MASK | \
-        IEEE80211_OFDM_RATE_24MB_MASK)
-#define IEEE80211_OFDM_DEFAULT_RATES_MASK       (IEEE80211_OFDM_BASIC_RATES_MASK | \
-        IEEE80211_OFDM_RATE_9MB_MASK  | \
-        IEEE80211_OFDM_RATE_18MB_MASK | \
-        IEEE80211_OFDM_RATE_36MB_MASK | \
-        IEEE80211_OFDM_RATE_48MB_MASK | \
-        IEEE80211_OFDM_RATE_54MB_MASK)
-#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
-                                IEEE80211_CCK_DEFAULT_RATES_MASK)
-#define IEEE80211_NUM_OFDM_RATES            8
-#define IEEE80211_NUM_CCK_RATES             4
-#define IEEE80211_OFDM_SHIFT_MASK_A         4
-/* this is stolen and modified from the madwifi driver*/
-#define IEEE80211_FC0_TYPE_MASK         0x0c
-#define IEEE80211_FC0_TYPE_DATA         0x08
-#define IEEE80211_FC0_SUBTYPE_MASK      0xB0
-#define IEEE80211_FC0_SUBTYPE_QOS       0x80
-#define IEEE80211_QOS_HAS_SEQ(fc) \
-        (((fc) & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) == \
-         (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
-/* this is stolen from ipw2200 driver */
-#define IEEE_IBSS_MAC_HASH_SIZE 31
-struct ieee_ibss_seq {
-        u8 mac[ETH_ALEN];
-        u16 seq_num[17];
-        u16 frag_num[17];
-        unsigned long packet_time[17];
-        struct list_head list;
-};
-/* NOTE: This data is for statistical purposes; not all hardware provides this
- *       information for frames received.  Not setting these will not cause
- *       any adverse affects. */
-struct ieee80211_rx_stats {
-        u32 mac_time[2];
-        u8 signalstrength;
-        s8 rssi;
-        u8 signal;
-        u8 noise;
-        u16 rate; /* in 100 kbps */
-        u8 received_channel;
-        u8 control;
-        u8 mask;
-        u8 freq;
-        u16 len;
-        u8 nic_type;
-};
-/* IEEE 802.11 requires that STA supports concurrent reception of at least
- * three fragmented frames. This define can be increased to support more
- * concurrent frames, but it should be noted that each entry can consume about
- * 2 kB of RAM and increasing cache size will slow down frame reassembly. */
-#define IEEE80211_FRAG_CACHE_LEN 4
-struct ieee80211_frag_entry {
-        unsigned long first_frag_time;
-        unsigned int seq;
-        unsigned int last_frag;
-        struct sk_buff *skb;
-        u8 src_addr[ETH_ALEN];
-        u8 dst_addr[ETH_ALEN];
-};
-struct ieee80211_stats {
-        unsigned int tx_unicast_frames;
-        unsigned int tx_multicast_frames;
-        unsigned int tx_fragments;
-        unsigned int tx_unicast_octets;
-        unsigned int tx_multicast_octets;
-        unsigned int tx_deferred_transmissions;
-        unsigned int tx_single_retry_frames;
-        unsigned int tx_multiple_retry_frames;
-        unsigned int tx_retry_limit_exceeded;
-        unsigned int tx_discards;
-        unsigned int rx_unicast_frames;
-        unsigned int rx_multicast_frames;
-        unsigned int rx_fragments;
-        unsigned int rx_unicast_octets;
-        unsigned int rx_multicast_octets;
-        unsigned int rx_fcs_errors;
-        unsigned int rx_discards_no_buffer;
-        unsigned int tx_discards_wrong_sa;
-        unsigned int rx_discards_undecryptable;
-        unsigned int rx_message_in_msg_fragments;
-        unsigned int rx_message_in_bad_msg_fragments;
-};
-struct ieee80211_device;
-#include "ieee80211_crypt.h"
-#define SEC_KEY_1         (1<<0)
-#define SEC_KEY_2         (1<<1)
-#define SEC_KEY_3         (1<<2)
-#define SEC_KEY_4         (1<<3)
-#define SEC_ACTIVE_KEY    (1<<4)
-#define SEC_AUTH_MODE     (1<<5)
-#define SEC_UNICAST_GROUP (1<<6)
-#define SEC_LEVEL         (1<<7)
-#define SEC_ENABLED       (1<<8)
-#define SEC_LEVEL_0      0 /* None */
-#define SEC_LEVEL_1      1 /* WEP 40 and 104 bit */
-#define SEC_LEVEL_2      2 /* Level 1 + TKIP */
-#define SEC_LEVEL_2_CKIP 3 /* Level 1 + CKIP */
-#define SEC_LEVEL_3      4 /* Level 2 + CCMP */
-#define WEP_KEYS 4
-#define WEP_KEY_LEN 13
-#define WEP_KEY_LEN_MODIF 32
-struct ieee80211_security {
-        u16 active_key:2,
-            enabled:1,
-            auth_mode:2,
-            auth_algo:4,
-            unicast_uses_group:1;
-        u8 key_sizes[WEP_KEYS];
-        u8 keys[WEP_KEYS][WEP_KEY_LEN_MODIF];
-        u8 level;
-        u16 flags;
-} __attribute__ ((packed));
-/*
- 802.11 data frame from AP
-      ,-------------------------------------------------------------------.
-Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
-      |------|------|---------|---------|---------|------|---------|------|
-Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  frame  |  fcs |
-      |      | tion | (BSSID) |         |         | ence |  data   |      |
-      `-------------------------------------------------------------------'
-Total: 28-2340 bytes
-*/
-/* Management Frame Information Element Types */
-enum {
-        MFIE_TYPE_SSID = 0,
-        MFIE_TYPE_RATES = 1,
-        MFIE_TYPE_FH_SET = 2,
-        MFIE_TYPE_DS_SET = 3,
-        MFIE_TYPE_CF_SET = 4,
-        MFIE_TYPE_TIM = 5,
-        MFIE_TYPE_IBSS_SET = 6,
-        MFIE_TYPE_COUNTRY = 7,
-        MFIE_TYPE_CHALLENGE = 16,
-        MFIE_TYPE_ERP = 42,
-        MFIE_TYPE_RSN = 48,
-        MFIE_TYPE_RATES_EX = 50,
-        MFIE_TYPE_GENERIC = 221,
-};
-struct ieee80211_header_data {
-        __le16 frame_ctl;
-        u16 duration_id;
-        u8 addr1[6];
-        u8 addr2[6];
-        u8 addr3[6];
-        u16 seq_ctrl;
-};
-struct ieee80211_hdr_4addr {
-        __le16 frame_ctl;
-        u16 duration_id;
-        u8 addr1[ETH_ALEN];
-        u8 addr2[ETH_ALEN];
-        u8 addr3[ETH_ALEN];
-        u16 seq_ctl;
-        u8 addr4[ETH_ALEN];
-} __attribute__ ((packed));
-struct ieee80211_hdr_3addrqos {
-        u16 frame_ctl;
-        u16 duration_id;
-        u8 addr1[ETH_ALEN];
-        u8 addr2[ETH_ALEN];
-        u8 addr3[ETH_ALEN];
-        u16 seq_ctl;
-        u16 qos_ctl;
-} __attribute__ ((packed));
-struct ieee80211_hdr_4addrqos {
-        u16 frame_ctl;
-        u16 duration_id;
-        u8 addr1[ETH_ALEN];
-        u8 addr2[ETH_ALEN];
-        u8 addr3[ETH_ALEN];
-        u16 seq_ctl;
-        u8 addr4[ETH_ALEN];
-        u16 qos_ctl;
-} __attribute__ ((packed));
-struct ieee80211_info_element_hdr {
-        u8 id;
-        u8 len;
-} __attribute__ ((packed));
-struct ieee80211_info_element {
-        u8 id;
-        u8 len;
-        u8 data[0];
-} __attribute__ ((packed));
-struct ieee80211_authentication {
-        struct ieee80211_header_data header;
-        u16 algorithm;
-        u16 transaction;
-        u16 status;
-        //struct ieee80211_info_element_hdr info_element;
-} __attribute__ ((packed));
-struct ieee80211_disassoc_frame {
-        struct ieee80211_hdr_3addr header;
-        u16    reasoncode;
-} __attribute__ ((packed));
-struct ieee80211_probe_request {
-        struct ieee80211_header_data header;
-        /* struct ieee80211_info_element info_element; */
-} __attribute__ ((packed));
-struct ieee80211_probe_response {
-        struct ieee80211_header_data header;
-        u32 time_stamp[2];
-        u16 beacon_interval;
-        u16 capability;
-        struct ieee80211_info_element info_element;
-} __attribute__ ((packed));
-struct ieee80211_assoc_request_frame {
-        struct ieee80211_hdr_3addr header;
-        u16 capability;
-        u16 listen_interval;
-        //u8 current_ap[ETH_ALEN];
-        struct ieee80211_info_element_hdr info_element;
-} __attribute__ ((packed));
-struct ieee80211_assoc_response_frame {
-        struct ieee80211_hdr_3addr header;
-        u16 capability;
-        u16 status;
-        u16 aid;
-        struct ieee80211_info_element info_element; /* supported rates */
-} __attribute__ ((packed));
-struct ieee80211_txb {
-        u8 nr_frags;
-        u8 encrypted;
-        u16 reserved;
-        u16 frag_size;
-        u16 payload_size;
-        struct sk_buff *fragments[0];
-};
-/* SWEEP TABLE ENTRIES NUMBER */
-#define MAX_SWEEP_TAB_ENTRIES                   42
-#define MAX_SWEEP_TAB_ENTRIES_PER_PACKET        7
-/* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
- * only use 8, and then use extended rates for the remaining supported
- * rates.  Other APs, however, stick all of their supported rates on the
- * main rates information element... */
-#define MAX_RATES_LENGTH                        ((u8)12)
-#define MAX_RATES_EX_LENGTH                     ((u8)16)
-#define MAX_NETWORK_COUNT                       128
-#define MAX_CHANNEL_NUMBER                      165
-#define IEEE80211_SOFTMAC_SCAN_TIME             100 /* (HZ / 2) */
-#define IEEE80211_SOFTMAC_ASSOC_RETRY_TIME      (HZ * 2)
-#define CRC_LENGTH      4U
-#define MAX_WPA_IE_LEN  64
-#define NETWORK_EMPTY_ESSID     (1 << 0)
-#define NETWORK_HAS_OFDM        (1 << 1)
-#define NETWORK_HAS_CCK         (1 << 2)
-struct ieee80211_wmm_ac_param {
-        u8 ac_aci_acm_aifsn;
-        u8 ac_ecwmin_ecwmax;
-        u16 ac_txop_limit;
-};
-struct ieee80211_wmm_ts_info {
-        u8 ac_dir_tid;
-        u8 ac_up_psb;
-        u8 reserved;
-} __attribute__ ((packed));
-struct ieee80211_wmm_tspec_elem {
-        struct ieee80211_wmm_ts_info ts_info;
-        u16 norm_msdu_size;
-        u16 max_msdu_size;
-        u32 min_serv_inter;
-        u32 max_serv_inter;
-        u32 inact_inter;
-        u32 suspen_inter;
-        u32 serv_start_time;
-        u32 min_data_rate;
-        u32 mean_data_rate;
-        u32 peak_data_rate;
-        u32 max_burst_size;
-        u32 delay_bound;
-        u32 min_phy_rate;
-        u16 surp_band_allow;
-        u16 medium_time;
-}__attribute__((packed));
-enum eap_type {
-        EAP_PACKET = 0,
-        EAPOL_START,
-        EAPOL_LOGOFF,
-        EAPOL_KEY,
-        EAPOL_ENCAP_ASF_ALERT
-};
-static const char *eap_types[] = {
-        [EAP_PACKET]            = "EAP-Packet",
-        [EAPOL_START]           = "EAPOL-Start",
-        [EAPOL_LOGOFF]          = "EAPOL-Logoff",
-        [EAPOL_KEY]             = "EAPOL-Key",
-        [EAPOL_ENCAP_ASF_ALERT] = "EAPOL-Encap-ASF-Alert"
-};
-static inline const char *eap_get_type(int type)
-{
-        return (type >= ARRAY_SIZE(eap_types)) ? "Unknown" : eap_types[type];
-}
-struct eapol {
-        u8 snap[6];
-        u16 ethertype;
-        u8 version;
-        u8 type;
-        u16 length;
-} __attribute__ ((packed));
-struct ieee80211_softmac_stats {
-        unsigned int rx_ass_ok;
-        unsigned int rx_ass_err;
-        unsigned int rx_probe_rq;
-        unsigned int tx_probe_rs;
-        unsigned int tx_beacons;
-        unsigned int rx_auth_rq;
-        unsigned int rx_auth_rs_ok;
-        unsigned int rx_auth_rs_err;
-        unsigned int tx_auth_rq;
-        unsigned int no_auth_rs;
-        unsigned int no_ass_rs;
-        unsigned int tx_ass_rq;
-        unsigned int rx_ass_rq;
-        unsigned int tx_probe_rq;
-        unsigned int reassoc;
-        unsigned int swtxstop;
-        unsigned int swtxawake;
-};
-#define BEACON_PROBE_SSID_ID_POSITION 12
-/*
- * These are the data types that can make up management packets
- *
-        u16 auth_algorithm;
-        u16 auth_sequence;
-        u16 beacon_interval;
-        u16 capability;
-        u8 current_ap[ETH_ALEN];
-        u16 listen_interval;
-        struct {
-                u16 association_id:14, reserved:2;
-        } __attribute__ ((packed));
-        u32 time_stamp[2];
-        u16 reason;
-        u16 status;
-*/
-#define IEEE80211_DEFAULT_TX_ESSID "Penguin"
-#define IEEE80211_DEFAULT_BASIC_RATE 10
-enum {WMM_all_frame, WMM_two_frame, WMM_four_frame, WMM_six_frame};
-#define MAX_SP_Len  (WMM_all_frame << 4)
-#define IEEE80211_QOS_TID 0x0f
-#define QOS_CTL_NOTCONTAIN_ACK (0x01 << 5)
-#define MAX_IE_LEN                                              0xFF //+YJ,080625
-struct rtl8187se_channel_list {
-        u8      channel[MAX_CHANNEL_NUMBER + 1];
-        u8      len;
-};
-//by amy for ps
-#define IEEE80211_WATCH_DOG_TIME    2000
-//by amy for ps
-//by amy for antenna
-#define ANTENNA_DIVERSITY_TIMER_PERIOD          1000 // 1000 m
-//by amy for antenna
-#define IEEE80211_DTIM_MBCAST 4
-#define IEEE80211_DTIM_UCAST 2
-#define IEEE80211_DTIM_VALID 1
-#define IEEE80211_DTIM_INVALID 0
-#define IEEE80211_PS_DISABLED 0
-#define IEEE80211_PS_UNICAST IEEE80211_DTIM_UCAST
-#define IEEE80211_PS_MBCAST IEEE80211_DTIM_MBCAST
-#define IEEE80211_PS_ENABLE   IEEE80211_DTIM_VALID
-//added by David for QoS 2006/6/30
-//#define WMM_Hang_8187
-#ifdef WMM_Hang_8187
-#undef WMM_Hang_8187
-#endif
-#define WME_AC_BE   0x00
-#define WME_AC_BK   0x01
-#define WME_AC_VI   0x02
-#define WME_AC_VO   0x03
-#define WME_ACI_MASK 0x03
-#define WME_AIFSN_MASK 0x03
-#define WME_AC_PRAM_LEN 16
-//UP Mapping to AC, using in MgntQuery_SequenceNumber() and maybe for DSCP
-//#define UP2AC(up)     ((up<3) ? ((up==0)?1:0) : (up>>1))
-#define UP2AC(up) (                \
-        ((up) < 1) ? WME_AC_BE : \
-        ((up) < 3) ? WME_AC_BK : \
-        ((up) < 4) ? WME_AC_BE : \
-        ((up) < 6) ? WME_AC_VI : \
-        WME_AC_VO)
-//AC Mapping to UP, using in Tx part for selecting the corresponding TX queue
-#define AC2UP(_ac)      (       \
-        ((_ac) == WME_AC_VO) ? 6 : \
-        ((_ac) == WME_AC_VI) ? 5 : \
-        ((_ac) == WME_AC_BK) ? 1 : \
-        0)
-#define ETHER_ADDR_LEN          6       /* length of an Ethernet address */
-struct  ether_header {
-        u8 ether_dhost[ETHER_ADDR_LEN];
-        u8 ether_shost[ETHER_ADDR_LEN];
-        u16 ether_type;
-} __attribute__((packed));
-#ifndef ETHERTYPE_PAE
-#define ETHERTYPE_PAE   0x888e          /* EAPOL PAE/802.1x */
-#endif
-#ifndef ETHERTYPE_IP
-#define ETHERTYPE_IP    0x0800          /* IP protocol */
-#endif
-struct ieee80211_network {
-        /* These entries are used to identify a unique network */
-        u8 bssid[ETH_ALEN];
-        u8 channel;
-        /* Ensure null-terminated for any debug msgs */
-        u8 ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 ssid_len;
-        /* These are network statistics */
-        struct ieee80211_rx_stats stats;
-        u16 capability;
-        u8 rates[MAX_RATES_LENGTH];
-        u8 rates_len;
-        u8 rates_ex[MAX_RATES_EX_LENGTH];
-        u8 rates_ex_len;
-        unsigned long last_scanned;
-        u8 mode;
-        u8 flags;
-        u32 last_associate;
-        u32 time_stamp[2];
-        u16 beacon_interval;
-        u16 listen_interval;
-        u16 atim_window;
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        size_t wpa_ie_len;
-        u8 rsn_ie[MAX_WPA_IE_LEN];
-        size_t rsn_ie_len;
-        u8 dtim_period;
-        u8 dtim_data;
-        u32 last_dtim_sta_time[2];
-        struct list_head list;
-        //appeded for QoS
-        u8 wmm_info;
-        struct ieee80211_wmm_ac_param wmm_param[4];
-        u8 QoS_Enable;
-        u8 SignalStrength;
-//by amy 080312
-        u8 HighestOperaRate;
-//by amy 080312
-        u8 Turbo_Enable;//enable turbo mode, added by thomas
-        u16 CountryIeLen;
-        u8 CountryIeBuf[MAX_IE_LEN];
-};
-enum ieee80211_state {
-        /* the card is not linked at all */
-        IEEE80211_NOLINK = 0,
-        /* IEEE80211_ASSOCIATING* are for BSS client mode
-         * the driver shall not perform RX filtering unless
-         * the state is LINKED.
-         * The driver shall just check for the state LINKED and
-         * defaults to NOLINK for ALL the other states (including
-         * LINKED_SCANNING)
-         */
-        /* the association procedure will start (wq scheduling)*/
-        IEEE80211_ASSOCIATING,
-        IEEE80211_ASSOCIATING_RETRY,
-        /* the association procedure is sending AUTH request*/
-        IEEE80211_ASSOCIATING_AUTHENTICATING,
-        /* the association procedure has successfully authenticated
-         * and is sending association request
-         */
-        IEEE80211_ASSOCIATING_AUTHENTICATED,
-        /* the link is ok. the card associated to a BSS or linked
-         * to a ibss cell or acting as an AP and creating the bss
-         */
-        IEEE80211_LINKED,
-        /* same as LINKED, but the driver shall apply RX filter
-         * rules as we are in NO_LINK mode. As the card is still
-         * logically linked, but it is doing a syncro site survey
-         * then it will be back to LINKED state.
-         */
-        IEEE80211_LINKED_SCANNING,
-};
-#define DEFAULT_MAX_SCAN_AGE (15 * HZ)
-#define DEFAULT_FTS 2346
-#define CFG_IEEE80211_RESERVE_FCS (1<<0)
-#define CFG_IEEE80211_COMPUTE_FCS (1<<1)
-typedef struct tx_pending_t{
-        int frag;
-        struct ieee80211_txb *txb;
-}tx_pending_t;
-enum {
-        COUNTRY_CODE_FCC = 0,
-        COUNTRY_CODE_IC = 1,
-        COUNTRY_CODE_ETSI = 2,
-        COUNTRY_CODE_SPAIN = 3,
-        COUNTRY_CODE_FRANCE = 4,
-        COUNTRY_CODE_MKK = 5,
-        COUNTRY_CODE_MKK1 = 6,
-        COUNTRY_CODE_ISRAEL = 7,
-        COUNTRY_CODE_TELEC = 8,
-        COUNTRY_CODE_GLOBAL_DOMAIN = 9,
-        COUNTRY_CODE_WORLD_WIDE_13_INDEX = 10
-};
-struct ieee80211_device {
-        struct net_device *dev;
-        /* Bookkeeping structures */
-        struct net_device_stats stats;
-        struct ieee80211_stats ieee_stats;
-        struct ieee80211_softmac_stats softmac_stats;
-        /* Probe / Beacon management */
-        struct list_head network_free_list;
-        struct list_head network_list;
-        struct ieee80211_network *networks;
-        int scans;
-        int scan_age;
-        int iw_mode; /* operating mode (IW_MODE_*) */
-        spinlock_t lock;
-        spinlock_t wpax_suitlist_lock;
-        int tx_headroom; /* Set to size of any additional room needed at front
-                          * of allocated Tx SKBs */
-        u32 config;
-        /* WEP and other encryption related settings at the device level */
-        int open_wep; /* Set to 1 to allow unencrypted frames */
-        int reset_on_keychange; /* Set to 1 if the HW needs to be reset on
-                                 * WEP key changes */
-        /* If the host performs {en,de}cryption, then set to 1 */
-        int host_encrypt;
-        int host_decrypt;
-        int ieee802_1x; /* is IEEE 802.1X used */
-        /* WPA data */
-        int wpa_enabled;
-        int drop_unencrypted;
-        int tkip_countermeasures;
-        int privacy_invoked;
-        size_t wpa_ie_len;
-        u8 *wpa_ie;
-        u8 ap_mac_addr[6];
-        u16 pairwise_key_type;
-        u16 broadcast_key_type;
-        struct list_head crypt_deinit_list;
-        struct ieee80211_crypt_data *crypt[WEP_KEYS];
-        int tx_keyidx; /* default TX key index (crypt[tx_keyidx]) */
-        struct timer_list crypt_deinit_timer;
-        int bcrx_sta_key; /* use individual keys to override default keys even
-                           * with RX of broad/multicast frames */
-        /* Fragmentation structures */
-        /* each stream contains an entry */
-        struct ieee80211_frag_entry frag_cache[17][IEEE80211_FRAG_CACHE_LEN];
-        unsigned int frag_next_idx[17];
-        u16 fts; /* Fragmentation Threshold */
-        /* This stores infos for the current network.
-         * Either the network we are associated in INFRASTRUCTURE
-         * or the network that we are creating in MASTER mode.
-         * ad-hoc is a mixture ;-).
-         * Note that in infrastructure mode, even when not associated,
-         * fields bssid and essid may be valid (if wpa_set and essid_set
-         * are true) as thy carry the value set by the user via iwconfig
-         */
-        struct ieee80211_network current_network;
-        enum ieee80211_state state;
-        int short_slot;
-        int mode;       /* A, B, G */
-        int modulation; /* CCK, OFDM */
-        int freq_band;  /* 2.4Ghz, 5.2Ghz, Mixed */
-        int abg_true;   /* ABG flag              */
-        /* used for forcing the ibss workqueue to terminate
-         * without wait for the syncro scan to terminate
-         */
-        short sync_scan_hurryup;
-        void * pDot11dInfo;
-        bool bGlobalDomain;
-        // For Liteon Ch12~13 passive scan
-        u8      MinPassiveChnlNum;
-        u8      IbssStartChnl;
-        int rate;       /* current rate */
-        int basic_rate;
-        //FIXME: please callback, see if redundant with softmac_features
-        short active_scan;
-        /* this contains flags for selectively enable softmac support */
-        u16 softmac_features;
-        /* if the sequence control field is not filled by HW */
-        u16 seq_ctrl[5];
-        /* association procedure transaction sequence number */
-        u16 associate_seq;
-        /* AID for RTXed association responses */
-        u16 assoc_id;
-        /* power save mode related*/
-        short ps;
-        short sta_sleep;
-        int ps_timeout;
-        struct tasklet_struct ps_task;
-        u32 ps_th;
-        u32 ps_tl;
-        short raw_tx;
-        /* used if IEEE_SOFTMAC_TX_QUEUE is set */
-        short queue_stop;
-        short scanning;
-        short proto_started;
-        struct semaphore wx_sem;
-        struct semaphore scan_sem;
-        spinlock_t mgmt_tx_lock;
-        spinlock_t beacon_lock;
-        short beacon_txing;
-        short wap_set;
-        short ssid_set;
-        u8  wpax_type_set;    //{added by David, 2006.9.28}
-        u32 wpax_type_notify; //{added by David, 2006.9.26}
-        /* QoS related flag */
-        char init_wmmparam_flag;
-        /* for discarding duplicated packets in IBSS */
-        struct list_head ibss_mac_hash[IEEE_IBSS_MAC_HASH_SIZE];
-        /* for discarding duplicated packets in BSS */
-        u16 last_rxseq_num[17]; /* rx seq previous per-tid */
-        u16 last_rxfrag_num[17];/* tx frag previous per-tid */
-        unsigned long last_packet_time[17];
-        /* for PS mode */
-        unsigned long last_rx_ps_time;
-        /* used if IEEE_SOFTMAC_SINGLE_QUEUE is set */
-        struct sk_buff *mgmt_queue_ring[MGMT_QUEUE_NUM];
-        int mgmt_queue_head;
-        int mgmt_queue_tail;
-        /* used if IEEE_SOFTMAC_TX_QUEUE is set */
-        struct  tx_pending_t tx_pending;
-        /* used if IEEE_SOFTMAC_ASSOCIATE is set */
-        struct timer_list associate_timer;
-        /* used if IEEE_SOFTMAC_BEACONS is set */
-        struct timer_list beacon_timer;
-        struct work_struct associate_complete_wq;
-//      struct work_struct associate_retry_wq;
-        struct work_struct associate_procedure_wq;
-//      struct work_struct softmac_scan_wq;
-        struct work_struct wx_sync_scan_wq;
-        struct work_struct wmm_param_update_wq;
-        struct work_struct ps_request_tx_ack_wq;//for ps
-//      struct work_struct hw_wakeup_wq;
-//      struct work_struct hw_sleep_wq;
-//      struct work_struct watch_dog_wq;
-        bool bInactivePs;
-        bool actscanning;
-        bool beinretry;
-        u16 ListenInterval;
-        unsigned long NumRxDataInPeriod; //YJ,add,080828
-        unsigned long NumRxBcnInPeriod;  //YJ,add,080828
-        unsigned long NumRxOkTotal;
-        unsigned long NumRxUnicast;//YJ,add,080828,for keep alive
-        bool bHwRadioOff;
-        struct delayed_work softmac_scan_wq;
-        struct delayed_work associate_retry_wq;
-        struct delayed_work hw_wakeup_wq;
-        struct delayed_work hw_sleep_wq;//+by amy 080324
-        struct delayed_work watch_dog_wq;
-        struct delayed_work sw_antenna_wq;
-        struct delayed_work  start_ibss_wq;
-//by amy for rate adaptive 080312
-    struct delayed_work rate_adapter_wq;
-//by amy for rate adaptive
-        struct delayed_work hw_dig_wq;
-        struct delayed_work tx_pw_wq;
-//Added for RF power on power off by lizhaoming 080512
-        struct delayed_work GPIOChangeRFWorkItem;
-        struct workqueue_struct *wq;
-        /* Callback functions */
-        void (*set_security)(struct net_device *dev,
-                             struct ieee80211_security *sec);
-        /* Used to TX data frame by using txb structs.
-         * this is not used if in the softmac_features
-         * is set the flag IEEE_SOFTMAC_TX_QUEUE
-         */
-        int (*hard_start_xmit)(struct ieee80211_txb *txb,
-                               struct net_device *dev);
-        int (*reset_port)(struct net_device *dev);
-        /* Softmac-generated frames (management) are TXed via this
-         * callback if the flag IEEE_SOFTMAC_SINGLE_QUEUE is
-         * not set. As some cards may have different HW queues that
-         * one might want to use for data and management frames
-         * the option to have two callbacks might be useful.
-         * This function can't sleep.
-         */
-        int (*softmac_hard_start_xmit)(struct sk_buff *skb,
-                               struct net_device *dev);
-        /* used instead of hard_start_xmit (not softmac_hard_start_xmit)
-         * if the IEEE_SOFTMAC_TX_QUEUE feature is used to TX data
-         * frames. If the option IEEE_SOFTMAC_SINGLE_QUEUE is also set
-         * then also management frames are sent via this callback.
-         * This function can't sleep.
-         */
-        void (*softmac_data_hard_start_xmit)(struct sk_buff *skb,
-                               struct net_device *dev,int rate);
-        /* stops the HW queue for DATA frames. Useful to avoid
-         * waste time to TX data frame when we are reassociating
-         * This function can sleep.
-         */
-        void (*data_hard_stop)(struct net_device *dev);
-        /* OK this is complementar to data_poll_hard_stop */
-        void (*data_hard_resume)(struct net_device *dev);
-        /* ask to the driver to retune the radio .
-         * This function can sleep. the driver should ensure
-         * the radio has been switched before return.
-         */
-        void (*set_chan)(struct net_device *dev,short ch);
-        /* These are not used if the ieee stack takes care of
-         * scanning (IEEE_SOFTMAC_SCAN feature set).
-         * In this case only the set_chan is used.
-         *
-         * The syncro version is similar to the start_scan but
-         * does not return until all channels has been scanned.
-         * this is called in user context and should sleep,
-         * it is called in a work_queue when switching to ad-hoc mode
-         * or in behalf of iwlist scan when the card is associated
-         * and root user ask for a scan.
-         * the function stop_scan should stop both the syncro and
-         * background scanning and can sleep.
-         * The function start_scan should initiate the background
-         * scanning and can't sleep.
-         */
-        void (*scan_syncro)(struct net_device *dev);
-        void (*start_scan)(struct net_device *dev);
-        void (*stop_scan)(struct net_device *dev);
-        /* indicate the driver that the link state is changed
-         * for example it may indicate the card is associated now.
-         * Driver might be interested in this to apply RX filter
-         * rules or simply light the LINK led
-         */
-        void (*link_change)(struct net_device *dev);
-        /* these two function indicates to the HW when to start
-         * and stop to send beacons. This is used when the
-         * IEEE_SOFTMAC_BEACONS is not set. For now the
-         * stop_send_bacons is NOT guaranteed to be called only
-         * after start_send_beacons.
-         */
-        void (*start_send_beacons) (struct net_device *dev);
-        void (*stop_send_beacons) (struct net_device *dev);
-        /* power save mode related */
-        void (*sta_wake_up) (struct net_device *dev);
-        void (*ps_request_tx_ack) (struct net_device *dev);
-        void (*enter_sleep_state) (struct net_device *dev, u32 th, u32 tl);
-        short (*ps_is_queue_empty) (struct net_device *dev);
-        /* QoS related */
-        //void (*wmm_param_update) (struct net_device *dev, u8 *ac_param);
-        //void (*wmm_param_update) (struct ieee80211_device *ieee);
-        /* This must be the last item so that it points to the data
-         * allocated beyond this structure by alloc_ieee80211 */
-        u8 priv[0];
-};
-#define IEEE_A            (1<<0)
-#define IEEE_B            (1<<1)
-#define IEEE_G            (1<<2)
-#define IEEE_MODE_MASK    (IEEE_A|IEEE_B|IEEE_G)
-/* Generate a 802.11 header */
-/* Uses the channel change callback directly
- * instead of [start/stop] scan callbacks
- */
-#define IEEE_SOFTMAC_SCAN (1<<2)
-/* Perform authentication and association handshake */
-#define IEEE_SOFTMAC_ASSOCIATE (1<<3)
-/* Generate probe requests */
-#define IEEE_SOFTMAC_PROBERQ (1<<4)
-/* Generate response to probe requests */
-#define IEEE_SOFTMAC_PROBERS (1<<5)
-/* The ieee802.11 stack will manages the netif queue
- * wake/stop for the driver, taking care of 802.11
- * fragmentation. See softmac.c for details. */
-#define IEEE_SOFTMAC_TX_QUEUE (1<<7)
-/* Uses only the softmac_data_hard_start_xmit
- * even for TX management frames.
- */
-#define IEEE_SOFTMAC_SINGLE_QUEUE (1<<8)
-/* Generate beacons.  The stack will enqueue beacons
- * to the card
- */
-#define IEEE_SOFTMAC_BEACONS (1<<6)
-static inline void *ieee80211_priv(struct net_device *dev)
-{
-        return ((struct ieee80211_device *)netdev_priv(dev))->priv;
-}
-static inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
-{
-        /* Single white space is for Linksys APs */
-        if (essid_len == 1 && essid[0] == ' ')
-                return 1;
-        /* Otherwise, if the entire essid is 0, we assume it is hidden */
-        while (essid_len) {
-                essid_len--;
-                if (essid[essid_len] != '\0')
-                        return 0;
-        }
-        return 1;
-}
-static inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee,
-                                          int mode)
-{
-        /*
-         * It is possible for both access points and our device to support
-         * combinations of modes, so as long as there is one valid combination
-         * of ap/device supported modes, then return success
-         *
-         */
-        if ((mode & IEEE_A) &&
-            (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
-            (ieee->freq_band & IEEE80211_52GHZ_BAND))
-                return 1;
-        if ((mode & IEEE_G) &&
-            (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
-            (ieee->freq_band & IEEE80211_24GHZ_BAND))
-                return 1;
-        if ((mode & IEEE_B) &&
-            (ieee->modulation & IEEE80211_CCK_MODULATION) &&
-            (ieee->freq_band & IEEE80211_24GHZ_BAND))
-                return 1;
-        return 0;
-}
-static inline int ieee80211_get_hdrlen(u16 fc)
-{
-        int hdrlen = 24;
-        switch (WLAN_FC_GET_TYPE(fc)) {
-        case IEEE80211_FTYPE_DATA:
-                if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
-                        hdrlen = 30; /* Addr4 */
-                if(IEEE80211_QOS_HAS_SEQ(fc))
-                        hdrlen += 2; /* QOS ctrl*/
-                break;
-        case IEEE80211_FTYPE_CTL:
-                switch (WLAN_FC_GET_STYPE(fc)) {
-                case IEEE80211_STYPE_CTS:
-                case IEEE80211_STYPE_ACK:
-                        hdrlen = 10;
-                        break;
-                default:
-                        hdrlen = 16;
-                        break;
-                }
-                break;
-        }
-        return hdrlen;
-}
-/* ieee80211.c */
-extern void free_ieee80211(struct net_device *dev);
-extern struct net_device *alloc_ieee80211(int sizeof_priv);
-extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
-/* ieee80211_tx.c */
-extern int ieee80211_encrypt_fragment(struct ieee80211_device *ieee,
-                                      struct sk_buff *frag, int hdr_len);
-extern int ieee80211_rtl_xmit(struct sk_buff *skb, struct net_device *dev);
-extern void ieee80211_txb_free(struct ieee80211_txb *);
-/* ieee80211_rx.c */
-extern int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
-                            struct ieee80211_rx_stats *rx_stats);
-extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
-                             struct ieee80211_hdr_4addr *header,
-                             struct ieee80211_rx_stats *stats);
-/* ieee80211_wx.c */
-extern int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *key);
-extern int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
-                                   struct iw_request_info *info,
-                                   union iwreq_data *wrqu, char *key);
-extern int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
-                                   struct iw_request_info *info,
-                                   union iwreq_data *wrqu, char *key);
-extern int ieee80211_wx_set_encode_ext(struct ieee80211_device *ieee,
-                                       struct iw_request_info *info,
-                                       union iwreq_data *wrqu, char *extra);
-int ieee80211_wx_set_auth(struct ieee80211_device *ieee,
-                          struct iw_request_info *info,
-                          struct iw_param *data, char *extra);
-int ieee80211_wx_set_mlme(struct ieee80211_device *ieee,
-                          struct iw_request_info *info,
-                          union iwreq_data *wrqu, char *extra);
-int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len);
-/* ieee80211_softmac.c */
-extern short ieee80211_is_54g(const struct ieee80211_network *net);
-extern short ieee80211_is_shortslot(const struct ieee80211_network *net);
-extern int ieee80211_rx_frame_softmac(struct ieee80211_device *ieee,
-                                      struct sk_buff *skb,
-                                      struct ieee80211_rx_stats *rx_stats,
-                                      u16 type, u16 stype);
-extern void ieee80211_softmac_new_net(struct ieee80211_device *ieee,
-                                      struct ieee80211_network *net);
-extern void ieee80211_softmac_xmit(struct ieee80211_txb *txb,
-                                   struct ieee80211_device *ieee);
-extern void ieee80211_softmac_check_all_nets(struct ieee80211_device *ieee);
-extern void ieee80211_start_bss(struct ieee80211_device *ieee);
-extern void ieee80211_start_master_bss(struct ieee80211_device *ieee);
-extern void ieee80211_start_ibss(struct ieee80211_device *ieee);
-extern void ieee80211_softmac_init(struct ieee80211_device *ieee);
-extern void ieee80211_softmac_free(struct ieee80211_device *ieee);
-extern void ieee80211_associate_abort(struct ieee80211_device *ieee);
-extern void ieee80211_disassociate(struct ieee80211_device *ieee);
-extern void ieee80211_stop_scan(struct ieee80211_device *ieee);
-extern void ieee80211_start_scan_syncro(struct ieee80211_device *ieee);
-extern void ieee80211_check_all_nets(struct ieee80211_device *ieee);
-extern void ieee80211_start_protocol(struct ieee80211_device *ieee);
-extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
-extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
-extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
-extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
-extern void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee);
-extern void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee);
-extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
-extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
-extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
-extern int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee,
-                                          struct iw_point *p);
-extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
-extern void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success);
-extern void SendDisassociation(struct ieee80211_device *ieee, u8 *asSta,
-                               u8 asRsn);
-extern void ieee80211_rtl_start_scan(struct ieee80211_device *ieee);
-//Add for RF power on power off by lizhaoming 080512
-extern void SendDisassociation(struct ieee80211_device *ieee, u8 *asSta,
-                               u8 asRsn);
-/* ieee80211_crypt_ccmp&tkip&wep.c */
-extern void ieee80211_tkip_null(void);
-extern void ieee80211_wep_null(void);
-extern void ieee80211_ccmp_null(void);
-/* ieee80211_softmac_wx.c */
-extern int ieee80211_wx_get_wap(struct ieee80211_device *ieee,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu, char *ext);
-extern int ieee80211_wx_set_wap(struct ieee80211_device *ieee,
-                                struct iw_request_info *info,
-                                union iwreq_data *awrq,
-                                char *extra);
-extern int ieee80211_wx_get_essid(struct ieee80211_device *ieee,
-                                  struct iw_request_info *a,
-                                  union iwreq_data *wrqu, char *b);
-extern int ieee80211_wx_set_rate(struct ieee80211_device *ieee,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *extra);
-extern int ieee80211_wx_get_rate(struct ieee80211_device *ieee,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *extra);
-extern int ieee80211_wx_set_mode(struct ieee80211_device *ieee,
-                                 struct iw_request_info *a,
-                                 union iwreq_data *wrqu, char *b);
-extern int ieee80211_wx_set_scan(struct ieee80211_device *ieee,
-                                 struct iw_request_info *a,
-                                 union iwreq_data *wrqu, char *b);
-extern int ieee80211_wx_set_essid(struct ieee80211_device *ieee,
-                                  struct iw_request_info *a,
-                                  union iwreq_data *wrqu, char *extra);
-extern int ieee80211_wx_get_mode(struct ieee80211_device *ieee,
-                                 struct iw_request_info *a,
-                                 union iwreq_data *wrqu, char *b);
-extern int ieee80211_wx_set_freq(struct ieee80211_device *ieee,
-                                 struct iw_request_info *a,
-                                 union iwreq_data *wrqu, char *b);
-extern int ieee80211_wx_get_freq(struct ieee80211_device *ieee,
-                                 struct iw_request_info *a,
-                                 union iwreq_data *wrqu, char *b);
-extern void ieee80211_wx_sync_scan_wq(struct work_struct *work);
-extern int ieee80211_wx_set_rawtx(struct ieee80211_device *ieee,
-                                  struct iw_request_info *info,
-                                  union iwreq_data *wrqu, char *extra);
-extern int ieee80211_wx_get_name(struct ieee80211_device *ieee,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *extra);
-extern int ieee80211_wx_set_power(struct ieee80211_device *ieee,
-                                  struct iw_request_info *info,
-                                  union iwreq_data *wrqu, char *extra);
-extern int ieee80211_wx_get_power(struct ieee80211_device *ieee,
-                                  struct iw_request_info *info,
-                                  union iwreq_data *wrqu, char *extra);
-extern void ieee80211_softmac_ips_scan_syncro(struct ieee80211_device *ieee);
-extern void ieee80211_sta_ps_send_null_frame(struct ieee80211_device *ieee,
-                                             short pwr);
-extern const long ieee80211_wlan_frequencies[];
-extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
-{
-        ieee->scans++;
-}
-extern inline int ieee80211_get_scans(struct ieee80211_device *ieee)
-{
-        return ieee->scans;
-}
-static inline const char *escape_essid(const char *essid, u8 essid_len) {
-        static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-        const char *s = essid;
-        char *d = escaped;
-        if (ieee80211_is_empty_essid(essid, essid_len)) {
-                memcpy(escaped, "<hidden>", sizeof("<hidden>"));
-                return escaped;
-        }
-        essid_len = min(essid_len, (u8)IW_ESSID_MAX_SIZE);
-        while (essid_len--) {
-                if (*s == '\0') {
-                        *d++ = '\\';
-                        *d++ = '0';
-                        s++;
-                } else {
-                        *d++ = *s++;
-                }
-        }
-        *d = '\0';
-        return escaped;
-}
-#endif /* IEEE80211_H */
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
deleted file mode 100644
index 101f0c0cdb0a..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
+++ /dev/null
@@ -1,240 +0,0 @@
-/*
- * Host AP crypto routines
- *
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- * Portions Copyright (C) 2004, Intel Corporation <jketreno@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- *
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-//#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/string.h>
-#include <linux/errno.h>
-#include "ieee80211.h"
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("HostAP crypto");
-MODULE_LICENSE("GPL");
-struct ieee80211_crypto_alg {
-        struct list_head list;
-        struct ieee80211_crypto_ops *ops;
-};
-struct ieee80211_crypto {
-        struct list_head algs;
-        spinlock_t lock;
-};
-static struct ieee80211_crypto *hcrypt;
-void ieee80211_crypt_deinit_entries(struct ieee80211_device *ieee, int force)
-{
-        struct list_head *ptr, *n;
-        struct ieee80211_crypt_data *entry;
-        for (ptr = ieee->crypt_deinit_list.next, n = ptr->next;
-             ptr != &ieee->crypt_deinit_list; ptr = n, n = ptr->next) {
-                entry = list_entry(ptr, struct ieee80211_crypt_data, list);
-                if (atomic_read(&entry->refcnt) != 0 && !force)
-                        continue;
-                list_del(ptr);
-                if (entry->ops)
-                        entry->ops->deinit(entry->priv);
-                kfree(entry);
-        }
-}
-void ieee80211_crypt_deinit_handler(unsigned long data)
-{
-        struct ieee80211_device *ieee = (struct ieee80211_device *)data;
-        unsigned long flags;
-        spin_lock_irqsave(&ieee->lock, flags);
-        ieee80211_crypt_deinit_entries(ieee, 0);
-        if (!list_empty(&ieee->crypt_deinit_list)) {
-                pr_debug("entries remaining in delayed crypt deletion list\n");
-                ieee->crypt_deinit_timer.expires = jiffies + HZ;
-                add_timer(&ieee->crypt_deinit_timer);
-        }
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
-                                    struct ieee80211_crypt_data **crypt)
-{
-        struct ieee80211_crypt_data *tmp;
-        unsigned long flags;
-        if (*crypt == NULL)
-                return;
-        tmp = *crypt;
-        *crypt = NULL;
-        /* must not run ops->deinit() while there may be pending encrypt or
-         * decrypt operations. Use a list of delayed deinits to avoid needing
-         * locking. */
-        spin_lock_irqsave(&ieee->lock, flags);
-        list_add(&tmp->list, &ieee->crypt_deinit_list);
-        if (!timer_pending(&ieee->crypt_deinit_timer)) {
-                ieee->crypt_deinit_timer.expires = jiffies + HZ;
-                add_timer(&ieee->crypt_deinit_timer);
-        }
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops)
-{
-        unsigned long flags;
-        struct ieee80211_crypto_alg *alg;
-        if (hcrypt == NULL)
-                return -1;
-        alg = kzalloc(sizeof(*alg), GFP_KERNEL);
-        if (alg == NULL)
-                return -ENOMEM;
-        alg->ops = ops;
-        spin_lock_irqsave(&hcrypt->lock, flags);
-        list_add(&alg->list, &hcrypt->algs);
-        spin_unlock_irqrestore(&hcrypt->lock, flags);
-        pr_debug("registered algorithm '%s'\n", ops->name);
-        return 0;
-}
-int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops)
-{
-        unsigned long flags;
-        struct list_head *ptr;
-        struct ieee80211_crypto_alg *del_alg = NULL;
-        if (hcrypt == NULL)
-                return -1;
-        spin_lock_irqsave(&hcrypt->lock, flags);
-        for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
-                struct ieee80211_crypto_alg *alg =
-                        (struct ieee80211_crypto_alg *) ptr;
-                if (alg->ops == ops) {
-                        list_del(&alg->list);
-                        del_alg = alg;
-                        break;
-                }
-        }
-        spin_unlock_irqrestore(&hcrypt->lock, flags);
-        if (del_alg) {
-                pr_debug("unregistered algorithm '%s'\n", ops->name);
-                kfree(del_alg);
-        }
-        return del_alg ? 0 : -1;
-}
-struct ieee80211_crypto_ops *ieee80211_get_crypto_ops(const char *name)
-{
-        unsigned long flags;
-        struct list_head *ptr;
-        struct ieee80211_crypto_alg *found_alg = NULL;
-        if (hcrypt == NULL)
-                return NULL;
-        spin_lock_irqsave(&hcrypt->lock, flags);
-        for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
-                struct ieee80211_crypto_alg *alg =
-                        (struct ieee80211_crypto_alg *) ptr;
-                if (strcmp(alg->ops->name, name) == 0) {
-                        found_alg = alg;
-                        break;
-                }
-        }
-        spin_unlock_irqrestore(&hcrypt->lock, flags);
-        if (found_alg)
-                return found_alg->ops;
-        else
-                return NULL;
-}
-static void *ieee80211_crypt_null_init(int keyidx) { return (void *) 1; }
-static void ieee80211_crypt_null_deinit(void *priv) {}
-static struct ieee80211_crypto_ops ieee80211_crypt_null = {
-        .name                   = "NULL",
-        .init                   = ieee80211_crypt_null_init,
-        .deinit                 = ieee80211_crypt_null_deinit,
-        .encrypt_mpdu           = NULL,
-        .decrypt_mpdu           = NULL,
-        .encrypt_msdu           = NULL,
-        .decrypt_msdu           = NULL,
-        .set_key                = NULL,
-        .get_key                = NULL,
-        .extra_prefix_len       = 0,
-        .extra_postfix_len      = 0,
-        .owner                  = THIS_MODULE,
-};
-int ieee80211_crypto_init(void)
-{
-        int ret = -ENOMEM;
-        hcrypt = kzalloc(sizeof(*hcrypt), GFP_KERNEL);
-        if (!hcrypt)
-                goto out;
-        INIT_LIST_HEAD(&hcrypt->algs);
-        spin_lock_init(&hcrypt->lock);
-        ret = ieee80211_register_crypto_ops(&ieee80211_crypt_null);
-        if (ret < 0) {
-                kfree(hcrypt);
-                hcrypt = NULL;
-        }
-out:
-        return ret;
-}
-void ieee80211_crypto_deinit(void)
-{
-        struct list_head *ptr, *n;
-        struct ieee80211_crypto_alg *alg = NULL;
-        if (hcrypt == NULL)
-                return;
-        list_for_each_safe(ptr, n, &hcrypt->algs) {
-                alg = list_entry(ptr, struct ieee80211_crypto_alg, list);
-                if (alg) {
-                        list_del(ptr);
-                        pr_debug("unregistered algorithm '%s' (deinit)\n",
-                                 alg->ops->name);
-                        kfree(alg);
-                }
-        }
-        kfree(hcrypt);
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.h b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.h
deleted file mode 100644
index 0b4ea431982d..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Original code based on Host AP (software wireless LAN access point) driver
- * for Intersil Prism2/2.5/3.
- *
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * Adaption to a generic IEEE 802.11 stack by James Ketrenos
- * <jketreno@linux.intel.com>
- *
- * Copyright (c) 2004, Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-/*
- * This file defines the interface to the ieee80211 crypto module.
- */
-#ifndef IEEE80211_CRYPT_H
-#define IEEE80211_CRYPT_H
-#include <linux/skbuff.h>
-struct ieee80211_crypto_ops {
-        const char *name;
-        /* init new crypto context (e.g., allocate private data space,
-         * select IV, etc.); returns NULL on failure or pointer to allocated
-         * private data on success */
-        void * (*init)(int keyidx);
-        /* deinitialize crypto context and free allocated private data */
-        void (*deinit)(void *priv);
-        /* encrypt/decrypt return < 0 on error or >= 0 on success. The return
-         * value from decrypt_mpdu is passed as the keyidx value for
-         * decrypt_msdu. skb must have enough head and tail room for the
-         * encryption; if not, error will be returned; these functions are
-         * called for all MPDUs (i.e., fragments).
-         */
-        int (*encrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
-        int (*decrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
-        /* These functions are called for full MSDUs, i.e. full frames.
-         * These can be NULL if full MSDU operations are not needed. */
-        int (*encrypt_msdu)(struct sk_buff *skb, int hdr_len, void *priv);
-        int (*decrypt_msdu)(struct sk_buff *skb, int keyidx, int hdr_len,
-                            void *priv);
-        int (*set_key)(void *key, int len, u8 *seq, void *priv);
-        int (*get_key)(void *key, int len, u8 *seq, void *priv);
-        /* procfs handler for printing out key information and possible
-         * statistics */
-        char * (*print_stats)(char *p, void *priv);
-        /* maximum number of bytes added by encryption; encrypt buf is
-         * allocated with extra_prefix_len bytes, copy of in_buf, and
-         * extra_postfix_len; encrypt need not use all this space, but
-         * the result must start at the beginning of the buffer and correct
-         * length must be returned */
-        int extra_prefix_len, extra_postfix_len;
-        struct module *owner;
-};
-struct ieee80211_crypt_data {
-        struct list_head list; /* delayed deletion list */
-        struct ieee80211_crypto_ops *ops;
-        void *priv;
-        atomic_t refcnt;
-};
-int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops);
-int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops);
-struct ieee80211_crypto_ops *ieee80211_get_crypto_ops(const char *name);
-void ieee80211_crypt_deinit_entries(struct ieee80211_device *, int);
-void ieee80211_crypt_deinit_handler(unsigned long);
-void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
-                                    struct ieee80211_crypt_data **crypt);
-#endif
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_ccmp.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_ccmp.c
deleted file mode 100644
index 4fe253818630..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_ccmp.c
+++ /dev/null
@@ -1,455 +0,0 @@
-/*
- * Host AP crypt: host-based CCMP encryption implementation for Host AP driver
- *
- * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/random.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/if_ether.h>
-#include <linux/if_arp.h>
-#include <linux/string.h>
-#include <linux/wireless.h>
-#include "ieee80211.h"
-#include <linux/crypto.h>
-#include <linux/scatterlist.h>
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Host AP crypt: CCMP");
-MODULE_LICENSE("GPL");
-#define AES_BLOCK_LEN 16
-#define CCMP_HDR_LEN 8
-#define CCMP_MIC_LEN 8
-#define CCMP_TK_LEN 16
-#define CCMP_PN_LEN 6
-struct ieee80211_ccmp_data {
-        u8 key[CCMP_TK_LEN];
-        int key_set;
-        u8 tx_pn[CCMP_PN_LEN];
-        u8 rx_pn[CCMP_PN_LEN];
-        u32 dot11RSNAStatsCCMPFormatErrors;
-        u32 dot11RSNAStatsCCMPReplays;
-        u32 dot11RSNAStatsCCMPDecryptErrors;
-        int key_idx;
-        struct crypto_tfm *tfm;
-        /* scratch buffers for virt_to_page() (crypto API) */
-        u8 tx_b0[AES_BLOCK_LEN], tx_b[AES_BLOCK_LEN],
-                tx_e[AES_BLOCK_LEN], tx_s0[AES_BLOCK_LEN];
-        u8 rx_b0[AES_BLOCK_LEN], rx_b[AES_BLOCK_LEN], rx_a[AES_BLOCK_LEN];
-};
-static void ieee80211_ccmp_aes_encrypt(struct crypto_tfm *tfm,
-                                const u8 pt[16], u8 ct[16])
-{
-        crypto_cipher_encrypt_one((void *)tfm, ct, pt);
-}
-static void *ieee80211_ccmp_init(int key_idx)
-{
-        struct ieee80211_ccmp_data *priv;
-        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
-        if (priv == NULL)
-                goto fail;
-        priv->key_idx = key_idx;
-        priv->tfm = (void *)crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(priv->tfm)) {
-                pr_debug("could not allocate crypto API aes\n");
-                priv->tfm = NULL;
-                goto fail;
-        }
-        return priv;
-fail:
-        if (priv) {
-                if (priv->tfm)
-                        crypto_free_cipher((void *)priv->tfm);
-                kfree(priv);
-        }
-        return NULL;
-}
-static void ieee80211_ccmp_deinit(void *priv)
-{
-        struct ieee80211_ccmp_data *_priv = priv;
-        if (_priv && _priv->tfm)
-                crypto_free_cipher((void *)_priv->tfm);
-        kfree(priv);
-}
-static inline void xor_block(u8 *b, u8 *a, size_t len)
-{
-        int i;
-        for (i = 0; i < len; i++)
-                b[i] ^= a[i];
-}
-static void ccmp_init_blocks(struct crypto_tfm *tfm,
-                             struct ieee80211_hdr_4addr *hdr,
-                             u8 *pn, size_t dlen, u8 *b0, u8 *auth,
-                             u8 *s0)
-{
-        u8 *pos, qc = 0;
-        size_t aad_len;
-        u16 fc;
-        int a4_included, qc_included;
-        u8 aad[2 * AES_BLOCK_LEN];
-        fc = le16_to_cpu(hdr->frame_ctl);
-        a4_included = ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-                       (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS));
-        /*
-        qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
-                       (WLAN_FC_GET_STYPE(fc) & 0x08));
-        */
-        qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
-                       (WLAN_FC_GET_STYPE(fc) & 0x80));
-        aad_len = 22;
-        if (a4_included)
-                aad_len += 6;
-        if (qc_included) {
-                pos = (u8 *) &hdr->addr4;
-                if (a4_included)
-                        pos += 6;
-                qc = *pos & 0x0f;
-                aad_len += 2;
-        }
-        /* CCM Initial Block:
-         * Flag (Include authentication header, M=3 (8-octet MIC),
-         *       L=1 (2-octet Dlen))
-         * Nonce: 0x00 | A2 | PN
-         * Dlen */
-        b0[0] = 0x59;
-        b0[1] = qc;
-        memcpy(b0 + 2, hdr->addr2, ETH_ALEN);
-        memcpy(b0 + 8, pn, CCMP_PN_LEN);
-        b0[14] = (dlen >> 8) & 0xff;
-        b0[15] = dlen & 0xff;
-        /* AAD:
-         * FC with bits 4..6 and 11..13 masked to zero; 14 is always one
-         * A1 | A2 | A3
-         * SC with bits 4..15 (seq#) masked to zero
-         * A4 (if present)
-         * QC (if present)
-         */
-        pos = (u8 *) hdr;
-        aad[0] = 0; /* aad_len >> 8 */
-        aad[1] = aad_len & 0xff;
-        aad[2] = pos[0] & 0x8f;
-        aad[3] = pos[1] & 0xc7;
-        memcpy(aad + 4, hdr->addr1, 3 * ETH_ALEN);
-        pos = (u8 *) &hdr->seq_ctl;
-        aad[22] = pos[0] & 0x0f;
-        aad[23] = 0; /* all bits masked */
-        memset(aad + 24, 0, 8);
-        if (a4_included)
-                memcpy(aad + 24, hdr->addr4, ETH_ALEN);
-        if (qc_included) {
-                aad[a4_included ? 30 : 24] = qc;
-                /* rest of QC masked */
-        }
-        /* Start with the first block and AAD */
-        ieee80211_ccmp_aes_encrypt(tfm, b0, auth);
-        xor_block(auth, aad, AES_BLOCK_LEN);
-        ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
-        xor_block(auth, &aad[AES_BLOCK_LEN], AES_BLOCK_LEN);
-        ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
-        b0[0] &= 0x07;
-        b0[14] = b0[15] = 0;
-        ieee80211_ccmp_aes_encrypt(tfm, b0, s0);
-}
-static int ieee80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-        struct ieee80211_ccmp_data *key = priv;
-        int data_len, i;
-        u8 *pos;
-        struct ieee80211_hdr_4addr *hdr;
-        int blocks, last, len;
-        u8 *mic;
-        u8 *b0 = key->tx_b0;
-        u8 *b = key->tx_b;
-        u8 *e = key->tx_e;
-        u8 *s0 = key->tx_s0;
-        if (skb_headroom(skb) < CCMP_HDR_LEN ||
-            skb_tailroom(skb) < CCMP_MIC_LEN ||
-            skb->len < hdr_len)
-                return -1;
-        data_len = skb->len - hdr_len;
-        pos = skb_push(skb, CCMP_HDR_LEN);
-        memmove(pos, pos + CCMP_HDR_LEN, hdr_len);
-        pos += hdr_len;
-        i = CCMP_PN_LEN - 1;
-        while (i >= 0) {
-                key->tx_pn[i]++;
-                if (key->tx_pn[i] != 0)
-                        break;
-                i--;
-        }
-        *pos++ = key->tx_pn[5];
-        *pos++ = key->tx_pn[4];
-        *pos++ = 0;
-        *pos++ = (key->key_idx << 6) | (1 << 5) /* Ext IV included */;
-        *pos++ = key->tx_pn[3];
-        *pos++ = key->tx_pn[2];
-        *pos++ = key->tx_pn[1];
-        *pos++ = key->tx_pn[0];
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        mic = skb_put(skb, CCMP_MIC_LEN);
-        ccmp_init_blocks(key->tfm, hdr, key->tx_pn, data_len, b0, b, s0);
-        blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
-        last = data_len % AES_BLOCK_LEN;
-        for (i = 1; i <= blocks; i++) {
-                len = (i == blocks && last) ? last : AES_BLOCK_LEN;
-                /* Authentication */
-                xor_block(b, pos, len);
-                ieee80211_ccmp_aes_encrypt(key->tfm, b, b);
-                /* Encryption, with counter */
-                b0[14] = (i >> 8) & 0xff;
-                b0[15] = i & 0xff;
-                ieee80211_ccmp_aes_encrypt(key->tfm, b0, e);
-                xor_block(pos, e, len);
-                pos += len;
-        }
-        for (i = 0; i < CCMP_MIC_LEN; i++)
-                mic[i] = b[i] ^ s0[i];
-        return 0;
-}
-static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-        struct ieee80211_ccmp_data *key = priv;
-        u8 keyidx, *pos;
-        struct ieee80211_hdr_4addr *hdr;
-        u8 pn[6];
-        size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN - CCMP_MIC_LEN;
-        u8 *mic = skb->data + skb->len - CCMP_MIC_LEN;
-        u8 *b0 = key->rx_b0;
-        u8 *b = key->rx_b;
-        u8 *a = key->rx_a;
-        int i, blocks, last, len;
-        if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) {
-                key->dot11RSNAStatsCCMPFormatErrors++;
-                return -1;
-        }
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        pos = skb->data + hdr_len;
-        keyidx = pos[3];
-        if (!(keyidx & (1 << 5))) {
-                if (net_ratelimit()) {
-                        pr_debug("received packet without ExtIV flag from %pM\n",
-                                 hdr->addr2);
-                }
-                key->dot11RSNAStatsCCMPFormatErrors++;
-                return -2;
-        }
-        keyidx >>= 6;
-        if (key->key_idx != keyidx) {
-                pr_debug("RX tkey->key_idx=%d frame keyidx=%d priv=%p\n",
-                         key->key_idx, keyidx, priv);
-                return -6;
-        }
-        if (!key->key_set) {
-                if (net_ratelimit()) {
-                        pr_debug("received packet from %pM with keyid=%d that does not have a configured key\n",
-                                 hdr->addr2, keyidx);
-                }
-                return -3;
-        }
-        pn[0] = pos[7];
-        pn[1] = pos[6];
-        pn[2] = pos[5];
-        pn[3] = pos[4];
-        pn[4] = pos[1];
-        pn[5] = pos[0];
-        pos += 8;
-        if (memcmp(pn, key->rx_pn, CCMP_PN_LEN) <= 0) {
-                if (net_ratelimit()) {
-                        pr_debug("replay detected: STA=%pM previous PN %pm received PN %pm\n",
-                                 hdr->addr2, key->rx_pn, pn);
-                }
-                key->dot11RSNAStatsCCMPReplays++;
-                return -4;
-        }
-        ccmp_init_blocks(key->tfm, hdr, pn, data_len, b0, a, b);
-        xor_block(mic, b, CCMP_MIC_LEN);
-        blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
-        last = data_len % AES_BLOCK_LEN;
-        for (i = 1; i <= blocks; i++) {
-                len = (i == blocks && last) ? last : AES_BLOCK_LEN;
-                /* Decrypt, with counter */
-                b0[14] = (i >> 8) & 0xff;
-                b0[15] = i & 0xff;
-                ieee80211_ccmp_aes_encrypt(key->tfm, b0, b);
-                xor_block(pos, b, len);
-                /* Authentication */
-                xor_block(a, pos, len);
-                ieee80211_ccmp_aes_encrypt(key->tfm, a, a);
-                pos += len;
-        }
-        if (memcmp(mic, a, CCMP_MIC_LEN) != 0) {
-                if (net_ratelimit())
-                        pr_debug("decrypt failed: STA=%pM\n", hdr->addr2);
-                key->dot11RSNAStatsCCMPDecryptErrors++;
-                return -5;
-        }
-        memcpy(key->rx_pn, pn, CCMP_PN_LEN);
-        /* Remove hdr and MIC */
-        memmove(skb->data + CCMP_HDR_LEN, skb->data, hdr_len);
-        skb_pull(skb, CCMP_HDR_LEN);
-        skb_trim(skb, skb->len - CCMP_MIC_LEN);
-        return keyidx;
-}
-static int ieee80211_ccmp_set_key(void *key, int len, u8 *seq, void *priv)
-{
-        struct ieee80211_ccmp_data *data = priv;
-        int keyidx;
-        struct crypto_tfm *tfm = data->tfm;
-        keyidx = data->key_idx;
-        memset(data, 0, sizeof(*data));
-        data->key_idx = keyidx;
-        data->tfm = tfm;
-        if (len == CCMP_TK_LEN) {
-                memcpy(data->key, key, CCMP_TK_LEN);
-                data->key_set = 1;
-                if (seq) {
-                        data->rx_pn[0] = seq[5];
-                        data->rx_pn[1] = seq[4];
-                        data->rx_pn[2] = seq[3];
-                        data->rx_pn[3] = seq[2];
-                        data->rx_pn[4] = seq[1];
-                        data->rx_pn[5] = seq[0];
-                }
-                crypto_cipher_setkey((void *)data->tfm, data->key, CCMP_TK_LEN);
-        } else if (len == 0)
-                data->key_set = 0;
-        else
-                return -1;
-        return 0;
-}
-static int ieee80211_ccmp_get_key(void *key, int len, u8 *seq, void *priv)
-{
-        struct ieee80211_ccmp_data *data = priv;
-        if (len < CCMP_TK_LEN)
-                return -1;
-        if (!data->key_set)
-                return 0;
-        memcpy(key, data->key, CCMP_TK_LEN);
-        if (seq) {
-                seq[0] = data->tx_pn[5];
-                seq[1] = data->tx_pn[4];
-                seq[2] = data->tx_pn[3];
-                seq[3] = data->tx_pn[2];
-                seq[4] = data->tx_pn[1];
-                seq[5] = data->tx_pn[0];
-        }
-        return CCMP_TK_LEN;
-}
-static char *ieee80211_ccmp_print_stats(char *p, void *priv)
-{
-        struct ieee80211_ccmp_data *ccmp = priv;
-        p += sprintf(p,
-                     "key[%d] alg=CCMP key_set=%d tx_pn=%pm rx_pn=%pm format_errors=%d replays=%d decrypt_errors=%d\n",
-                     ccmp->key_idx, ccmp->key_set,
-                     ccmp->tx_pn, ccmp->rx_pn,
-                     ccmp->dot11RSNAStatsCCMPFormatErrors,
-                     ccmp->dot11RSNAStatsCCMPReplays,
-                     ccmp->dot11RSNAStatsCCMPDecryptErrors);
-        return p;
-}
-void ieee80211_ccmp_null(void)
-{
-        return;
-}
-static struct ieee80211_crypto_ops ieee80211_crypt_ccmp = {
-        .name                   = "CCMP",
-        .init                   = ieee80211_ccmp_init,
-        .deinit                 = ieee80211_ccmp_deinit,
-        .encrypt_mpdu           = ieee80211_ccmp_encrypt,
-        .decrypt_mpdu           = ieee80211_ccmp_decrypt,
-        .encrypt_msdu           = NULL,
-        .decrypt_msdu           = NULL,
-        .set_key                = ieee80211_ccmp_set_key,
-        .get_key                = ieee80211_ccmp_get_key,
-        .print_stats            = ieee80211_ccmp_print_stats,
-        .extra_prefix_len       = CCMP_HDR_LEN,
-        .extra_postfix_len      = CCMP_MIC_LEN,
-        .owner                  = THIS_MODULE,
-};
-int ieee80211_crypto_ccmp_init(void)
-{
-        return ieee80211_register_crypto_ops(&ieee80211_crypt_ccmp);
-}
-void ieee80211_crypto_ccmp_exit(void)
-{
-        ieee80211_unregister_crypto_ops(&ieee80211_crypt_ccmp);
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_tkip.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_tkip.c
deleted file mode 100644
index 6c1acc5dfba7..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_tkip.c
+++ /dev/null
@@ -1,740 +0,0 @@
-/*
- * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
- *
- * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/random.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/if_ether.h>
-#include <linux/if_arp.h>
-#include <asm/string.h>
-#include "ieee80211.h"
-#include <linux/crypto.h>
-#include <linux/scatterlist.h>
-#include <linux/crc32.h>
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Host AP crypt: TKIP");
-MODULE_LICENSE("GPL");
-struct ieee80211_tkip_data {
-#define TKIP_KEY_LEN 32
-        u8 key[TKIP_KEY_LEN];
-        int key_set;
-        u32 tx_iv32;
-        u16 tx_iv16;
-        u16 tx_ttak[5];
-        int tx_phase1_done;
-        u32 rx_iv32;
-        u16 rx_iv16;
-        u16 rx_ttak[5];
-        int rx_phase1_done;
-        u32 rx_iv32_new;
-        u16 rx_iv16_new;
-        u32 dot11RSNAStatsTKIPReplays;
-        u32 dot11RSNAStatsTKIPICVErrors;
-        u32 dot11RSNAStatsTKIPLocalMICFailures;
-        int key_idx;
-        struct crypto_blkcipher *rx_tfm_arc4;
-        struct crypto_hash *rx_tfm_michael;
-        struct crypto_blkcipher *tx_tfm_arc4;
-        struct crypto_hash *tx_tfm_michael;
-        struct crypto_tfm *tfm_arc4;
-        struct crypto_tfm *tfm_michael;
-        /* scratch buffers for virt_to_page() (crypto API) */
-        u8 rx_hdr[16], tx_hdr[16];
-};
-static void *ieee80211_tkip_init(int key_idx)
-{
-        struct ieee80211_tkip_data *priv;
-        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
-        if (priv == NULL)
-                goto fail;
-        priv->key_idx = key_idx;
-        priv->tx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
-                                                CRYPTO_ALG_ASYNC);
-        if (IS_ERR(priv->tx_tfm_arc4)) {
-                printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
-                       "crypto API arc4\n");
-                priv->tx_tfm_arc4 = NULL;
-                goto fail;
-        }
-        priv->tx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
-                                                 CRYPTO_ALG_ASYNC);
-        if (IS_ERR(priv->tx_tfm_michael)) {
-                printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
-                       "crypto API michael_mic\n");
-                priv->tx_tfm_michael = NULL;
-                goto fail;
-        }
-        priv->rx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
-                                                CRYPTO_ALG_ASYNC);
-        if (IS_ERR(priv->rx_tfm_arc4)) {
-                printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
-                       "crypto API arc4\n");
-                priv->rx_tfm_arc4 = NULL;
-                goto fail;
-        }
-        priv->rx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
-                                                 CRYPTO_ALG_ASYNC);
-        if (IS_ERR(priv->rx_tfm_michael)) {
-                printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
-                       "crypto API michael_mic\n");
-                priv->rx_tfm_michael = NULL;
-                goto fail;
-        }
-        return priv;
-fail:
-        if (priv) {
-                if (priv->tx_tfm_michael)
-                        crypto_free_hash(priv->tx_tfm_michael);
-                if (priv->tx_tfm_arc4)
-                        crypto_free_blkcipher(priv->tx_tfm_arc4);
-                if (priv->rx_tfm_michael)
-                        crypto_free_hash(priv->rx_tfm_michael);
-                if (priv->rx_tfm_arc4)
-                        crypto_free_blkcipher(priv->rx_tfm_arc4);
-                kfree(priv);
-        }
-        return NULL;
-}
-static void ieee80211_tkip_deinit(void *priv)
-{
-        struct ieee80211_tkip_data *_priv = priv;
-        if (_priv) {
-                if (_priv->tx_tfm_michael)
-                        crypto_free_hash(_priv->tx_tfm_michael);
-                if (_priv->tx_tfm_arc4)
-                        crypto_free_blkcipher(_priv->tx_tfm_arc4);
-                if (_priv->rx_tfm_michael)
-                        crypto_free_hash(_priv->rx_tfm_michael);
-                if (_priv->rx_tfm_arc4)
-                        crypto_free_blkcipher(_priv->rx_tfm_arc4);
-        }
-        kfree(priv);
-}
-static inline u16 RotR1(u16 val)
-{
-        return (val >> 1) | (val << 15);
-}
-static inline u8 Lo8(u16 val)
-{
-        return val & 0xff;
-}
-static inline u8 Hi8(u16 val)
-{
-        return val >> 8;
-}
-static inline u16 Lo16(u32 val)
-{
-        return val & 0xffff;
-}
-static inline u16 Hi16(u32 val)
-{
-        return val >> 16;
-}
-static inline u16 Mk16(u8 hi, u8 lo)
-{
-        return lo | (((u16) hi) << 8);
-}
-static inline u16 Mk16_le(u16 *v)
-{
-        return le16_to_cpu(*v);
-}
-static const u16 Sbox[256] = {
-        0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
-        0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
-        0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
-        0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
-        0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
-        0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
-        0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
-        0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
-        0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
-        0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
-        0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
-        0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
-        0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
-        0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
-        0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
-        0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
-        0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
-        0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
-        0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
-        0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
-        0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
-        0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
-        0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
-        0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
-        0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
-        0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
-        0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
-        0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
-        0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
-        0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
-        0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
-        0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
-};
-static inline u16 _S_(u16 v)
-{
-        u16 t = Sbox[Hi8(v)];
-        return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
-}
-#define PHASE1_LOOP_COUNT 8
-static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
-{
-        int i, j;
-        /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
-        TTAK[0] = Lo16(IV32);
-        TTAK[1] = Hi16(IV32);
-        TTAK[2] = Mk16(TA[1], TA[0]);
-        TTAK[3] = Mk16(TA[3], TA[2]);
-        TTAK[4] = Mk16(TA[5], TA[4]);
-        for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
-                j = 2 * (i & 1);
-                TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
-                TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
-                TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
-                TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
-                TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
-        }
-}
-static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
-                               u16 IV16)
-{
-        /* Make temporary area overlap WEP seed so that the final copy can be
-         * avoided on little endian hosts. */
-        u16 *PPK = (u16 *) &WEPSeed[4];
-        /* Step 1 - make copy of TTAK and bring in TSC */
-        PPK[0] = TTAK[0];
-        PPK[1] = TTAK[1];
-        PPK[2] = TTAK[2];
-        PPK[3] = TTAK[3];
-        PPK[4] = TTAK[4];
-        PPK[5] = TTAK[4] + IV16;
-        /* Step 2 - 96-bit bijective mixing using S-box */
-        PPK[0] += _S_(PPK[5] ^ Mk16_le((u16 *) &TK[0]));
-        PPK[1] += _S_(PPK[0] ^ Mk16_le((u16 *) &TK[2]));
-        PPK[2] += _S_(PPK[1] ^ Mk16_le((u16 *) &TK[4]));
-        PPK[3] += _S_(PPK[2] ^ Mk16_le((u16 *) &TK[6]));
-        PPK[4] += _S_(PPK[3] ^ Mk16_le((u16 *) &TK[8]));
-        PPK[5] += _S_(PPK[4] ^ Mk16_le((u16 *) &TK[10]));
-        PPK[0] += RotR1(PPK[5] ^ Mk16_le((u16 *) &TK[12]));
-        PPK[1] += RotR1(PPK[0] ^ Mk16_le((u16 *) &TK[14]));
-        PPK[2] += RotR1(PPK[1]);
-        PPK[3] += RotR1(PPK[2]);
-        PPK[4] += RotR1(PPK[3]);
-        PPK[5] += RotR1(PPK[4]);
-        /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
-         * WEPSeed[0..2] is transmitted as WEP IV */
-        WEPSeed[0] = Hi8(IV16);
-        WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
-        WEPSeed[2] = Lo8(IV16);
-        WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((u16 *) &TK[0])) >> 1);
-#ifdef __BIG_ENDIAN
-        {
-                int i;
-                for (i = 0; i < 6; i++)
-                        PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
-        }
-#endif
-}
-static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-        struct ieee80211_tkip_data *tkey = priv;
-        struct blkcipher_desc desc = {.tfm = tkey->tx_tfm_arc4};
-        int len;
-        u8  *pos;
-        struct ieee80211_hdr_4addr *hdr;
-        u8 rc4key[16], *icv;
-        u32 crc;
-        struct scatterlist sg;
-        int ret;
-        ret = 0;
-        if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 4 ||
-            skb->len < hdr_len)
-                return -1;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        if (!tkey->tx_phase1_done) {
-                tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,
-                                   tkey->tx_iv32);
-                tkey->tx_phase1_done = 1;
-        }
-        tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
-        len = skb->len - hdr_len;
-        pos = skb_push(skb, 8);
-        memmove(pos, pos + 8, hdr_len);
-        pos += hdr_len;
-        *pos++ = rc4key[0];
-        *pos++ = rc4key[1];
-        *pos++ = rc4key[2];
-        *pos++ = (tkey->key_idx << 6) | (1 << 5) /* Ext IV included */;
-        *pos++ = tkey->tx_iv32 & 0xff;
-        *pos++ = (tkey->tx_iv32 >> 8) & 0xff;
-        *pos++ = (tkey->tx_iv32 >> 16) & 0xff;
-        *pos++ = (tkey->tx_iv32 >> 24) & 0xff;
-        icv = skb_put(skb, 4);
-        crc = ~crc32_le(~0, pos, len);
-        icv[0] = crc;
-        icv[1] = crc >> 8;
-        icv[2] = crc >> 16;
-        icv[3] = crc >> 24;
-        crypto_blkcipher_setkey(tkey->tx_tfm_arc4, rc4key, 16);
-        sg_init_one(&sg, pos, len + 4);
-        ret = crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
-        tkey->tx_iv16++;
-        if (tkey->tx_iv16 == 0) {
-                tkey->tx_phase1_done = 0;
-                tkey->tx_iv32++;
-        }
-           return ret;
-}
-static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-        struct ieee80211_tkip_data *tkey = priv;
-        struct blkcipher_desc desc = { .tfm = tkey->rx_tfm_arc4 };
-        u8 keyidx, *pos;
-        u32 iv32;
-        u16 iv16;
-        struct ieee80211_hdr_4addr *hdr;
-        u8 icv[4];
-        u32 crc;
-        struct scatterlist sg;
-        u8 rc4key[16];
-        int plen;
-        if (skb->len < hdr_len + 8 + 4)
-                return -1;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        pos = skb->data + hdr_len;
-        keyidx = pos[3];
-        if (!(keyidx & (1 << 5))) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: received packet without ExtIV"
-                               " flag from %pM\n", hdr->addr2);
-                }
-                return -2;
-        }
-        keyidx >>= 6;
-        if (tkey->key_idx != keyidx) {
-                printk(KERN_DEBUG "TKIP: RX tkey->key_idx=%d frame "
-                       "keyidx=%d priv=%p\n", tkey->key_idx, keyidx, priv);
-                return -6;
-        }
-        if (!tkey->key_set) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: received packet from %pM"
-                               " with keyid=%d that does not have a configured"
-                               " key\n", hdr->addr2, keyidx);
-                }
-                return -3;
-        }
-        iv16 = (pos[0] << 8) | pos[2];
-        iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
-        pos += 8;
-        if (iv32 < tkey->rx_iv32 ||
-            (iv32 == tkey->rx_iv32 && iv16 <= tkey->rx_iv16)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: replay detected: STA=%pM"
-                               " previous TSC %08x%04x received TSC "
-                               "%08x%04x\n", hdr->addr2,
-                               tkey->rx_iv32, tkey->rx_iv16, iv32, iv16);
-                }
-                tkey->dot11RSNAStatsTKIPReplays++;
-                return -4;
-        }
-        if (iv32 != tkey->rx_iv32 || !tkey->rx_phase1_done) {
-                tkip_mixing_phase1(tkey->rx_ttak, tkey->key, hdr->addr2, iv32);
-                tkey->rx_phase1_done = 1;
-        }
-        tkip_mixing_phase2(rc4key, tkey->key, tkey->rx_ttak, iv16);
-        plen = skb->len - hdr_len - 12;
-        crypto_blkcipher_setkey(tkey->rx_tfm_arc4, rc4key, 16);
-        sg_init_one(&sg, pos, plen + 4);
-        if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG ": TKIP: failed to decrypt "
-                               "received packet from %pM\n",
-                               hdr->addr2);
-                }
-                return -7;
-        }
-        crc = ~crc32_le(~0, pos, plen);
-        icv[0] = crc;
-        icv[1] = crc >> 8;
-        icv[2] = crc >> 16;
-        icv[3] = crc >> 24;
-        if (memcmp(icv, pos + plen, 4) != 0) {
-                if (iv32 != tkey->rx_iv32) {
-                        /* Previously cached Phase1 result was already lost, so
-                         * it needs to be recalculated for the next packet. */
-                        tkey->rx_phase1_done = 0;
-                }
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TKIP: ICV error detected: STA="
-                               "%pM\n", hdr->addr2);
-                }
-                tkey->dot11RSNAStatsTKIPICVErrors++;
-                return -5;
-        }
-        /* Update real counters only after Michael MIC verification has
-         * completed */
-        tkey->rx_iv32_new = iv32;
-        tkey->rx_iv16_new = iv16;
-        /* Remove IV and ICV */
-        memmove(skb->data + 8, skb->data, hdr_len);
-        skb_pull(skb, 8);
-        skb_trim(skb, skb->len - 4);
-        return keyidx;
-}
-static int michael_mic(struct crypto_hash *tfm_michael, u8 *key, u8 *hdr,
-                        u8 *data, size_t data_len, u8 *mic)
-{
-        struct hash_desc desc;
-        struct scatterlist sg[2];
-        if (tfm_michael == NULL) {
-                printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
-                return -1;
-        }
-        sg_init_table(sg, 2);
-        sg_set_buf(&sg[0], hdr, 16);
-        sg_set_buf(&sg[1], data, data_len);
-        if (crypto_hash_setkey(tfm_michael, key, 8))
-                return -1;
-        desc.tfm = tfm_michael;
-        desc.flags = 0;
-        return crypto_hash_digest(&desc, sg, data_len + 16, mic);
-}
-static void michael_mic_hdr(struct sk_buff *skb, u8 *hdr)
-{
-        struct ieee80211_hdr_4addr *hdr11;
-        hdr11 = (struct ieee80211_hdr_4addr *)skb->data;
-        switch (le16_to_cpu(hdr11->frame_ctl) &
-                (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
-        case IEEE80211_FCTL_TODS:
-                memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
-                memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
-                break;
-        case IEEE80211_FCTL_FROMDS:
-                memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
-                memcpy(hdr + ETH_ALEN, hdr11->addr3, ETH_ALEN); /* SA */
-                break;
-        case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
-                memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
-                memcpy(hdr + ETH_ALEN, hdr11->addr4, ETH_ALEN); /* SA */
-                break;
-        case 0:
-                memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
-                memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
-                break;
-        }
-        hdr[12] = 0; /* priority */
-        hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
-}
-static int ieee80211_michael_mic_add(struct sk_buff *skb, int hdr_len,
-                                     void *priv)
-{
-        struct ieee80211_tkip_data *tkey = priv;
-        u8 *pos;
-        struct ieee80211_hdr_4addr *hdr;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        if (skb_tailroom(skb) < 8 || skb->len < hdr_len) {
-                printk(KERN_DEBUG "Invalid packet for Michael MIC add "
-                       "(tailroom=%d hdr_len=%d skb->len=%d)\n",
-                       skb_tailroom(skb), hdr_len, skb->len);
-                return -1;
-        }
-        michael_mic_hdr(skb, tkey->tx_hdr);
-        if (IEEE80211_QOS_HAS_SEQ(le16_to_cpu(hdr->frame_ctl)))
-                tkey->tx_hdr[12] = *(skb->data + hdr_len - 2) & 0x07;
-        pos = skb_put(skb, 8);
-        if (michael_mic(tkey->tx_tfm_michael, &tkey->key[16], tkey->tx_hdr,
-                        skb->data + hdr_len, skb->len - 8 - hdr_len, pos))
-                return -1;
-        return 0;
-}
-static void ieee80211_michael_mic_failure(struct net_device *dev,
-                                          struct ieee80211_hdr_4addr *hdr,
-                                          int keyidx)
-{
-        union iwreq_data wrqu;
-        struct iw_michaelmicfailure ev;
-        /* TODO: needed parameters: count, keyid, key type, TSC */
-        memset(&ev, 0, sizeof(ev));
-        ev.flags = keyidx & IW_MICFAILURE_KEY_ID;
-        if (hdr->addr1[0] & 0x01)
-                ev.flags |= IW_MICFAILURE_GROUP;
-        else
-                ev.flags |= IW_MICFAILURE_PAIRWISE;
-        ev.src_addr.sa_family = ARPHRD_ETHER;
-        memcpy(ev.src_addr.sa_data, hdr->addr2, ETH_ALEN);
-        memset(&wrqu, 0, sizeof(wrqu));
-        wrqu.data.length = sizeof(ev);
-        wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu, (char *) &ev);
-}
-static int ieee80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
-                                        int hdr_len, void *priv)
-{
-        struct ieee80211_tkip_data *tkey = priv;
-        u8 mic[8];
-        struct ieee80211_hdr_4addr *hdr;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        if (!tkey->key_set)
-                return -1;
-        michael_mic_hdr(skb, tkey->rx_hdr);
-        if (IEEE80211_QOS_HAS_SEQ(le16_to_cpu(hdr->frame_ctl)))
-                tkey->rx_hdr[12] = *(skb->data + hdr_len - 2) & 0x07;
-        if (michael_mic(tkey->rx_tfm_michael, &tkey->key[24], tkey->rx_hdr,
-                        skb->data + hdr_len, skb->len - 8 - hdr_len, mic))
-                return -1;
-        if (memcmp(mic, skb->data + skb->len - 8, 8) != 0) {
-                struct ieee80211_hdr_4addr *hdr;
-                hdr = (struct ieee80211_hdr_4addr *)skb->data;
-                printk(KERN_DEBUG "%s: Michael MIC verification failed for "
-                       "MSDU from %pM keyidx=%d\n",
-                       skb->dev ? skb->dev->name : "N/A", hdr->addr2,
-                       keyidx);
-                if (skb->dev)
-                        ieee80211_michael_mic_failure(skb->dev, hdr, keyidx);
-                tkey->dot11RSNAStatsTKIPLocalMICFailures++;
-                return -1;
-        }
-        /* Update TSC counters for RX now that the packet verification has
-         * completed. */
-        tkey->rx_iv32 = tkey->rx_iv32_new;
-        tkey->rx_iv16 = tkey->rx_iv16_new;
-        skb_trim(skb, skb->len - 8);
-        return 0;
-}
-static int ieee80211_tkip_set_key(void *key, int len, u8 *seq, void *priv)
-{
-        struct ieee80211_tkip_data *tkey = priv;
-        int keyidx;
-        struct crypto_hash *tfm = tkey->tx_tfm_michael;
-        struct crypto_blkcipher *tfm2 = tkey->tx_tfm_arc4;
-        struct crypto_hash *tfm3 = tkey->rx_tfm_michael;
-        struct crypto_blkcipher *tfm4 = tkey->rx_tfm_arc4;
-        keyidx = tkey->key_idx;
-        memset(tkey, 0, sizeof(*tkey));
-        tkey->key_idx = keyidx;
-        tkey->tx_tfm_michael = tfm;
-        tkey->tx_tfm_arc4 = tfm2;
-        tkey->rx_tfm_michael = tfm3;
-        tkey->rx_tfm_arc4 = tfm4;
-        if (len == TKIP_KEY_LEN) {
-                memcpy(tkey->key, key, TKIP_KEY_LEN);
-                tkey->key_set = 1;
-                tkey->tx_iv16 = 1; /* TSC is initialized to 1 */
-                if (seq) {
-                        tkey->rx_iv32 = (seq[5] << 24) | (seq[4] << 16) |
-                                (seq[3] << 8) | seq[2];
-                        tkey->rx_iv16 = (seq[1] << 8) | seq[0];
-                }
-        } else if (len == 0)
-                tkey->key_set = 0;
-        else
-                return -1;
-        return 0;
-}
-static int ieee80211_tkip_get_key(void *key, int len, u8 *seq, void *priv)
-{
-        struct ieee80211_tkip_data *tkey = priv;
-        if (len < TKIP_KEY_LEN)
-                return -1;
-        if (!tkey->key_set)
-                return 0;
-        memcpy(key, tkey->key, TKIP_KEY_LEN);
-        if (seq) {
-                /* Return the sequence number of the last transmitted frame. */
-                u16 iv16 = tkey->tx_iv16;
-                u32 iv32 = tkey->tx_iv32;
-                if (iv16 == 0)
-                        iv32--;
-                iv16--;
-                seq[0] = tkey->tx_iv16;
-                seq[1] = tkey->tx_iv16 >> 8;
-                seq[2] = tkey->tx_iv32;
-                seq[3] = tkey->tx_iv32 >> 8;
-                seq[4] = tkey->tx_iv32 >> 16;
-                seq[5] = tkey->tx_iv32 >> 24;
-        }
-        return TKIP_KEY_LEN;
-}
-static char *ieee80211_tkip_print_stats(char *p, void *priv)
-{
-        struct ieee80211_tkip_data *tkip = priv;
-        p += sprintf(p, "key[%d] alg=TKIP key_set=%d "
-                     "tx_pn=%02x%02x%02x%02x%02x%02x "
-                     "rx_pn=%02x%02x%02x%02x%02x%02x "
-                     "replays=%d icv_errors=%d local_mic_failures=%d\n",
-                     tkip->key_idx, tkip->key_set,
-                     (tkip->tx_iv32 >> 24) & 0xff,
-                     (tkip->tx_iv32 >> 16) & 0xff,
-                     (tkip->tx_iv32 >> 8) & 0xff,
-                     tkip->tx_iv32 & 0xff,
-                     (tkip->tx_iv16 >> 8) & 0xff,
-                     tkip->tx_iv16 & 0xff,
-                     (tkip->rx_iv32 >> 24) & 0xff,
-                     (tkip->rx_iv32 >> 16) & 0xff,
-                     (tkip->rx_iv32 >> 8) & 0xff,
-                     tkip->rx_iv32 & 0xff,
-                     (tkip->rx_iv16 >> 8) & 0xff,
-                     tkip->rx_iv16 & 0xff,
-                     tkip->dot11RSNAStatsTKIPReplays,
-                     tkip->dot11RSNAStatsTKIPICVErrors,
-                     tkip->dot11RSNAStatsTKIPLocalMICFailures);
-        return p;
-}
-static struct ieee80211_crypto_ops ieee80211_crypt_tkip = {
-        .name                   = "TKIP",
-        .init                   = ieee80211_tkip_init,
-        .deinit                 = ieee80211_tkip_deinit,
-        .encrypt_mpdu           = ieee80211_tkip_encrypt,
-        .decrypt_mpdu           = ieee80211_tkip_decrypt,
-        .encrypt_msdu           = ieee80211_michael_mic_add,
-        .decrypt_msdu           = ieee80211_michael_mic_verify,
-        .set_key                = ieee80211_tkip_set_key,
-        .get_key                = ieee80211_tkip_get_key,
-        .print_stats            = ieee80211_tkip_print_stats,
-        .extra_prefix_len       = 4 + 4, /* IV + ExtIV */
-        .extra_postfix_len      = 8 + 4, /* MIC + ICV */
-        .owner                  = THIS_MODULE,
-};
-int ieee80211_crypto_tkip_init(void)
-{
-        return ieee80211_register_crypto_ops(&ieee80211_crypt_tkip);
-}
-void ieee80211_crypto_tkip_exit(void)
-{
-        ieee80211_unregister_crypto_ops(&ieee80211_crypt_tkip);
-}
-void ieee80211_tkip_null(void)
-{
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_wep.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_wep.c
deleted file mode 100644
index f25367224941..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt_wep.c
+++ /dev/null
@@ -1,277 +0,0 @@
-/*
- * Host AP crypt: host-based WEP encryption implementation for Host AP driver
- *
- * Copyright (c) 2002-2004, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/random.h>
-#include <linux/skbuff.h>
-#include <linux/string.h>
-#include "ieee80211.h"
-#include <linux/crypto.h>
-#include <linux/scatterlist.h>
-#include <linux/crc32.h>
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Host AP crypt: WEP");
-MODULE_LICENSE("GPL");
-struct prism2_wep_data {
-        u32 iv;
-#define WEP_KEY_LEN 13
-        u8 key[WEP_KEY_LEN + 1];
-        u8 key_len;
-        u8 key_idx;
-        struct crypto_blkcipher *tx_tfm;
-        struct crypto_blkcipher *rx_tfm;
-};
-static void *prism2_wep_init(int keyidx)
-{
-        struct prism2_wep_data *priv;
-        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
-        if (priv == NULL)
-                goto fail;
-        priv->key_idx = keyidx;
-        priv->tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(priv->tx_tfm)) {
-                pr_debug("could not allocate crypto API arc4\n");
-                priv->tx_tfm = NULL;
-                goto fail;
-        }
-        priv->rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(priv->rx_tfm)) {
-                pr_debug("could not allocate crypto API arc4\n");
-                priv->rx_tfm = NULL;
-                goto fail;
-        }
-        /* start WEP IV from a random value */
-        get_random_bytes(&priv->iv, 4);
-        return priv;
-fail:
-        if (priv) {
-                if (priv->tx_tfm)
-                        crypto_free_blkcipher(priv->tx_tfm);
-                if (priv->rx_tfm)
-                        crypto_free_blkcipher(priv->rx_tfm);
-                kfree(priv);
-        }
-        return NULL;
-}
-static void prism2_wep_deinit(void *priv)
-{
-        struct prism2_wep_data *_priv = priv;
-        if (_priv) {
-                if (_priv->tx_tfm)
-                        crypto_free_blkcipher(_priv->tx_tfm);
-                if (_priv->rx_tfm)
-                        crypto_free_blkcipher(_priv->rx_tfm);
-        }
-        kfree(priv);
-}
-/* Perform WEP encryption on given skb that has at least 4 bytes of headroom
- * for IV and 4 bytes of tailroom for ICV. Both IV and ICV will be transmitted,
- * so the payload length increases with 8 bytes.
- *
- * WEP frame payload: IV + TX key idx, RC4(data), ICV = RC4(CRC32(data))
- */
-static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-        struct prism2_wep_data *wep = priv;
-        struct blkcipher_desc desc = { .tfm = wep->tx_tfm };
-        u32 klen, len;
-        u8 key[WEP_KEY_LEN + 3];
-        u8 *pos;
-        u32 crc;
-        u8 *icv;
-        struct scatterlist sg;
-        if (skb_headroom(skb) < 4 || skb_tailroom(skb) < 4 ||
-            skb->len < hdr_len)
-                return -1;
-        len = skb->len - hdr_len;
-        pos = skb_push(skb, 4);
-        memmove(pos, pos + 4, hdr_len);
-        pos += hdr_len;
-        klen = 3 + wep->key_len;
-        wep->iv++;
-        /* Fluhrer, Mantin, and Shamir have reported weaknesses in the key
-         * scheduling algorithm of RC4. At least IVs (KeyByte + 3, 0xff, N)
-         * can be used to speedup attacks, so avoid using them. */
-        if ((wep->iv & 0xff00) == 0xff00) {
-                u8 B = (wep->iv >> 16) & 0xff;
-                if (B >= 3 && B < klen)
-                        wep->iv += 0x0100;
-        }
-        /* Prepend 24-bit IV to RC4 key and TX frame */
-        *pos++ = key[0] = (wep->iv >> 16) & 0xff;
-        *pos++ = key[1] = (wep->iv >> 8) & 0xff;
-        *pos++ = key[2] = wep->iv & 0xff;
-        *pos++ = wep->key_idx << 6;
-        /* Copy rest of the WEP key (the secret part) */
-        memcpy(key + 3, wep->key, wep->key_len);
-        /* Append little-endian CRC32 and encrypt it to produce ICV */
-        crc = ~crc32_le(~0, pos, len);
-        icv = skb_put(skb, 4);
-        icv[0] = crc;
-        icv[1] = crc >> 8;
-        icv[2] = crc >> 16;
-        icv[3] = crc >> 24;
-        crypto_blkcipher_setkey(wep->tx_tfm, key, klen);
-        sg_init_one(&sg, pos, len + 4);
-        return crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
-}
-/* Perform WEP decryption on given buffer. Buffer includes whole WEP part of
- * the frame: IV (4 bytes), encrypted payload (including SNAP header),
- * ICV (4 bytes). len includes both IV and ICV.
- *
- * Returns 0 if frame was decrypted successfully and ICV was correct and -1 on
- * failure. If frame is OK, IV and ICV will be removed.
- */
-static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-        struct prism2_wep_data *wep = priv;
-        struct blkcipher_desc desc = { .tfm = wep->rx_tfm };
-        u32 klen, plen;
-        u8 key[WEP_KEY_LEN + 3];
-        u8 keyidx, *pos;
-        u32 crc;
-        u8 icv[4];
-        struct scatterlist sg;
-        if (skb->len < hdr_len + 8)
-                return -1;
-        pos = skb->data + hdr_len;
-        key[0] = *pos++;
-        key[1] = *pos++;
-        key[2] = *pos++;
-        keyidx = *pos++ >> 6;
-        if (keyidx != wep->key_idx)
-                return -1;
-        klen = 3 + wep->key_len;
-        /* Copy rest of the WEP key (the secret part) */
-        memcpy(key + 3, wep->key, wep->key_len);
-        /* Apply RC4 to data and compute CRC32 over decrypted data */
-        plen = skb->len - hdr_len - 8;
-        crypto_blkcipher_setkey(wep->rx_tfm, key, klen);
-        sg_init_one(&sg, pos, plen + 4);
-        if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4))
-                return -7;
-        crc = ~crc32_le(~0, pos, plen);
-        icv[0] = crc;
-        icv[1] = crc >> 8;
-        icv[2] = crc >> 16;
-        icv[3] = crc >> 24;
-        if (memcmp(icv, pos + plen, 4) != 0) {
-                /* ICV mismatch - drop frame */
-                return -2;
-        }
-        /* Remove IV and ICV */
-        memmove(skb->data + 4, skb->data, hdr_len);
-        skb_pull(skb, 4);
-        skb_trim(skb, skb->len - 4);
-        return 0;
-}
-static int prism2_wep_set_key(void *key, int len, u8 *seq, void *priv)
-{
-        struct prism2_wep_data *wep = priv;
-        if (len < 0 || len > WEP_KEY_LEN)
-                return -1;
-        memcpy(wep->key, key, len);
-        wep->key_len = len;
-        return 0;
-}
-static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv)
-{
-        struct prism2_wep_data *wep = priv;
-        if (len < wep->key_len)
-                return -1;
-        memcpy(key, wep->key, wep->key_len);
-        return wep->key_len;
-}
-static char *prism2_wep_print_stats(char *p, void *priv)
-{
-        struct prism2_wep_data *wep = priv;
-        p += sprintf(p, "key[%d] alg=WEP len=%d\n",
-                     wep->key_idx, wep->key_len);
-        return p;
-}
-static struct ieee80211_crypto_ops ieee80211_crypt_wep = {
-        .name                   = "WEP",
-        .init                   = prism2_wep_init,
-        .deinit                 = prism2_wep_deinit,
-        .encrypt_mpdu           = prism2_wep_encrypt,
-        .decrypt_mpdu           = prism2_wep_decrypt,
-        .encrypt_msdu           = NULL,
-        .decrypt_msdu           = NULL,
-        .set_key                = prism2_wep_set_key,
-        .get_key                = prism2_wep_get_key,
-        .print_stats            = prism2_wep_print_stats,
-        .extra_prefix_len       = 4, /* IV */
-        .extra_postfix_len      = 4, /* ICV */
-        .owner                  = THIS_MODULE,
-};
-int ieee80211_crypto_wep_init(void)
-{
-        return ieee80211_register_crypto_ops(&ieee80211_crypt_wep);
-}
-void ieee80211_crypto_wep_exit(void)
-{
-        ieee80211_unregister_crypto_ops(&ieee80211_crypt_wep);
-}
-void ieee80211_wep_null(void)
-{
-        return;
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_module.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_module.c
deleted file mode 100644
index 07a1fbb6678e..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_module.c
+++ /dev/null
@@ -1,203 +0,0 @@
-/*******************************************************************************
-  Copyright(c) 2004 Intel Corporation. All rights reserved.
-  Portions of this file are based on the WEP enablement code provided by the
-  Host AP project hostap-drivers v0.1.3
-  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
-  <jkmaline@cc.hut.fi>
-  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-*******************************************************************************/
-#include <linux/compiler.h>
-//#include <linux/config.h>
-#include <linux/errno.h>
-#include <linux/if_arp.h>
-#include <linux/in6.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/pci.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/tcp.h>
-#include <linux/types.h>
-#include <linux/wireless.h>
-#include <linux/etherdevice.h>
-#include <linux/uaccess.h>
-#include <net/arp.h>
-#include <net/net_namespace.h>
-#include "ieee80211.h"
-MODULE_DESCRIPTION("802.11 data/management/control stack");
-MODULE_AUTHOR("Copyright (C) 2004 Intel Corporation <jketreno@linux.intel.com>");
-MODULE_LICENSE("GPL");
-#define DRV_NAME "ieee80211"
-static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
-{
-        if (ieee->networks)
-                return 0;
-        ieee->networks = kcalloc(
-                MAX_NETWORK_COUNT, sizeof(struct ieee80211_network),
-                GFP_KERNEL);
-        if (!ieee->networks)
-                return -ENOMEM;
-        return 0;
-}
-static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
-{
-        if (!ieee->networks)
-                return;
-        kfree(ieee->networks);
-        ieee->networks = NULL;
-}
-static inline void ieee80211_networks_initialize(struct ieee80211_device *ieee)
-{
-        int i;
-        INIT_LIST_HEAD(&ieee->network_free_list);
-        INIT_LIST_HEAD(&ieee->network_list);
-        for (i = 0; i < MAX_NETWORK_COUNT; i++)
-                list_add_tail(&ieee->networks[i].list, &ieee->network_free_list);
-}
-struct net_device *alloc_ieee80211(int sizeof_priv)
-{
-        struct ieee80211_device *ieee;
-        struct net_device *dev;
-        int i, err;
-        IEEE80211_DEBUG_INFO("Initializing...\n");
-        dev = alloc_etherdev(sizeof(struct ieee80211_device) + sizeof_priv);
-        if (!dev) {
-                IEEE80211_ERROR("Unable to network device.\n");
-                goto failed;
-        }
-        ieee = netdev_priv(dev);
-        ieee->dev = dev;
-        err = ieee80211_networks_allocate(ieee);
-        if (err) {
-                IEEE80211_ERROR("Unable to allocate beacon storage: %d\n",
-                                err);
-                goto failed;
-        }
-        ieee80211_networks_initialize(ieee);
-        /* Default fragmentation threshold is maximum payload size */
-        ieee->fts = DEFAULT_FTS;
-        ieee->scan_age = DEFAULT_MAX_SCAN_AGE;
-        ieee->open_wep = 1;
-        /* Default to enabling full open WEP with host based encrypt/decrypt */
-        ieee->host_encrypt = 1;
-        ieee->host_decrypt = 1;
-        ieee->ieee802_1x = 1; /* Default to supporting 802.1x */
-        INIT_LIST_HEAD(&ieee->crypt_deinit_list);
-        init_timer(&ieee->crypt_deinit_timer);
-        ieee->crypt_deinit_timer.data = (unsigned long)ieee;
-        ieee->crypt_deinit_timer.function = ieee80211_crypt_deinit_handler;
-        spin_lock_init(&ieee->lock);
-        spin_lock_init(&ieee->wpax_suitlist_lock);
-        ieee->wpax_type_set = 0;
-        ieee->wpa_enabled = 0;
-        ieee->tkip_countermeasures = 0;
-        ieee->drop_unencrypted = 0;
-        ieee->privacy_invoked = 0;
-        ieee->ieee802_1x = 1;
-        ieee->raw_tx = 0;
-        ieee80211_softmac_init(ieee);
-        for (i = 0; i < IEEE_IBSS_MAC_HASH_SIZE; i++)
-                INIT_LIST_HEAD(&ieee->ibss_mac_hash[i]);
-        for (i = 0; i < 17; i++) {
-                ieee->last_rxseq_num[i] = -1;
-                ieee->last_rxfrag_num[i] = -1;
-                ieee->last_packet_time[i] = 0;
-        }
-//These function were added to load crypte module autoly
-        ieee80211_tkip_null();
-        ieee80211_wep_null();
-        ieee80211_ccmp_null();
-        return dev;
- failed:
-        if (dev)
-                free_netdev(dev);
-        return NULL;
-}
-void free_ieee80211(struct net_device *dev)
-{
-        struct ieee80211_device *ieee = netdev_priv(dev);
-        int i;
-        struct list_head *p, *q;
-        ieee80211_softmac_free(ieee);
-        del_timer_sync(&ieee->crypt_deinit_timer);
-        ieee80211_crypt_deinit_entries(ieee, 1);
-        for (i = 0; i < WEP_KEYS; i++) {
-                struct ieee80211_crypt_data *crypt = ieee->crypt[i];
-                if (crypt) {
-                        if (crypt->ops)
-                                crypt->ops->deinit(crypt->priv);
-                        kfree(crypt);
-                        ieee->crypt[i] = NULL;
-                }
-        }
-        ieee80211_networks_free(ieee);
-        for (i = 0; i < IEEE_IBSS_MAC_HASH_SIZE; i++) {
-                list_for_each_safe(p, q, &ieee->ibss_mac_hash[i]) {
-                        kfree(list_entry(p, struct ieee_ibss_seq, list));
-                        list_del(p);
-                }
-        }
-        free_netdev(dev);
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
deleted file mode 100644
index b522b57a2691..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
+++ /dev/null
@@ -1,1486 +0,0 @@
-/*
- * Original code based Host AP (software wireless LAN access point) driver
- * for Intersil Prism2/2.5/3 - hostap.o module, common routines
- *
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- * Copyright (c) 2004, Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- ******************************************************************************
-  Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andrea.merello@gmail.com>
-  A special thanks goes to Realtek for their support !
-******************************************************************************/
-#include <linux/compiler.h>
-//#include <linux/config.h>
-#include <linux/errno.h>
-#include <linux/if_arp.h>
-#include <linux/in6.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/pci.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/tcp.h>
-#include <linux/types.h>
-#include <linux/wireless.h>
-#include <linux/etherdevice.h>
-#include <linux/uaccess.h>
-#include <linux/ctype.h>
-#include "ieee80211.h"
-#include "dot11d.h"
-static inline void ieee80211_monitor_rx(struct ieee80211_device *ieee,
-                                        struct sk_buff *skb,
-                                        struct ieee80211_rx_stats *rx_stats)
-{
-        struct ieee80211_hdr_4addr *hdr =
-                (struct ieee80211_hdr_4addr *)skb->data;
-        u16 fc = le16_to_cpu(hdr->frame_ctl);
-        skb->dev = ieee->dev;
-        skb_reset_mac_header(skb);
-        skb_pull(skb, ieee80211_get_hdrlen(fc));
-        skb->pkt_type = PACKET_OTHERHOST;
-        skb->protocol = __constant_htons(ETH_P_80211_RAW);
-        memset(skb->cb, 0, sizeof(skb->cb));
-        netif_rx(skb);
-}
-/* Called only as a tasklet (software IRQ) */
-static struct ieee80211_frag_entry *
-ieee80211_frag_cache_find(struct ieee80211_device *ieee, unsigned int seq,
-                          unsigned int frag, u8 tid, u8 *src, u8 *dst)
-{
-        struct ieee80211_frag_entry *entry;
-        int i;
-        for (i = 0; i < IEEE80211_FRAG_CACHE_LEN; i++) {
-                entry = &ieee->frag_cache[tid][i];
-                if (entry->skb != NULL &&
-                    time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
-                        IEEE80211_DEBUG_FRAG(
-                                "expiring fragment cache entry "
-                                "seq=%u last_frag=%u\n",
-                                entry->seq, entry->last_frag);
-                        dev_kfree_skb_any(entry->skb);
-                        entry->skb = NULL;
-                }
-                if (entry->skb != NULL && entry->seq == seq &&
-                    (entry->last_frag + 1 == frag || frag == -1) &&
-                    memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
-                    memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
-                        return entry;
-        }
-        return NULL;
-}
-/* Called only as a tasklet (software IRQ) */
-static struct sk_buff *
-ieee80211_frag_cache_get(struct ieee80211_device *ieee,
-                         struct ieee80211_hdr_4addr *hdr)
-{
-        struct sk_buff *skb = NULL;
-        u16 fc = le16_to_cpu(hdr->frame_ctl);
-        u16 sc = le16_to_cpu(hdr->seq_ctl);
-        unsigned int frag = WLAN_GET_SEQ_FRAG(sc);
-        unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
-        struct ieee80211_frag_entry *entry;
-        struct ieee80211_hdr_3addrqos *hdr_3addrqos;
-        struct ieee80211_hdr_4addrqos *hdr_4addrqos;
-        u8 tid;
-        if (((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS) && IEEE80211_QOS_HAS_SEQ(fc)) {
-                hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)hdr;
-                tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QOS_TID;
-                tid = UP2AC(tid);
-                tid++;
-        } else if (IEEE80211_QOS_HAS_SEQ(fc)) {
-                hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
-                tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
-                tid = UP2AC(tid);
-                tid++;
-        } else {
-                tid = 0;
-        }
-        if (frag == 0) {
-                /* Reserve enough space to fit maximum frame length */
-                skb = dev_alloc_skb(ieee->dev->mtu +
-                                    sizeof(struct ieee80211_hdr_4addr) +
-                                    8 /* LLC */ +
-                                    2 /* alignment */ +
-                                    8 /* WEP */ +
-                                    ETH_ALEN /* WDS */ +
-                                    (IEEE80211_QOS_HAS_SEQ(fc) ? 2 : 0) /* QOS Control */);
-                if (skb == NULL)
-                        return NULL;
-                entry = &ieee->frag_cache[tid][ieee->frag_next_idx[tid]];
-                ieee->frag_next_idx[tid]++;
-                if (ieee->frag_next_idx[tid] >= IEEE80211_FRAG_CACHE_LEN)
-                        ieee->frag_next_idx[tid] = 0;
-                if (entry->skb != NULL)
-                        dev_kfree_skb_any(entry->skb);
-                entry->first_frag_time = jiffies;
-                entry->seq = seq;
-                entry->last_frag = frag;
-                entry->skb = skb;
-                memcpy(entry->src_addr, hdr->addr2, ETH_ALEN);
-                memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN);
-        } else {
-                /* received a fragment of a frame for which the head fragment
-                 * should have already been received */
-                entry = ieee80211_frag_cache_find(ieee, seq, frag, tid, hdr->addr2,
-                                                  hdr->addr1);
-                if (entry != NULL) {
-                        entry->last_frag = frag;
-                        skb = entry->skb;
-                }
-        }
-        return skb;
-}
-/* Called only as a tasklet (software IRQ) */
-static int ieee80211_frag_cache_invalidate(struct ieee80211_device *ieee,
-                                           struct ieee80211_hdr_4addr *hdr)
-{
-        u16 fc = le16_to_cpu(hdr->frame_ctl);
-        u16 sc = le16_to_cpu(hdr->seq_ctl);
-        unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
-        struct ieee80211_frag_entry *entry;
-        struct ieee80211_hdr_3addrqos *hdr_3addrqos;
-        struct ieee80211_hdr_4addrqos *hdr_4addrqos;
-        u8 tid;
-        if (((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS) && IEEE80211_QOS_HAS_SEQ(fc)) {
-                hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)hdr;
-                tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QOS_TID;
-                tid = UP2AC(tid);
-                tid++;
-        } else if (IEEE80211_QOS_HAS_SEQ(fc)) {
-                hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
-                tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
-                tid = UP2AC(tid);
-                tid++;
-        } else {
-                tid = 0;
-        }
-        entry = ieee80211_frag_cache_find(ieee, seq, -1, tid, hdr->addr2,
-                                          hdr->addr1);
-        if (entry == NULL) {
-                IEEE80211_DEBUG_FRAG(
-                        "could not invalidate fragment cache "
-                        "entry (seq=%u)\n", seq);
-                return -1;
-        }
-        entry->skb = NULL;
-        return 0;
-}
-/* ieee80211_rx_frame_mgtmt
- *
- * Responsible for handling management control frames
- *
- * Called by ieee80211_rx */
-static inline int
-ieee80211_rx_frame_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb,
-                        struct ieee80211_rx_stats *rx_stats, u16 type,
-                        u16 stype)
-{
-        struct ieee80211_hdr_4addr *hdr;
-        // cheat the the hdr type
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        /* On the struct stats definition there is written that
-         * this is not mandatory.... but seems that the probe
-         * response parser uses it
-         */
-        rx_stats->len = skb->len;
-        ieee80211_rx_mgt(ieee, (struct ieee80211_hdr_4addr *)skb->data,
-                         rx_stats);
-        if ((ieee->state == IEEE80211_LINKED) && (memcmp(hdr->addr3, ieee->current_network.bssid, ETH_ALEN))) {
-                dev_kfree_skb_any(skb);
-                return 0;
-        }
-        ieee80211_rx_frame_softmac(ieee, skb, rx_stats, type, stype);
-        dev_kfree_skb_any(skb);
-        return 0;
-}
-/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
-/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
-static unsigned char rfc1042_header[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
-/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
-static unsigned char bridge_tunnel_header[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
-/* No encapsulation header if EtherType < 0x600 (=length) */
-/* Called by ieee80211_rx_frame_decrypt */
-static int ieee80211_is_eapol_frame(struct ieee80211_device *ieee,
-                                    struct sk_buff *skb, size_t hdrlen)
-{
-        struct net_device *dev = ieee->dev;
-        u16 fc, ethertype;
-        struct ieee80211_hdr_4addr *hdr;
-        u8 *pos;
-        if (skb->len < 24)
-                return 0;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
-        /* check that the frame is unicast frame to us */
-        if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-            IEEE80211_FCTL_TODS &&
-            memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
-            memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
-                /* ToDS frame with own addr BSSID and DA */
-        } else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-                   IEEE80211_FCTL_FROMDS &&
-                   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
-                /* FromDS frame with own addr as DA */
-        } else
-                return 0;
-        if (skb->len < 24 + 8)
-                return 0;
-        /* check for port access entity Ethernet type */
-//      pos = skb->data + 24;
-        pos = skb->data + hdrlen;
-        ethertype = (pos[6] << 8) | pos[7];
-        if (ethertype == ETH_P_PAE)
-                return 1;
-        return 0;
-}
-/* Called only as a tasklet (software IRQ), by ieee80211_rx */
-static inline int
-ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
-                           struct ieee80211_crypt_data *crypt)
-{
-        struct ieee80211_hdr_4addr *hdr;
-        int res, hdrlen;
-        if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
-                return 0;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
-#ifdef CONFIG_IEEE80211_CRYPT_TKIP
-        if (ieee->tkip_countermeasures &&
-            strcmp(crypt->ops->name, "TKIP") == 0) {
-                if (net_ratelimit()) {
-                        netdev_dbg(ieee->dev,
-                                   "TKIP countermeasures: dropped received packet from %pM\n",
-                                   ieee->dev->name, hdr->addr2);
-                }
-                return -1;
-        }
-#endif
-        atomic_inc(&crypt->refcnt);
-        res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
-        atomic_dec(&crypt->refcnt);
-        if (res < 0) {
-                IEEE80211_DEBUG_DROP(
-                        "decryption failed (SA=%pM"
-                        ") res=%d\n", hdr->addr2, res);
-                if (res == -2)
-                        IEEE80211_DEBUG_DROP("Decryption failed ICV "
-                                             "mismatch (key %d)\n",
-                                             skb->data[hdrlen + 3] >> 6);
-                ieee->ieee_stats.rx_discards_undecryptable++;
-                return -1;
-        }
-        return res;
-}
-/* Called only as a tasklet (software IRQ), by ieee80211_rx */
-static inline int
-ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
-                                struct sk_buff *skb, int keyidx,
-                                struct ieee80211_crypt_data *crypt)
-{
-        struct ieee80211_hdr_4addr *hdr;
-        int res, hdrlen;
-        if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
-                return 0;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
-        atomic_inc(&crypt->refcnt);
-        res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
-        atomic_dec(&crypt->refcnt);
-        if (res < 0) {
-                netdev_dbg(ieee->dev,
-                           "MSDU decryption/MIC verification failed (SA=%pM keyidx=%d)\n",
-                           hdr->addr2, keyidx);
-                return -1;
-        }
-        return 0;
-}
-/* this function is stolen from ipw2200 driver*/
-#define IEEE_PACKET_RETRY_TIME (5*HZ)
-static int is_duplicate_packet(struct ieee80211_device *ieee,
-                               struct ieee80211_hdr_4addr *header)
-{
-        u16 fc = le16_to_cpu(header->frame_ctl);
-        u16 sc = le16_to_cpu(header->seq_ctl);
-        u16 seq = WLAN_GET_SEQ_SEQ(sc);
-        u16 frag = WLAN_GET_SEQ_FRAG(sc);
-        u16 *last_seq, *last_frag;
-        unsigned long *last_time;
-        struct ieee80211_hdr_3addrqos *hdr_3addrqos;
-        struct ieee80211_hdr_4addrqos *hdr_4addrqos;
-        u8 tid;
-        //TO2DS and QoS
-        if (((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS) && IEEE80211_QOS_HAS_SEQ(fc)) {
-                hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)header;
-                tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QOS_TID;
-                tid = UP2AC(tid);
-                tid++;
-        } else if (IEEE80211_QOS_HAS_SEQ(fc)) { //QoS
-                hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)header;
-                tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
-                tid = UP2AC(tid);
-                tid++;
-        } else { // no QoS
-                tid = 0;
-        }
-        switch (ieee->iw_mode) {
-        case IW_MODE_ADHOC:
-        {
-                struct list_head *p;
-                struct ieee_ibss_seq *entry = NULL;
-                u8 *mac = header->addr2;
-                int index = mac[5] % IEEE_IBSS_MAC_HASH_SIZE;
-                list_for_each(p, &ieee->ibss_mac_hash[index]) {
-                        entry = list_entry(p, struct ieee_ibss_seq, list);
-                        if (!memcmp(entry->mac, mac, ETH_ALEN))
-                                break;
-                }
-        //      if (memcmp(entry->mac, mac, ETH_ALEN)){
-                if (p == &ieee->ibss_mac_hash[index]) {
-                        entry = kmalloc(sizeof(struct ieee_ibss_seq), GFP_ATOMIC);
-                        if (!entry)
-                                return 0;
-                        memcpy(entry->mac, mac, ETH_ALEN);
-                        entry->seq_num[tid] = seq;
-                        entry->frag_num[tid] = frag;
-                        entry->packet_time[tid] = jiffies;
-                        list_add(&entry->list, &ieee->ibss_mac_hash[index]);
-                        return 0;
-                }
-                last_seq = &entry->seq_num[tid];
-                last_frag = &entry->frag_num[tid];
-                last_time = &entry->packet_time[tid];
-                break;
-        }
-        case IW_MODE_INFRA:
-                last_seq = &ieee->last_rxseq_num[tid];
-                last_frag = &ieee->last_rxfrag_num[tid];
-                last_time = &ieee->last_packet_time[tid];
-                break;
-        default:
-                return 0;
-        }
-//      if(tid != 0) {
-//              printk(KERN_WARNING ":)))))))))))%x %x %x, fc(%x)\n", tid, *last_seq, seq, header->frame_ctl);
-//      }
-        if ((*last_seq == seq) &&
-            time_after(*last_time + IEEE_PACKET_RETRY_TIME, jiffies)) {
-                if (*last_frag == frag) {
-                        //printk(KERN_WARNING "[1] go drop!\n");
-                        goto drop;
-                }
-                if (*last_frag + 1 != frag)
-                        /* out-of-order fragment */
-                        //printk(KERN_WARNING "[2] go drop!\n");
-                        goto drop;
-        } else
-                *last_seq = seq;
-        *last_frag = frag;
-        *last_time = jiffies;
-        return 0;
-drop:
-//      BUG_ON(!(fc & IEEE80211_FCTL_RETRY));
-//      printk("DUP\n");
-        return 1;
-}
-/* All received frames are sent to this function. @skb contains the frame in
- * IEEE 802.11 format, i.e., in the format it was sent over air.
- * This function is called only as a tasklet (software IRQ). */
-int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
-                     struct ieee80211_rx_stats *rx_stats)
-{
-        struct net_device *dev = ieee->dev;
-        //struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct ieee80211_hdr_4addr *hdr;
-        size_t hdrlen;
-        u16 fc, type, stype, sc;
-        struct net_device_stats *stats;
-        unsigned int frag;
-        u8 *payload;
-        u16 ethertype;
-        u8 dst[ETH_ALEN];
-        u8 src[ETH_ALEN];
-        u8 bssid[ETH_ALEN];
-        struct ieee80211_crypt_data *crypt = NULL;
-        int keyidx = 0;
-        // cheat the the hdr type
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        stats = &ieee->stats;
-        if (skb->len < 10) {
-                netdev_info(ieee->dev, "SKB length < 10\n");
-                goto rx_dropped;
-        }
-        fc = le16_to_cpu(hdr->frame_ctl);
-        type = WLAN_FC_GET_TYPE(fc);
-        stype = WLAN_FC_GET_STYPE(fc);
-        sc = le16_to_cpu(hdr->seq_ctl);
-        frag = WLAN_GET_SEQ_FRAG(sc);
-//YJ,add,080828,for keep alive
-        if ((fc & IEEE80211_FCTL_TODS) != IEEE80211_FCTL_TODS) {
-                if (!memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN))
-                        ieee->NumRxUnicast++;
-        } else {
-                if (!memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN))
-                        ieee->NumRxUnicast++;
-        }
-//YJ,add,080828,for keep alive,end
-        hdrlen = ieee80211_get_hdrlen(fc);
-        if (ieee->iw_mode == IW_MODE_MONITOR) {
-                ieee80211_monitor_rx(ieee, skb, rx_stats);
-                stats->rx_packets++;
-                stats->rx_bytes += skb->len;
-                return 1;
-        }
-        if (ieee->host_decrypt) {
-                int idx = 0;
-                if (skb->len >= hdrlen + 3)
-                        idx = skb->data[hdrlen + 3] >> 6;
-                crypt = ieee->crypt[idx];
-                /* allow NULL decrypt to indicate an station specific override
-                 * for default encryption */
-                if (crypt && (crypt->ops == NULL ||
-                              crypt->ops->decrypt_mpdu == NULL))
-                        crypt = NULL;
-                if (!crypt && (fc & IEEE80211_FCTL_WEP)) {
-                        /* This seems to be triggered by some (multicast?)
-                         * frames from other than current BSS, so just drop the
-                         * frames silently instead of filling system log with
-                         * these reports. */
-                        IEEE80211_DEBUG_DROP("Decryption failed (not set)"
-                                             " (SA=%pM)\n",
-                                             hdr->addr2);
-                        ieee->ieee_stats.rx_discards_undecryptable++;
-                        goto rx_dropped;
-                }
-        }
-        if (skb->len < IEEE80211_DATA_HDR3_LEN)
-                goto rx_dropped;
-        // if QoS enabled, should check the sequence for each of the AC
-        if (is_duplicate_packet(ieee, hdr))
-                goto rx_dropped;
-        if (type == IEEE80211_FTYPE_MGMT) {
-                if (ieee80211_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
-                        goto rx_dropped;
-                else
-                        goto rx_exit;
-        }
-        /* Data frame - extract src/dst addresses */
-        switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
-        case IEEE80211_FCTL_FROMDS:
-                memcpy(dst, hdr->addr1, ETH_ALEN);
-                memcpy(src, hdr->addr3, ETH_ALEN);
-                memcpy(bssid, hdr->addr2, ETH_ALEN);
-                break;
-        case IEEE80211_FCTL_TODS:
-                memcpy(dst, hdr->addr3, ETH_ALEN);
-                memcpy(src, hdr->addr2, ETH_ALEN);
-                memcpy(bssid, hdr->addr1, ETH_ALEN);
-                break;
-        case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
-                if (skb->len < IEEE80211_DATA_HDR4_LEN)
-                        goto rx_dropped;
-                memcpy(dst, hdr->addr3, ETH_ALEN);
-                memcpy(src, hdr->addr4, ETH_ALEN);
-                memcpy(bssid, ieee->current_network.bssid, ETH_ALEN);
-                break;
-        case 0:
-                memcpy(dst, hdr->addr1, ETH_ALEN);
-                memcpy(src, hdr->addr2, ETH_ALEN);
-                memcpy(bssid, hdr->addr3, ETH_ALEN);
-                break;
-        }
-        dev->last_rx = jiffies;
-        /* Nullfunc frames may have PS-bit set, so they must be passed to
-         * hostap_handle_sta_rx() before being dropped here. */
-        if (stype != IEEE80211_STYPE_DATA &&
-            stype != IEEE80211_STYPE_DATA_CFACK &&
-            stype != IEEE80211_STYPE_DATA_CFPOLL &&
-            stype != IEEE80211_STYPE_DATA_CFACKPOLL &&
-            stype != IEEE80211_STYPE_QOS_DATA//add by David,2006.8.4
-            ) {
-                if (stype != IEEE80211_STYPE_NULLFUNC)
-                        IEEE80211_DEBUG_DROP(
-                                "RX: dropped data frame "
-                                "with no data (type=0x%02x, "
-                                "subtype=0x%02x, len=%d)\n",
-                                type, stype, skb->len);
-                goto rx_dropped;
-        }
-        if (memcmp(bssid, ieee->current_network.bssid, ETH_ALEN))
-                goto rx_dropped;
-        ieee->NumRxDataInPeriod++;
-        ieee->NumRxOkTotal++;
-        /* skb: hdr + (possibly fragmented, possibly encrypted) payload */
-        if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
-            (keyidx = ieee80211_rx_frame_decrypt(ieee, skb, crypt)) < 0)
-                goto rx_dropped;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        /* skb: hdr + (possibly fragmented) plaintext payload */
-        // PR: FIXME: hostap has additional conditions in the "if" below:
-        // ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
-        if ((frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) {
-                int flen;
-                struct sk_buff *frag_skb = ieee80211_frag_cache_get(ieee, hdr);
-                IEEE80211_DEBUG_FRAG("Rx Fragment received (%u)\n", frag);
-                if (!frag_skb) {
-                        IEEE80211_DEBUG(IEEE80211_DL_RX | IEEE80211_DL_FRAG,
-                                        "Rx cannot get skb from fragment "
-                                        "cache (morefrag=%d seq=%u frag=%u)\n",
-                                        (fc & IEEE80211_FCTL_MOREFRAGS) != 0,
-                                        WLAN_GET_SEQ_SEQ(sc), frag);
-                        goto rx_dropped;
-                }
-                flen = skb->len;
-                if (frag != 0)
-                        flen -= hdrlen;
-                if (frag_skb->tail + flen > frag_skb->end) {
-                        netdev_warn(ieee->dev,
-                                    "host decrypted and reassembled frame did not fit skb\n");
-                        ieee80211_frag_cache_invalidate(ieee, hdr);
-                        goto rx_dropped;
-                }
-                if (frag == 0) {
-                        /* copy first fragment (including full headers) into
-                         * beginning of the fragment cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data, flen);
-                } else {
-                        /* append frame payload to the end of the fragment
-                         * cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
-                               flen);
-                }
-                dev_kfree_skb_any(skb);
-                skb = NULL;
-                if (fc & IEEE80211_FCTL_MOREFRAGS) {
-                        /* more fragments expected - leave the skb in fragment
-                         * cache for now; it will be delivered to upper layers
-                         * after all fragments have been received */
-                        goto rx_exit;
-                }
-                /* this was the last fragment and the frame will be
-                 * delivered, so remove skb from fragment cache */
-                skb = frag_skb;
-                hdr = (struct ieee80211_hdr_4addr *)skb->data;
-                ieee80211_frag_cache_invalidate(ieee, hdr);
-        }
-        /* skb: hdr + (possible reassembled) full MSDU payload; possibly still
-         * encrypted/authenticated */
-        if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
-            ieee80211_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt))
-                goto rx_dropped;
-        hdr = (struct ieee80211_hdr_4addr *)skb->data;
-        if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep) {
-                if (/*ieee->ieee802_1x &&*/
-                    ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
-#ifdef CONFIG_IEEE80211_DEBUG
-                        /* pass unencrypted EAPOL frames even if encryption is
-                         * configured */
-                        struct eapol *eap = (struct eapol *)(skb->data +
-                                24);
-                        IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
-                                                eap_get_type(eap->type));
-#endif
-                } else {
-                        IEEE80211_DEBUG_DROP(
-                                "encryption configured, but RX "
-                                "frame not encrypted (SA=%pM)\n",
-                                hdr->addr2);
-                        goto rx_dropped;
-                }
-        }
-#ifdef CONFIG_IEEE80211_DEBUG
-        if (crypt && !(fc & IEEE80211_FCTL_WEP) &&
-            ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
-                        struct eapol *eap = (struct eapol *)(skb->data +
-                                24);
-                        IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
-                                                eap_get_type(eap->type));
-        }
-#endif
-        if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep &&
-            !ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
-                IEEE80211_DEBUG_DROP(
-                        "dropped unencrypted RX data "
-                        "frame from %pM"
-                        " (drop_unencrypted=1)\n",
-                        hdr->addr2);
-                goto rx_dropped;
-        }
-/*
-        if(ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
-                printk(KERN_WARNING "RX: IEEE802.1X EPAOL frame!\n");
-        }
-*/
-        /* skb: hdr + (possible reassembled) full plaintext payload */
-        payload = skb->data + hdrlen;
-        ethertype = (payload[6] << 8) | payload[7];
-        /* convert hdr + possible LLC headers into Ethernet header */
-        if (skb->len - hdrlen >= 8 &&
-            ((memcmp(payload, rfc1042_header, SNAP_SIZE) == 0 &&
-              ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-             memcmp(payload, bridge_tunnel_header, SNAP_SIZE) == 0)) {
-                /* remove RFC1042 or Bridge-Tunnel encapsulation and
-                 * replace EtherType */
-                skb_pull(skb, hdrlen + SNAP_SIZE);
-                memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-                memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-        } else {
-                u16 len;
-                /* Leave Ethernet header part of hdr and full payload */
-                skb_pull(skb, hdrlen);
-                len = htons(skb->len);
-                memcpy(skb_push(skb, 2), &len, 2);
-                memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-                memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-        }
-        stats->rx_packets++;
-        stats->rx_bytes += skb->len;
-        if (skb) {
-                skb->protocol = eth_type_trans(skb, dev);
-                memset(skb->cb, 0, sizeof(skb->cb));
-                skb->dev = dev;
-                skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
-                ieee->last_rx_ps_time = jiffies;
-                netif_rx(skb);
-        }
- rx_exit:
-        return 1;
- rx_dropped:
-        stats->rx_dropped++;
-        /* Returning 0 indicates to caller that we have not handled the SKB--
-         * so it is still allocated and can be used again by underlying
-         * hardware as a DMA target */
-        return 0;
-}
-#define MGMT_FRAME_FIXED_PART_LENGTH            0x24
-static inline int ieee80211_is_ofdm_rate(u8 rate)
-{
-        switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
-        case IEEE80211_OFDM_RATE_6MB:
-        case IEEE80211_OFDM_RATE_9MB:
-        case IEEE80211_OFDM_RATE_12MB:
-        case IEEE80211_OFDM_RATE_18MB:
-        case IEEE80211_OFDM_RATE_24MB:
-        case IEEE80211_OFDM_RATE_36MB:
-        case IEEE80211_OFDM_RATE_48MB:
-        case IEEE80211_OFDM_RATE_54MB:
-                return 1;
-        }
-        return 0;
-}
-static inline int ieee80211_SignalStrengthTranslate(int CurrSS)
-{
-        int RetSS;
-        // Step 1. Scale mapping.
-        if (CurrSS >= 71 && CurrSS <= 100)
-                RetSS = 90 + ((CurrSS - 70) / 3);
-        else if (CurrSS >= 41 && CurrSS <= 70)
-                RetSS = 78 + ((CurrSS - 40) / 3);
-        else if (CurrSS >= 31 && CurrSS <= 40)
-                RetSS = 66 + (CurrSS - 30);
-        else if (CurrSS >= 21 && CurrSS <= 30)
-                RetSS = 54 + (CurrSS - 20);
-        else if (CurrSS >= 5 && CurrSS <= 20)
-                RetSS = 42 + (((CurrSS - 5) * 2) / 3);
-        else if (CurrSS == 4)
-                RetSS = 36;
-        else if (CurrSS == 3)
-                RetSS = 27;
-        else if (CurrSS == 2)
-                RetSS = 18;
-        else if (CurrSS == 1)
-                RetSS = 9;
-        else
-                RetSS = CurrSS;
-        //RT_TRACE(COMP_DBG, DBG_LOUD, ("##### After Mapping:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
-        // Step 2. Smoothing.
-        //RT_TRACE(COMP_DBG, DBG_LOUD, ("$$$$$ After Smoothing:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
-        return RetSS;
-}
-static inline void
-ieee80211_extract_country_ie(struct ieee80211_device *ieee,
-                             struct ieee80211_info_element *info_element,
-                             struct ieee80211_network *network, u8 *addr2)
-{
-        if (IS_DOT11D_ENABLE(ieee)) {
-                if (info_element->len != 0) {
-                        memcpy(network->CountryIeBuf, info_element->data, info_element->len);
-                        network->CountryIeLen = info_element->len;
-                        if (!IS_COUNTRY_IE_VALID(ieee))
-                                Dot11d_UpdateCountryIe(ieee, addr2, info_element->len, info_element->data);
-                }
-                //
-                // 070305, rcnjko: I update country IE watch dog here because
-                // some AP (e.g. Cisco 1242) don't include country IE in their
-                // probe response frame.
-                //
-                if (IS_EQUAL_CIE_SRC(ieee, addr2))
-                        UPDATE_CIE_WATCHDOG(ieee);
-        }
-}
-/* SignalStrengthIndex is 0-100 */
-static int ieee80211_TranslateToDbm(unsigned char SignalStrengthIndex)
-{
-        unsigned char SignalPower; // in dBm.
-        // Translate to dBm (x=0.5y-95).
-        SignalPower = (int)SignalStrengthIndex * 7 / 10;
-        SignalPower -= 95;
-        return SignalPower;
-}
-inline int ieee80211_network_init(
-        struct ieee80211_device *ieee,
-        struct ieee80211_probe_response *beacon,
-        struct ieee80211_network *network,
-        struct ieee80211_rx_stats *stats)
-{
-#ifdef CONFIG_IEEE80211_DEBUG
-        char rates_str[64];
-        char *p;
-#endif
-        struct ieee80211_info_element *info_element;
-        u16 left;
-        u8 i;
-        short offset;
-        u8 curRate = 0, hOpRate = 0, curRate_ex = 0;
-        /* Pull out fixed field data */
-        memcpy(network->bssid, beacon->header.addr3, ETH_ALEN);
-        network->capability = beacon->capability;
-        network->last_scanned = jiffies;
-        network->time_stamp[0] = beacon->time_stamp[0];
-        network->time_stamp[1] = beacon->time_stamp[1];
-        network->beacon_interval = beacon->beacon_interval;
-        /* Where to pull this? beacon->listen_interval;*/
-        network->listen_interval = 0x0A;
-        network->rates_len = network->rates_ex_len = 0;
-        network->last_associate = 0;
-        network->ssid_len = 0;
-        network->flags = 0;
-        network->atim_window = 0;
-        network->QoS_Enable = 0;
-//by amy 080312
-        network->HighestOperaRate = 0;
-//by amy 080312
-        network->Turbo_Enable = 0;
-        network->CountryIeLen = 0;
-        memset(network->CountryIeBuf, 0, MAX_IE_LEN);
-        if (stats->freq == IEEE80211_52GHZ_BAND) {
-                /* for A band (No DS info) */
-                network->channel = stats->received_channel;
-        } else
-                network->flags |= NETWORK_HAS_CCK;
-        network->wpa_ie_len = 0;
-        network->rsn_ie_len = 0;
-        info_element = &beacon->info_element;
-        left = stats->len - ((void *)info_element - (void *)beacon);
-        while (left >= sizeof(struct ieee80211_info_element_hdr)) {
-                if (sizeof(struct ieee80211_info_element_hdr) + info_element->len > left) {
-                        IEEE80211_DEBUG_SCAN("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%d left=%d.\n",
-                                             info_element->len + sizeof(struct ieee80211_info_element),
-                                             left);
-                        return 1;
-                }
-                switch (info_element->id) {
-                case MFIE_TYPE_SSID:
-                        if (ieee80211_is_empty_essid(info_element->data,
-                                                     info_element->len)) {
-                                network->flags |= NETWORK_EMPTY_ESSID;
-                                break;
-                        }
-                        network->ssid_len = min(info_element->len,
-                                                (u8)IW_ESSID_MAX_SIZE);
-                        memcpy(network->ssid, info_element->data, network->ssid_len);
-                        if (network->ssid_len < IW_ESSID_MAX_SIZE)
-                                memset(network->ssid + network->ssid_len, 0,
-                                       IW_ESSID_MAX_SIZE - network->ssid_len);
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_SSID: '%s' len=%d.\n",
-                                             network->ssid, network->ssid_len);
-                        break;
-                case MFIE_TYPE_RATES:
-#ifdef CONFIG_IEEE80211_DEBUG
-                        p = rates_str;
-#endif
-                        network->rates_len = min(info_element->len, MAX_RATES_LENGTH);
-                        for (i = 0; i < network->rates_len; i++) {
-                                network->rates[i] = info_element->data[i];
-                                curRate = network->rates[i] & 0x7f;
-                                if (hOpRate < curRate)
-                                        hOpRate = curRate;
-#ifdef CONFIG_IEEE80211_DEBUG
-                                p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
-#endif
-                                if (ieee80211_is_ofdm_rate(info_element->data[i])) {
-                                        network->flags |= NETWORK_HAS_OFDM;
-                                        if (info_element->data[i] &
-                                            IEEE80211_BASIC_RATE_MASK)
-                                                network->flags &=
-                                                        ~NETWORK_HAS_CCK;
-                                }
-                        }
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES: '%s' (%d)\n",
-                                             rates_str, network->rates_len);
-                        break;
-                case MFIE_TYPE_RATES_EX:
-#ifdef CONFIG_IEEE80211_DEBUG
-                        p = rates_str;
-#endif
-                        network->rates_ex_len = min(info_element->len, MAX_RATES_EX_LENGTH);
-                        for (i = 0; i < network->rates_ex_len; i++) {
-                                network->rates_ex[i] = info_element->data[i];
-                                curRate_ex = network->rates_ex[i] & 0x7f;
-                                if (hOpRate < curRate_ex)
-                                        hOpRate = curRate_ex;
-#ifdef CONFIG_IEEE80211_DEBUG
-                                p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
-#endif
-                                if (ieee80211_is_ofdm_rate(info_element->data[i])) {
-                                        network->flags |= NETWORK_HAS_OFDM;
-                                        if (info_element->data[i] &
-                                            IEEE80211_BASIC_RATE_MASK)
-                                                network->flags &=
-                                                        ~NETWORK_HAS_CCK;
-                                }
-                        }
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES_EX: '%s' (%d)\n",
-                                             rates_str, network->rates_ex_len);
-                        break;
-                case MFIE_TYPE_DS_SET:
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_DS_SET: %d\n",
-                                             info_element->data[0]);
-                        if (stats->freq == IEEE80211_24GHZ_BAND)
-                                network->channel = info_element->data[0];
-                        break;
-                case MFIE_TYPE_FH_SET:
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_FH_SET: ignored\n");
-                        break;
-                case MFIE_TYPE_CF_SET:
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_CF_SET: ignored\n");
-                        break;
-                case MFIE_TYPE_TIM:
-                        if (info_element->len < 4)
-                                break;
-                        network->dtim_period = info_element->data[1];
-                        if (ieee->state != IEEE80211_LINKED)
-                                break;
-                        network->last_dtim_sta_time[0] = jiffies;
-                        network->last_dtim_sta_time[1] = stats->mac_time[1];
-                        network->dtim_data = IEEE80211_DTIM_VALID;
-                        if (info_element->data[0] != 0)
-                                break;
-                        if (info_element->data[2] & 1)
-                                network->dtim_data |= IEEE80211_DTIM_MBCAST;
-                        offset = (info_element->data[2] >> 1)*2;
-                        //printk("offset1:%x aid:%x\n",offset, ieee->assoc_id);
-                        /* add and modified for ps 2008.1.22 */
-                        if (ieee->assoc_id < 8*offset ||
-                                ieee->assoc_id > 8*(offset + info_element->len - 3)) {
-                                break;
-                        }
-                        offset = (ieee->assoc_id/8) - offset;// + ((aid % 8)? 0 : 1) ;
-                //      printk("offset:%x data:%x, ucast:%d\n", offset,
-                        //      info_element->data[3+offset] ,
-                        //      info_element->data[3+offset] & (1<<(ieee->assoc_id%8)));
-                        if (info_element->data[3+offset] & (1<<(ieee->assoc_id%8)))
-                                network->dtim_data |= IEEE80211_DTIM_UCAST;
-                        break;
-                case MFIE_TYPE_IBSS_SET:
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_IBSS_SET: ignored\n");
-                        break;
-                case MFIE_TYPE_CHALLENGE:
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_CHALLENGE: ignored\n");
-                        break;
-                case MFIE_TYPE_GENERIC:
-                        //nic is 87B
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_GENERIC: %d bytes\n",
-                                             info_element->len);
-                        if (info_element->len >= 4  &&
-                            info_element->data[0] == 0x00 &&
-                            info_element->data[1] == 0x50 &&
-                            info_element->data[2] == 0xf2 &&
-                            info_element->data[3] == 0x01) {
-                                network->wpa_ie_len = min(info_element->len + 2,
-                                                         MAX_WPA_IE_LEN);
-                                memcpy(network->wpa_ie, info_element,
-                                       network->wpa_ie_len);
-                        }
-                        if (info_element->len == 7 &&
-                            info_element->data[0] == 0x00 &&
-                            info_element->data[1] == 0xe0 &&
-                            info_element->data[2] == 0x4c &&
-                            info_element->data[3] == 0x01 &&
-                            info_element->data[4] == 0x02) {
-                                network->Turbo_Enable = 1;
-                        }
-                        if (1 == stats->nic_type) //nic 87
-                                break;
-                        if (info_element->len >= 5  &&
-                            info_element->data[0] == 0x00 &&
-                            info_element->data[1] == 0x50 &&
-                            info_element->data[2] == 0xf2 &&
-                            info_element->data[3] == 0x02 &&
-                            info_element->data[4] == 0x00) {
-                                //printk(KERN_WARNING "wmm info updated: %x\n", info_element->data[6]);
-                                //WMM Information Element
-                                network->wmm_info = info_element->data[6];
-                                network->QoS_Enable = 1;
-                        }
-                        if (info_element->len >= 8  &&
-                            info_element->data[0] == 0x00 &&
-                            info_element->data[1] == 0x50 &&
-                            info_element->data[2] == 0xf2 &&
-                            info_element->data[3] == 0x02 &&
-                            info_element->data[4] == 0x01) {
-                                // Not care about version at present.
-                                //WMM Information Element
-                                //printk(KERN_WARNING "wmm info&param updated: %x\n", info_element->data[6]);
-                                network->wmm_info = info_element->data[6];
-                                //WMM Parameter Element
-                                memcpy(network->wmm_param, (u8 *)(info_element->data + 8), (info_element->len - 8));
-                                network->QoS_Enable = 1;
-                        }
-                        break;
-                case MFIE_TYPE_RSN:
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_RSN: %d bytes\n",
-                                             info_element->len);
-                        network->rsn_ie_len = min(info_element->len + 2,
-                                                 MAX_WPA_IE_LEN);
-                        memcpy(network->rsn_ie, info_element,
-                               network->rsn_ie_len);
-                        break;
-                case MFIE_TYPE_COUNTRY:
-                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_COUNTRY: %d bytes\n",
-                                             info_element->len);
-//                      printk("=====>Receive <%s> Country IE\n",network->ssid);
-                        ieee80211_extract_country_ie(ieee, info_element, network, beacon->header.addr2);
-                        break;
-                default:
-                        IEEE80211_DEBUG_SCAN("unsupported IE %d\n",
-                                             info_element->id);
-                        break;
-                }
-                left -= sizeof(struct ieee80211_info_element_hdr) +
-                        info_element->len;
-                info_element = (struct ieee80211_info_element *)
-                        &info_element->data[info_element->len];
-        }
-//by amy 080312
-        network->HighestOperaRate = hOpRate;
-//by amy 080312
-        network->mode = 0;
-        if (stats->freq == IEEE80211_52GHZ_BAND)
-                network->mode = IEEE_A;
-        else {
-                if (network->flags & NETWORK_HAS_OFDM)
-                        network->mode |= IEEE_G;
-                if (network->flags & NETWORK_HAS_CCK)
-                        network->mode |= IEEE_B;
-        }
-        if (network->mode == 0) {
-                IEEE80211_DEBUG_SCAN("Filtered out '%s (%pM)' "
-                                     "network.\n",
-                                     escape_essid(network->ssid,
-                                                  network->ssid_len),
-                                     network->bssid);
-                return 1;
-        }
-        if (ieee80211_is_empty_essid(network->ssid, network->ssid_len))
-                network->flags |= NETWORK_EMPTY_ESSID;
-        stats->signal = ieee80211_TranslateToDbm(stats->signalstrength);
-        //stats->noise = stats->signal - stats->noise;
-        stats->noise = ieee80211_TranslateToDbm(100 - stats->signalstrength) - 25;
-        memcpy(&network->stats, stats, sizeof(network->stats));
-        return 0;
-}
-static inline int is_same_network(struct ieee80211_network *src,
-                                  struct ieee80211_network *dst,
-                                  struct ieee80211_device *ieee)
-{
-        /* A network is only a duplicate if the channel, BSSID, ESSID
-         * and the capability field (in particular IBSS and BSS) all match.
-         * We treat all <hidden> with the same BSSID and channel
-         * as one network */
-        return (((src->ssid_len == dst->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) &&  //YJ,mod,080819,for hidden ap
-                //((src->ssid_len == dst->ssid_len) &&
-                (src->channel == dst->channel) &&
-                !memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
-                (!memcmp(src->ssid, dst->ssid, src->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) && //YJ,mod,080819,for hidden ap
-                //!memcmp(src->ssid, dst->ssid, src->ssid_len) &&
-                ((src->capability & WLAN_CAPABILITY_IBSS) ==
-                (dst->capability & WLAN_CAPABILITY_IBSS)) &&
-                ((src->capability & WLAN_CAPABILITY_BSS) ==
-                (dst->capability & WLAN_CAPABILITY_BSS)));
-}
-inline void update_network(struct ieee80211_network *dst,
-                           struct ieee80211_network *src)
-{
-        unsigned char quality = src->stats.signalstrength;
-        unsigned char signal = 0;
-        unsigned char noise = 0;
-        if (dst->stats.signalstrength > 0)
-                quality = (dst->stats.signalstrength * 5 + src->stats.signalstrength + 5)/6;
-        signal = ieee80211_TranslateToDbm(quality);
-        //noise = signal - src->stats.noise;
-        if (dst->stats.noise > 0)
-                noise = (dst->stats.noise * 5 + src->stats.noise)/6;
-        //if(strcmp(dst->ssid, "linksys_lzm000") == 0)
-//      printk("ssid:%s, quality:%d, signal:%d\n", dst->ssid, quality, signal);
-        memcpy(&dst->stats, &src->stats, sizeof(struct ieee80211_rx_stats));
-        dst->stats.signalstrength = quality;
-        dst->stats.signal = signal;
-//      printk("==================>stats.signal is %d\n",dst->stats.signal);
-        dst->stats.noise = noise;
-        dst->capability = src->capability;
-        memcpy(dst->rates, src->rates, src->rates_len);
-        dst->rates_len = src->rates_len;
-        memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len);
-        dst->rates_ex_len = src->rates_ex_len;
-        dst->HighestOperaRate = src->HighestOperaRate;
-        //printk("==========>in %s: src->ssid is %s,chan is %d\n",__func__,src->ssid,src->channel);
-        //YJ,add,080819,for hidden ap
-        if (src->ssid_len > 0) {
-                //if(src->ssid_len == 13)
-                //      printk("=====================>>>>>>>> Dst ssid: %s Src ssid: %s\n", dst->ssid, src->ssid);
-                memset(dst->ssid, 0, dst->ssid_len);
-                dst->ssid_len = src->ssid_len;
-                memcpy(dst->ssid, src->ssid, src->ssid_len);
-        }
-        //YJ,add,080819,for hidden ap,end
-        dst->channel = src->channel;
-        dst->mode = src->mode;
-        dst->flags = src->flags;
-        dst->time_stamp[0] = src->time_stamp[0];
-        dst->time_stamp[1] = src->time_stamp[1];
-        dst->beacon_interval = src->beacon_interval;
-        dst->listen_interval = src->listen_interval;
-        dst->atim_window = src->atim_window;
-        dst->dtim_period = src->dtim_period;
-        dst->dtim_data = src->dtim_data;
-        dst->last_dtim_sta_time[0] = src->last_dtim_sta_time[0];
-        dst->last_dtim_sta_time[1] = src->last_dtim_sta_time[1];
-//      printk("update:%s, dtim_period:%x, dtim_data:%x\n", src->ssid, src->dtim_period, src->dtim_data);
-        memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
-        dst->wpa_ie_len = src->wpa_ie_len;
-        memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len);
-        dst->rsn_ie_len = src->rsn_ie_len;
-        dst->last_scanned = jiffies;
-        /* dst->last_associate is not overwritten */
-// disable QoS process now, added by David 2006/7/25
-#if 1
-        dst->wmm_info = src->wmm_info; //sure to exist in beacon or probe response frame.
-/*
-        if((dst->wmm_info^src->wmm_info)&0x0f) {//Param Set Count change, update Parameter
-          memcpy(dst->wmm_param, src->wmm_param, IEEE80211_AC_PRAM_LEN);
-        }
-*/
-        if (src->wmm_param[0].ac_aci_acm_aifsn || \
-           src->wmm_param[1].ac_aci_acm_aifsn || \
-           src->wmm_param[2].ac_aci_acm_aifsn || \
-           src->wmm_param[3].ac_aci_acm_aifsn) {
-                memcpy(dst->wmm_param, src->wmm_param, WME_AC_PRAM_LEN);
-        }
-        dst->QoS_Enable = src->QoS_Enable;
-#else
-        dst->QoS_Enable = 1;//for Rtl8187 simulation
-#endif
-        dst->SignalStrength = src->SignalStrength;
-        dst->Turbo_Enable = src->Turbo_Enable;
-        dst->CountryIeLen = src->CountryIeLen;
-        memcpy(dst->CountryIeBuf, src->CountryIeBuf, src->CountryIeLen);
-}
-inline void
-ieee80211_process_probe_response(struct ieee80211_device *ieee,
-                                 struct ieee80211_probe_response *beacon,
-                                 struct ieee80211_rx_stats *stats)
-{
-        struct ieee80211_network network;
-        struct ieee80211_network *target;
-        struct ieee80211_network *oldest = NULL;
-#ifdef CONFIG_IEEE80211_DEBUG
-        struct ieee80211_info_element *info_element = &beacon->info_element;
-#endif
-        unsigned long flags;
-        short renew;
-        u8 wmm_info;
-        u8 is_beacon = (WLAN_FC_GET_STYPE(beacon->header.frame_ctl) == IEEE80211_STYPE_BEACON) ? 1 : 0;  //YJ,add,080819,for hidden ap
-        memset(&network, 0, sizeof(struct ieee80211_network));
-        IEEE80211_DEBUG_SCAN(
-                "'%s' (%pM): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
-                escape_essid(info_element->data, info_element->len),
-                beacon->header.addr3,
-                (beacon->capability & (1<<0xf)) ? '1' : '0',
-                (beacon->capability & (1<<0xe)) ? '1' : '0',
-                (beacon->capability & (1<<0xd)) ? '1' : '0',
-                (beacon->capability & (1<<0xc)) ? '1' : '0',
-                (beacon->capability & (1<<0xb)) ? '1' : '0',
-                (beacon->capability & (1<<0xa)) ? '1' : '0',
-                (beacon->capability & (1<<0x9)) ? '1' : '0',
-                (beacon->capability & (1<<0x8)) ? '1' : '0',
-                (beacon->capability & (1<<0x7)) ? '1' : '0',
-                (beacon->capability & (1<<0x6)) ? '1' : '0',
-                (beacon->capability & (1<<0x5)) ? '1' : '0',
-                (beacon->capability & (1<<0x4)) ? '1' : '0',
-                (beacon->capability & (1<<0x3)) ? '1' : '0',
-                (beacon->capability & (1<<0x2)) ? '1' : '0',
-                (beacon->capability & (1<<0x1)) ? '1' : '0',
-                (beacon->capability & (1<<0x0)) ? '1' : '0');
-        if (ieee80211_network_init(ieee, beacon, &network, stats)) {
-                IEEE80211_DEBUG_SCAN("Dropped '%s' (%pM) via %s.\n",
-                                     escape_essid(info_element->data,
-                                                  info_element->len),
-                                     beacon->header.addr3,
-                                     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
-                                     IEEE80211_STYPE_PROBE_RESP ?
-                                     "PROBE RESPONSE" : "BEACON");
-                return;
-        }
-        // For Asus EeePc request,
-        // (1) if wireless adapter receive get any 802.11d country code in AP beacon,
-        //         wireless adapter should follow the country code.
-        // (2)  If there is no any country code in beacon,
-        //       then wireless adapter should do active scan from ch1~11 and
-        //       passive scan from ch12~14
-        if (ieee->bGlobalDomain) {
-                if (WLAN_FC_GET_STYPE(beacon->header.frame_ctl) == IEEE80211_STYPE_PROBE_RESP) {
-                        // Case 1: Country code
-                        if (IS_COUNTRY_IE_VALID(ieee)) {
-                                if (!IsLegalChannel(ieee, network.channel)) {
-                                        printk("GetScanInfo(): For Country code, filter probe response at channel(%d).\n", network.channel);
-                                        return;
-                                }
-                        }
-                        // Case 2: No any country code.
-                        else {
-                                // Filter over channel ch12~14
-                                if (network.channel > 11) {
-                                        printk("GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n", network.channel);
-                                        return;
-                                }
-                        }
-                } else {
-                        // Case 1: Country code
-                        if (IS_COUNTRY_IE_VALID(ieee)) {
-                                if (!IsLegalChannel(ieee, network.channel)) {
-                                        printk("GetScanInfo(): For Country code, filter beacon at channel(%d).\n", network.channel);
-                                        return;
-                                }
-                        }
-                        // Case 2: No any country code.
-                        else {
-                                // Filter over channel ch12~14
-                                if (network.channel > 14) {
-                                        printk("GetScanInfo(): For Global Domain, filter beacon at channel(%d).\n", network.channel);
-                                        return;
-                                }
-                        }
-                }
-        }
-        /* The network parsed correctly -- so now we scan our known networks
-         * to see if we can find it in our list.
-         *
-         * NOTE:  This search is definitely not optimized.  Once its doing
-         *        the "right thing" we'll optimize it for efficiency if
-         *        necessary */
-        /* Search for this entry in the list and update it if it is
-         * already there. */
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (is_same_network(&ieee->current_network, &network, ieee)) {
-                wmm_info = ieee->current_network.wmm_info;
-                //YJ,add,080819,for hidden ap
-                if (is_beacon == 0)
-                        network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & ieee->current_network.flags);
-                else if (ieee->state == IEEE80211_LINKED)
-                        ieee->NumRxBcnInPeriod++;
-                //YJ,add,080819,for hidden ap,end
-                //printk("====>network.ssid=%s cur_ssid=%s\n", network.ssid, ieee->current_network.ssid);
-                update_network(&ieee->current_network, &network);
-        }
-        list_for_each_entry(target, &ieee->network_list, list) {
-                if (is_same_network(target, &network, ieee))
-                        break;
-                if ((oldest == NULL) ||
-                    (target->last_scanned < oldest->last_scanned))
-                        oldest = target;
-        }
-        /* If we didn't find a match, then get a new network slot to initialize
-         * with this beacon's information */
-        if (&target->list == &ieee->network_list) {
-                if (list_empty(&ieee->network_free_list)) {
-                        /* If there are no more slots, expire the oldest */
-                        list_del(&oldest->list);
-                        target = oldest;
-                        IEEE80211_DEBUG_SCAN("Expired '%s' (%pM) from "
-                                             "network list.\n",
-                                             escape_essid(target->ssid,
-                                                          target->ssid_len),
-                                             target->bssid);
-                } else {
-                        /* Otherwise just pull from the free list */
-                        target = list_entry(ieee->network_free_list.next,
-                                            struct ieee80211_network, list);
-                        list_del(ieee->network_free_list.next);
-                }
-#ifdef CONFIG_IEEE80211_DEBUG
-                IEEE80211_DEBUG_SCAN("Adding '%s' (%pM) via %s.\n",
-                                     escape_essid(network.ssid,
-                                                  network.ssid_len),
-                                     network.bssid,
-                                     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
-                                     IEEE80211_STYPE_PROBE_RESP ?
-                                     "PROBE RESPONSE" : "BEACON");
-#endif
-                memcpy(target, &network, sizeof(*target));
-                list_add_tail(&target->list, &ieee->network_list);
-        } else {
-                IEEE80211_DEBUG_SCAN("Updating '%s' (%pM) via %s.\n",
-                                     escape_essid(target->ssid,
-                                                  target->ssid_len),
-                                     target->bssid,
-                                     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
-                                     IEEE80211_STYPE_PROBE_RESP ?
-                                     "PROBE RESPONSE" : "BEACON");
-                /* we have an entry and we are going to update it. But this entry may
-                 * be already expired. In this case we do the same as we found a new
-                 * net and call the new_net handler
-                 */
-                renew = !time_after(target->last_scanned + ieee->scan_age, jiffies);
-                //YJ,add,080819,for hidden ap
-                if (is_beacon == 0)
-                        network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & target->flags);
-                //if(strncmp(network.ssid, "linksys-c",9) == 0)
-                //      printk("====>2 network.ssid=%s FLAG=%d target.ssid=%s FLAG=%d\n", network.ssid, network.flags, target->ssid, target->flags);
-                if (((network.flags & NETWORK_EMPTY_ESSID) == NETWORK_EMPTY_ESSID) \
-                    && (((network.ssid_len > 0) && (strncmp(target->ssid, network.ssid, network.ssid_len)))\
-                    || ((ieee->current_network.ssid_len == network.ssid_len) && (strncmp(ieee->current_network.ssid, network.ssid, network.ssid_len) == 0) && (ieee->state == IEEE80211_NOLINK))))
-                        renew = 1;
-                //YJ,add,080819,for hidden ap,end
-                update_network(target, &network);
-        }
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-void ieee80211_rx_mgt(struct ieee80211_device *ieee,
-                      struct ieee80211_hdr_4addr *header,
-                      struct ieee80211_rx_stats *stats)
-{
-        switch (WLAN_FC_GET_STYPE(header->frame_ctl)) {
-        case IEEE80211_STYPE_BEACON:
-                IEEE80211_DEBUG_MGMT("received BEACON (%d)\n",
-                                     WLAN_FC_GET_STYPE(header->frame_ctl));
-                IEEE80211_DEBUG_SCAN("Beacon\n");
-                ieee80211_process_probe_response(
-                        ieee, (struct ieee80211_probe_response *)header, stats);
-                break;
-        case IEEE80211_STYPE_PROBE_RESP:
-                IEEE80211_DEBUG_MGMT("received PROBE RESPONSE (%d)\n",
-                                     WLAN_FC_GET_STYPE(header->frame_ctl));
-                IEEE80211_DEBUG_SCAN("Probe response\n");
-                ieee80211_process_probe_response(
-                        ieee, (struct ieee80211_probe_response *)header, stats);
-                break;
-        }
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
deleted file mode 100644
index 03eb164798cd..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
+++ /dev/null
@@ -1,2711 +0,0 @@
-/* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
- *
- * Mostly extracted from the rtl8180-sa2400 driver for the
- * in-kernel generic ieee802.11 stack.
- *
- * Few lines might be stolen from other part of the ieee80211
- * stack. Copyright who own it's copyright
- *
- * WPA code stolen from the ipw2200 driver.
- * Copyright who own it's copyright.
- *
- * released under the GPL
- */
-#include "ieee80211.h"
-#include <linux/random.h>
-#include <linux/delay.h>
-#include <linux/slab.h>
-#include <linux/interrupt.h>
-#include <linux/uaccess.h>
-#include <linux/etherdevice.h>
-#include "dot11d.h"
-short ieee80211_is_54g(const struct ieee80211_network *net)
-{
-        return (net->rates_ex_len > 0) || (net->rates_len > 4);
-}
-short ieee80211_is_shortslot(const struct ieee80211_network *net)
-{
-        return net->capability & WLAN_CAPABILITY_SHORT_SLOT;
-}
-/* returns the total length needed for placing the RATE MFIE
- * tag and the EXTENDED RATE MFIE tag if needed.
- * It encludes two bytes per tag for the tag itself and its len
- */
-static unsigned int ieee80211_MFIE_rate_len(struct ieee80211_device *ieee)
-{
-        unsigned int rate_len = 0;
-        if (ieee->modulation & IEEE80211_CCK_MODULATION)
-                rate_len = IEEE80211_CCK_RATE_LEN + 2;
-        if (ieee->modulation & IEEE80211_OFDM_MODULATION)
-                rate_len += IEEE80211_OFDM_RATE_LEN + 2;
-        return rate_len;
-}
-/* place the MFIE rate, tag to the memory (double) poised.
- * Then it updates the pointer so that it points after the new MFIE tag added.
- */
-static void ieee80211_MFIE_Brate(struct ieee80211_device *ieee, u8 **tag_p)
-{
-        u8 *tag = *tag_p;
-        if (ieee->modulation & IEEE80211_CCK_MODULATION) {
-                *tag++ = MFIE_TYPE_RATES;
-                *tag++ = 4;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
-        }
-        /* We may add an option for custom rates that specific HW might support */
-        *tag_p = tag;
-}
-static void ieee80211_MFIE_Grate(struct ieee80211_device *ieee, u8 **tag_p)
-{
-        u8 *tag = *tag_p;
-                if (ieee->modulation & IEEE80211_OFDM_MODULATION) {
-                *tag++ = MFIE_TYPE_RATES_EX;
-                *tag++ = 8;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
-                *tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
-        }
-        /* We may add an option for custom rates that specific HW might support */
-        *tag_p = tag;
-}
-static void ieee80211_WMM_Info(struct ieee80211_device *ieee, u8 **tag_p)
-{
-        u8 *tag = *tag_p;
-        *tag++ = MFIE_TYPE_GENERIC; /* 0 */
-        *tag++ = 7;
-        *tag++ = 0x00;
-        *tag++ = 0x50;
-        *tag++ = 0xf2;
-        *tag++ = 0x02; /* 5 */
-        *tag++ = 0x00;
-        *tag++ = 0x01;
-#ifdef SUPPORT_USPD
-        if (ieee->current_network.wmm_info & 0x80)
-                *tag++ = 0x0f|MAX_SP_Len;
-        else
-                *tag++ = MAX_SP_Len;
-#else
-        *tag++ = MAX_SP_Len;
-#endif
-        *tag_p = tag;
-}
-static void ieee80211_TURBO_Info(struct ieee80211_device *ieee, u8 **tag_p)
-{
-        u8 *tag = *tag_p;
-        *tag++ = MFIE_TYPE_GENERIC; /* 0 */
-        *tag++ = 7;
-        *tag++ = 0x00;
-        *tag++ = 0xe0;
-        *tag++ = 0x4c;
-        *tag++ = 0x01; /* 5 */
-        *tag++ = 0x02;
-        *tag++ = 0x11;
-        *tag++ = 0x00;
-        *tag_p = tag;
-        printk(KERN_ALERT "This is enable turbo mode IE process\n");
-}
-static void enqueue_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb)
-{
-        int nh;
-        nh = (ieee->mgmt_queue_head + 1) % MGMT_QUEUE_NUM;
-        ieee->mgmt_queue_head = nh;
-        ieee->mgmt_queue_ring[nh] = skb;
-}
-static struct sk_buff *dequeue_mgmt(struct ieee80211_device *ieee)
-{
-        struct sk_buff *ret;
-        if (ieee->mgmt_queue_tail == ieee->mgmt_queue_head)
-                return NULL;
-        ret = ieee->mgmt_queue_ring[ieee->mgmt_queue_tail];
-        ieee->mgmt_queue_tail =
-                (ieee->mgmt_queue_tail + 1) % MGMT_QUEUE_NUM;
-        return ret;
-}
-static void init_mgmt_queue(struct ieee80211_device *ieee)
-{
-        ieee->mgmt_queue_tail = ieee->mgmt_queue_head = 0;
-}
-void ieee80211_sta_wakeup(struct ieee80211_device *ieee, short nl);
-inline void softmac_mgmt_xmit(struct sk_buff *skb,
-                              struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
-        struct ieee80211_hdr_3addr  *header =
-                (struct ieee80211_hdr_3addr  *) skb->data;
-        spin_lock_irqsave(&ieee->lock, flags);
-        /* called with 2nd param 0, no mgmt lock required */
-        ieee80211_sta_wakeup(ieee, 0);
-        if (single) {
-                if (ieee->queue_stop) {
-                        enqueue_mgmt(ieee, skb);
-                } else {
-                        header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0]<<4);
-                        if (ieee->seq_ctrl[0] == 0xFFF)
-                                ieee->seq_ctrl[0] = 0;
-                        else
-                                ieee->seq_ctrl[0]++;
-                        /* avoid watchdog triggers */
-                        ieee->dev->trans_start = jiffies;
-                        ieee->softmac_data_hard_start_xmit(skb, ieee->dev, ieee->basic_rate);
-                }
-                spin_unlock_irqrestore(&ieee->lock, flags);
-        } else {
-                spin_unlock_irqrestore(&ieee->lock, flags);
-                spin_lock_irqsave(&ieee->mgmt_tx_lock, flags);
-                header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
-                if (ieee->seq_ctrl[0] == 0xFFF)
-                        ieee->seq_ctrl[0] = 0;
-                else
-                        ieee->seq_ctrl[0]++;
-                /* avoid watchdog triggers */
-                ieee->dev->trans_start = jiffies;
-                ieee->softmac_hard_start_xmit(skb, ieee->dev);
-                spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags);
-        }
-}
-inline void softmac_ps_mgmt_xmit(struct sk_buff *skb,
-                                 struct ieee80211_device *ieee)
-{
-        short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
-        struct ieee80211_hdr_3addr  *header =
-                (struct ieee80211_hdr_3addr  *) skb->data;
-        if (single) {
-                header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
-                if (ieee->seq_ctrl[0] == 0xFFF)
-                        ieee->seq_ctrl[0] = 0;
-                else
-                        ieee->seq_ctrl[0]++;
-                /* avoid watchdog triggers */
-                ieee->dev->trans_start = jiffies;
-                ieee->softmac_data_hard_start_xmit(skb, ieee->dev, ieee->basic_rate);
-        } else {
-                header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
-                if (ieee->seq_ctrl[0] == 0xFFF)
-                        ieee->seq_ctrl[0] = 0;
-                else
-                        ieee->seq_ctrl[0]++;
-                /* avoid watchdog triggers */
-                ieee->dev->trans_start = jiffies;
-                ieee->softmac_hard_start_xmit(skb, ieee->dev);
-        }
-}
-inline struct sk_buff *
-ieee80211_disassociate_skb(struct ieee80211_network *beacon,
-                           struct ieee80211_device *ieee, u8 asRsn)
-{
-        struct sk_buff *skb;
-        struct ieee80211_disassoc_frame *disass;
-        skb = dev_alloc_skb(sizeof(struct ieee80211_disassoc_frame));
-        if (!skb)
-                return NULL;
-        disass = (struct ieee80211_disassoc_frame *) skb_put(skb, sizeof(struct ieee80211_disassoc_frame));
-        disass->header.frame_control = cpu_to_le16(IEEE80211_STYPE_DISASSOC);
-        disass->header.duration_id = 0;
-        memcpy(disass->header.addr1, beacon->bssid, ETH_ALEN);
-        memcpy(disass->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(disass->header.addr3, beacon->bssid, ETH_ALEN);
-        disass->reasoncode = asRsn;
-        return skb;
-}
-void SendDisassociation(struct ieee80211_device *ieee, u8 *asSta, u8 asRsn)
-{
-        struct ieee80211_network *beacon = &ieee->current_network;
-        struct sk_buff *skb;
-        skb = ieee80211_disassociate_skb(beacon, ieee, asRsn);
-        if (skb)
-                softmac_mgmt_xmit(skb, ieee);
-}
-inline struct sk_buff *ieee80211_probe_req(struct ieee80211_device *ieee)
-{
-        unsigned int len, rate_len;
-        u8 *tag;
-        struct sk_buff *skb;
-        struct ieee80211_probe_request *req;
-        len = ieee->current_network.ssid_len;
-        rate_len = ieee80211_MFIE_rate_len(ieee);
-        skb = dev_alloc_skb(sizeof(struct ieee80211_probe_request) +
-                            2 + len + rate_len);
-        if (!skb)
-                return NULL;
-        req = (struct ieee80211_probe_request *) skb_put(skb, sizeof(struct ieee80211_probe_request));
-        req->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
-        req->header.duration_id = 0; /* FIXME: is this OK ? */
-        memset(req->header.addr1, 0xff, ETH_ALEN);
-        memcpy(req->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
-        memset(req->header.addr3, 0xff, ETH_ALEN);
-        tag = (u8 *) skb_put(skb, len + 2 + rate_len);
-        *tag++ = MFIE_TYPE_SSID;
-        *tag++ = len;
-        memcpy(tag, ieee->current_network.ssid, len);
-        tag += len;
-        ieee80211_MFIE_Brate(ieee, &tag);
-        ieee80211_MFIE_Grate(ieee, &tag);
-        return skb;
-}
-struct sk_buff *ieee80211_get_beacon_(struct ieee80211_device *ieee);
-static void ieee80211_send_beacon(struct ieee80211_device *ieee)
-{
-        struct sk_buff *skb;
-        skb = ieee80211_get_beacon_(ieee);
-        if (skb) {
-                softmac_mgmt_xmit(skb, ieee);
-                ieee->softmac_stats.tx_beacons++;
-                dev_kfree_skb_any(skb);
-        }
-        ieee->beacon_timer.expires = jiffies +
-                (MSECS(ieee->current_network.beacon_interval - 5));
-        if (ieee->beacon_txing)
-                add_timer(&ieee->beacon_timer);
-}
-static void ieee80211_send_beacon_cb(unsigned long _ieee)
-{
-        struct ieee80211_device *ieee =
-                (struct ieee80211_device *) _ieee;
-        unsigned long flags;
-        spin_lock_irqsave(&ieee->beacon_lock, flags);
-        ieee80211_send_beacon(ieee);
-        spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-}
-static void ieee80211_send_probe(struct ieee80211_device *ieee)
-{
-        struct sk_buff *skb;
-        skb = ieee80211_probe_req(ieee);
-        if (skb) {
-                softmac_mgmt_xmit(skb, ieee);
-                ieee->softmac_stats.tx_probe_rq++;
-        }
-}
-static void ieee80211_send_probe_requests(struct ieee80211_device *ieee)
-{
-        if (ieee->active_scan && (ieee->softmac_features & IEEE_SOFTMAC_PROBERQ)) {
-                ieee80211_send_probe(ieee);
-                ieee80211_send_probe(ieee);
-        }
-}
-/* this performs syncro scan blocking the caller until all channels
- * in the allowed channel map has been checked.
- */
-static void ieee80211_softmac_scan_syncro(struct ieee80211_device *ieee)
-{
-        short ch = 0;
-        u8 channel_map[MAX_CHANNEL_NUMBER+1];
-        memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
-        down(&ieee->scan_sem);
-        while (1) {
-                do {
-                        ch++;
-                        if (ch > MAX_CHANNEL_NUMBER)
-                                goto out; /* scan completed */
-                } while (!channel_map[ch]);
-                /* this function can be called in two situations
-                 * 1- We have switched to ad-hoc mode and we are
-                 *    performing a complete syncro scan before conclude
-                 *    there are no interesting cell and to create a
-                 *    new one. In this case the link state is
-                 *    IEEE80211_NOLINK until we found an interesting cell.
-                 *    If so the ieee8021_new_net, called by the RX path
-                 *    will set the state to IEEE80211_LINKED, so we stop
-                 *    scanning
-                 * 2- We are linked and the root uses run iwlist scan.
-                 *    So we switch to IEEE80211_LINKED_SCANNING to remember
-                 *    that we are still logically linked (not interested in
-                 *    new network events, despite for updating the net list,
-                 *    but we are temporarily 'unlinked' as the driver shall
-                 *    not filter RX frames and the channel is changing.
-                 * So the only situation in witch are interested is to check
-                 * if the state become LINKED because of the #1 situation
-                 */
-                if (ieee->state == IEEE80211_LINKED)
-                        goto out;
-                ieee->set_chan(ieee->dev, ch);
-                if (channel_map[ch] == 1)
-                        ieee80211_send_probe_requests(ieee);
-                /* this prevent excessive time wait when we
-                 * need to wait for a syncro scan to end..
-                 */
-                if (ieee->sync_scan_hurryup)
-                        goto out;
-                msleep_interruptible_rtl(IEEE80211_SOFTMAC_SCAN_TIME);
-        }
-out:
-        ieee->sync_scan_hurryup = 0;
-        up(&ieee->scan_sem);
-        if (IS_DOT11D_ENABLE(ieee))
-                DOT11D_ScanComplete(ieee);
-}
-void ieee80211_softmac_ips_scan_syncro(struct ieee80211_device *ieee)
-{
-        int ch;
-        unsigned int watch_dog = 0;
-        u8 channel_map[MAX_CHANNEL_NUMBER+1];
-        memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
-        down(&ieee->scan_sem);
-        ch = ieee->current_network.channel;
-        while (1) {
-                /* this function can be called in two situations
-                 * 1- We have switched to ad-hoc mode and we are
-                 *    performing a complete syncro scan before conclude
-                 *    there are no interesting cell and to create a
-                 *    new one. In this case the link state is
-                 *    IEEE80211_NOLINK until we found an interesting cell.
-                 *    If so the ieee8021_new_net, called by the RX path
-                 *    will set the state to IEEE80211_LINKED, so we stop
-                 *    scanning
-                 * 2- We are linked and the root uses run iwlist scan.
-                 *    So we switch to IEEE80211_LINKED_SCANNING to remember
-                 *    that we are still logically linked (not interested in
-                 *    new network events, despite for updating the net list,
-                 *    but we are temporarily 'unlinked' as the driver shall
-                 *    not filter RX frames and the channel is changing.
-                 * So the only situation in witch are interested is to check
-                 * if the state become LINKED because of the #1 situation
-                 */
-                if (ieee->state == IEEE80211_LINKED)
-                        goto out;
-                if (channel_map[ieee->current_network.channel] > 0)
-                        ieee->set_chan(ieee->dev, ieee->current_network.channel);
-                if (channel_map[ieee->current_network.channel] == 1)
-                        ieee80211_send_probe_requests(ieee);
-                msleep_interruptible_rtl(IEEE80211_SOFTMAC_SCAN_TIME);
-                do {
-                        if (watch_dog++ >= MAX_CHANNEL_NUMBER)
-                                goto out; /* scan completed */
-                        ieee->current_network.channel = (ieee->current_network.channel + 1)%MAX_CHANNEL_NUMBER;
-                } while (!channel_map[ieee->current_network.channel]);
-        }
-out:
-        ieee->actscanning = false;
-        up(&ieee->scan_sem);
-        if (IS_DOT11D_ENABLE(ieee))
-                DOT11D_ScanComplete(ieee);
-}
-static void ieee80211_softmac_scan_wq(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, softmac_scan_wq);
-        static short watchdog;
-        u8 channel_map[MAX_CHANNEL_NUMBER+1];
-        memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
-        down(&ieee->scan_sem);
-        do {
-                ieee->current_network.channel =
-                        (ieee->current_network.channel + 1) % MAX_CHANNEL_NUMBER;
-                if (watchdog++ > MAX_CHANNEL_NUMBER)
-                                goto out; /* no good chans */
-        } while (!channel_map[ieee->current_network.channel]);
-        if (ieee->scanning == 0) {
-                printk("error out, scanning = 0\n");
-                goto out;
-        }
-        ieee->set_chan(ieee->dev, ieee->current_network.channel);
-        if (channel_map[ieee->current_network.channel] == 1)
-                ieee80211_send_probe_requests(ieee);
-        queue_delayed_work(ieee->wq, &ieee->softmac_scan_wq, IEEE80211_SOFTMAC_SCAN_TIME);
-        up(&ieee->scan_sem);
-        return;
-out:
-        ieee->actscanning = false;
-        watchdog = 0;
-        ieee->scanning = 0;
-        up(&ieee->scan_sem);
-        if (IS_DOT11D_ENABLE(ieee))
-                DOT11D_ScanComplete(ieee);
-        return;
-}
-static void ieee80211_beacons_start(struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&ieee->beacon_lock, flags);
-        ieee->beacon_txing = 1;
-        ieee80211_send_beacon(ieee);
-        spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-}
-static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&ieee->beacon_lock, flags);
-        ieee->beacon_txing = 0;
-        del_timer_sync(&ieee->beacon_timer);
-        spin_unlock_irqrestore(&ieee->beacon_lock, flags);
-}
-void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
-{
-        if (ieee->stop_send_beacons)
-                ieee->stop_send_beacons(ieee->dev);
-        if (ieee->softmac_features & IEEE_SOFTMAC_BEACONS)
-                ieee80211_beacons_stop(ieee);
-}
-void ieee80211_start_send_beacons(struct ieee80211_device *ieee)
-{
-        if (ieee->start_send_beacons)
-                ieee->start_send_beacons(ieee->dev);
-        if (ieee->softmac_features & IEEE_SOFTMAC_BEACONS)
-                ieee80211_beacons_start(ieee);
-}
-static void ieee80211_softmac_stop_scan(struct ieee80211_device *ieee)
-{
-        down(&ieee->scan_sem);
-        if (ieee->scanning == 1) {
-                ieee->scanning = 0;
-                cancel_delayed_work(&ieee->softmac_scan_wq);
-        }
-        up(&ieee->scan_sem);
-}
-void ieee80211_stop_scan(struct ieee80211_device *ieee)
-{
-        if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
-                ieee80211_softmac_stop_scan(ieee);
-        else
-                ieee->stop_scan(ieee->dev);
-}
-/* called with ieee->lock held */
-void ieee80211_rtl_start_scan(struct ieee80211_device *ieee)
-{
-        if (IS_DOT11D_ENABLE(ieee)) {
-                if (IS_COUNTRY_IE_VALID(ieee))
-                        RESET_CIE_WATCHDOG(ieee);
-        }
-        if (ieee->softmac_features & IEEE_SOFTMAC_SCAN) {
-                if (ieee->scanning == 0) {
-                        ieee->scanning = 1;
-#if 1
-                        queue_delayed_work(ieee->wq, &ieee->softmac_scan_wq, 0);
-#endif
-                }
-        }else
-                ieee->start_scan(ieee->dev);
-}
-/* called with wx_sem held */
-void ieee80211_start_scan_syncro(struct ieee80211_device *ieee)
-{
-        if (IS_DOT11D_ENABLE(ieee)) {
-                if (IS_COUNTRY_IE_VALID(ieee))
-                        RESET_CIE_WATCHDOG(ieee);
-        }
-        ieee->sync_scan_hurryup = 0;
-        if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
-                ieee80211_softmac_scan_syncro(ieee);
-        else
-                ieee->scan_syncro(ieee->dev);
-}
-inline struct sk_buff *
-ieee80211_authentication_req(struct ieee80211_network *beacon,
-                             struct ieee80211_device *ieee, int challengelen)
-{
-        struct sk_buff *skb;
-        struct ieee80211_authentication *auth;
-        skb = dev_alloc_skb(sizeof(struct ieee80211_authentication) + challengelen);
-        if (!skb)
-                return NULL;
-        auth = (struct ieee80211_authentication *)
-                skb_put(skb, sizeof(struct ieee80211_authentication));
-        auth->header.frame_ctl = IEEE80211_STYPE_AUTH;
-        if (challengelen)
-                auth->header.frame_ctl |= IEEE80211_FCTL_WEP;
-        auth->header.duration_id = 0x013a; /* FIXME */
-        memcpy(auth->header.addr1, beacon->bssid, ETH_ALEN);
-        memcpy(auth->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(auth->header.addr3, beacon->bssid, ETH_ALEN);
-        auth->algorithm = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
-        auth->transaction = cpu_to_le16(ieee->associate_seq);
-        ieee->associate_seq++;
-        auth->status = cpu_to_le16(WLAN_STATUS_SUCCESS);
-        return skb;
-}
-static struct sk_buff *ieee80211_probe_resp(struct ieee80211_device *ieee,
-                                            u8 *dest)
-{
-        u8 *tag;
-        int beacon_size;
-        struct ieee80211_probe_response *beacon_buf;
-        struct sk_buff *skb;
-        int encrypt;
-        int atim_len, erp_len;
-        struct ieee80211_crypt_data *crypt;
-        char *ssid = ieee->current_network.ssid;
-        int ssid_len = ieee->current_network.ssid_len;
-        int rate_len = ieee->current_network.rates_len+2;
-        int rate_ex_len = ieee->current_network.rates_ex_len;
-        int wpa_ie_len = ieee->wpa_ie_len;
-        if (rate_ex_len > 0)
-                rate_ex_len += 2;
-        if (ieee->current_network.capability & WLAN_CAPABILITY_IBSS)
-                atim_len = 4;
-        else
-                atim_len = 0;
-        if (ieee80211_is_54g(&ieee->current_network))
-                erp_len = 3;
-        else
-                erp_len = 0;
-        beacon_size = sizeof(struct ieee80211_probe_response)+
-                ssid_len
-                +3 /* channel */
-                +rate_len
-                +rate_ex_len
-                +atim_len
-                +wpa_ie_len
-                +erp_len;
-        skb = dev_alloc_skb(beacon_size);
-        if (!skb)
-                return NULL;
-        beacon_buf = (struct ieee80211_probe_response *) skb_put(skb, beacon_size);
-        memcpy(beacon_buf->header.addr1, dest, ETH_ALEN);
-        memcpy(beacon_buf->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(beacon_buf->header.addr3, ieee->current_network.bssid, ETH_ALEN);
-        beacon_buf->header.duration_id = 0; /* FIXME */
-        beacon_buf->beacon_interval =
-                cpu_to_le16(ieee->current_network.beacon_interval);
-        beacon_buf->capability =
-                cpu_to_le16(ieee->current_network.capability & WLAN_CAPABILITY_IBSS);
-        if (ieee->short_slot && (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_SLOT))
-                beacon_buf->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
-        crypt = ieee->crypt[ieee->tx_keyidx];
-        encrypt = ieee->host_encrypt && crypt && crypt->ops &&
-                ((0 == strcmp(crypt->ops->name, "WEP")) || wpa_ie_len);
-        if (encrypt)
-                beacon_buf->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
-        beacon_buf->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_RESP);
-        beacon_buf->info_element.id = MFIE_TYPE_SSID;
-        beacon_buf->info_element.len = ssid_len;
-        tag = (u8 *) beacon_buf->info_element.data;
-        memcpy(tag, ssid, ssid_len);
-        tag += ssid_len;
-        *(tag++) = MFIE_TYPE_RATES;
-        *(tag++) = rate_len - 2;
-        memcpy(tag, ieee->current_network.rates, rate_len-2);
-        tag += rate_len - 2;
-        *(tag++) = MFIE_TYPE_DS_SET;
-        *(tag++) = 1;
-        *(tag++) = ieee->current_network.channel;
-        if (atim_len) {
-                *(tag++) = MFIE_TYPE_IBSS_SET;
-                *(tag++) = 2;
-                *((u16 *)(tag)) = cpu_to_le16(ieee->current_network.atim_window);
-                tag += 2;
-        }
-        if (erp_len) {
-                *(tag++) = MFIE_TYPE_ERP;
-                *(tag++) = 1;
-                *(tag++) = 0;
-        }
-        if (rate_ex_len) {
-                *(tag++) = MFIE_TYPE_RATES_EX;
-                *(tag++) = rate_ex_len-2;
-                memcpy(tag, ieee->current_network.rates_ex, rate_ex_len-2);
-                tag += rate_ex_len - 2;
-        }
-        if (wpa_ie_len) {
-                if (ieee->iw_mode == IW_MODE_ADHOC) {
-                        /* as Windows will set pairwise key same as the group
-                         * key which is not allowed in Linux, so set this for
-                         * IOT issue.
-                         */
-                        memcpy(&ieee->wpa_ie[14], &ieee->wpa_ie[8], 4);
-                }
-                memcpy(tag, ieee->wpa_ie, ieee->wpa_ie_len);
-        }
-        skb->dev = ieee->dev;
-        return skb;
-}
-static struct sk_buff *ieee80211_assoc_resp(struct ieee80211_device *ieee,
-                                            u8 *dest)
-{
-        struct sk_buff *skb;
-        u8 *tag;
-        struct ieee80211_crypt_data *crypt;
-        struct ieee80211_assoc_response_frame *assoc;
-        short encrypt;
-        unsigned int rate_len = ieee80211_MFIE_rate_len(ieee);
-        int len = sizeof(struct ieee80211_assoc_response_frame) + rate_len;
-        skb = dev_alloc_skb(len);
-        if (!skb)
-                return NULL;
-        assoc = (struct ieee80211_assoc_response_frame *)
-                skb_put(skb, sizeof(struct ieee80211_assoc_response_frame));
-        assoc->header.frame_control = cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP);
-        memcpy(assoc->header.addr1, dest, ETH_ALEN);
-        memcpy(assoc->header.addr3, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(assoc->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
-        assoc->capability = cpu_to_le16(ieee->iw_mode == IW_MODE_MASTER ?
-                WLAN_CAPABILITY_BSS : WLAN_CAPABILITY_IBSS);
-        if (ieee->short_slot)
-                assoc->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
-        if (ieee->host_encrypt)
-                crypt = ieee->crypt[ieee->tx_keyidx];
-        else
-                crypt = NULL;
-        encrypt = (crypt && crypt->ops);
-        if (encrypt)
-                assoc->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
-        assoc->status = 0;
-        assoc->aid = cpu_to_le16(ieee->assoc_id);
-        if (ieee->assoc_id == 0x2007)
-                ieee->assoc_id = 0;
-        else
-                ieee->assoc_id++;
-        tag = (u8 *) skb_put(skb, rate_len);
-        ieee80211_MFIE_Brate(ieee, &tag);
-        ieee80211_MFIE_Grate(ieee, &tag);
-        return skb;
-}
-static struct sk_buff *ieee80211_auth_resp(struct ieee80211_device *ieee,
-                                           int status, u8 *dest)
-{
-        struct sk_buff *skb;
-        struct ieee80211_authentication *auth;
-        skb = dev_alloc_skb(sizeof(struct ieee80211_authentication)+1);
-        if (!skb)
-                return NULL;
-        skb->len = sizeof(struct ieee80211_authentication);
-        auth = (struct ieee80211_authentication *)skb->data;
-        auth->status = cpu_to_le16(status);
-        auth->transaction = cpu_to_le16(2);
-        auth->algorithm = cpu_to_le16(WLAN_AUTH_OPEN);
-        memcpy(auth->header.addr3, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(auth->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(auth->header.addr1, dest, ETH_ALEN);
-        auth->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_AUTH);
-        return skb;
-}
-static struct sk_buff *ieee80211_null_func(struct ieee80211_device *ieee, short pwr)
-{
-        struct sk_buff *skb;
-        struct ieee80211_hdr_3addr *hdr;
-        skb = dev_alloc_skb(sizeof(struct ieee80211_hdr_3addr));
-        if (!skb)
-                return NULL;
-        hdr = (struct ieee80211_hdr_3addr *)skb_put(skb, sizeof(struct ieee80211_hdr_3addr));
-        memcpy(hdr->addr1, ieee->current_network.bssid, ETH_ALEN);
-        memcpy(hdr->addr2, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(hdr->addr3, ieee->current_network.bssid, ETH_ALEN);
-        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                IEEE80211_STYPE_NULLFUNC | IEEE80211_FCTL_TODS |
-                (pwr ? IEEE80211_FCTL_PM:0));
-        return skb;
-}
-static void ieee80211_resp_to_assoc_rq(struct ieee80211_device *ieee, u8 *dest)
-{
-        struct sk_buff *buf = ieee80211_assoc_resp(ieee, dest);
-        if (buf) {
-                softmac_mgmt_xmit(buf, ieee);
-                dev_kfree_skb_any(buf);
-        }
-}
-static void ieee80211_resp_to_auth(struct ieee80211_device *ieee, int s, u8 *dest)
-{
-        struct sk_buff *buf = ieee80211_auth_resp(ieee, s, dest);
-        if (buf) {
-                softmac_mgmt_xmit(buf, ieee);
-                dev_kfree_skb_any(buf);
-        }
-}
-static void ieee80211_resp_to_probe(struct ieee80211_device *ieee, u8 *dest)
-{
-        struct sk_buff *buf = ieee80211_probe_resp(ieee, dest);
-        if (buf) {
-                softmac_mgmt_xmit(buf, ieee);
-                dev_kfree_skb_any(buf);
-        }
-}
-inline struct sk_buff *
-ieee80211_association_req(struct ieee80211_network *beacon,
-                          struct ieee80211_device *ieee)
-{
-        struct sk_buff *skb;
-        struct ieee80211_assoc_request_frame *hdr;
-        u8 *tag;
-        unsigned int wpa_len = beacon->wpa_ie_len;
-#if 1
-        /* for testing purpose */
-        unsigned int rsn_len = beacon->rsn_ie_len;
-#endif
-        unsigned int rate_len = ieee80211_MFIE_rate_len(ieee);
-        unsigned int wmm_info_len = beacon->QoS_Enable?9:0;
-        unsigned int turbo_info_len = beacon->Turbo_Enable?9:0;
-        u8  encry_proto = ieee->wpax_type_notify & 0xff;
-        int len = 0;
-        /* [0] Notify type of encryption: WPA/WPA2
-         * [1] pair wise type
-         * [2] authen type
-         */
-        if (ieee->wpax_type_set) {
-                if (IEEE_PROTO_WPA == encry_proto) {
-                        rsn_len = 0;
-                } else if (IEEE_PROTO_RSN == encry_proto) {
-                        wpa_len = 0;
-                }
-        }
-        len = sizeof(struct ieee80211_assoc_request_frame)+
-                + beacon->ssid_len /* essid tagged val */
-                + rate_len /* rates tagged val */
-                + wpa_len
-                + rsn_len
-                + wmm_info_len
-                + turbo_info_len;
-        skb = dev_alloc_skb(len);
-        if (!skb)
-                return NULL;
-        hdr = (struct ieee80211_assoc_request_frame *)
-                skb_put(skb, sizeof(struct ieee80211_assoc_request_frame));
-        hdr->header.frame_control = IEEE80211_STYPE_ASSOC_REQ;
-        hdr->header.duration_id = 37; /* FIXME */
-        memcpy(hdr->header.addr1, beacon->bssid, ETH_ALEN);
-        memcpy(hdr->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
-        memcpy(hdr->header.addr3, beacon->bssid, ETH_ALEN);
-        memcpy(ieee->ap_mac_addr, beacon->bssid, ETH_ALEN); /* for HW security */
-        hdr->capability = cpu_to_le16(WLAN_CAPABILITY_BSS);
-        if (beacon->capability & WLAN_CAPABILITY_PRIVACY)
-                hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
-        if (beacon->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
-                hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE);
-        if (ieee->short_slot)
-                hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
-        hdr->listen_interval = 0xa; /* FIXME */
-        hdr->info_element.id = MFIE_TYPE_SSID;
-        hdr->info_element.len = beacon->ssid_len;
-        tag = skb_put(skb, beacon->ssid_len);
-        memcpy(tag, beacon->ssid, beacon->ssid_len);
-        tag = skb_put(skb, rate_len);
-        ieee80211_MFIE_Brate(ieee, &tag);
-        ieee80211_MFIE_Grate(ieee, &tag);
-        /* add rsn==0 condition for ap's mix security mode(wpa+wpa2)
-         * choose AES encryption as default algorithm while using mixed mode.
-         */
-        tag = skb_put(skb, ieee->wpa_ie_len);
-        memcpy(tag, ieee->wpa_ie, ieee->wpa_ie_len);
-        tag = skb_put(skb, wmm_info_len);
-        if (wmm_info_len)
-          ieee80211_WMM_Info(ieee, &tag);
-        tag = skb_put(skb, turbo_info_len);
-        if (turbo_info_len)
-                ieee80211_TURBO_Info(ieee, &tag);
-        return skb;
-}
-void ieee80211_associate_abort(struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&ieee->lock, flags);
-        ieee->associate_seq++;
-        /* don't scan, and avoid to have the RX path possibly
-         * try again to associate. Even do not react to AUTH or
-         * ASSOC response. Just wait for the retry wq to be scheduled.
-         * Here we will check if there are good nets to associate
-         * with, so we retry or just get back to NO_LINK and scanning
-         */
-        if (ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATING) {
-                IEEE80211_DEBUG_MGMT("Authentication failed\n");
-                ieee->softmac_stats.no_auth_rs++;
-        } else {
-                IEEE80211_DEBUG_MGMT("Association failed\n");
-                ieee->softmac_stats.no_ass_rs++;
-        }
-        ieee->state = IEEE80211_ASSOCIATING_RETRY;
-        queue_delayed_work(ieee->wq, &ieee->associate_retry_wq, IEEE80211_SOFTMAC_ASSOC_RETRY_TIME);
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-static void ieee80211_associate_abort_cb(unsigned long dev)
-{
-        ieee80211_associate_abort((struct ieee80211_device *) dev);
-}
-static void ieee80211_associate_step1(struct ieee80211_device *ieee)
-{
-        struct ieee80211_network *beacon = &ieee->current_network;
-        struct sk_buff *skb;
-        IEEE80211_DEBUG_MGMT("Stopping scan\n");
-        ieee->softmac_stats.tx_auth_rq++;
-        skb = ieee80211_authentication_req(beacon, ieee, 0);
-        if (!skb) {
-                ieee80211_associate_abort(ieee);
-        } else {
-                ieee->state = IEEE80211_ASSOCIATING_AUTHENTICATING;
-                IEEE80211_DEBUG_MGMT("Sending authentication request\n");
-                softmac_mgmt_xmit(skb, ieee);
-                /* BUGON when you try to add_timer twice, using mod_timer may
-                 * be better.
-                 */
-                if (!timer_pending(&ieee->associate_timer)) {
-                        ieee->associate_timer.expires = jiffies + (HZ / 2);
-                        add_timer(&ieee->associate_timer);
-                }
-                /* If call dev_kfree_skb_any,a warning will ocur....
-                 * KERNEL: assertion (!atomic_read(&skb->users)) failed at
-                 * net/core/dev.c (1708)
-                 */
-        }
-}
-static void ieee80211_rtl_auth_challenge(struct ieee80211_device *ieee, u8 *challenge,
-                                  int chlen)
-{
-        u8 *c;
-        struct sk_buff *skb;
-        struct ieee80211_network *beacon = &ieee->current_network;
-        del_timer_sync(&ieee->associate_timer);
-        ieee->associate_seq++;
-        ieee->softmac_stats.tx_auth_rq++;
-        skb = ieee80211_authentication_req(beacon, ieee, chlen+2);
-        if (!skb)
-                ieee80211_associate_abort(ieee);
-        else {
-                c = skb_put(skb, chlen+2);
-                *(c++) = MFIE_TYPE_CHALLENGE;
-                *(c++) = chlen;
-                memcpy(c, challenge, chlen);
-                IEEE80211_DEBUG_MGMT("Sending authentication challenge response\n");
-                ieee80211_encrypt_fragment(ieee, skb, sizeof(struct ieee80211_hdr_3addr));
-                softmac_mgmt_xmit(skb, ieee);
-                if (!timer_pending(&ieee->associate_timer)) {
-                ieee->associate_timer.expires = jiffies + (HZ / 2);
-                add_timer(&ieee->associate_timer);
-                }
-                dev_kfree_skb_any(skb);
-        }
-        kfree(challenge);
-}
-static void ieee80211_associate_step2(struct ieee80211_device *ieee)
-{
-        struct sk_buff *skb;
-        struct ieee80211_network *beacon = &ieee->current_network;
-        del_timer_sync(&ieee->associate_timer);
-        IEEE80211_DEBUG_MGMT("Sending association request\n");
-        ieee->softmac_stats.tx_ass_rq++;
-        skb = ieee80211_association_req(beacon, ieee);
-        if (!skb)
-                ieee80211_associate_abort(ieee);
-        else {
-                softmac_mgmt_xmit(skb, ieee);
-                if (!timer_pending(&ieee->associate_timer)) {
-                ieee->associate_timer.expires = jiffies + (HZ / 2);
-                add_timer(&ieee->associate_timer);
-                }
-        }
-}
-static void ieee80211_associate_complete_wq(struct work_struct *work)
-{
-        struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, associate_complete_wq);
-        printk(KERN_INFO "Associated successfully\n");
-        if (ieee80211_is_54g(&ieee->current_network) &&
-                (ieee->modulation & IEEE80211_OFDM_MODULATION)) {
-                ieee->rate = 540;
-                printk(KERN_INFO"Using G rates\n");
-        } else {
-                ieee->rate = 110;
-                printk(KERN_INFO"Using B rates\n");
-        }
-        ieee->link_change(ieee->dev);
-        notify_wx_assoc_event(ieee);
-        if (ieee->data_hard_resume)
-                ieee->data_hard_resume(ieee->dev);
-        netif_carrier_on(ieee->dev);
-}
-static void ieee80211_associate_complete(struct ieee80211_device *ieee)
-{
-        del_timer_sync(&ieee->associate_timer);
-        ieee->state = IEEE80211_LINKED;
-        IEEE80211_DEBUG_MGMT("Successfully associated\n");
-        queue_work(ieee->wq, &ieee->associate_complete_wq);
-}
-static void ieee80211_associate_procedure_wq(struct work_struct *work)
-{
-        struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, associate_procedure_wq);
-        ieee->sync_scan_hurryup = 1;
-        down(&ieee->wx_sem);
-        if (ieee->data_hard_stop)
-                ieee->data_hard_stop(ieee->dev);
-        ieee80211_stop_scan(ieee);
-        ieee->set_chan(ieee->dev, ieee->current_network.channel);
-        ieee->associate_seq = 1;
-        ieee80211_associate_step1(ieee);
-        up(&ieee->wx_sem);
-}
-inline void ieee80211_softmac_new_net(struct ieee80211_device *ieee,
-                                      struct ieee80211_network *net)
-{
-        u8 tmp_ssid[IW_ESSID_MAX_SIZE+1];
-        int tmp_ssid_len = 0;
-        short apset, ssidset, ssidbroad, apmatch, ssidmatch;
-        /* we are interested in new new only if we are not associated
-         * and we are not associating / authenticating
-         */
-        if (ieee->state != IEEE80211_NOLINK)
-                return;
-        if ((ieee->iw_mode == IW_MODE_INFRA) && !(net->capability & WLAN_CAPABILITY_BSS))
-                return;
-        if ((ieee->iw_mode == IW_MODE_ADHOC) && !(net->capability & WLAN_CAPABILITY_IBSS))
-                return;
-        if (ieee->iw_mode == IW_MODE_INFRA || ieee->iw_mode == IW_MODE_ADHOC) {
-                /* if the user specified the AP MAC, we need also the essid
-                 * This could be obtained by beacons or, if the network does not
-                 * broadcast it, it can be put manually.
-                 */
-                apset = ieee->wap_set;
-                ssidset = ieee->ssid_set;
-                ssidbroad =  !(net->ssid_len == 0 || net->ssid[0] == '\0');
-                apmatch = (memcmp(ieee->current_network.bssid, net->bssid, ETH_ALEN) == 0);
-                if (ieee->current_network.ssid_len != net->ssid_len)
-                        ssidmatch = 0;
-                else
-                        ssidmatch = (0 == strncmp(ieee->current_network.ssid, net->ssid, net->ssid_len));
-                /* if the user set the AP check if match.
-                 * if the network does not broadcast essid we check the user
-                 * supplied ANY essid
-                 * if the network does broadcast and the user does not set essid
-                 * it is OK
-                 * if the network does broadcast and the user did set essid
-                 * chech if essid match
-                 * (apset && apmatch && ((ssidset && ssidbroad && ssidmatch) ||
-                 *  (ssidbroad && !ssidset) || (!ssidbroad && ssidset))) ||
-                 * if the ap is not set, check that the user set the bssid and
-                 * the network does broadcast and that those two bssid matches
-                 * (!apset && ssidset && ssidbroad && ssidmatch)
-                 */
-                if ((apset && apmatch && ((ssidset && ssidbroad && ssidmatch) ||
-                     (ssidbroad && !ssidset) || (!ssidbroad && ssidset))) ||
-                    (!apset && ssidset && ssidbroad && ssidmatch)) {
-                        /* if the essid is hidden replace it with the
-                         * essid provided by the user.
-                         */
-                        if (!ssidbroad) {
-                                strncpy(tmp_ssid, ieee->current_network.ssid, IW_ESSID_MAX_SIZE);
-                                tmp_ssid_len = ieee->current_network.ssid_len;
-                        }
-                        memcpy(&ieee->current_network, net, sizeof(struct ieee80211_network));
-                        if (!ssidbroad) {
-                                strncpy(ieee->current_network.ssid, tmp_ssid, IW_ESSID_MAX_SIZE);
-                                ieee->current_network.ssid_len = tmp_ssid_len;
-                        }
-                        printk(KERN_INFO"Linking with %s: channel is %d\n", ieee->current_network.ssid, ieee->current_network.channel);
-                        if (ieee->iw_mode == IW_MODE_INFRA) {
-                                ieee->state = IEEE80211_ASSOCIATING;
-                                ieee->beinretry = false;
-                                queue_work(ieee->wq, &ieee->associate_procedure_wq);
-                        } else {
-                                if (ieee80211_is_54g(&ieee->current_network) &&
-                                                (ieee->modulation & IEEE80211_OFDM_MODULATION)) {
-                                        ieee->rate = 540;
-                                        printk(KERN_INFO"Using G rates\n");
-                                } else {
-                                        ieee->rate = 110;
-                                        printk(KERN_INFO"Using B rates\n");
-                                }
-                                ieee->state = IEEE80211_LINKED;
-                                ieee->beinretry = false;
-                        }
-                }
-        }
-}
-void ieee80211_softmac_check_all_nets(struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        struct ieee80211_network *target;
-        spin_lock_irqsave(&ieee->lock, flags);
-        list_for_each_entry(target, &ieee->network_list, list) {
-                /* if the state become different that NOLINK means
-                 * we had found what we are searching for
-                 */
-                if (ieee->state != IEEE80211_NOLINK)
-                        break;
-                if (ieee->scan_age == 0 || time_after(target->last_scanned + ieee->scan_age, jiffies))
-                        ieee80211_softmac_new_net(ieee, target);
-        }
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-static inline u16 auth_parse(struct sk_buff *skb, u8 **challenge, int *chlen)
-{
-        struct ieee80211_authentication *a;
-        u8 *t;
-        if (skb->len < (sizeof(struct ieee80211_authentication) - sizeof(struct ieee80211_info_element))) {
-                IEEE80211_DEBUG_MGMT("invalid len in auth resp: %d\n", skb->len);
-                return 0xcafe;
-        }
-        *challenge = NULL;
-        a = (struct ieee80211_authentication *) skb->data;
-        if (skb->len > (sizeof(struct ieee80211_authentication) + 3)) {
-                t = skb->data + sizeof(struct ieee80211_authentication);
-                if (*(t++) == MFIE_TYPE_CHALLENGE) {
-                        *chlen = *(t++);
-                        *challenge = kmemdup(t, *chlen, GFP_ATOMIC);
-                        if (!*challenge)
-                                return -ENOMEM;
-                }
-        }
-        return cpu_to_le16(a->status);
-}
-static int auth_rq_parse(struct sk_buff *skb, u8 *dest)
-{
-        struct ieee80211_authentication *a;
-        if (skb->len < (sizeof(struct ieee80211_authentication) - sizeof(struct ieee80211_info_element))) {
-                IEEE80211_DEBUG_MGMT("invalid len in auth request: %d\n", skb->len);
-                return -1;
-        }
-        a = (struct ieee80211_authentication *) skb->data;
-        memcpy(dest, a->header.addr2, ETH_ALEN);
-        if (le16_to_cpu(a->algorithm) != WLAN_AUTH_OPEN)
-                return  WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
-        return WLAN_STATUS_SUCCESS;
-}
-static short probe_rq_parse(struct ieee80211_device *ieee, struct sk_buff *skb,
-                            u8 *src)
-{
-        u8 *tag;
-        u8 *skbend;
-        u8 *ssid = NULL;
-        u8 ssidlen = 0;
-        struct ieee80211_hdr_3addr   *header =
-                (struct ieee80211_hdr_3addr   *) skb->data;
-        if (skb->len < sizeof(struct ieee80211_hdr_3addr))
-                return -1; /* corrupted */
-        memcpy(src, header->addr2, ETH_ALEN);
-        skbend = (u8 *)skb->data + skb->len;
-        tag = skb->data + sizeof(struct ieee80211_hdr_3addr);
-        while (tag+1 < skbend) {
-                if (*tag == 0) {
-                        ssid = tag+2;
-                        ssidlen = *(tag+1);
-                        break;
-                }
-                tag++; /* point to the len field */
-                tag = tag + *(tag); /* point to the last data byte of the tag */
-                tag++; /* point to the next tag */
-        }
-        if (ssidlen == 0)
-                return 1;
-        if (!ssid)
-                 return 1; /* ssid not found in tagged param */
-        return (!strncmp(ssid, ieee->current_network.ssid, ssidlen));
-}
-static int assoc_rq_parse(struct sk_buff *skb, u8 *dest)
-{
-        struct ieee80211_assoc_request_frame *a;
-        if (skb->len < (sizeof(struct ieee80211_assoc_request_frame) -
-                sizeof(struct ieee80211_info_element))) {
-                IEEE80211_DEBUG_MGMT("invalid len in auth request:%d\n", skb->len);
-                return -1;
-        }
-        a = (struct ieee80211_assoc_request_frame *) skb->data;
-        memcpy(dest, a->header.addr2, ETH_ALEN);
-        return 0;
-}
-static inline u16 assoc_parse(struct sk_buff *skb, int *aid)
-{
-        struct ieee80211_assoc_response_frame *a;
-        if (skb->len < sizeof(struct ieee80211_assoc_response_frame)) {
-                IEEE80211_DEBUG_MGMT("invalid len in auth resp: %d\n", skb->len);
-                return 0xcafe;
-        }
-        a = (struct ieee80211_assoc_response_frame *) skb->data;
-        *aid = le16_to_cpu(a->aid) & 0x3fff;
-        return le16_to_cpu(a->status);
-}
-static inline void ieee80211_rx_probe_rq(struct ieee80211_device *ieee,
-                                         struct sk_buff *skb)
-{
-        u8 dest[ETH_ALEN];
-        ieee->softmac_stats.rx_probe_rq++;
-        if (probe_rq_parse(ieee, skb, dest)) {
-                ieee->softmac_stats.tx_probe_rs++;
-                ieee80211_resp_to_probe(ieee, dest);
-        }
-}
-inline void ieee80211_rx_auth_rq(struct ieee80211_device *ieee,
-                                 struct sk_buff *skb)
-{
-        u8 dest[ETH_ALEN];
-        int status;
-        ieee->softmac_stats.rx_auth_rq++;
-        status = auth_rq_parse(skb, dest);
-        if (status != -1)
-                ieee80211_resp_to_auth(ieee, status, dest);
-}
-inline void
-ieee80211_rx_assoc_rq(struct ieee80211_device *ieee, struct sk_buff *skb)
-{
-        u8 dest[ETH_ALEN];
-        ieee->softmac_stats.rx_ass_rq++;
-        if (assoc_rq_parse(skb, dest) != -1)
-                ieee80211_resp_to_assoc_rq(ieee, dest);
-        printk(KERN_INFO"New client associated: %pM\n", dest);
-}
-void ieee80211_sta_ps_send_null_frame(struct ieee80211_device *ieee, short pwr)
-{
-        struct sk_buff *buf = ieee80211_null_func(ieee, pwr);
-        if (buf)
-                softmac_ps_mgmt_xmit(buf, ieee);
-}
-static short ieee80211_sta_ps_sleep(struct ieee80211_device *ieee, u32 *time_h,
-                             u32 *time_l)
-{
-        int timeout = 0;
-        u8 dtim;
-        dtim = ieee->current_network.dtim_data;
-        if (!(dtim & IEEE80211_DTIM_VALID))
-                return 0;
-        else
-                timeout = ieee->current_network.beacon_interval;
-        ieee->current_network.dtim_data = IEEE80211_DTIM_INVALID;
-        if (dtim & ((IEEE80211_DTIM_UCAST | IEEE80211_DTIM_MBCAST) & ieee->ps))
-                return 2;
-        if (!time_after(jiffies, ieee->dev->trans_start + MSECS(timeout)))
-                return 0;
-        if (!time_after(jiffies, ieee->last_rx_ps_time + MSECS(timeout)))
-                return 0;
-        if ((ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE) &&
-                (ieee->mgmt_queue_tail != ieee->mgmt_queue_head))
-                return 0;
-        if (time_l) {
-                *time_l = ieee->current_network.last_dtim_sta_time[0]
-                        + MSECS((ieee->current_network.beacon_interval));
-        }
-        if (time_h) {
-                *time_h = ieee->current_network.last_dtim_sta_time[1];
-                if (time_l && *time_l < ieee->current_network.last_dtim_sta_time[0])
-                        *time_h += 1;
-        }
-        return 1;
-}
-static inline void ieee80211_sta_ps(struct ieee80211_device *ieee)
-{
-        u32 th, tl;
-        short sleep;
-        unsigned long flags, flags2;
-        spin_lock_irqsave(&ieee->lock, flags);
-        if ((ieee->ps == IEEE80211_PS_DISABLED ||
-                ieee->iw_mode != IW_MODE_INFRA ||
-                ieee->state != IEEE80211_LINKED)) {
-                /* #warning CHECK_LOCK_HERE */
-                spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
-                ieee80211_sta_wakeup(ieee, 1);
-                spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
-        }
-        sleep = ieee80211_sta_ps_sleep(ieee, &th, &tl);
-        /* 2 wake, 1 sleep, 0 do nothing */
-        if (sleep == 0)
-                goto out;
-        if (sleep == 1) {
-                if (ieee->sta_sleep == 1)
-                        ieee->enter_sleep_state(ieee->dev, th, tl);
-                else if (ieee->sta_sleep == 0) {
-                        spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
-                        if (ieee->ps_is_queue_empty(ieee->dev)) {
-                                ieee->sta_sleep = 2;
-                                ieee->ps_request_tx_ack(ieee->dev);
-                                ieee80211_sta_ps_send_null_frame(ieee, 1);
-                                ieee->ps_th = th;
-                                ieee->ps_tl = tl;
-                        }
-                        spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
-                }
-        } else if (sleep == 2) {
-                /* #warning CHECK_LOCK_HERE */
-                spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
-                ieee80211_sta_wakeup(ieee, 1);
-                spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
-        }
-out:
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-void ieee80211_sta_wakeup(struct ieee80211_device *ieee, short nl)
-{
-        if (ieee->sta_sleep == 0) {
-                if (nl) {
-                        ieee->ps_request_tx_ack(ieee->dev);
-                        ieee80211_sta_ps_send_null_frame(ieee, 0);
-                }
-                return;
-        }
-        if (ieee->sta_sleep == 1)
-                ieee->sta_wake_up(ieee->dev);
-        ieee->sta_sleep = 0;
-        if (nl) {
-                ieee->ps_request_tx_ack(ieee->dev);
-                ieee80211_sta_ps_send_null_frame(ieee, 0);
-        }
-}
-void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success)
-{
-        unsigned long flags, flags2;
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (ieee->sta_sleep == 2) {
-                /* Null frame with PS bit set */
-                if (success) {
-                        ieee->sta_sleep = 1;
-                        ieee->enter_sleep_state(ieee->dev, ieee->ps_th, ieee->ps_tl);
-                }
-                /* if the card report not success we can't be sure the AP
-                 * has not RXed so we can't assume the AP believe us awake
-                 */
-        } else {
-                if ((ieee->sta_sleep == 0) && !success) {
-                        spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
-                        ieee80211_sta_ps_send_null_frame(ieee, 0);
-                        spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
-                }
-        }
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-inline int ieee80211_rx_frame_softmac(struct ieee80211_device *ieee,
-                                      struct sk_buff *skb,
-                                      struct ieee80211_rx_stats *rx_stats,
-                                      u16 type, u16 stype)
-{
-        struct ieee80211_hdr_3addr *header = (struct ieee80211_hdr_3addr *) skb->data;
-        u16 errcode;
-        u8 *challenge = NULL;
-        int chlen = 0;
-        int aid = 0;
-        struct ieee80211_assoc_response_frame *assoc_resp;
-        struct ieee80211_info_element *info_element;
-        if (!ieee->proto_started)
-                return 0;
-        if (ieee->sta_sleep || (ieee->ps != IEEE80211_PS_DISABLED &&
-                ieee->iw_mode == IW_MODE_INFRA &&
-                ieee->state == IEEE80211_LINKED))
-                tasklet_schedule(&ieee->ps_task);
-        if (WLAN_FC_GET_STYPE(header->frame_control) != IEEE80211_STYPE_PROBE_RESP &&
-                WLAN_FC_GET_STYPE(header->frame_control) != IEEE80211_STYPE_BEACON)
-                ieee->last_rx_ps_time = jiffies;
-        switch (WLAN_FC_GET_STYPE(header->frame_control)) {
-                case IEEE80211_STYPE_ASSOC_RESP:
-                case IEEE80211_STYPE_REASSOC_RESP:
-                        IEEE80211_DEBUG_MGMT("received [RE]ASSOCIATION RESPONSE (%d)\n",
-                                        WLAN_FC_GET_STYPE(header->frame_ctl));
-                        if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
-                                ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATED &&
-                                ieee->iw_mode == IW_MODE_INFRA) {
-                                errcode = assoc_parse(skb, &aid);
-                                if (0 == errcode) {
-                                        u16 left;
-                                        ieee->state = IEEE80211_LINKED;
-                                        ieee->assoc_id = aid;
-                                        ieee->softmac_stats.rx_ass_ok++;
-                                        /* card type is 8187 */
-                                        if (1 == rx_stats->nic_type)
-                                                goto associate_complete;
-                                        assoc_resp = (struct ieee80211_assoc_response_frame *)skb->data;
-                                        info_element = &assoc_resp->info_element;
-                                        left = skb->len - ((void *)info_element - (void *)assoc_resp);
-                                        while (left >= sizeof(struct ieee80211_info_element_hdr)) {
-                                                if (sizeof(struct ieee80211_info_element_hdr) + info_element->len > left) {
-                                                        printk(KERN_WARNING "[re]associate response error!");
-                                                        return 1;
-                                                }
-                                                switch (info_element->id) {
-                                                  case MFIE_TYPE_GENERIC:
-                                                        IEEE80211_DEBUG_SCAN("MFIE_TYPE_GENERIC: %d bytes\n", info_element->len);
-                                                        if (info_element->len >= 8  &&
-                                                            info_element->data[0] == 0x00 &&
-                                                            info_element->data[1] == 0x50 &&
-                                                            info_element->data[2] == 0xf2 &&
-                                                            info_element->data[3] == 0x02 &&
-                                                            info_element->data[4] == 0x01) {
-                                                                /* Not care about version at present.
-                                                                 * WMM Parameter Element.
-                                                                 */
-                                                                memcpy(ieee->current_network.wmm_param, (u8 *)(info_element->data\
-                                                                        + 8), (info_element->len - 8));
-                                                                if (((ieee->current_network.wmm_info^info_element->data[6])& \
-                                                                                    0x0f) || (!ieee->init_wmmparam_flag)) {
-                                                                        /* refresh parameter element for current network
-                                                                         * update the register parameter for hardware.
-                                                                         */
-                                                                        ieee->init_wmmparam_flag = 1;
-                                                                        queue_work(ieee->wq, &ieee->wmm_param_update_wq);
-                                                                }
-                                                                /* update info_element for current network */
-                                                                ieee->current_network.wmm_info  = info_element->data[6];
-                                                        }
-                                                        break;
-                                                  default:
-                                                        /* nothing to do at present!!! */
-                                                        break;
-                                                }
-                                                left -= sizeof(struct ieee80211_info_element_hdr) +
-                                                        info_element->len;
-                                                info_element = (struct ieee80211_info_element *)
-                                                        &info_element->data[info_element->len];
-                                        }
-                                        /* legacy AP, reset the AC_xx_param register */
-                                        if (!ieee->init_wmmparam_flag) {
-                                                queue_work(ieee->wq, &ieee->wmm_param_update_wq);
-                                                ieee->init_wmmparam_flag = 1; /* indicate AC_xx_param upated since last associate */
-                                        }
-associate_complete:
-                                        ieee80211_associate_complete(ieee);
-                                } else {
-                                        ieee->softmac_stats.rx_ass_err++;
-                                        IEEE80211_DEBUG_MGMT(
-                                                "Association response status code 0x%x\n",
-                                                errcode);
-                                        ieee80211_associate_abort(ieee);
-                                }
-                        }
-                        break;
-                case IEEE80211_STYPE_ASSOC_REQ:
-                case IEEE80211_STYPE_REASSOC_REQ:
-                        if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
-                                ieee->iw_mode == IW_MODE_MASTER)
-                                ieee80211_rx_assoc_rq(ieee, skb);
-                        break;
-                case IEEE80211_STYPE_AUTH:
-                        if (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) {
-                                if (ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATING &&
-                                ieee->iw_mode == IW_MODE_INFRA){
-                                                IEEE80211_DEBUG_MGMT("Received authentication response");
-                                                errcode = auth_parse(skb, &challenge, &chlen);
-                                                if (0 == errcode) {
-                                                        if (ieee->open_wep || !challenge) {
-                                                                ieee->state = IEEE80211_ASSOCIATING_AUTHENTICATED;
-                                                                ieee->softmac_stats.rx_auth_rs_ok++;
-                                                                ieee80211_associate_step2(ieee);
-                                                        } else {
-                                                                ieee80211_rtl_auth_challenge(ieee, challenge, chlen);
-                                                        }
-                                                } else {
-                                                        ieee->softmac_stats.rx_auth_rs_err++;
-                                                        IEEE80211_DEBUG_MGMT("Authentication response status code 0x%x", errcode);
-                                                        ieee80211_associate_abort(ieee);
-                                                }
-                                        } else if (ieee->iw_mode == IW_MODE_MASTER) {
-                                                ieee80211_rx_auth_rq(ieee, skb);
-                                        }
-                                }
-                        break;
-                case IEEE80211_STYPE_PROBE_REQ:
-                        if ((ieee->softmac_features & IEEE_SOFTMAC_PROBERS) &&
-                                ((ieee->iw_mode == IW_MODE_ADHOC ||
-                                ieee->iw_mode == IW_MODE_MASTER) &&
-                                ieee->state == IEEE80211_LINKED))
-                                ieee80211_rx_probe_rq(ieee, skb);
-                        break;
-                case IEEE80211_STYPE_DISASSOC:
-                case IEEE80211_STYPE_DEAUTH:
-                        /* FIXME for now repeat all the association procedure
-                         * both for disassociation and deauthentication
-                         */
-                        if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
-                                (ieee->state == IEEE80211_LINKED) &&
-                                (ieee->iw_mode == IW_MODE_INFRA) &&
-                                (!memcmp(header->addr2, ieee->current_network.bssid, ETH_ALEN))) {
-                                ieee->state = IEEE80211_ASSOCIATING;
-                                ieee->softmac_stats.reassoc++;
-                                queue_work(ieee->wq, &ieee->associate_procedure_wq);
-                        }
-                        break;
-                default:
-                        return -1;
-                        break;
-        }
-        return 0;
-}
-/* following are for a simpler TX queue management.
- * Instead of using netif_[stop/wake]_queue the driver
- * will uses these two function (plus a reset one), that
- * will internally uses the kernel netif_* and takes
- * care of the ieee802.11 fragmentation.
- * So the driver receives a fragment per time and might
- * call the stop function when it want without take care
- * to have enough room to TX an entire packet.
- * This might be useful if each fragment need it's own
- * descriptor, thus just keep a total free memory > than
- * the max fragmentation threshold is not enough.. If the
- * ieee802.11 stack passed a TXB struct then you needed
- * to keep N free descriptors where
- * N = MAX_PACKET_SIZE / MIN_FRAG_TRESHOLD
- * In this way you need just one and the 802.11 stack
- * will take care of buffering fragments and pass them to
- * to the driver later, when it wakes the queue.
- */
-void ieee80211_softmac_xmit(struct ieee80211_txb *txb,
-                            struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        int  i;
-        spin_lock_irqsave(&ieee->lock, flags);
-        /* called with 2nd parm 0, no tx mgmt lock required */
-        ieee80211_sta_wakeup(ieee, 0);
-        for (i = 0; i < txb->nr_frags; i++) {
-                if (ieee->queue_stop) {
-                        ieee->tx_pending.txb = txb;
-                        ieee->tx_pending.frag = i;
-                        goto exit;
-                } else {
-                        ieee->softmac_data_hard_start_xmit(
-                                txb->fragments[i],
-                                ieee->dev, ieee->rate);
-                        ieee->stats.tx_packets++;
-                        ieee->stats.tx_bytes += txb->fragments[i]->len;
-                        ieee->dev->trans_start = jiffies;
-                }
-        }
-        ieee80211_txb_free(txb);
-        exit:
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-/* called with ieee->lock acquired */
-static void ieee80211_resume_tx(struct ieee80211_device *ieee)
-{
-        int i;
-        for (i = ieee->tx_pending.frag; i < ieee->tx_pending.txb->nr_frags; i++) {
-                if (ieee->queue_stop) {
-                        ieee->tx_pending.frag = i;
-                        return;
-                } else {
-                        ieee->softmac_data_hard_start_xmit(
-                                ieee->tx_pending.txb->fragments[i],
-                                ieee->dev, ieee->rate);
-                        ieee->stats.tx_packets++;
-                        ieee->dev->trans_start = jiffies;
-                }
-        }
-        ieee80211_txb_free(ieee->tx_pending.txb);
-        ieee->tx_pending.txb = NULL;
-}
-void ieee80211_reset_queue(struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&ieee->lock, flags);
-        init_mgmt_queue(ieee);
-        if (ieee->tx_pending.txb) {
-                ieee80211_txb_free(ieee->tx_pending.txb);
-                ieee->tx_pending.txb = NULL;
-        }
-        ieee->queue_stop = 0;
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        struct sk_buff *skb;
-        struct ieee80211_hdr_3addr  *header;
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (!ieee->queue_stop)
-                goto exit;
-        ieee->queue_stop = 0;
-        if (ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE) {
-                while (!ieee->queue_stop && (skb = dequeue_mgmt(ieee))) {
-                        header = (struct ieee80211_hdr_3addr  *) skb->data;
-                        header->seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
-                        if (ieee->seq_ctrl[0] == 0xFFF)
-                                ieee->seq_ctrl[0] = 0;
-                        else
-                                ieee->seq_ctrl[0]++;
-                        ieee->softmac_data_hard_start_xmit(skb, ieee->dev, ieee->basic_rate);
-                        dev_kfree_skb_any(skb);
-                }
-        }
-        if (!ieee->queue_stop && ieee->tx_pending.txb)
-                ieee80211_resume_tx(ieee);
-        if (!ieee->queue_stop && netif_queue_stopped(ieee->dev)) {
-                ieee->softmac_stats.swtxawake++;
-                netif_wake_queue(ieee->dev);
-        }
-exit:
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee)
-{
-        if (!netif_queue_stopped(ieee->dev)) {
-                netif_stop_queue(ieee->dev);
-                ieee->softmac_stats.swtxstop++;
-        }
-        ieee->queue_stop = 1;
-}
-inline void ieee80211_randomize_cell(struct ieee80211_device *ieee)
-{
-        random_ether_addr(ieee->current_network.bssid);
-}
-/* called in user context only */
-void ieee80211_start_master_bss(struct ieee80211_device *ieee)
-{
-        ieee->assoc_id = 1;
-        if (ieee->current_network.ssid_len == 0) {
-                strncpy(ieee->current_network.ssid,
-                        IEEE80211_DEFAULT_TX_ESSID,
-                        IW_ESSID_MAX_SIZE);
-                ieee->current_network.ssid_len = strlen(IEEE80211_DEFAULT_TX_ESSID);
-                ieee->ssid_set = 1;
-        }
-        memcpy(ieee->current_network.bssid, ieee->dev->dev_addr, ETH_ALEN);
-        ieee->set_chan(ieee->dev, ieee->current_network.channel);
-        ieee->state = IEEE80211_LINKED;
-        ieee->link_change(ieee->dev);
-        notify_wx_assoc_event(ieee);
-        if (ieee->data_hard_resume)
-                ieee->data_hard_resume(ieee->dev);
-        netif_carrier_on(ieee->dev);
-}
-static void ieee80211_start_monitor_mode(struct ieee80211_device *ieee)
-{
-        if (ieee->raw_tx) {
-                if (ieee->data_hard_resume)
-                        ieee->data_hard_resume(ieee->dev);
-                netif_carrier_on(ieee->dev);
-        }
-}
-static void ieee80211_start_ibss_wq(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, start_ibss_wq);
-        /* iwconfig mode ad-hoc will schedule this and return
-         * on the other hand this will block further iwconfig SET
-         * operations because of the wx_sem hold.
-         * Anyway some most set operations set a flag to speed-up
-         * (abort) this wq (when syncro scanning) before sleeping
-         * on the semaphore
-         */
-        down(&ieee->wx_sem);
-        if (ieee->current_network.ssid_len == 0) {
-                strcpy(ieee->current_network.ssid, IEEE80211_DEFAULT_TX_ESSID);
-                ieee->current_network.ssid_len = strlen(IEEE80211_DEFAULT_TX_ESSID);
-                ieee->ssid_set = 1;
-        }
-        /* check if we have this cell in our network list */
-        ieee80211_softmac_check_all_nets(ieee);
-        if (ieee->state == IEEE80211_NOLINK)
-                ieee->current_network.channel = 10;
-        /* if not then the state is not linked. Maybe the user switched to
-         * ad-hoc mode just after being in monitor mode, or just after
-         * being very few time in managed mode (so the card have had no
-         * time to scan all the chans..) or we have just run up the iface
-         * after setting ad-hoc mode. So we have to give another try..
-         * Here, in ibss mode, should be safe to do this without extra care
-         * (in bss mode we had to make sure no-one tried to associate when
-         * we had just checked the ieee->state and we was going to start the
-         * scan) because in ibss mode the ieee80211_new_net function, when
-         * finds a good net, just set the ieee->state to IEEE80211_LINKED,
-         * so, at worst, we waste a bit of time to initiate an unneeded syncro
-         * scan, that will stop at the first round because it sees the state
-         * associated.
-         */
-        if (ieee->state == IEEE80211_NOLINK)
-                ieee80211_start_scan_syncro(ieee);
-        /* the network definitively is not here.. create a new cell */
-        if (ieee->state == IEEE80211_NOLINK) {
-                printk("creating new IBSS cell\n");
-                if (!ieee->wap_set)
-                        ieee80211_randomize_cell(ieee);
-                if (ieee->modulation & IEEE80211_CCK_MODULATION) {
-                        ieee->current_network.rates_len = 4;
-                        ieee->current_network.rates[0] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-                        ieee->current_network.rates[1] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-                        ieee->current_network.rates[2] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
-                        ieee->current_network.rates[3] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
-                } else
-                        ieee->current_network.rates_len = 0;
-                if (ieee->modulation & IEEE80211_OFDM_MODULATION) {
-                        ieee->current_network.rates_ex_len = 8;
-                        ieee->current_network.rates_ex[0] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
-                        ieee->current_network.rates_ex[1] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
-                        ieee->current_network.rates_ex[2] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
-                        ieee->current_network.rates_ex[3] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
-                        ieee->current_network.rates_ex[4] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
-                        ieee->current_network.rates_ex[5] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
-                        ieee->current_network.rates_ex[6] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
-                        ieee->current_network.rates_ex[7] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
-                        ieee->rate = 540;
-                } else {
-                        ieee->current_network.rates_ex_len = 0;
-                        ieee->rate = 110;
-                }
-                /* By default, WMM function will be disabled in IBSS mode */
-                ieee->current_network.QoS_Enable = 0;
-                ieee->current_network.atim_window = 0;
-                ieee->current_network.capability = WLAN_CAPABILITY_IBSS;
-                if (ieee->short_slot)
-                        ieee->current_network.capability |= WLAN_CAPABILITY_SHORT_SLOT;
-        }
-        ieee->state = IEEE80211_LINKED;
-        ieee->set_chan(ieee->dev, ieee->current_network.channel);
-        ieee->link_change(ieee->dev);
-        notify_wx_assoc_event(ieee);
-        ieee80211_start_send_beacons(ieee);
-        printk(KERN_WARNING "after sending beacon packet!\n");
-        if (ieee->data_hard_resume)
-                ieee->data_hard_resume(ieee->dev);
-        netif_carrier_on(ieee->dev);
-        up(&ieee->wx_sem);
-}
-inline void ieee80211_start_ibss(struct ieee80211_device *ieee)
-{
-        queue_delayed_work(ieee->wq, &ieee->start_ibss_wq, 100);
-}
-/* this is called only in user context, with wx_sem held */
-void ieee80211_start_bss(struct ieee80211_device *ieee)
-{
-        unsigned long flags;
-        /* Ref: 802.11d 11.1.3.3
-         * STA shall not start a BSS unless properly formed Beacon frame
-         * including a Country IE.
-         */
-        if (IS_DOT11D_ENABLE(ieee) && !IS_COUNTRY_IE_VALID(ieee)) {
-                if (!ieee->bGlobalDomain)
-                        return;
-        }
-        /* check if we have already found the net we are interested in (if any).
-         * if not (we are disassociated and we are not
-         * in associating / authenticating phase) start the background scanning.
-         */
-        ieee80211_softmac_check_all_nets(ieee);
-        /* ensure no-one start an associating process (thus setting
-         * the ieee->state to ieee80211_ASSOCIATING) while we
-         * have just cheked it and we are going to enable scan.
-         * The ieee80211_new_net function is always called with
-         * lock held (from both ieee80211_softmac_check_all_nets and
-         * the rx path), so we cannot be in the middle of such function
-         */
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (ieee->state == IEEE80211_NOLINK) {
-                ieee->actscanning = true;
-                ieee80211_rtl_start_scan(ieee);
-        }
-        spin_unlock_irqrestore(&ieee->lock, flags);
-}
-/* called only in userspace context */
-void ieee80211_disassociate(struct ieee80211_device *ieee)
-{
-        netif_carrier_off(ieee->dev);
-        if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)
-                        ieee80211_reset_queue(ieee);
-        if (ieee->data_hard_stop)
-                        ieee->data_hard_stop(ieee->dev);
-        if (IS_DOT11D_ENABLE(ieee))
-                Dot11d_Reset(ieee);
-        ieee->link_change(ieee->dev);
-        if (ieee->state == IEEE80211_LINKED)
-                notify_wx_assoc_event(ieee);
-        ieee->state = IEEE80211_NOLINK;
-}
-static void ieee80211_associate_retry_wq(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, associate_retry_wq);
-        unsigned long flags;
-        down(&ieee->wx_sem);
-        if (!ieee->proto_started)
-                goto exit;
-        if (ieee->state != IEEE80211_ASSOCIATING_RETRY)
-                goto exit;
-        /* until we do not set the state to IEEE80211_NOLINK
-        * there are no possibility to have someone else trying
-        * to start an association procedure (we get here with
-        * ieee->state = IEEE80211_ASSOCIATING).
-        * When we set the state to IEEE80211_NOLINK it is possible
-        * that the RX path run an attempt to associate, but
-        * both ieee80211_softmac_check_all_nets and the
-        * RX path works with ieee->lock held so there are no
-        * problems. If we are still disassociated then start a scan.
-        * the lock here is necessary to ensure no one try to start
-        * an association procedure when we have just checked the
-        * state and we are going to start the scan.
-        */
-        ieee->state = IEEE80211_NOLINK;
-        ieee->beinretry = true;
-        ieee80211_softmac_check_all_nets(ieee);
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (ieee->state == IEEE80211_NOLINK) {
-                ieee->beinretry = false;
-                ieee->actscanning = true;
-                ieee80211_rtl_start_scan(ieee);
-        }
-        if (ieee->state == IEEE80211_NOLINK)
-                notify_wx_assoc_event(ieee);
-        spin_unlock_irqrestore(&ieee->lock, flags);
-exit:
-        up(&ieee->wx_sem);
-}
-struct sk_buff *ieee80211_get_beacon_(struct ieee80211_device *ieee)
-{
-        u8 broadcast_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-        struct sk_buff *skb = NULL;
-        struct ieee80211_probe_response *b;
-        skb = ieee80211_probe_resp(ieee, broadcast_addr);
-        if (!skb)
-                return NULL;
-        b = (struct ieee80211_probe_response *) skb->data;
-        b->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_BEACON);
-        return skb;
-}
-struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee)
-{
-        struct sk_buff *skb;
-        struct ieee80211_probe_response *b;
-        skb = ieee80211_get_beacon_(ieee);
-        if (!skb)
-                return NULL;
-        b = (struct ieee80211_probe_response *) skb->data;
-        b->header.seq_ctrl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
-        if (ieee->seq_ctrl[0] == 0xFFF)
-                ieee->seq_ctrl[0] = 0;
-        else
-                ieee->seq_ctrl[0]++;
-        return skb;
-}
-void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee)
-{
-        ieee->sync_scan_hurryup = 1;
-        down(&ieee->wx_sem);
-        ieee80211_stop_protocol(ieee);
-        up(&ieee->wx_sem);
-}
-void ieee80211_stop_protocol(struct ieee80211_device *ieee)
-{
-        if (!ieee->proto_started)
-                return;
-        ieee->proto_started = 0;
-        ieee80211_stop_send_beacons(ieee);
-        if ((ieee->iw_mode == IW_MODE_INFRA) && (ieee->state == IEEE80211_LINKED))
-                SendDisassociation(ieee, NULL, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
-        del_timer_sync(&ieee->associate_timer);
-        cancel_delayed_work(&ieee->associate_retry_wq);
-        cancel_delayed_work(&ieee->start_ibss_wq);
-        ieee80211_stop_scan(ieee);
-        ieee80211_disassociate(ieee);
-}
-void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee)
-{
-        ieee->sync_scan_hurryup = 0;
-        down(&ieee->wx_sem);
-        ieee80211_start_protocol(ieee);
-        up(&ieee->wx_sem);
-}
-void ieee80211_start_protocol(struct ieee80211_device *ieee)
-{
-        short ch = 0;
-        int i = 0;
-        if (ieee->proto_started)
-                return;
-        ieee->proto_started = 1;
-        if (ieee->current_network.channel == 0) {
-                do {
-                        ch++;
-                        if (ch > MAX_CHANNEL_NUMBER)
-                                return; /* no channel found */
-                } while (!GET_DOT11D_INFO(ieee)->channel_map[ch]);
-                ieee->current_network.channel = ch;
-        }
-        if (ieee->current_network.beacon_interval == 0)
-                ieee->current_network.beacon_interval = 100;
-        ieee->set_chan(ieee->dev, ieee->current_network.channel);
-        for (i = 0; i < 17; i++) {
-                ieee->last_rxseq_num[i] = -1;
-                ieee->last_rxfrag_num[i] = -1;
-                ieee->last_packet_time[i] = 0;
-        }
-        ieee->init_wmmparam_flag = 0; /* reinitialize AC_xx_PARAM registers. */
-        /* if the user set the MAC of the ad-hoc cell and then
-         * switch to managed mode, shall we  make sure that association
-         * attempts does not fail just because the user provide the essid
-         * and the nic is still checking for the AP MAC ??
-         */
-        switch (ieee->iw_mode) {
-                case IW_MODE_AUTO:
-                        ieee->iw_mode = IW_MODE_INFRA;
-                        /* not set break here intentionly */
-                case IW_MODE_INFRA:
-                        ieee80211_start_bss(ieee);
-                        break;
-                case IW_MODE_ADHOC:
-                        ieee80211_start_ibss(ieee);
-                        break;
-                case IW_MODE_MASTER:
-                        ieee80211_start_master_bss(ieee);
-                break;
-                case IW_MODE_MONITOR:
-                        ieee80211_start_monitor_mode(ieee);
-                        break;
-                default:
-                        ieee->iw_mode = IW_MODE_INFRA;
-                        ieee80211_start_bss(ieee);
-                        break;
-        }
-}
-#define DRV_NAME  "Ieee80211"
-void ieee80211_softmac_init(struct ieee80211_device *ieee)
-{
-        int i;
-        memset(&ieee->current_network, 0, sizeof(struct ieee80211_network));
-        ieee->state = IEEE80211_NOLINK;
-        ieee->sync_scan_hurryup = 0;
-        for (i = 0; i < 5; i++)
-                ieee->seq_ctrl[i] = 0;
-        ieee->assoc_id = 0;
-        ieee->queue_stop = 0;
-        ieee->scanning = 0;
-        ieee->softmac_features = 0; /* so IEEE2100-like driver are happy */
-        ieee->wap_set = 0;
-        ieee->ssid_set = 0;
-        ieee->proto_started = 0;
-        ieee->basic_rate = IEEE80211_DEFAULT_BASIC_RATE;
-        ieee->rate = 3;
-        ieee->ps = IEEE80211_PS_MBCAST|IEEE80211_PS_UNICAST;
-        ieee->sta_sleep = 0;
-        ieee->bInactivePs = false;
-        ieee->actscanning = false;
-        ieee->ListenInterval = 2;
-        ieee->NumRxDataInPeriod = 0;
-        ieee->NumRxBcnInPeriod = 0;
-        ieee->NumRxOkTotal = 0;
-        ieee->NumRxUnicast = 0; /* for keep alive */
-        ieee->beinretry = false;
-        ieee->bHwRadioOff = false;
-        init_mgmt_queue(ieee);
-        ieee->tx_pending.txb = NULL;
-        init_timer(&ieee->associate_timer);
-        ieee->associate_timer.data = (unsigned long)ieee;
-        ieee->associate_timer.function = ieee80211_associate_abort_cb;
-        init_timer(&ieee->beacon_timer);
-        ieee->beacon_timer.data = (unsigned long) ieee;
-        ieee->beacon_timer.function = ieee80211_send_beacon_cb;
-        ieee->wq = create_workqueue(DRV_NAME);
-        INIT_DELAYED_WORK(&ieee->start_ibss_wq, (void *) ieee80211_start_ibss_wq);
-        INIT_WORK(&ieee->associate_complete_wq, (void *) ieee80211_associate_complete_wq);
-        INIT_WORK(&ieee->associate_procedure_wq, (void *) ieee80211_associate_procedure_wq);
-        INIT_DELAYED_WORK(&ieee->softmac_scan_wq, (void *) ieee80211_softmac_scan_wq);
-        INIT_DELAYED_WORK(&ieee->associate_retry_wq, (void *) ieee80211_associate_retry_wq);
-        INIT_WORK(&ieee->wx_sync_scan_wq, (void *) ieee80211_wx_sync_scan_wq);
-        sema_init(&ieee->wx_sem, 1);
-        sema_init(&ieee->scan_sem, 1);
-        spin_lock_init(&ieee->mgmt_tx_lock);
-        spin_lock_init(&ieee->beacon_lock);
-        tasklet_init(&ieee->ps_task,
-             (void(*)(unsigned long)) ieee80211_sta_ps,
-             (unsigned long)ieee);
-        ieee->pDot11dInfo = kmalloc(sizeof(RT_DOT11D_INFO), GFP_ATOMIC);
-}
-void ieee80211_softmac_free(struct ieee80211_device *ieee)
-{
-        down(&ieee->wx_sem);
-        del_timer_sync(&ieee->associate_timer);
-        cancel_delayed_work(&ieee->associate_retry_wq);
-        /* add for RF power on power of */
-        cancel_delayed_work(&ieee->GPIOChangeRFWorkItem);
-        destroy_workqueue(ieee->wq);
-        kfree(ieee->pDot11dInfo);
-        up(&ieee->wx_sem);
-}
-/* Start of WPA code. This is stolen from the ipw2200 driver  */
-static int ieee80211_wpa_enable(struct ieee80211_device *ieee, int value)
-{
-        /* This is called when wpa_supplicant loads and closes the driver
-         * interface. */
-        printk("%s WPA\n", value ? "enabling" : "disabling");
-        ieee->wpa_enabled = value;
-        return 0;
-}
-static void ieee80211_wpa_assoc_frame(struct ieee80211_device *ieee, char *wpa_ie,
-                               int wpa_ie_len)
-{
-        /* make sure WPA is enabled */
-        ieee80211_wpa_enable(ieee, 1);
-        ieee80211_disassociate(ieee);
-}
-static int ieee80211_wpa_mlme(struct ieee80211_device *ieee, int command,
-                              int reason)
-{
-        int ret = 0;
-        switch (command) {
-        case IEEE_MLME_STA_DEAUTH:
-                /* silently ignore */
-                break;
-        case IEEE_MLME_STA_DISASSOC:
-                ieee80211_disassociate(ieee);
-                break;
-        default:
-                printk("Unknown MLME request: %d\n", command);
-                ret = -EOPNOTSUPP;
-        }
-        return ret;
-}
-static int ieee80211_wpa_set_wpa_ie(struct ieee80211_device *ieee,
-                                    struct ieee_param *param, int plen)
-{
-        u8 *buf;
-        if (param->u.wpa_ie.len > MAX_WPA_IE_LEN ||
-            (param->u.wpa_ie.len && param->u.wpa_ie.data == NULL))
-                return -EINVAL;
-        if (param->u.wpa_ie.len) {
-                buf = kmemdup(param->u.wpa_ie.data, param->u.wpa_ie.len,
-                              GFP_KERNEL);
-                if (buf == NULL)
-                        return -ENOMEM;
-                kfree(ieee->wpa_ie);
-                ieee->wpa_ie = buf;
-                ieee->wpa_ie_len = param->u.wpa_ie.len;
-        } else {
-                kfree(ieee->wpa_ie);
-                ieee->wpa_ie = NULL;
-                ieee->wpa_ie_len = 0;
-        }
-        ieee80211_wpa_assoc_frame(ieee, ieee->wpa_ie, ieee->wpa_ie_len);
-        return 0;
-}
-#define AUTH_ALG_OPEN_SYSTEM                    0x1
-#define AUTH_ALG_SHARED_KEY                     0x2
-static int ieee80211_wpa_set_auth_algs(struct ieee80211_device *ieee, int value)
-{
-        struct ieee80211_security sec = {
-                .flags = SEC_AUTH_MODE,
-        };
-        int ret = 0;
-        if (value & AUTH_ALG_SHARED_KEY) {
-                sec.auth_mode = WLAN_AUTH_SHARED_KEY;
-                ieee->open_wep = 0;
-        } else {
-                sec.auth_mode = WLAN_AUTH_OPEN;
-                ieee->open_wep = 1;
-        }
-        if (ieee->set_security)
-                ieee->set_security(ieee->dev, &sec);
-        else
-                ret = -EOPNOTSUPP;
-        return ret;
-}
-static int ieee80211_wpa_set_param(struct ieee80211_device *ieee, u8 name,
-                                   u32 value)
-{
-        int ret = 0;
-        unsigned long flags;
-        switch (name) {
-        case IEEE_PARAM_WPA_ENABLED:
-                ret = ieee80211_wpa_enable(ieee, value);
-                break;
-        case IEEE_PARAM_TKIP_COUNTERMEASURES:
-                ieee->tkip_countermeasures = value;
-                break;
-        case IEEE_PARAM_DROP_UNENCRYPTED: {
-                /* HACK:
-                 *
-                 * wpa_supplicant calls set_wpa_enabled when the driver
-                 * is loaded and unloaded, regardless of if WPA is being
-                 * used.  No other calls are made which can be used to
-                 * determine if encryption will be used or not prior to
-                 * association being expected.  If encryption is not being
-                 * used, drop_unencrypted is set to false, else true -- we
-                 * can use this to determine if the CAP_PRIVACY_ON bit should
-                 * be set.
-                 */
-                struct ieee80211_security sec = {
-                        .flags = SEC_ENABLED,
-                        .enabled = value,
-                };
-                ieee->drop_unencrypted = value;
-                /* We only change SEC_LEVEL for open mode. Others
-                 * are set by ipw_wpa_set_encryption.
-                 */
-                if (!value) {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_0;
-                } else {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_1;
-                }
-                if (ieee->set_security)
-                        ieee->set_security(ieee->dev, &sec);
-                break;
-        }
-        case IEEE_PARAM_PRIVACY_INVOKED:
-                ieee->privacy_invoked = value;
-                break;
-        case IEEE_PARAM_AUTH_ALGS:
-                ret = ieee80211_wpa_set_auth_algs(ieee, value);
-                break;
-        case IEEE_PARAM_IEEE_802_1X:
-                ieee->ieee802_1x = value;
-                break;
-        case IEEE_PARAM_WPAX_SELECT:
-                spin_lock_irqsave(&ieee->wpax_suitlist_lock, flags);
-                ieee->wpax_type_set = 1;
-                ieee->wpax_type_notify = value;
-                spin_unlock_irqrestore(&ieee->wpax_suitlist_lock, flags);
-                break;
-        default:
-                printk("Unknown WPA param: %d\n", name);
-                ret = -EOPNOTSUPP;
-        }
-        return ret;
-}
-/* implementation borrowed from hostap driver */
-static int ieee80211_wpa_set_encryption(struct ieee80211_device *ieee,
-                                        struct ieee_param *param, int param_len)
-{
-        int ret = 0;
-        struct ieee80211_crypto_ops *ops;
-        struct ieee80211_crypt_data **crypt;
-        struct ieee80211_security sec = {
-                .flags = 0,
-        };
-        param->u.crypt.err = 0;
-        param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
-        if (param_len !=
-            (int) ((char *) param->u.crypt.key - (char *) param) +
-            param->u.crypt.key_len) {
-                printk("Len mismatch %d, %d\n", param_len,
-                               param->u.crypt.key_len);
-                return -EINVAL;
-        }
-        if (is_broadcast_ether_addr(param->sta_addr)) {
-                if (param->u.crypt.idx >= WEP_KEYS)
-                        return -EINVAL;
-                crypt = &ieee->crypt[param->u.crypt.idx];
-        } else {
-                return -EINVAL;
-        }
-        if (strcmp(param->u.crypt.alg, "none") == 0) {
-                if (crypt) {
-                        sec.enabled = 0;
-                        /* FIXME FIXME */
-                        sec.level = SEC_LEVEL_0;
-                        sec.flags |= SEC_ENABLED | SEC_LEVEL;
-                        ieee80211_crypt_delayed_deinit(ieee, crypt);
-                }
-                goto done;
-        }
-        sec.enabled = 1;
-        /* FIXME FIXME */
-        sec.flags |= SEC_ENABLED;
-        /* IPW HW cannot build TKIP MIC, host decryption still needed. */
-        if (!(ieee->host_encrypt || ieee->host_decrypt) &&
-            strcmp(param->u.crypt.alg, "TKIP"))
-                goto skip_host_crypt;
-        ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-        if (ops == NULL && strcmp(param->u.crypt.alg, "WEP") == 0)
-                ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-        else if (ops == NULL && strcmp(param->u.crypt.alg, "TKIP") == 0)
-                ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-        else if (ops == NULL && strcmp(param->u.crypt.alg, "CCMP") == 0)
-                ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-        if (ops == NULL) {
-                printk("unknown crypto alg '%s'\n", param->u.crypt.alg);
-                param->u.crypt.err = IEEE_CRYPT_ERR_UNKNOWN_ALG;
-                ret = -EINVAL;
-                goto done;
-        }
-        if (*crypt == NULL || (*crypt)->ops != ops) {
-                struct ieee80211_crypt_data *new_crypt;
-                ieee80211_crypt_delayed_deinit(ieee, crypt);
-                new_crypt = kmalloc(sizeof(*new_crypt), GFP_KERNEL);
-                if (new_crypt == NULL) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
-                memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
-                new_crypt->ops = ops;
-                if (new_crypt->ops)
-                        new_crypt->priv =
-                                new_crypt->ops->init(param->u.crypt.idx);
-                if (new_crypt->priv == NULL) {
-                        kfree(new_crypt);
-                        param->u.crypt.err = IEEE_CRYPT_ERR_CRYPT_INIT_FAILED;
-                        ret = -EINVAL;
-                        goto done;
-                }
-                *crypt = new_crypt;
-        }
-        if (param->u.crypt.key_len > 0 && (*crypt)->ops->set_key &&
-            (*crypt)->ops->set_key(param->u.crypt.key,
-                                   param->u.crypt.key_len, param->u.crypt.seq,
-                                   (*crypt)->priv) < 0) {
-                printk("key setting failed\n");
-                param->u.crypt.err = IEEE_CRYPT_ERR_KEY_SET_FAILED;
-                ret = -EINVAL;
-                goto done;
-        }
- skip_host_crypt:
-        if (param->u.crypt.set_tx) {
-                ieee->tx_keyidx = param->u.crypt.idx;
-                sec.active_key = param->u.crypt.idx;
-                sec.flags |= SEC_ACTIVE_KEY;
-        } else
-                sec.flags &= ~SEC_ACTIVE_KEY;
-        if (param->u.crypt.alg != NULL) {
-                memcpy(sec.keys[param->u.crypt.idx],
-                       param->u.crypt.key,
-                       param->u.crypt.key_len);
-                sec.key_sizes[param->u.crypt.idx] = param->u.crypt.key_len;
-                sec.flags |= (1 << param->u.crypt.idx);
-                if (strcmp(param->u.crypt.alg, "WEP") == 0) {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_1;
-                } else if (strcmp(param->u.crypt.alg, "TKIP") == 0) {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_2;
-                } else if (strcmp(param->u.crypt.alg, "CCMP") == 0) {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_3;
-                }
-        }
- done:
-        if (ieee->set_security)
-                ieee->set_security(ieee->dev, &sec);
-        /* Do not reset port if card is in Managed mode since resetting will
-         * generate new IEEE 802.11 authentication which may end up in looping
-         * with IEEE 802.1X.  If your hardware requires a reset after WEP
-         * configuration (for example... Prism2), implement the reset_port in
-         * the callbacks structures used to initialize the 802.11 stack. */
-        if (ieee->reset_on_keychange &&
-            ieee->iw_mode != IW_MODE_INFRA &&
-            ieee->reset_port &&
-            ieee->reset_port(ieee->dev)) {
-                printk("reset_port failed\n");
-                param->u.crypt.err = IEEE_CRYPT_ERR_CARD_CONF_FAILED;
-                return -EINVAL;
-        }
-        return ret;
-}
-int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee,
-                                   struct iw_point *p)
-{
-        struct ieee_param *param;
-        int ret = 0;
-        down(&ieee->wx_sem);
-        if (p->length < sizeof(struct ieee_param) || !p->pointer) {
-                ret = -EINVAL;
-                goto out;
-        }
-        param = memdup_user(p->pointer, p->length);
-        if (IS_ERR(param)) {
-                ret = PTR_ERR(param);
-                goto out;
-        }
-        switch (param->cmd) {
-        case IEEE_CMD_SET_WPA_PARAM:
-                ret = ieee80211_wpa_set_param(ieee, param->u.wpa_param.name,
-                                        param->u.wpa_param.value);
-                break;
-        case IEEE_CMD_SET_WPA_IE:
-                ret = ieee80211_wpa_set_wpa_ie(ieee, param, p->length);
-                break;
-        case IEEE_CMD_SET_ENCRYPTION:
-                ret = ieee80211_wpa_set_encryption(ieee, param, p->length);
-                break;
-        case IEEE_CMD_MLME:
-                ret = ieee80211_wpa_mlme(ieee, param->u.mlme.command,
-                                   param->u.mlme.reason_code);
-                break;
-        default:
-                printk("Unknown WPA supplicant request: %d\n", param->cmd);
-                ret = -EOPNOTSUPP;
-                break;
-        }
-        if (ret == 0 && copy_to_user(p->pointer, param, p->length))
-                ret = -EFAULT;
-        kfree(param);
-out:
-        up(&ieee->wx_sem);
-        return ret;
-}
-void notify_wx_assoc_event(struct ieee80211_device *ieee)
-{
-        union iwreq_data wrqu;
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        if (ieee->state == IEEE80211_LINKED)
-                memcpy(wrqu.ap_addr.sa_data, ieee->current_network.bssid, ETH_ALEN);
-        else
-                memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
-        wireless_send_event(ieee->dev, SIOCGIWAP, &wrqu, NULL);
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
deleted file mode 100644
index 46f35644126c..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
+++ /dev/null
@@ -1,567 +0,0 @@
-/* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
- *
- * Mostly extracted from the rtl8180-sa2400 driver for the
- * in-kernel generic ieee802.11 stack.
- *
- * Some pieces of code might be stolen from ipw2100 driver
- * copyright of who own it's copyright ;-)
- *
- * PS wx handler mostly stolen from hostap, copyright who
- * own it's copyright ;-)
- *
- * released under the GPL
- */
-#include <linux/etherdevice.h>
-#include "ieee80211.h"
-/* FIXME: add A freqs */
-const long ieee80211_wlan_frequencies[] = {
-        2412, 2417, 2422, 2427,
-        2432, 2437, 2442, 2447,
-        2452, 2457, 2462, 2467,
-        2472, 2484
-};
-int ieee80211_wx_set_freq(struct ieee80211_device *ieee,
-                          struct iw_request_info *a, union iwreq_data *wrqu,
-                          char *b)
-{
-        int ret;
-        struct iw_freq *fwrq = &wrqu->freq;
-//      printk("in %s\n",__func__);
-        down(&ieee->wx_sem);
-        if (ieee->iw_mode == IW_MODE_INFRA) {
-                ret = -EOPNOTSUPP;
-                goto out;
-        }
-        /* if setting by freq convert to channel */
-        if (fwrq->e == 1) {
-                if ((fwrq->m >= (int) 2.412e8 &&
-                     fwrq->m <= (int) 2.487e8)) {
-                        int f = fwrq->m / 100000;
-                        int c = 0;
-                        while ((c < 14) && (f != ieee80211_wlan_frequencies[c]))
-                                c++;
-                        /* hack to fall through */
-                        fwrq->e = 0;
-                        fwrq->m = c + 1;
-                }
-        }
-        if (fwrq->e > 0 || fwrq->m > 14 || fwrq->m < 1) {
-                ret = -EOPNOTSUPP;
-                goto out;
-        } else { /* Set the channel */
-                ieee->current_network.channel = fwrq->m;
-                ieee->set_chan(ieee->dev, ieee->current_network.channel);
-                if (ieee->iw_mode == IW_MODE_ADHOC || ieee->iw_mode == IW_MODE_MASTER)
-                        if (ieee->state == IEEE80211_LINKED) {
-                                ieee80211_stop_send_beacons(ieee);
-                                ieee80211_start_send_beacons(ieee);
-                        }
-        }
-        ret = 0;
-out:
-        up(&ieee->wx_sem);
-        return ret;
-}
-int ieee80211_wx_get_freq(struct ieee80211_device *ieee,
-                          struct iw_request_info *a, union iwreq_data *wrqu,
-                          char *b)
-{
-        struct iw_freq *fwrq = &wrqu->freq;
-        if (ieee->current_network.channel == 0)
-                return -1;
-        fwrq->m = ieee->current_network.channel;
-        fwrq->e = 0;
-        return 0;
-}
-int ieee80211_wx_get_wap(struct ieee80211_device *ieee,
-                         struct iw_request_info *info, union iwreq_data *wrqu,
-                         char *extra)
-{
-        unsigned long flags;
-        wrqu->ap_addr.sa_family = ARPHRD_ETHER;
-        if (ieee->iw_mode == IW_MODE_MONITOR)
-                return -1;
-        /* We want avoid to give to the user inconsistent infos*/
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (ieee->state != IEEE80211_LINKED &&
-                ieee->state != IEEE80211_LINKED_SCANNING &&
-                ieee->wap_set == 0)
-                memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
-        else
-                memcpy(wrqu->ap_addr.sa_data,
-                       ieee->current_network.bssid, ETH_ALEN);
-        spin_unlock_irqrestore(&ieee->lock, flags);
-        return 0;
-}
-int ieee80211_wx_set_wap(struct ieee80211_device *ieee,
-                         struct iw_request_info *info, union iwreq_data *awrq,
-                         char *extra)
-{
-        int ret = 0;
-        unsigned long flags;
-        short ifup = ieee->proto_started;//dev->flags & IFF_UP;
-        struct sockaddr *temp = (struct sockaddr *)awrq;
-        //printk("=======Set WAP:");
-        ieee->sync_scan_hurryup = 1;
-        down(&ieee->wx_sem);
-        /* use ifconfig hw ether */
-        if (ieee->iw_mode == IW_MODE_MASTER) {
-                ret = -1;
-                goto out;
-        }
-        if (temp->sa_family != ARPHRD_ETHER) {
-                ret = -EINVAL;
-                goto out;
-        }
-        if (ifup)
-                ieee80211_stop_protocol(ieee);
-        /* just to avoid to give inconsistent infos in the
-         * get wx method. not really needed otherwise
-         */
-        spin_lock_irqsave(&ieee->lock, flags);
-        memcpy(ieee->current_network.bssid, temp->sa_data, ETH_ALEN);
-        ieee->wap_set = !is_zero_ether_addr(temp->sa_data);
-        //printk(" %x:%x:%x:%x:%x:%x\n", ieee->current_network.bssid[0],ieee->current_network.bssid[1],ieee->current_network.bssid[2],ieee->current_network.bssid[3],ieee->current_network.bssid[4],ieee->current_network.bssid[5]);
-        spin_unlock_irqrestore(&ieee->lock, flags);
-        if (ifup)
-                ieee80211_start_protocol(ieee);
-out:
-        up(&ieee->wx_sem);
-        return ret;
-}
-int ieee80211_wx_get_essid(struct ieee80211_device *ieee,
-                           struct iw_request_info *a, union iwreq_data *wrqu,
-                           char *b)
-{
-        int len, ret = 0;
-        unsigned long flags;
-        if (ieee->iw_mode == IW_MODE_MONITOR)
-                return -1;
-        /* We want avoid to give to the user inconsistent infos*/
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (ieee->current_network.ssid[0] == '\0' ||
-                ieee->current_network.ssid_len == 0){
-                ret = -1;
-                goto out;
-        }
-        if (ieee->state != IEEE80211_LINKED &&
-                ieee->state != IEEE80211_LINKED_SCANNING &&
-                ieee->ssid_set == 0){
-                ret = -1;
-                goto out;
-        }
-        len = ieee->current_network.ssid_len;
-        wrqu->essid.length = len;
-        strncpy(b, ieee->current_network.ssid, len);
-        wrqu->essid.flags = 1;
-out:
-        spin_unlock_irqrestore(&ieee->lock, flags);
-        return ret;
-}
-int ieee80211_wx_set_rate(struct ieee80211_device *ieee,
-                          struct iw_request_info *info, union iwreq_data *wrqu,
-                          char *extra)
-{
-        u32 target_rate = wrqu->bitrate.value;
-        //added by lizhaoming for auto mode
-        if (target_rate == -1)
-                ieee->rate = 110;
-        else
-                ieee->rate = target_rate/100000;
-        //FIXME: we might want to limit rate also in management protocols.
-        return 0;
-}
-int ieee80211_wx_get_rate(struct ieee80211_device *ieee,
-                          struct iw_request_info *info, union iwreq_data *wrqu,
-                          char *extra)
-{
-        wrqu->bitrate.value = ieee->rate * 100000;
-        return 0;
-}
-int ieee80211_wx_set_mode(struct ieee80211_device *ieee,
-                          struct iw_request_info *a, union iwreq_data *wrqu,
-                          char *b)
-{
-        ieee->sync_scan_hurryup = 1;
-        down(&ieee->wx_sem);
-        if (wrqu->mode == ieee->iw_mode)
-                goto out;
-        if (wrqu->mode == IW_MODE_MONITOR)
-                ieee->dev->type = ARPHRD_IEEE80211;
-        else
-                ieee->dev->type = ARPHRD_ETHER;
-        if (!ieee->proto_started) {
-                ieee->iw_mode = wrqu->mode;
-        } else {
-                ieee80211_stop_protocol(ieee);
-                ieee->iw_mode = wrqu->mode;
-                ieee80211_start_protocol(ieee);
-        }
-out:
-        up(&ieee->wx_sem);
-        return 0;
-}
-void ieee80211_wx_sync_scan_wq(struct work_struct *work)
-{
-        struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, wx_sync_scan_wq);
-        short chan;
-        chan = ieee->current_network.channel;
-        if (ieee->data_hard_stop)
-                ieee->data_hard_stop(ieee->dev);
-        ieee80211_stop_send_beacons(ieee);
-        ieee->state = IEEE80211_LINKED_SCANNING;
-        ieee->link_change(ieee->dev);
-        ieee80211_start_scan_syncro(ieee);
-        ieee->set_chan(ieee->dev, chan);
-        ieee->state = IEEE80211_LINKED;
-        ieee->link_change(ieee->dev);
-        if (ieee->data_hard_resume)
-                ieee->data_hard_resume(ieee->dev);
-        if (ieee->iw_mode == IW_MODE_ADHOC || ieee->iw_mode == IW_MODE_MASTER)
-                ieee80211_start_send_beacons(ieee);
-        //YJ,add,080828, In prevent of lossing ping packet during scanning
-        //ieee80211_sta_ps_send_null_frame(ieee, false);
-        //YJ,add,080828,end
-        up(&ieee->wx_sem);
-}
-int ieee80211_wx_set_scan(struct ieee80211_device *ieee,
-                          struct iw_request_info *a, union iwreq_data *wrqu,
-                          char *b)
-{
-        int ret = 0;
-        down(&ieee->wx_sem);
-        if (ieee->iw_mode == IW_MODE_MONITOR || !(ieee->proto_started)) {
-                ret = -1;
-                goto out;
-        }
-        //YJ,add,080828
-        //In prevent of lossing ping packet during scanning
-        //ieee80211_sta_ps_send_null_frame(ieee, true);
-        //YJ,add,080828,end
-        if (ieee->state == IEEE80211_LINKED) {
-                queue_work(ieee->wq, &ieee->wx_sync_scan_wq);
-                /* intentionally forget to up sem */
-                return 0;
-        }
-out:
-        up(&ieee->wx_sem);
-        return ret;
-}
-int ieee80211_wx_set_essid(struct ieee80211_device *ieee,
-                           struct iw_request_info *a, union iwreq_data *wrqu,
-                           char *extra)
-{
-        int ret = 0, len;
-        short proto_started;
-        unsigned long flags;
-        ieee->sync_scan_hurryup = 1;
-        down(&ieee->wx_sem);
-        proto_started = ieee->proto_started;
-        if (wrqu->essid.length > IW_ESSID_MAX_SIZE) {
-                ret = -E2BIG;
-                goto out;
-        }
-        if (ieee->iw_mode == IW_MODE_MONITOR) {
-                ret = -1;
-                goto out;
-        }
-        if (proto_started)
-                ieee80211_stop_protocol(ieee);
-        /* this is just to be sure that the GET wx callback
-         * has consistent infos. not needed otherwise
-         */
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (wrqu->essid.flags && wrqu->essid.length) {
-//YJ,modified,080819
-                len = (wrqu->essid.length < IW_ESSID_MAX_SIZE) ? (wrqu->essid.length) : IW_ESSID_MAX_SIZE;
-                memset(ieee->current_network.ssid, 0, ieee->current_network.ssid_len); //YJ,add,080819
-                strncpy(ieee->current_network.ssid, extra, len);
-                ieee->current_network.ssid_len = len;
-                ieee->ssid_set = 1;
-//YJ,modified,080819,end
-                //YJ,add,080819,for hidden ap
-                if (len == 0) {
-                        memset(ieee->current_network.bssid, 0, ETH_ALEN);
-                        ieee->current_network.capability = 0;
-                }
-                //YJ,add,080819,for hidden ap,end
-        } else {
-                ieee->ssid_set = 0;
-                ieee->current_network.ssid[0] = '\0';
-                ieee->current_network.ssid_len = 0;
-        }
-        //printk("==========set essid %s!\n",ieee->current_network.ssid);
-        spin_unlock_irqrestore(&ieee->lock, flags);
-        if (proto_started)
-                ieee80211_start_protocol(ieee);
-out:
-        up(&ieee->wx_sem);
-        return ret;
-}
-int ieee80211_wx_get_mode(struct ieee80211_device *ieee,
-                          struct iw_request_info *a, union iwreq_data *wrqu,
-                          char *b)
-{
-        wrqu->mode = ieee->iw_mode;
-        return 0;
-}
-int ieee80211_wx_set_rawtx(struct ieee80211_device *ieee,
-                           struct iw_request_info *info, union iwreq_data *wrqu,
-                           char *extra)
-{
-        int *parms = (int *)extra;
-        int enable = (parms[0] > 0);
-        short prev = ieee->raw_tx;
-        down(&ieee->wx_sem);
-        if (enable)
-                ieee->raw_tx = 1;
-        else
-                ieee->raw_tx = 0;
-        netdev_info(ieee->dev, "raw TX is %s\n",
-                    ieee->raw_tx ? "enabled" : "disabled");
-        if (ieee->iw_mode == IW_MODE_MONITOR) {
-                if (prev == 0 && ieee->raw_tx) {
-                        if (ieee->data_hard_resume)
-                                ieee->data_hard_resume(ieee->dev);
-                        netif_carrier_on(ieee->dev);
-                }
-                if (prev && ieee->raw_tx == 1)
-                        netif_carrier_off(ieee->dev);
-        }
-        up(&ieee->wx_sem);
-        return 0;
-}
-int ieee80211_wx_get_name(struct ieee80211_device *ieee,
-                          struct iw_request_info *info, union iwreq_data *wrqu,
-                          char *extra)
-{
-        strlcpy(wrqu->name, "802.11", IFNAMSIZ);
-        if (ieee->modulation & IEEE80211_CCK_MODULATION) {
-                strlcat(wrqu->name, "b", IFNAMSIZ);
-                if (ieee->modulation & IEEE80211_OFDM_MODULATION)
-                        strlcat(wrqu->name, "/g", IFNAMSIZ);
-        } else if (ieee->modulation & IEEE80211_OFDM_MODULATION)
-                strlcat(wrqu->name, "g", IFNAMSIZ);
-        if ((ieee->state == IEEE80211_LINKED) ||
-                (ieee->state == IEEE80211_LINKED_SCANNING))
-                strlcat(wrqu->name, "  link", IFNAMSIZ);
-        else if (ieee->state != IEEE80211_NOLINK)
-                strlcat(wrqu->name, " .....", IFNAMSIZ);
-        return 0;
-}
-/* this is mostly stolen from hostap */
-int ieee80211_wx_set_power(struct ieee80211_device *ieee,
-                           struct iw_request_info *info, union iwreq_data *wrqu,
-                           char *extra)
-{
-        int ret = 0;
-        if ((!ieee->sta_wake_up) ||
-            (!ieee->ps_request_tx_ack) ||
-            (!ieee->enter_sleep_state) ||
-            (!ieee->ps_is_queue_empty)) {
-                printk("ERROR. PS mode tried to be use but driver missed a callback\n\n");
-                return -1;
-        }
-        down(&ieee->wx_sem);
-        if (wrqu->power.disabled) {
-                ieee->ps = IEEE80211_PS_DISABLED;
-                goto exit;
-        }
-        switch (wrqu->power.flags & IW_POWER_MODE) {
-        case IW_POWER_UNICAST_R:
-                ieee->ps = IEEE80211_PS_UNICAST;
-                break;
-        case IW_POWER_ALL_R:
-                ieee->ps = IEEE80211_PS_UNICAST | IEEE80211_PS_MBCAST;
-                break;
-        case IW_POWER_ON:
-                ieee->ps = IEEE80211_PS_DISABLED;
-                break;
-        default:
-                ret = -EINVAL;
-                goto exit;
-        }
-        if (wrqu->power.flags & IW_POWER_TIMEOUT) {
-                ieee->ps_timeout = wrqu->power.value / 1000;
-                printk("Timeout %d\n", ieee->ps_timeout);
-        }
-        if (wrqu->power.flags & IW_POWER_PERIOD) {
-                ret = -EOPNOTSUPP;
-                goto exit;
-                //wrq->value / 1024;
-        }
-exit:
-        up(&ieee->wx_sem);
-        return ret;
-}
-/* this is stolen from hostap */
-int ieee80211_wx_get_power(struct ieee80211_device *ieee,
-                           struct iw_request_info *info, union iwreq_data *wrqu,
-                           char *extra)
-{
-        int ret = 0;
-        down(&ieee->wx_sem);
-        if (ieee->ps == IEEE80211_PS_DISABLED) {
-                wrqu->power.disabled = 1;
-                goto exit;
-        }
-        wrqu->power.disabled = 0;
-//      if ((wrqu->power.flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
-                wrqu->power.flags = IW_POWER_TIMEOUT;
-                wrqu->power.value = ieee->ps_timeout * 1000;
-//      } else {
-//              ret = -EOPNOTSUPP;
-//              goto exit;
-                //wrqu->power.flags = IW_POWER_PERIOD;
-                //wrqu->power.value = ieee->current_network.dtim_period *
-                //      ieee->current_network.beacon_interval * 1024;
-//      }
-        if (ieee->ps & IEEE80211_PS_MBCAST)
-                wrqu->power.flags |= IW_POWER_ALL_R;
-        else
-                wrqu->power.flags |= IW_POWER_UNICAST_R;
-exit:
-        up(&ieee->wx_sem);
-        return ret;
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
deleted file mode 100644
index 0dc5ae414270..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
+++ /dev/null
@@ -1,591 +0,0 @@
-/******************************************************************************
-  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-******************************************************************************
-  Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andrea.merello@gmail.com>
-  A special thanks goes to Realtek for their support !
-******************************************************************************/
-#include <linux/compiler.h>
-#include <linux/errno.h>
-#include <linux/if_arp.h>
-#include <linux/in6.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/pci.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/tcp.h>
-#include <linux/types.h>
-#include <linux/wireless.h>
-#include <linux/etherdevice.h>
-#include <asm/uaccess.h>
-#include <linux/if_vlan.h>
-#include "ieee80211.h"
-/*
-802.11 Data Frame
-802.11 frame_contorl for data frames - 2 bytes
-     ,-----------------------------------------------------------------------------------------.
-bits | 0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |  9  |  a  |  b  |  c  |  d  |  e   |
-     |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
-val  | 0  |  0  |  0  |  1  |  x  |  0  |  0  |  0  |  1  |  0  |  x  |  x  |  x  |  x  |  x   |
-     |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
-desc | ^-ver-^  |  ^type-^  |  ^-----subtype-----^  | to  |from |more |retry| pwr |more |wep   |
-     |          |           | x=0 data,x=1 data+ack | DS  | DS  |frag |     | mgm |data |      |
-     '-----------------------------------------------------------------------------------------'
-                                                    /\
-                                                    |
-802.11 Data Frame                                   |
-           ,--------- 'ctrl' expands to >-----------'
-          |
-      ,--'---,-------------------------------------------------------------.
-Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
-      |------|------|---------|---------|---------|------|---------|------|
-Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  Frame  |  fcs |
-      |      | tion | (BSSID) |         |         | ence |  data   |      |
-      `--------------------------------------------------|         |------'
-Total: 28 non-data bytes                                 `----.----'
-                                                              |
-       .- 'Frame data' expands to <---------------------------'
-       |
-       V
-      ,---------------------------------------------------.
-Bytes |  1   |  1   |    1    |    3     |  2   |  0-2304 |
-      |------|------|---------|----------|------|---------|
-Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP      |
-      | DSAP | SSAP |         |          |      | Packet  |
-      | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8|      |         |
-      `-----------------------------------------|         |
-Total: 8 non-data bytes                         `----.----'
-                                                     |
-       .- 'IP Packet' expands, if WEP enabled, to <--'
-       |
-       V
-      ,-----------------------.
-Bytes |  4  |   0-2296  |  4  |
-      |-----|-----------|-----|
-Desc. | IV  | Encrypted | ICV |
-      |     | IP Packet |     |
-      `-----------------------'
-Total: 8 non-data bytes
-802.3 Ethernet Data Frame
-      ,-----------------------------------------.
-Bytes |   6   |   6   |  2   |  Variable |   4  |
-      |-------|-------|------|-----------|------|
-Desc. | Dest. | Source| Type | IP Packet |  fcs |
-      |  MAC  |  MAC  |      |           |      |
-      `-----------------------------------------'
-Total: 18 non-data bytes
-In the event that fragmentation is required, the incoming payload is split into
-N parts of size ieee->fts.  The first fragment contains the SNAP header and the
-remaining packets are just data.
-If encryption is enabled, each fragment payload size is reduced by enough space
-to add the prefix and postfix (IV and ICV totalling 8 bytes in the case of WEP)
-So if you have 1500 bytes of payload with ieee->fts set to 500 without
-encryption it will take 3 frames.  With WEP it will take 4 frames as the
-payload of each frame is reduced to 492 bytes.
-* SKB visualization
-*
-*  ,- skb->data
-* |
-* |    ETHERNET HEADER        ,-<-- PAYLOAD
-* |                           |     14 bytes from skb->data
-* |  2 bytes for Type --> ,T. |     (sizeof ethhdr)
-* |                       | | |
-* |,-Dest.--. ,--Src.---. | | |
-* |  6 bytes| | 6 bytes | | | |
-* v         | |         | | | |
-* 0         | v       1 | v | v           2
-* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
-*     ^     | ^         | ^ |
-*     |     | |         | | |
-*     |     | |         | `T' <---- 2 bytes for Type
-*     |     | |         |
-*     |     | '---SNAP--' <-------- 6 bytes for SNAP
-*     |     |
-*     `-IV--' <-------------------- 4 bytes for IV (WEP)
-*
-*      SNAP HEADER
-*
-*/
-static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
-static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
-static inline int ieee80211_put_snap(u8 *data, u16 h_proto)
-{
-        struct ieee80211_snap_hdr *snap;
-        u8 *oui;
-        snap = (struct ieee80211_snap_hdr *)data;
-        snap->dsap = 0xaa;
-        snap->ssap = 0xaa;
-        snap->ctrl = 0x03;
-        if (h_proto == 0x8137 || h_proto == 0x80f3)
-                oui = P802_1H_OUI;
-        else
-                oui = RFC1042_OUI;
-        snap->oui[0] = oui[0];
-        snap->oui[1] = oui[1];
-        snap->oui[2] = oui[2];
-        *(u16 *)(data + SNAP_SIZE) = htons(h_proto);
-        return SNAP_SIZE + sizeof(u16);
-}
-int ieee80211_encrypt_fragment(struct ieee80211_device *ieee,
-                               struct sk_buff *frag, int hdr_len)
-{
-        struct ieee80211_crypt_data* crypt = ieee->crypt[ieee->tx_keyidx];
-        int res;
-        /*
-         * added to care about null crypt condition, to solve that system hangs
-         * when shared keys error
-         */
-        if (!crypt || !crypt->ops)
-                return -1;
-#ifdef CONFIG_IEEE80211_CRYPT_TKIP
-        struct ieee80211_hdr_4addr *header;
-        if (ieee->tkip_countermeasures &&
-            crypt && crypt->ops && strcmp(crypt->ops->name, "TKIP") == 0) {
-                header = (struct ieee80211_hdr_4addr *)frag->data;
-                if (net_ratelimit()) {
-                        netdev_dbg(ieee->dev, "TKIP countermeasures: dropped "
-                               "TX packet to %pM\n", header->addr1);
-                }
-                return -1;
-        }
-#endif
-        /*
-         * To encrypt, frame format is:
-         * IV (4 bytes), clear payload (including SNAP), ICV (4 bytes)
-         *
-         * PR: FIXME: Copied from hostap. Check fragmentation/MSDU/MPDU
-         * encryption.
-         *
-         * Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
-         * call both MSDU and MPDU encryption functions from here.
-         */
-        atomic_inc(&crypt->refcnt);
-        res = 0;
-        if (crypt->ops->encrypt_msdu)
-                res = crypt->ops->encrypt_msdu(frag, hdr_len, crypt->priv);
-        if (res == 0 && crypt->ops->encrypt_mpdu)
-                res = crypt->ops->encrypt_mpdu(frag, hdr_len, crypt->priv);
-        atomic_dec(&crypt->refcnt);
-        if (res < 0) {
-                netdev_info(ieee->dev, "Encryption failed: len=%d.\n", frag->len);
-                ieee->ieee_stats.tx_discards++;
-                return -1;
-        }
-        return 0;
-}
-void ieee80211_txb_free(struct ieee80211_txb *txb)
-{
-        int i;
-        if (unlikely(!txb))
-                return;
-        for (i = 0; i < txb->nr_frags; i++)
-                if (txb->fragments[i])
-                        dev_kfree_skb_any(txb->fragments[i]);
-        kfree(txb);
-}
-static struct ieee80211_txb *ieee80211_alloc_txb(int nr_frags, int txb_size,
-                                                 gfp_t gfp_mask)
-{
-        struct ieee80211_txb *txb;
-        int i;
-        txb = kmalloc(
-                sizeof(struct ieee80211_txb) + (sizeof(u8 *) * nr_frags),
-                gfp_mask);
-        if (!txb)
-                return NULL;
-        memset(txb, 0, sizeof(struct ieee80211_txb));
-        txb->nr_frags = nr_frags;
-        txb->frag_size = txb_size;
-        for (i = 0; i < nr_frags; i++) {
-                txb->fragments[i] = dev_alloc_skb(txb_size);
-                if (unlikely(!txb->fragments[i])) {
-                        i--;
-                        break;
-                }
-        }
-        if (unlikely(i != nr_frags)) {
-                while (i >= 0)
-                        dev_kfree_skb_any(txb->fragments[i--]);
-                kfree(txb);
-                return NULL;
-        }
-        return txb;
-}
-/*
- * Classify the to-be send data packet
- * Need to acquire the sent queue index.
- */
-static int ieee80211_classify(struct sk_buff *skb,
-                              struct ieee80211_network *network)
-{
-        struct ether_header *eh = (struct ether_header *)skb->data;
-        unsigned int wme_UP = 0;
-        if (!network->QoS_Enable) {
-                skb->priority = 0;
-                return(wme_UP);
-        }
-        if (eh->ether_type == __constant_htons(ETHERTYPE_IP)) {
-                const struct iphdr *ih = (struct iphdr *)(skb->data +
-                    sizeof(struct ether_header));
-                wme_UP = (ih->tos >> 5)&0x07;
-        } else if (vlan_tx_tag_present(skb)) {/* vtag packet */
-#ifndef VLAN_PRI_SHIFT
-#define VLAN_PRI_SHIFT  13              /* Shift to find VLAN user priority */
-#define VLAN_PRI_MASK   7               /* Mask for user priority bits in VLAN */
-#endif
-                u32 tag = vlan_tx_tag_get(skb);
-                wme_UP = (tag >> VLAN_PRI_SHIFT) & VLAN_PRI_MASK;
-        } else if (ETH_P_PAE ==  ntohs(((struct ethhdr *)skb->data)->h_proto)) {
-                wme_UP = 7;
-        }
-        skb->priority = wme_UP;
-        return(wme_UP);
-}
-/* SKBs are added to the ieee->tx_queue. */
-int ieee80211_rtl_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        struct ieee80211_device *ieee = netdev_priv(dev);
-        struct ieee80211_txb *txb = NULL;
-        struct ieee80211_hdr_3addrqos *frag_hdr;
-        int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size;
-        unsigned long flags;
-        struct net_device_stats *stats = &ieee->stats;
-        int ether_type, encrypt;
-        int bytes, fc, qos_ctl, hdr_len;
-        struct sk_buff *skb_frag;
-        struct ieee80211_hdr_3addrqos header = { /* Ensure zero initialized */
-                .duration_id = 0,
-                .seq_ctl = 0,
-                .qos_ctl = 0
-        };
-        u8 dest[ETH_ALEN], src[ETH_ALEN];
-        struct ieee80211_crypt_data* crypt;
-        spin_lock_irqsave(&ieee->lock, flags);
-        /*
-         * If there is no driver handler to take the TXB, don't bother
-         * creating it...
-         */
-        if ((!ieee->hard_start_xmit &&
-             !(ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)) ||
-            ((!ieee->softmac_data_hard_start_xmit &&
-              (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)))) {
-                netdev_warn(ieee->dev, "No xmit handler.\n");
-                goto success;
-        }
-        ieee80211_classify(skb,&ieee->current_network);
-        if (likely(ieee->raw_tx == 0)){
-                if (unlikely(skb->len < SNAP_SIZE + sizeof(u16))) {
-                        netdev_warn(ieee->dev, "skb too small (%d).\n", skb->len);
-                        goto success;
-                }
-                ether_type = ntohs(((struct ethhdr *)skb->data)->h_proto);
-                crypt = ieee->crypt[ieee->tx_keyidx];
-                encrypt = !(ether_type == ETH_P_PAE && ieee->ieee802_1x) &&
-                        ieee->host_encrypt && crypt && crypt->ops;
-                if (!encrypt && ieee->ieee802_1x &&
-                ieee->drop_unencrypted && ether_type != ETH_P_PAE) {
-                        stats->tx_dropped++;
-                        goto success;
-                }
-        #ifdef CONFIG_IEEE80211_DEBUG
-                if (crypt && !encrypt && ether_type == ETH_P_PAE) {
-                        struct eapol *eap = (struct eapol *)(skb->data +
-                                sizeof(struct ethhdr) - SNAP_SIZE - sizeof(u16));
-                        IEEE80211_DEBUG_EAP("TX: IEEE 802.11 EAPOL frame: %s\n",
-                                eap_get_type(eap->type));
-                }
-        #endif
-                /* Save source and destination addresses */
-                memcpy(&dest, skb->data, ETH_ALEN);
-                memcpy(&src, skb->data+ETH_ALEN, ETH_ALEN);
-                /* Advance the SKB to the start of the payload */
-                skb_pull(skb, sizeof(struct ethhdr));
-                /* Determine total amount of storage required for TXB packets */
-                bytes = skb->len + SNAP_SIZE + sizeof(u16);
-                if (ieee->current_network.QoS_Enable) {
-                        if (encrypt)
-                                fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA |
-                                        IEEE80211_FCTL_WEP;
-                        else
-                                fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
-                } else {
-                        if (encrypt)
-                                fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
-                                        IEEE80211_FCTL_WEP;
-                        else
-                                fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
-                }
-                if (ieee->iw_mode == IW_MODE_INFRA) {
-                        fc |= IEEE80211_FCTL_TODS;
-                        /* To DS: Addr1 = BSSID, Addr2 = SA, Addr3 = DA */
-                        memcpy(&header.addr1, ieee->current_network.bssid, ETH_ALEN);
-                        memcpy(&header.addr2, &src, ETH_ALEN);
-                        memcpy(&header.addr3, &dest, ETH_ALEN);
-                } else if (ieee->iw_mode == IW_MODE_ADHOC) {
-                        /*
-                         * not From/To DS: Addr1 = DA, Addr2 = SA,
-                         * Addr3 = BSSID
-                         */
-                        memcpy(&header.addr1, dest, ETH_ALEN);
-                        memcpy(&header.addr2, src, ETH_ALEN);
-                        memcpy(&header.addr3, ieee->current_network.bssid, ETH_ALEN);
-                }
-                header.frame_ctl = cpu_to_le16(fc);
-                /*
-                 * Determine fragmentation size based on destination (multicast
-                 * and broadcast are not fragmented)
-                 */
-                if (is_multicast_ether_addr(header.addr1)) {
-                        frag_size = MAX_FRAG_THRESHOLD;
-                        qos_ctl = QOS_CTL_NOTCONTAIN_ACK;
-                } else {
-                        /* default:392 */
-                        frag_size = ieee->fts;
-                        qos_ctl = 0;
-                }
-                if (ieee->current_network.QoS_Enable)   {
-                        hdr_len = IEEE80211_3ADDR_LEN + 2;
-                        /* skb->priority is set in the ieee80211_classify() */
-                        qos_ctl |= skb->priority;
-                        header.qos_ctl = cpu_to_le16(qos_ctl);
-                } else {
-                        hdr_len = IEEE80211_3ADDR_LEN;
-                }
-                /*
-                 * Determine amount of payload per fragment.  Regardless of if
-                 * this stack is providing the full 802.11 header, one will
-                 * eventually be affixed to this fragment -- so we must account
-                 * for it when determining the amount of payload space.
-                 */
-                bytes_per_frag = frag_size - hdr_len;
-                if (ieee->config &
-                (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
-                        bytes_per_frag -= IEEE80211_FCS_LEN;
-                /* Each fragment may need to have room for encryption pre/postfix */
-                if (encrypt)
-                        bytes_per_frag -= crypt->ops->extra_prefix_len +
-                                crypt->ops->extra_postfix_len;
-                /*
-                 * Number of fragments is the total bytes_per_frag /
-                 * payload_per_fragment
-                 */
-                nr_frags = bytes / bytes_per_frag;
-                bytes_last_frag = bytes % bytes_per_frag;
-                if (bytes_last_frag)
-                        nr_frags++;
-                else
-                        bytes_last_frag = bytes_per_frag;
-                /*
-                 * When we allocate the TXB we allocate enough space for the 
-                 * reserve and full fragment bytes (bytes_per_frag doesn't
-                 * include prefix, postfix, header, FCS, etc.)
-                 */
-                txb = ieee80211_alloc_txb(nr_frags, frag_size, GFP_ATOMIC);
-                if (unlikely(!txb)) {
-                        netdev_warn(ieee->dev, "Could not allocate TXB\n");
-                        goto failed;
-                }
-                txb->encrypted = encrypt;
-                txb->payload_size = bytes;
-                for (i = 0; i < nr_frags; i++) {
-                        skb_frag = txb->fragments[i];
-                        skb_frag->priority = UP2AC(skb->priority);
-                        if (encrypt)
-                                skb_reserve(skb_frag, crypt->ops->extra_prefix_len);
-                        frag_hdr = (struct ieee80211_hdr_3addrqos *)skb_put(
-                                skb_frag, hdr_len);
-                        memcpy(frag_hdr, &header, hdr_len);
-                        /*
-                         * If this is not the last fragment, then add the MOREFRAGS
-                         * bit to the frame control
-                         */
-                        if (i != nr_frags - 1) {
-                                frag_hdr->frame_ctl = cpu_to_le16(
-                                        fc | IEEE80211_FCTL_MOREFRAGS);
-                                bytes = bytes_per_frag;
-                        } else {
-                                /* The last fragment takes the remaining length */
-                                bytes = bytes_last_frag;
-                        }
-                        if (ieee->current_network.QoS_Enable) {
-                                /*
-                                 * add 1 only indicate to corresponding seq
-                                 * number control 2006/7/12
-                                 */
-                                frag_hdr->seq_ctl = cpu_to_le16(
-                                        ieee->seq_ctrl[UP2AC(skb->priority)+1]<<4 | i);
-                        } else {
-                                frag_hdr->seq_ctl = cpu_to_le16(
-                                        ieee->seq_ctrl[0]<<4 | i);
-                        }
-                        /* Put a SNAP header on the first fragment */
-                        if (i == 0) {
-                                ieee80211_put_snap(
-                                        skb_put(skb_frag, SNAP_SIZE + sizeof(u16)),
-                                        ether_type);
-                                bytes -= SNAP_SIZE + sizeof(u16);
-                        }
-                        memcpy(skb_put(skb_frag, bytes), skb->data, bytes);
-                        /* Advance the SKB... */
-                        skb_pull(skb, bytes);
-                        /*
-                         * Encryption routine will move the header forward in
-                         * order to insert the IV between the header and the
-                         * payload
-                         */
-                        if (encrypt)
-                                ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
-                        if (ieee->config &
-                        (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
-                                skb_put(skb_frag, 4);
-                }
-                /* Advance sequence number in data frame. */
-                if (ieee->current_network.QoS_Enable) {
-                        if (ieee->seq_ctrl[UP2AC(skb->priority) + 1] == 0xFFF)
-                                ieee->seq_ctrl[UP2AC(skb->priority) + 1] = 0;
-                        else
-                                ieee->seq_ctrl[UP2AC(skb->priority) + 1]++;
-                } else {
-                        if (ieee->seq_ctrl[0] == 0xFFF)
-                                ieee->seq_ctrl[0] = 0;
-                        else
-                                ieee->seq_ctrl[0]++;
-                }
-        } else {
-                if (unlikely(skb->len < sizeof(struct ieee80211_hdr_3addr))) {
-                        netdev_warn(ieee->dev, "skb too small (%d).\n", skb->len);
-                        goto success;
-                }
-                txb = ieee80211_alloc_txb(1, skb->len, GFP_ATOMIC);
-                if (!txb) {
-                        netdev_warn(ieee->dev, "Could not allocate TXB\n");
-                        goto failed;
-                }
-                txb->encrypted = 0;
-                txb->payload_size = skb->len;
-                memcpy(skb_put(txb->fragments[0], skb->len), skb->data, skb->len);
-        }
- success:
-        spin_unlock_irqrestore(&ieee->lock, flags);
-                dev_kfree_skb_any(skb);
-        if (txb) {
-                if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE) {
-                        ieee80211_softmac_xmit(txb, ieee);
-                } else {
-                        if ((*ieee->hard_start_xmit)(txb, dev) == 0) {
-                                stats->tx_packets++;
-                                stats->tx_bytes += txb->payload_size;
-                                return NETDEV_TX_OK;
-                        }
-                        ieee80211_txb_free(txb);
-                }
-        }
-        return NETDEV_TX_OK;
- failed:
-        spin_unlock_irqrestore(&ieee->lock, flags);
-        netif_stop_queue(dev);
-        stats->tx_errors++;
-        return NETDEV_TX_BUSY;
-}
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c
deleted file mode 100644
index 07c3f715a6f5..000000000000
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c
+++ /dev/null
@@ -1,713 +0,0 @@
-/*
- *  Copyright(c) 2004 Intel Corporation. All rights reserved.
- *
- * Portions of this file are based on the WEP enablement code provided by the
- * Host AP project hostap-drivers v0.1.3
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59
- * Temple Place - Suite 330, Boston, MA  02111-1307, USA.
- *
- * The full GNU General Public License is included in this distribution in the
- * file called LICENSE.
- *
- * Contact Information:
- * James P. Ketrenos <ipw2100-admin@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
-#include <linux/wireless.h>
-#include <linux/kmod.h>
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/etherdevice.h>
-#include "ieee80211.h"
-static const char *ieee80211_modes[] = {
-        "?", "a", "b", "ab", "g", "ag", "bg", "abg"
-};
-#define MAX_CUSTOM_LEN 64
-static inline char *rtl818x_translate_scan(struct ieee80211_device *ieee,
-                                           char *start, char *stop,
-                                           struct ieee80211_network *network,
-                                           struct iw_request_info *info)
-{
-        char custom[MAX_CUSTOM_LEN];
-        char *p;
-        struct iw_event iwe;
-        int i, j;
-        u8 max_rate, rate;
-        /* First entry *MUST* be the AP MAC address */
-        iwe.cmd = SIOCGIWAP;
-        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-        ether_addr_copy(iwe.u.ap_addr.sa_data, network->bssid);
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
-        /* Remaining entries will be displayed in the order we provide them */
-        /* Add the ESSID */
-        iwe.cmd = SIOCGIWESSID;
-        iwe.u.data.flags = 1;
-        if (network->ssid_len == 0) {
-                iwe.u.data.length = sizeof("<hidden>");
-                start = iwe_stream_add_point(info, start, stop, &iwe, "<hidden>");
-        } else {
-                iwe.u.data.length = min_t(u8, network->ssid_len, 32);
-                start = iwe_stream_add_point(info, start, stop, &iwe, network->ssid);
-        }
-        /* Add the protocol name */
-        iwe.cmd = SIOCGIWNAME;
-        snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11%s", ieee80211_modes[network->mode]);
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN);
-        /* Add mode */
-        iwe.cmd = SIOCGIWMODE;
-        if (network->capability &
-            (WLAN_CAPABILITY_BSS | WLAN_CAPABILITY_IBSS)) {
-                if (network->capability & WLAN_CAPABILITY_BSS)
-                        iwe.u.mode = IW_MODE_MASTER;
-                else
-                        iwe.u.mode = IW_MODE_ADHOC;
-                start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_UINT_LEN);
-        }
-        /* Add frequency/channel */
-        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = network->channel;
-        iwe.u.freq.e = 0;
-        iwe.u.freq.i = 0;
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_FREQ_LEN);
-        /* Add encryption capability */
-        iwe.cmd = SIOCGIWENCODE;
-        if (network->capability & WLAN_CAPABILITY_PRIVACY)
-                iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-        else
-                iwe.u.data.flags = IW_ENCODE_DISABLED;
-        iwe.u.data.length = 0;
-        start = iwe_stream_add_point(info, start, stop, &iwe, network->ssid);
-        /* Add basic and extended rates */
-        max_rate = 0;
-        p = custom;
-        p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
-        for (i = 0, j = 0; i < network->rates_len; ) {
-                if (j < network->rates_ex_len &&
-                    ((network->rates_ex[j] & 0x7F) <
-                     (network->rates[i] & 0x7F)))
-                        rate = network->rates_ex[j++] & 0x7F;
-                else
-                        rate = network->rates[i++] & 0x7F;
-                if (rate > max_rate)
-                        max_rate = rate;
-                p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-                              "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
-        }
-        for (; j < network->rates_ex_len; j++) {
-                rate = network->rates_ex[j] & 0x7F;
-                p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-                              "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
-                if (rate > max_rate)
-                        max_rate = rate;
-        }
-        iwe.cmd = SIOCGIWRATE;
-        iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
-        iwe.u.bitrate.value = max_rate * 500000;
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_PARAM_LEN);
-        iwe.cmd = IWEVCUSTOM;
-        iwe.u.data.length = p - custom;
-        if (iwe.u.data.length)
-                start = iwe_stream_add_point(info, start, stop, &iwe, custom);
-        /* Add quality statistics */
-        /* TODO: Fix these values... */
-        if (network->stats.signal == 0 || network->stats.rssi == 0)
-                netdev_info(ieee->dev, "========>signal:%d, rssi:%d\n",
-                            network->stats.signal, network->stats.rssi);
-        iwe.cmd = IWEVQUAL;
-        iwe.u.qual.qual = network->stats.signalstrength;
-        iwe.u.qual.level = network->stats.signal;
-        iwe.u.qual.noise = network->stats.noise;
-        iwe.u.qual.updated = network->stats.mask & IEEE80211_STATMASK_WEMASK;
-        if (!(network->stats.mask & IEEE80211_STATMASK_RSSI))
-                iwe.u.qual.updated |= IW_QUAL_LEVEL_INVALID;
-        if (!(network->stats.mask & IEEE80211_STATMASK_NOISE))
-                iwe.u.qual.updated |= IW_QUAL_NOISE_INVALID;
-        if (!(network->stats.mask & IEEE80211_STATMASK_SIGNAL))
-                iwe.u.qual.updated |= IW_QUAL_QUAL_INVALID;
-        iwe.u.qual.updated = 7;
-        start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
-        iwe.cmd = IWEVCUSTOM;
-        p = custom;
-        iwe.u.data.length = p - custom;
-        if (iwe.u.data.length)
-                start = iwe_stream_add_point(info, start, stop, &iwe, custom);
-        memset(&iwe, 0, sizeof(iwe));
-        if (network->wpa_ie_len) {
-                char buf[MAX_WPA_IE_LEN];
-                memcpy(buf, network->wpa_ie, network->wpa_ie_len);
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = network->wpa_ie_len;
-                start = iwe_stream_add_point(info, start, stop, &iwe, buf);
-        }
-        memset(&iwe, 0, sizeof(iwe));
-        if (network->rsn_ie_len) {
-                char buf[MAX_WPA_IE_LEN];
-                memcpy(buf, network->rsn_ie, network->rsn_ie_len);
-                iwe.cmd = IWEVGENIE;
-                iwe.u.data.length = network->rsn_ie_len;
-                start = iwe_stream_add_point(info, start, stop, &iwe, buf);
-        }
-        /* Add EXTRA: Age to display seconds since last beacon/probe response
-         * for given network.
-         */
-        iwe.cmd = IWEVCUSTOM;
-        p = custom;
-        p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-                      " Last beacon: %lums ago", (jiffies - network->last_scanned) / (HZ / 100));
-        iwe.u.data.length = p - custom;
-        if (iwe.u.data.length)
-                start = iwe_stream_add_point(info, start, stop, &iwe, custom);
-        return start;
-}
-int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
-                          struct iw_request_info *info,
-                          union iwreq_data *wrqu, char *extra)
-{
-        struct ieee80211_network *network;
-        unsigned long flags;
-        int err = 0;
-        char *ev = extra;
-        char *stop = ev + wrqu->data.length;
-        int i = 0;
-        IEEE80211_DEBUG_WX("Getting scan\n");
-        down(&ieee->wx_sem);
-        spin_lock_irqsave(&ieee->lock, flags);
-        if (!ieee->bHwRadioOff) {
-                list_for_each_entry(network, &ieee->network_list, list) {
-                        i++;
-                        if ((stop-ev) < 200) {
-                                err = -E2BIG;
-                                break;
-                        }
-                        if (ieee->scan_age == 0 ||
-                            time_after(network->last_scanned + ieee->scan_age, jiffies)) {
-                                ev = rtl818x_translate_scan(ieee, ev, stop, network, info);
-                        } else
-                                IEEE80211_DEBUG_SCAN(
-                                        "Not showing network '%s ("
-                                        "%pM)' due to age (%lums).\n",
-                                        escape_essid(network->ssid,
-                                                     network->ssid_len),
-                                        network->bssid,
-                                        (jiffies - network->last_scanned) / (HZ / 100));
-                }
-        }
-        spin_unlock_irqrestore(&ieee->lock, flags);
-        up(&ieee->wx_sem);
-        wrqu->data.length = ev -  extra;
-        wrqu->data.flags = 0;
-        IEEE80211_DEBUG_WX("exit: %d networks returned.\n", i);
-        return err;
-}
-int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *keybuf)
-{
-        struct iw_point *erq = &(wrqu->encoding);
-        struct net_device *dev = ieee->dev;
-        struct ieee80211_security sec = {
-                .flags = 0
-        };
-        int i, key, key_provided, len;
-        struct ieee80211_crypt_data **crypt;
-        IEEE80211_DEBUG_WX("SET_ENCODE\n");
-        key = erq->flags & IW_ENCODE_INDEX;
-        if (key) {
-                if (key > WEP_KEYS)
-                        return -EINVAL;
-                key--;
-                key_provided = 1;
-        } else {
-                key_provided = 0;
-                key = ieee->tx_keyidx;
-        }
-        IEEE80211_DEBUG_WX("Key: %d [%s]\n", key, key_provided ?
-                           "provided" : "default");
-        crypt = &ieee->crypt[key];
-        if (erq->flags & IW_ENCODE_DISABLED) {
-                if (key_provided && *crypt) {
-                        IEEE80211_DEBUG_WX("Disabling encryption on key %d.\n",
-                                           key);
-                        ieee80211_crypt_delayed_deinit(ieee, crypt);
-                } else
-                        IEEE80211_DEBUG_WX("Disabling encryption.\n");
-                /* Check all the keys to see if any are still configured,
-                 * and if no key index was provided, de-init them all.
-                 */
-                for (i = 0; i < WEP_KEYS; i++) {
-                        if (ieee->crypt[i] != NULL) {
-                                if (key_provided)
-                                        break;
-                                ieee80211_crypt_delayed_deinit(
-                                        ieee, &ieee->crypt[i]);
-                        }
-                }
-                if (i == WEP_KEYS) {
-                        sec.enabled = 0;
-                        sec.level = SEC_LEVEL_0;
-                        sec.flags |= SEC_ENABLED | SEC_LEVEL;
-                }
-                goto done;
-        }
-        sec.enabled = 1;
-        sec.flags |= SEC_ENABLED;
-        if (*crypt != NULL && (*crypt)->ops != NULL &&
-            strcmp((*crypt)->ops->name, "WEP") != 0) {
-                /* changing to use WEP; deinit previously used algorithm
-                 * on this key.
-                 */
-                ieee80211_crypt_delayed_deinit(ieee, crypt);
-        }
-        if (*crypt == NULL) {
-                struct ieee80211_crypt_data *new_crypt;
-                /* take WEP into use */
-                new_crypt = kzalloc(sizeof(struct ieee80211_crypt_data),
-                                    GFP_KERNEL);
-                if (new_crypt == NULL)
-                        return -ENOMEM;
-                new_crypt->ops = ieee80211_get_crypto_ops("WEP");
-                if (!new_crypt->ops)
-                        new_crypt->ops = ieee80211_get_crypto_ops("WEP");
-                if (new_crypt->ops)
-                        new_crypt->priv = new_crypt->ops->init(key);
-                if (!new_crypt->ops || !new_crypt->priv) {
-                        kfree(new_crypt);
-                        new_crypt = NULL;
-                        netdev_warn(ieee->dev,
-                                    "could not initialize WEP: load module ieee80211_crypt_wep\n");
-                        return -EOPNOTSUPP;
-                }
-                *crypt = new_crypt;
-        }
-        /* If a new key was provided, set it up */
-        if (erq->length > 0) {
-                len = erq->length <= 5 ? 5 : 13;
-                memcpy(sec.keys[key], keybuf, erq->length);
-                if (len > erq->length)
-                        memset(sec.keys[key] + erq->length, 0,
-                               len - erq->length);
-                IEEE80211_DEBUG_WX("Setting key %d to '%s' (%d:%d bytes)\n",
-                                   key, escape_essid(sec.keys[key], len),
-                                   erq->length, len);
-                sec.key_sizes[key] = len;
-                (*crypt)->ops->set_key(sec.keys[key], len, NULL,
-                                       (*crypt)->priv);
-                sec.flags |= (1 << key);
-                /* This ensures a key will be activated if no key is
-                 * explicitly set.
-                 */
-                if (key == sec.active_key)
-                        sec.flags |= SEC_ACTIVE_KEY;
-                ieee->tx_keyidx = key;
-        } else {
-                len = (*crypt)->ops->get_key(sec.keys[key], WEP_KEY_LEN,
-                                             NULL, (*crypt)->priv);
-                if (len == 0) {
-                        /* Set a default key of all 0 */
-                        IEEE80211_DEBUG_WX("Setting key %d to all zero.\n",
-                                           key);
-                        memset(sec.keys[key], 0, 13);
-                        (*crypt)->ops->set_key(sec.keys[key], 13, NULL,
-                                               (*crypt)->priv);
-                        sec.key_sizes[key] = 13;
-                        sec.flags |= (1 << key);
-                }
-                /* No key data - just set the default TX key index */
-                if (key_provided) {
-                        IEEE80211_DEBUG_WX(
-                                "Setting key %d to default Tx key.\n", key);
-                        ieee->tx_keyidx = key;
-                        sec.active_key = key;
-                        sec.flags |= SEC_ACTIVE_KEY;
-                }
-        }
- done:
-        ieee->open_wep = !(erq->flags & IW_ENCODE_RESTRICTED);
-        sec.auth_mode = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
-        sec.flags |= SEC_AUTH_MODE;
-        IEEE80211_DEBUG_WX("Auth: %s\n", sec.auth_mode == WLAN_AUTH_OPEN ?
-                           "OPEN" : "SHARED KEY");
-        /* For now we just support WEP, so only set that security level...
-         * TODO: When WPA is added this is one place that needs to change
-         */
-        sec.flags |= SEC_LEVEL;
-        sec.level = SEC_LEVEL_1; /* 40 and 104 bit WEP */
-        if (ieee->set_security)
-                ieee->set_security(dev, &sec);
-        /* Do not reset port if card is in Managed mode since resetting will
-         * generate new IEEE 802.11 authentication which may end up in looping
-         * with IEEE 802.1X.  If your hardware requires a reset after WEP
-         * configuration (for example... Prism2), implement the reset_port in
-         * the callbacks structures used to initialize the 802.11 stack.
-         */
-        if (ieee->reset_on_keychange &&
-            ieee->iw_mode != IW_MODE_INFRA &&
-            ieee->reset_port && ieee->reset_port(dev)) {
-                netdev_dbg(ieee->dev, "reset_port failed\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *keybuf)
-{
-        struct iw_point *erq = &(wrqu->encoding);
-        int len, key;
-        struct ieee80211_crypt_data *crypt;
-        IEEE80211_DEBUG_WX("GET_ENCODE\n");
-        if (ieee->iw_mode == IW_MODE_MONITOR)
-                return -1;
-        key = erq->flags & IW_ENCODE_INDEX;
-        if (key) {
-                if (key > WEP_KEYS)
-                        return -EINVAL;
-                key--;
-        } else
-                key = ieee->tx_keyidx;
-        crypt = ieee->crypt[key];
-        erq->flags = key + 1;
-        if (crypt == NULL || crypt->ops == NULL) {
-                erq->length = 0;
-                erq->flags |= IW_ENCODE_DISABLED;
-                return 0;
-        }
-        if (strcmp(crypt->ops->name, "WEP") != 0) {
-                /* only WEP is supported with wireless extensions, so just
-                 * report that encryption is used.
-                 */
-                erq->length = 0;
-                erq->flags |= IW_ENCODE_ENABLED;
-                return 0;
-        }
-        len = crypt->ops->get_key(keybuf, WEP_KEY_LEN, NULL, crypt->priv);
-        erq->length = (len >= 0 ? len : 0);
-        erq->flags |= IW_ENCODE_ENABLED;
-        if (ieee->open_wep)
-                erq->flags |= IW_ENCODE_OPEN;
-        else
-                erq->flags |= IW_ENCODE_RESTRICTED;
-        return 0;
-}
-int ieee80211_wx_set_encode_ext(struct ieee80211_device *ieee,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu, char *extra)
-{
-        struct net_device *dev = ieee->dev;
-        struct iw_point *encoding = &wrqu->encoding;
-        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int i, idx, ret = 0;
-        int group_key = 0;
-        const char *alg;
-        struct ieee80211_crypto_ops *ops;
-        struct ieee80211_crypt_data **crypt;
-        struct ieee80211_security sec = {
-                .flags = 0,
-        };
-        idx = encoding->flags & IW_ENCODE_INDEX;
-        if (idx) {
-                if (idx < 1 || idx > WEP_KEYS)
-                        return -EINVAL;
-                idx--;
-        } else
-                idx = ieee->tx_keyidx;
-        if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
-                crypt = &ieee->crypt[idx];
-                group_key = 1;
-        } else {
-                /* some Cisco APs use idx>0 for unicast in dynamic WEP */
-                if (idx != 0 && ext->alg != IW_ENCODE_ALG_WEP)
-                        return -EINVAL;
-                if (ieee->iw_mode == IW_MODE_INFRA)
-                        crypt = &ieee->crypt[idx];
-                else
-                        return -EINVAL;
-        }
-        sec.flags |= SEC_ENABLED;
-        if ((encoding->flags & IW_ENCODE_DISABLED) ||
-            ext->alg == IW_ENCODE_ALG_NONE) {
-                if (*crypt)
-                        ieee80211_crypt_delayed_deinit(ieee, crypt);
-                for (i = 0; i < WEP_KEYS; i++)
-                        if (ieee->crypt[i] != NULL)
-                                break;
-                if (i == WEP_KEYS) {
-                        sec.enabled = 0;
-                        sec.level = SEC_LEVEL_0;
-                        sec.flags |= SEC_LEVEL;
-                }
-                goto done;
-        }
-        sec.enabled = 1;
-        switch (ext->alg) {
-        case IW_ENCODE_ALG_WEP:
-                alg = "WEP";
-                break;
-        case IW_ENCODE_ALG_TKIP:
-                alg = "TKIP";
-                break;
-        case IW_ENCODE_ALG_CCMP:
-                alg = "CCMP";
-                break;
-        default:
-                IEEE80211_DEBUG_WX("%s: unknown crypto alg %d\n",
-                                   dev->name, ext->alg);
-                ret = -EINVAL;
-                goto done;
-        }
-        ops = ieee80211_get_crypto_ops(alg);
-        if (ops == NULL)
-                ops = ieee80211_get_crypto_ops(alg);
-        if (ops == NULL) {
-                IEEE80211_DEBUG_WX("%s: unknown crypto alg %d\n",
-                                   dev->name, ext->alg);
-                netdev_err(ieee->dev, "========>unknown crypto alg %d\n",
-                           ext->alg);
-                ret = -EINVAL;
-                goto done;
-        }
-        if (*crypt == NULL || (*crypt)->ops != ops) {
-                struct ieee80211_crypt_data *new_crypt;
-                ieee80211_crypt_delayed_deinit(ieee, crypt);
-                new_crypt = kzalloc(sizeof(*new_crypt), GFP_KERNEL);
-                if (new_crypt == NULL) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
-                new_crypt->ops = ops;
-                if (new_crypt->ops)
-                        new_crypt->priv = new_crypt->ops->init(idx);
-                if (new_crypt->priv == NULL) {
-                        kfree(new_crypt);
-                        ret = -EINVAL;
-                        goto done;
-                }
-                *crypt = new_crypt;
-        }
-        if (ext->key_len > 0 && (*crypt)->ops->set_key &&
-            (*crypt)->ops->set_key(ext->key, ext->key_len, ext->rx_seq,
-                                   (*crypt)->priv) < 0) {
-                IEEE80211_DEBUG_WX("%s: key setting failed\n", dev->name);
-                netdev_err(ieee->dev, "key setting failed\n");
-                ret = -EINVAL;
-                goto done;
-        }
-#if 1
-        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
-                ieee->tx_keyidx = idx;
-                sec.active_key = idx;
-                sec.flags |= SEC_ACTIVE_KEY;
-        }
-        if (ext->alg != IW_ENCODE_ALG_NONE) {
-                memcpy(sec.keys[idx], ext->key, ext->key_len);
-                sec.key_sizes[idx] = ext->key_len;
-                sec.flags |= (1 << idx);
-                if (ext->alg == IW_ENCODE_ALG_WEP) {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_1;
-                } else if (ext->alg == IW_ENCODE_ALG_TKIP) {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_2;
-                } else if (ext->alg == IW_ENCODE_ALG_CCMP) {
-                        sec.flags |= SEC_LEVEL;
-                        sec.level = SEC_LEVEL_3;
-                }
-                /* Don't set sec level for group keys. */
-                if (group_key)
-                        sec.flags &= ~SEC_LEVEL;
-        }
-#endif
-done:
-        if (ieee->set_security)
-                ieee->set_security(ieee->dev, &sec);
-        if (ieee->reset_on_keychange &&
-            ieee->iw_mode != IW_MODE_INFRA &&
-            ieee->reset_port && ieee->reset_port(dev)) {
-                IEEE80211_DEBUG_WX("%s: reset_port failed\n", dev->name);
-                return -EINVAL;
-        }
-        return ret;
-}
-int ieee80211_wx_set_mlme(struct ieee80211_device *ieee,
-                          struct iw_request_info *info,
-                          union iwreq_data *wrqu, char *extra)
-{
-        struct iw_mlme *mlme = (struct iw_mlme *) extra;
-#if 1
-        switch (mlme->cmd) {
-        case IW_MLME_DEAUTH:
-        case IW_MLME_DISASSOC:
-                ieee80211_disassociate(ieee);
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-#endif
-        return 0;
-}
-int ieee80211_wx_set_auth(struct ieee80211_device *ieee,
-                          struct iw_request_info *info,
-                          struct iw_param *data, char *extra)
-{
-        switch (data->flags & IW_AUTH_INDEX) {
-        case IW_AUTH_WPA_VERSION:
-                /* need to support wpa2 here */
-                break;
-        case IW_AUTH_CIPHER_PAIRWISE:
-        case IW_AUTH_CIPHER_GROUP:
-        case IW_AUTH_KEY_MGMT:
-                /* Host AP driver does not use these parameters and allows
-                 * wpa_supplicant to control them internally.
-                 */
-                break;
-        case IW_AUTH_TKIP_COUNTERMEASURES:
-                ieee->tkip_countermeasures = data->value;
-                break;
-        case IW_AUTH_DROP_UNENCRYPTED:
-                ieee->drop_unencrypted = data->value;
-                break;
-        case IW_AUTH_80211_AUTH_ALG:
-                ieee->open_wep = (data->value&IW_AUTH_ALG_OPEN_SYSTEM) ? 1 : 0;
-                break;
-#if 1
-        case IW_AUTH_WPA_ENABLED:
-                ieee->wpa_enabled = (data->value) ? 1 : 0;
-                break;
-#endif
-        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-                ieee->ieee802_1x = data->value;
-                break;
-        case IW_AUTH_PRIVACY_INVOKED:
-                ieee->privacy_invoked = data->value;
-                break;
-        default:
-                return -EOPNOTSUPP;
-        }
-        return 0;
-}
-#if 1
-int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len)
-{
-        u8 *buf = NULL;
-        if (len > MAX_WPA_IE_LEN || (len && ie == NULL)) {
-                netdev_err(ieee->dev, "return error out, len:%zu\n", len);
-        return -EINVAL;
-        }
-        if (len) {
-                if (len != ie[1]+2) {
-                        netdev_err(ieee->dev, "len:%zu, ie:%d\n", len, ie[1]);
-                        return -EINVAL;
-                }
-                buf = kmemdup(ie, len, GFP_KERNEL);
-                if (buf == NULL)
-                        return -ENOMEM;
-                kfree(ieee->wpa_ie);
-                ieee->wpa_ie = buf;
-                ieee->wpa_ie_len = len;
-        } else {
-                kfree(ieee->wpa_ie);
-                ieee->wpa_ie = NULL;
-                ieee->wpa_ie_len = 0;
-        }
-        return 0;
-}
-#endif
diff --git a/drivers/staging/rtl8187se/r8180.h b/drivers/staging/rtl8187se/r8180.h
deleted file mode 100644
index 9f931dba1d82..000000000000
--- a/drivers/staging/rtl8187se/r8180.h
+++ /dev/null
@@ -1,640 +0,0 @@
-/*
- * This is part of rtl8180 OpenSource driver.
- * Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
- * Released under the terms of GPL (General Public Licence)
- *
- * Parts of this driver are based on the GPL part of the official realtek driver
- *
- * Parts of this driver are based on the rtl8180 driver skeleton from Patric
- * Schenke & Andres Salomon
- *
- * Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
- *
- * We want to thanks the Authors of those projects and the Ndiswrapper project
- * Authors.
- */
-#ifndef R8180H
-#define R8180H
-#include <linux/interrupt.h>
-#define RTL8180_MODULE_NAME "r8180"
-#define DMESG(x, a...) printk(KERN_INFO RTL8180_MODULE_NAME ": " x "\n", ## a)
-#define DMESGW(x, a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": WW:" x "\n", ## a)
-#define DMESGE(x, a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": EE:" x "\n", ## a)
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/ioport.h>
-#include <linux/sched.h>
-#include <linux/types.h>
-#include <linux/slab.h>
-#include <linux/netdevice.h>
-#include <linux/pci.h>
-#include <linux/etherdevice.h>
-#include <linux/delay.h>
-#include <linux/rtnetlink.h> /* for rtnl_lock() */
-#include <linux/wireless.h>
-#include <linux/timer.h>
-#include <linux/proc_fs.h> /* Necessary because we use the proc fs. */
-#include <linux/if_arp.h>
-#include "ieee80211/ieee80211.h"
-#include <asm/io.h>
-#define EPROM_93c46 0
-#define EPROM_93c56 1
-#define RTL_IOCTL_WPA_SUPPLICANT (SIOCIWFIRSTPRIV + 30)
-#define DEFAULT_FRAG_THRESHOLD 2342U
-#define MIN_FRAG_THRESHOLD 256U
-#define DEFAULT_RTS_THRESHOLD 2342U
-#define MIN_RTS_THRESHOLD 0U
-#define MAX_RTS_THRESHOLD 2342U
-#define DEFAULT_BEACONINTERVAL 0x64U
-#define DEFAULT_RETRY_RTS 7
-#define DEFAULT_RETRY_DATA 7
-#define BEACON_QUEUE 6
-#define aSifsTime 10
-#define sCrcLng 4
-#define sAckCtsLng 112 /* bits in ACK and CTS frames. */
-/* +by amy 080312. */
-#define RATE_ADAPTIVE_TIMER_PERIOD 300
-enum wireless_mode {
-        WIRELESS_MODE_UNKNOWN = 0x00,
-        WIRELESS_MODE_A = 0x01,
-        WIRELESS_MODE_B = 0x02,
-        WIRELESS_MODE_G = 0x04,
-        WIRELESS_MODE_AUTO = 0x08,
-};
-struct chnl_access_setting {
-        u16 sifs_timer;
-        u16 difs_timer;
-        u16 slot_time_timer;
-        u16 eifs_timer;
-        u16 cwmin_index;
-        u16 cwmax_index;
-};
-enum nic_t {
-        NIC_8185 = 1,
-        NIC_8185B
-};
-typedef u32 AC_CODING;
-#define AC0_BE  0 /* ACI: 0x00 */ /* Best Effort. */
-#define AC1_BK  1 /* ACI: 0x01 */ /* Background. */
-#define AC2_VI  2 /* ACI: 0x10 */ /* Video. */
-#define AC3_VO  3 /* ACI: 0x11 */ /* Voice. */
-#define AC_MAX  4 /* Max: define total number; Should not to be used as a real
-                   * enum.
-                   */
-/*
- * ECWmin/ECWmax field.
- * Ref: WMM spec 2.2.2: WME Parameter Element, p.13.
- */
-typedef union _ECW {
-        u8 charData;
-        struct {
-                u8 ECWmin:4;
-                u8 ECWmax:4;
-        } f;    /* Field */
-} ECW, *PECW;
-/*
- * ACI/AIFSN Field. Ref: WMM spec 2.2.2: WME Parameter Element, p.12.
- */
-typedef union _ACI_AIFSN {
-        u8 charData;
-        struct {
-                u8 AIFSN:4;
-                u8 ACM:1;
-                u8 ACI:2;
-                u8 Reserved:1;
-        } f;    /* Field */
-} ACI_AIFSN, *PACI_AIFSN;
-/*
- * AC Parameters Record Format.
- * Ref: WMM spec 2.2.2: WME Parameter Element, p.12.
- */
-typedef union _AC_PARAM {
-        u32 longData;
-        u8 charData[4];
-        struct {
-                ACI_AIFSN AciAifsn;
-                ECW Ecw;
-                u16 TXOPLimit;
-        } f;    /* Field */
-} AC_PARAM, *PAC_PARAM;
-struct buffer {
-        struct buffer *next;
-        u32 *buf;
-        dma_addr_t dma;
-};
-/* YJ,modified,080828. */
-struct stats {
-        unsigned long txrdu;
-        unsigned long rxrdu;
-        unsigned long rxnolast;
-        unsigned long rxnodata;
-        unsigned long rxnopointer;
-        unsigned long txnperr;
-        unsigned long txresumed;
-        unsigned long rxerr;
-        unsigned long rxoverflow;
-        unsigned long rxint;
-        unsigned long txbkpokint;
-        unsigned long txbepoking;
-        unsigned long txbkperr;
-        unsigned long txbeperr;
-        unsigned long txnpokint;
-        unsigned long txhpokint;
-        unsigned long txhperr;
-        unsigned long ints;
-        unsigned long shints;
-        unsigned long txoverflow;
-        unsigned long rxdmafail;
-        unsigned long txbeacon;
-        unsigned long txbeaconerr;
-        unsigned long txlpokint;
-        unsigned long txlperr;
-        unsigned long txretry; /* retry number tony 20060601 */
-        unsigned long rxcrcerrmin; /* crc error (0-500) */
-        unsigned long rxcrcerrmid; /* crc error (500-1000) */
-        unsigned long rxcrcerrmax; /* crc error (>1000) */
-        unsigned long rxicverr; /* ICV error */
-};
-#define MAX_LD_SLOT_NUM 10
-#define KEEP_ALIVE_INTERVAL 20 /* in seconds. */
-#define CHECK_FOR_HANG_PERIOD 2 /* be equal to watchdog check time. */
-#define DEFAULT_KEEP_ALIVE_LEVEL 1
-#define DEFAULT_SLOT_NUM 2
-#define POWER_PROFILE_AC 0
-#define POWER_PROFILE_BATTERY 1
-struct link_detect_t {
-        u32 rx_frame_num[MAX_LD_SLOT_NUM]; /* number of Rx Frame.
-                                            * CheckForHang_period  to determine
-                                            * link status.
-                                            */
-        u16 slot_num; /* number of CheckForHang period to determine link status,
-                       * default is 2.
-                       */
-        u16 slot_index;
-        u32 num_tx_ok_in_period; /* number of packet transmitted during
-                                  * CheckForHang.
-                                  */
-        u32 num_rx_ok_in_period; /* number of packet received during
-                                  * CheckForHang.
-                                  */
-        u8 idle_count; /* (KEEP_ALIVE_INTERVAL / CHECK_FOR_HANG_PERIOD) */
-        u32 last_num_tx_unicast;
-        u32 last_num_rx_unicast;
-        bool b_busy_traffic; /* when it is set to 1, UI cann't scan at will. */
-};
-/* YJ,modified,080828,end */
-/* by amy for led
- * ==========================================================================
- * LED customization.
- * ==========================================================================
- */
-enum led_strategy_8185 {
-        SW_LED_MODE0,
-        SW_LED_MODE1,
-        HW_LED, /* HW control 2 LEDs, LED0 and LED1 (there are 4 different
-                 * control modes). */
-};
-enum rt_rf_power_state {
-        RF_ON,
-        RF_SLEEP,
-        RF_OFF
-};
-enum _ReasonCode {
-        unspec_reason = 0x1,
-        auth_not_valid = 0x2,
-        deauth_lv_ss = 0x3,
-        inactivity = 0x4,
-        ap_overload = 0x5,
-        class2_err = 0x6,
-        class3_err = 0x7,
-        disas_lv_ss = 0x8,
-        asoc_not_auth = 0x9,
-        /* ----MIC_CHECK */
-        mic_failure = 0xe,
-        /* ----END MIC_CHECK */
-        /* Reason code defined in 802.11i D10.0 p.28. */
-        invalid_IE = 0x0d,
-        four_way_tmout = 0x0f,
-        two_way_tmout = 0x10,
-        IE_dismatch = 0x11,
-        invalid_Gcipher = 0x12,
-        invalid_Pcipher = 0x13,
-        invalid_AKMP = 0x14,
-        unsup_RSNIEver = 0x15,
-        invalid_RSNIE = 0x16,
-        auth_802_1x_fail = 0x17,
-        ciper_reject = 0x18,
-        /* Reason code defined in 7.3.1.7, 802.1e D13.0, p.42. Added by Annie,
-         * 2005-11-15.
-         */
-        QoS_unspec = 0x20, /* 32 */
-        QAP_bandwidth = 0x21, /* 33 */
-        poor_condition = 0x22, /* 34 */
-        no_facility = 0x23, /* 35 */
-        /* Where is 36??? */
-        req_declined = 0x25, /* 37 */
-        invalid_param = 0x26, /* 38 */
-        req_not_honored = 0x27, /* 39 */
-        TS_not_created = 0x2F, /* 47 */
-        DL_not_allowed = 0x30, /* 48 */
-        dest_not_exist = 0x31, /* 49 */
-        dest_not_QSTA = 0x32, /* 50 */
-};
-enum rt_ps_mode {
-        ACTIVE, /* Active/Continuous access. */
-        MAX_PS, /* Max power save mode. */
-        FAST_PS /* Fast power save mode. */
-};
-/* by amy for power save. */
-struct r8180_priv {
-        struct pci_dev *pdev;
-        short epromtype;
-        int irq;
-        struct ieee80211_device *ieee80211;
-        short plcp_preamble_mode; /* 0:auto 1:short 2:long */
-        spinlock_t irq_th_lock;
-        spinlock_t tx_lock;
-        spinlock_t ps_lock;
-        spinlock_t rf_ps_lock;
-        u16 irq_mask;
-        short irq_enabled;
-        struct net_device *dev;
-        short chan;
-        short sens;
-        short max_sens;
-        u8 chtxpwr[15]; /* channels from 1 to 14, 0 not used. */
-        u8 chtxpwr_ofdm[15]; /* channels from 1 to 14, 0 not used. */
-        u8 channel_plan;  /* it's the channel plan index. */
-        short up;
-        short crcmon; /* if 1 allow bad crc frame reception in monitor mode. */
-        struct timer_list scan_timer;
-        spinlock_t scan_lock;
-        u8 active_probe;
-        struct semaphore wx_sem;
-        short hw_wep;
-        short digphy;
-        short antb;
-        short diversity;
-        u32 key0[4];
-        short (*rf_set_sens)(struct net_device *dev, short sens);
-        void (*rf_set_chan)(struct net_device *dev, short ch);
-        void (*rf_close)(struct net_device *dev);
-        void (*rf_init)(struct net_device *dev);
-        void (*rf_sleep)(struct net_device *dev);
-        void (*rf_wakeup)(struct net_device *dev);
-        /* short rate; */
-        short promisc;
-        /* stats */
-        struct stats stats;
-        struct link_detect_t link_detect; /* YJ,add,080828 */
-        struct iw_statistics wstats;
-        /* RX stuff. */
-        u32 *rxring;
-        u32 *rxringtail;
-        dma_addr_t rxringdma;
-        struct buffer *rxbuffer;
-        struct buffer *rxbufferhead;
-        int rxringcount;
-        u16 rxbuffersize;
-        struct sk_buff *rx_skb;
-        short rx_skb_complete;
-        u32 rx_prevlen;
-        u32 *txmapring;
-        u32 *txbkpring;
-        u32 *txbepring;
-        u32 *txvipring;
-        u32 *txvopring;
-        u32 *txhpring;
-        dma_addr_t txmapringdma;
-        dma_addr_t txbkpringdma;
-        dma_addr_t txbepringdma;
-        dma_addr_t txvipringdma;
-        dma_addr_t txvopringdma;
-        dma_addr_t txhpringdma;
-        u32 *txmapringtail;
-        u32 *txbkpringtail;
-        u32 *txbepringtail;
-        u32 *txvipringtail;
-        u32 *txvopringtail;
-        u32 *txhpringtail;
-        u32 *txmapringhead;
-        u32 *txbkpringhead;
-        u32 *txbepringhead;
-        u32 *txvipringhead;
-        u32 *txvopringhead;
-        u32 *txhpringhead;
-        struct buffer *txmapbufs;
-        struct buffer *txbkpbufs;
-        struct buffer *txbepbufs;
-        struct buffer *txvipbufs;
-        struct buffer *txvopbufs;
-        struct buffer *txhpbufs;
-        struct buffer *txmapbufstail;
-        struct buffer *txbkpbufstail;
-        struct buffer *txbepbufstail;
-        struct buffer *txvipbufstail;
-        struct buffer *txvopbufstail;
-        struct buffer *txhpbufstail;
-        int txringcount;
-        int txbuffsize;
-        struct tasklet_struct irq_rx_tasklet;
-        u8 dma_poll_mask;
-        /* adhoc/master mode stuff. */
-        u32 *txbeaconringtail;
-        dma_addr_t txbeaconringdma;
-        u32 *txbeaconring;
-        int txbeaconcount;
-        struct buffer *txbeaconbufs;
-        struct buffer *txbeaconbufstail;
-        u8 retry_data;
-        u8 retry_rts;
-        u16 rts;
-        /* by amy for led. */
-        enum led_strategy_8185 led_strategy;
-        /* by amy for led. */
-        /* by amy for power save. */
-        struct timer_list watch_dog_timer;
-        bool bInactivePs;
-        bool bSwRfProcessing;
-        enum rt_rf_power_state eInactivePowerState;
-        enum rt_rf_power_state eRFPowerState;
-        u32 RfOffReason;
-        bool RFChangeInProgress;
-        bool SetRFPowerStateInProgress;
-        u8 RFProgType;
-        bool bLeisurePs;
-        enum rt_ps_mode dot11PowerSaveMode;
-        u8 TxPollingTimes;
-        bool bApBufOurFrame; /* TRUE if AP buffer our unicast data , we will
-                              * keep eAwake until receive data or timeout.
-                              */
-        u8 WaitBufDataBcnCount;
-        u8 WaitBufDataTimeOut;
-        /* by amy for power save. */
-        /* by amy for antenna. */
-        u8 EEPROMSwAntennaDiversity;
-        bool EEPROMDefaultAntenna1;
-        u8 RegSwAntennaDiversityMechanism;
-        bool bSwAntennaDiverity;
-        u8 RegDefaultAntenna;
-        bool bDefaultAntenna1;
-        u8 SignalStrength;
-        long Stats_SignalStrength;
-        long LastSignalStrengthInPercent; /* In percentage, used for smoothing,
-                                           * e.g. Moving Average.
-                                           */
-        u8 SignalQuality; /* in 0-100 index. */
-        long Stats_SignalQuality;
-        long RecvSignalPower; /* in dBm. */
-        long Stats_RecvSignalPower;
-        u8 LastRxPktAntenna; /* +by amy 080312 Antenna which received the lasted
-                              * packet. 0: Aux, 1:Main. Added by Roger,
-                              * 2008.01.25.
-                              */
-        u32 AdRxOkCnt;
-        long AdRxSignalStrength;
-        u8 CurrAntennaIndex; /* Index to current Antenna (both Tx and Rx). */
-        u8 AdTickCount; /* Times of SwAntennaDiversityTimer happened. */
-        u8 AdCheckPeriod; /* # of period SwAntennaDiversityTimer to check Rx
-                           * signal strength for SW Antenna Diversity.
-                           */
-        u8 AdMinCheckPeriod; /* Min value of AdCheckPeriod. */
-        u8 AdMaxCheckPeriod; /* Max value of AdCheckPeriod. */
-        long AdRxSsThreshold; /* Signal strength threshold to switch antenna. */
-        long AdMaxRxSsThreshold; /* Max value of AdRxSsThreshold. */
-        bool bAdSwitchedChecking; /* TRUE if we shall shall check Rx signal
-                                   * strength for last time switching antenna.
-                                   */
-        long AdRxSsBeforeSwitched; /* Rx signal strength before we switched
-                                    * antenna.
-                                    */
-        struct timer_list SwAntennaDiversityTimer;
-        /* by amy for antenna {by amy 080312 */
-        /* Crystal calibration. Added by Roger, 2007.12.11. */
-        bool bXtalCalibration; /* Crystal calibration.*/
-        u8 XtalCal_Xin; /* Crystal calibration for Xin. 0~7.5pF */
-        u8 XtalCal_Xout; /* Crystal calibration for Xout. 0~7.5pF */
-        /* Tx power tracking with thermal meter indication.
-         * Added by Roger, 2007.12.11.
-         */
-        bool bTxPowerTrack; /* Tx Power tracking. */
-        u8 ThermalMeter; /* Thermal meter reference indication. */
-        /* Dynamic Initial Gain Adjustment Mechanism. Added by Bruce,
-         * 2007-02-14.
-         */
-        bool bDigMechanism; /* TRUE if DIG is enabled, FALSE ow. */
-        bool bRegHighPowerMechanism; /* For High Power Mechanism. 061010,
-                                      * by rcnjko.
-                                      */
-        u32 FalseAlarmRegValue;
-        u8 RegDigOfdmFaUpTh; /* Upper threshold of OFDM false alarm, which is
-                              * used in DIG.
-                              */
-        u8 DIG_NumberFallbackVote;
-        u8 DIG_NumberUpgradeVote;
-        /* For HW antenna diversity, added by Roger, 2008.01.30. */
-        u32 AdMainAntennaRxOkCnt; /* Main antenna Rx OK count. */
-        u32 AdAuxAntennaRxOkCnt; /* Aux antenna Rx OK count. */
-        bool bHWAdSwitched; /* TRUE if we has switched default antenna by HW
-                             * evaluation.
-                             */
-        /* RF High Power upper/lower threshold. */
-        u8 RegHiPwrUpperTh;
-        u8 RegHiPwrLowerTh;
-        /* RF RSSI High Power upper/lower Threshold. */
-        u8 RegRSSIHiPwrUpperTh;
-        u8 RegRSSIHiPwrLowerTh;
-        /* Current CCK RSSI value to determine CCK high power, asked by SD3 DZ,
-         * by Bruce, 2007-04-12.
-         */
-        u8 CurCCKRSSI;
-        bool bCurCCKPkt;
-        /* High Power Mechanism. Added by amy, 080312. */
-        bool bToUpdateTxPwr;
-        long UndecoratedSmoothedSS;
-        long UndecoratedSmoothedRxPower;
-        u8 RSSI;
-        char RxPower;
-        u8 InitialGain;
-        /* For adjust Dig Threshold during Legacy/Leisure Power Save Mode. */
-        u32 DozePeriodInPast2Sec;
-        /* Don't access BB/RF under disable PLL situation. */
-        u8 InitialGainBackUp;
-        u8 RegBModeGainStage;
-        /* by amy for rate adaptive */
-        struct timer_list rateadapter_timer;
-        u32 RateAdaptivePeriod;
-        bool bEnhanceTxPwr;
-        bool bUpdateARFR;
-        int ForcedDataRate; /* Force Data Rate. 0: Auto, 0x02: 1M ~ 0x6C: 54M.)
-                             */
-        u32 NumTxUnicast; /* YJ,add,080828,for keep alive. */
-        u8 keepAliveLevel; /*YJ,add,080828,for KeepAlive. */
-        unsigned long NumTxOkTotal;
-        u16 LastRetryCnt;
-        u16 LastRetryRate;
-        unsigned long LastTxokCnt;
-        unsigned long LastRxokCnt;
-        u16 CurrRetryCnt;
-        unsigned long LastTxOKBytes;
-        unsigned long NumTxOkBytesTotal;
-        u8 LastFailTxRate;
-        long LastFailTxRateSS;
-        u8 FailTxRateCount;
-        u32 LastTxThroughput;
-        /* for up rate. */
-        unsigned short bTryuping;
-        u8 CurrTxRate; /* the rate before up. */
-        u16 CurrRetryRate;
-        u16 TryupingCount;
-        u8 TryDownCountLowData;
-        u8 TryupingCountNoData;
-        u8 CurrentOperaRate;
-        struct work_struct reset_wq;
-        struct work_struct watch_dog_wq;
-        short ack_tx_to_ieee;
-        u8 dma_poll_stop_mask;
-        u16 ShortRetryLimit;
-        u16 LongRetryLimit;
-        u16 EarlyRxThreshold;
-        u32 TransmitConfig;
-        u32 ReceiveConfig;
-        u32 IntrMask;
-        struct chnl_access_setting ChannelAccessSetting;
-};
-#define MANAGE_PRIORITY 0
-#define BK_PRIORITY 1
-#define BE_PRIORITY 2
-#define VI_PRIORITY 3
-#define VO_PRIORITY 4
-#define HI_PRIORITY 5
-#define BEACON_PRIORITY 6
-#define LOW_PRIORITY VI_PRIORITY
-#define NORM_PRIORITY VO_PRIORITY
-/* AC2Queue mapping. */
-#define AC2Q(_ac) (((_ac) == WME_AC_VO) ? VO_PRIORITY : \
-                ((_ac) == WME_AC_VI) ? VI_PRIORITY : \
-                ((_ac) == WME_AC_BK) ? BK_PRIORITY : \
-                BE_PRIORITY)
-short rtl8180_tx(struct net_device *dev, u8 *skbuf, int len, int priority,
-                 bool morefrag, short fragdesc, int rate);
-u8 read_nic_byte(struct net_device *dev, int x);
-u32 read_nic_dword(struct net_device *dev, int x);
-u16 read_nic_word(struct net_device *dev, int x);
-void write_nic_byte(struct net_device *dev, int x, u8 y);
-void write_nic_word(struct net_device *dev, int x, u16 y);
-void write_nic_dword(struct net_device *dev, int x, u32 y);
-void force_pci_posting(struct net_device *dev);
-void rtl8180_rtx_disable(struct net_device *);
-void rtl8180_set_anaparam(struct net_device *dev, u32 a);
-void rtl8185_set_anaparam2(struct net_device *dev, u32 a);
-void rtl8180_set_hw_wep(struct net_device *dev);
-void rtl8180_no_hw_wep(struct net_device *dev);
-void rtl8180_update_msr(struct net_device *dev);
-void rtl8180_beacon_tx_disable(struct net_device *dev);
-void rtl8180_beacon_rx_disable(struct net_device *dev);
-int rtl8180_down(struct net_device *dev);
-int rtl8180_up(struct net_device *dev);
-void rtl8180_commit(struct net_device *dev);
-void rtl8180_set_chan(struct net_device *dev, short ch);
-void write_phy(struct net_device *dev, u8 adr, u8 data);
-void write_phy_cck(struct net_device *dev, u8 adr, u32 data);
-void write_phy_ofdm(struct net_device *dev, u8 adr, u32 data);
-void rtl8185_tx_antenna(struct net_device *dev, u8 ant);
-void rtl8185_rf_pins_enable(struct net_device *dev);
-void IPSEnter(struct net_device *dev);
-void IPSLeave(struct net_device *dev);
-int get_curr_tx_free_desc(struct net_device *dev, int priority);
-void UpdateInitialGain(struct net_device *dev);
-bool SetAntennaConfig87SE(struct net_device *dev, u8 DefaultAnt,
-                          bool bAntDiversity);
-void rtl8185b_adapter_start(struct net_device *dev);
-void rtl8185b_rx_enable(struct net_device *dev);
-void rtl8185b_tx_enable(struct net_device *dev);
-void rtl8180_reset(struct net_device *dev);
-void rtl8185b_irq_enable(struct net_device *dev);
-void fix_rx_fifo(struct net_device *dev);
-void fix_tx_fifo(struct net_device *dev);
-void rtl8225z2_SetTXPowerLevel(struct net_device *dev, short ch);
-void rtl8180_rate_adapter(struct work_struct *work);
-bool MgntActSet_RF_State(struct net_device *dev, enum rt_rf_power_state StateToSet,
-                         u32 ChangeSource);
-#endif
-/* fun with the built-in ieee80211 stack... */
-extern int ieee80211_crypto_init(void);
-extern void ieee80211_crypto_deinit(void);
-extern int ieee80211_crypto_tkip_init(void);
-extern void ieee80211_crypto_tkip_exit(void);
-extern int ieee80211_crypto_ccmp_init(void);
-extern void ieee80211_crypto_ccmp_exit(void);
-extern int ieee80211_crypto_wep_init(void);
-extern void ieee80211_crypto_wep_exit(void);
diff --git a/drivers/staging/rtl8187se/r8180_93cx6.h b/drivers/staging/rtl8187se/r8180_93cx6.h
deleted file mode 100644
index b52b5b0610ab..000000000000
--- a/drivers/staging/rtl8187se/r8180_93cx6.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
-        This is part of rtl8180 OpenSource driver
-        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
-        Released under the terms of GPL (General Public Licence)
-        Parts of this driver are based on the GPL part of the official realtek driver
-        Parts of this driver are based on the rtl8180 driver skeleton from Patric Schenke & Andres Salomon
-        Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
-        We want to tanks the Authors of such projects and the Ndiswrapper project Authors.
-*/
-/*This files contains card eeprom (93c46 or 93c56) programming routines*/
-/*memory is addressed by WORDS*/
-#include "r8180.h"
-#include "r8180_hw.h"
-#define EPROM_DELAY 10
-#define EPROM_ANAPARAM_ADDRLWORD 0xd
-#define EPROM_ANAPARAM_ADDRHWORD 0xe
-#define RFCHIPID 0x6
-#define RFCHIPID_INTERSIL 1
-#define RFCHIPID_RFMD 2
-#define RFCHIPID_PHILIPS 3
-#define RFCHIPID_MAXIM 4
-#define RFCHIPID_GCT 5
-#define RFCHIPID_RTL8225 9
-#define RF_ZEBRA2 11
-#define EPROM_TXPW_BASE 0x05
-#define RF_ZEBRA4 12
-#define RFCHIPID_RTL8255 0xa
-#define RF_PARAM 0x19
-#define RF_PARAM_DIGPHY_SHIFT 0
-#define RF_PARAM_ANTBDEFAULT_SHIFT 1
-#define RF_PARAM_CARRIERSENSE_SHIFT 2
-#define RF_PARAM_CARRIERSENSE_MASK (3<<2)
-#define ENERGY_TRESHOLD 0x17
-#define EPROM_VERSION 0x1E
-#define MAC_ADR 0x7
-#define CIS 0x18
-#define EPROM_TXPW_OFDM_CH1_2 0x20
-#define EPROM_TXPW_CH1_2 0x30
-#define RTL818X_EEPROM_CMD_READ         (1 << 0)
-#define RTL818X_EEPROM_CMD_WRITE        (1 << 1)
-#define RTL818X_EEPROM_CMD_CK           (1 << 2)
-#define RTL818X_EEPROM_CMD_CS           (1 << 3)
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
deleted file mode 100644
index a6022d4e7573..000000000000
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ /dev/null
@@ -1,3775 +0,0 @@
-/*
- * This is part of rtl818x pci OpenSource driver - v 0.1
- * Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
- * Released under the terms of GPL (General Public License)
- *
- * Parts of this driver are based on the GPL part of the official
- * Realtek driver.
- *
- * Parts of this driver are based on the rtl8180 driver skeleton
- * from Patric Schenke & Andres Salomon.
- *
- * Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver.
- *
- * Parts of BB/RF code are derived from David Young rtl8180 netbsd driver.
- *
- * RSSI calc function from 'The Deuce'
- *
- * Some ideas borrowed from the 8139too.c driver included in linux kernel.
- *
- * We (I?) want to thanks the Authors of those projecs and also the
- * Ndiswrapper's project Authors.
- *
- * A big big thanks goes also to Realtek corp. for their help in my attempt to
- * add RTL8185 and RTL8225 support, and to David Young also.
- *
- * Power management interface routines.
- * Written by Mariusz Matuszek.
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#undef RX_DONT_PASS_UL
-#undef DUMMY_RX
-#include <linux/slab.h>
-#include <linux/syscalls.h>
-#include <linux/eeprom_93cx6.h>
-#include <linux/interrupt.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include "r8180_hw.h"
-#include "r8180.h"
-#include "r8180_rtl8225.h" /* RTL8225 Radio frontend */
-#include "r8180_93cx6.h"   /* Card EEPROM */
-#include "r8180_wx.h"
-#include "r8180_dm.h"
-#include "ieee80211/dot11d.h"
-static struct pci_device_id rtl8180_pci_id_tbl[] = {
-        {
-                .vendor = PCI_VENDOR_ID_REALTEK,
-                .device = 0x8199,
-                .subvendor = PCI_ANY_ID,
-                .subdevice = PCI_ANY_ID,
-                .driver_data = 0,
-        },
-        {
-                .vendor = 0,
-                .device = 0,
-                .subvendor = 0,
-                .subdevice = 0,
-                .driver_data = 0,
-        }
-};
-static char ifname[IFNAMSIZ] = "wlan%d";
-static int hwwep;
-MODULE_LICENSE("GPL");
-MODULE_DEVICE_TABLE(pci, rtl8180_pci_id_tbl);
-MODULE_AUTHOR("Andrea Merello <andrea.merello@gmail.com>");
-MODULE_DESCRIPTION("Linux driver for Realtek RTL8187SE WiFi cards");
-module_param_string(ifname, ifname, sizeof(ifname), S_IRUGO|S_IWUSR);
-module_param(hwwep, int, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(hwwep, " Try to use hardware WEP support. Still broken and not available on all cards");
-static int rtl8180_pci_probe(struct pci_dev *pdev,
-                             const struct pci_device_id *id);
-static void rtl8180_pci_remove(struct pci_dev *pdev);
-static void rtl8180_shutdown(struct pci_dev *pdev)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        if (dev->netdev_ops->ndo_stop)
-                dev->netdev_ops->ndo_stop(dev);
-        pci_disable_device(pdev);
-}
-static int rtl8180_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        if (!netif_running(dev))
-                goto out_pci_suspend;
-        if (dev->netdev_ops->ndo_stop)
-                dev->netdev_ops->ndo_stop(dev);
-        netif_device_detach(dev);
-out_pci_suspend:
-        pci_save_state(pdev);
-        pci_disable_device(pdev);
-        pci_set_power_state(pdev, pci_choose_state(pdev, state));
-        return 0;
-}
-static int rtl8180_resume(struct pci_dev *pdev)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        int err;
-        u32 val;
-        pci_set_power_state(pdev, PCI_D0);
-        err = pci_enable_device(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "pci_enable_device failed on resume\n");
-                return err;
-        }
-        pci_restore_state(pdev);
-        /*
-         * Suspend/Resume resets the PCI configuration space, so we have to
-         * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
-         * from interfering with C3 CPU state. pci_restore_state won't help
-         * here since it only restores the first 64 bytes pci config header.
-         */
-        pci_read_config_dword(pdev, 0x40, &val);
-        if ((val & 0x0000ff00) != 0)
-                pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
-        if (!netif_running(dev))
-                goto out;
-        if (dev->netdev_ops->ndo_open)
-                dev->netdev_ops->ndo_open(dev);
-        netif_device_attach(dev);
-out:
-        return 0;
-}
-static struct pci_driver rtl8180_pci_driver = {
-        .name           = RTL8180_MODULE_NAME,
-        .id_table       = rtl8180_pci_id_tbl,
-        .probe          = rtl8180_pci_probe,
-        .remove         = rtl8180_pci_remove,
-        .suspend        = rtl8180_suspend,
-        .resume         = rtl8180_resume,
-        .shutdown       = rtl8180_shutdown,
-};
-u8 read_nic_byte(struct net_device *dev, int x)
-{
-        return 0xff&readb((u8 __iomem *)dev->mem_start + x);
-}
-u32 read_nic_dword(struct net_device *dev, int x)
-{
-        return readl((u8 __iomem *)dev->mem_start + x);
-}
-u16 read_nic_word(struct net_device *dev, int x)
-{
-        return readw((u8 __iomem *)dev->mem_start + x);
-}
-void write_nic_byte(struct net_device *dev, int x, u8 y)
-{
-        writeb(y, (u8 __iomem *)dev->mem_start + x);
-        udelay(20);
-}
-void write_nic_dword(struct net_device *dev, int x, u32 y)
-{
-        writel(y, (u8 __iomem *)dev->mem_start + x);
-        udelay(20);
-}
-void write_nic_word(struct net_device *dev, int x, u16 y)
-{
-        writew(y, (u8 __iomem *)dev->mem_start + x);
-        udelay(20);
-}
-inline void force_pci_posting(struct net_device *dev)
-{
-        read_nic_byte(dev, EPROM_CMD);
-        mb();
-}
-static irqreturn_t rtl8180_interrupt(int irq, void *netdev);
-void set_nic_rxring(struct net_device *dev);
-void set_nic_txring(struct net_device *dev);
-static struct net_device_stats *rtl8180_stats(struct net_device *dev);
-void rtl8180_commit(struct net_device *dev);
-void rtl8180_start_tx_beacon(struct net_device *dev);
-static struct proc_dir_entry *rtl8180_proc;
-static int proc_get_registers(struct seq_file *m, void *v)
-{
-        struct net_device *dev = m->private;
-        int i, n, max = 0xff;
-        /* This dump the current register page */
-        for (n = 0; n <= max;) {
-                seq_printf(m, "\nD:  %2x > ", n);
-                for (i = 0; i < 16 && n <= max; i++, n++)
-                        seq_printf(m, "%2x ", read_nic_byte(dev, n));
-        }
-        seq_putc(m, '\n');
-        return 0;
-}
-int get_curr_tx_free_desc(struct net_device *dev, int priority);
-static int proc_get_stats_hw(struct seq_file *m, void *v)
-{
-        return 0;
-}
-static int proc_get_stats_rx(struct seq_file *m, void *v)
-{
-        struct net_device *dev = m->private;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        seq_printf(m,
-                "RX OK: %lu\n"
-                "RX Retry: %lu\n"
-                "RX CRC Error(0-500): %lu\n"
-                "RX CRC Error(500-1000): %lu\n"
-                "RX CRC Error(>1000): %lu\n"
-                "RX ICV Error: %lu\n",
-                priv->stats.rxint,
-                priv->stats.rxerr,
-                priv->stats.rxcrcerrmin,
-                priv->stats.rxcrcerrmid,
-                priv->stats.rxcrcerrmax,
-                priv->stats.rxicverr
-                );
-        return 0;
-}
-static int proc_get_stats_tx(struct seq_file *m, void *v)
-{
-        struct net_device *dev = m->private;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        unsigned long totalOK;
-        totalOK = priv->stats.txnpokint + priv->stats.txhpokint +
-                priv->stats.txlpokint;
-        seq_printf(m,
-                "TX OK: %lu\n"
-                "TX Error: %lu\n"
-                "TX Retry: %lu\n"
-                "TX beacon OK: %lu\n"
-                "TX beacon error: %lu\n",
-                totalOK,
-                priv->stats.txnperr+priv->stats.txhperr+priv->stats.txlperr,
-                priv->stats.txretry,
-                priv->stats.txbeacon,
-                priv->stats.txbeaconerr
-        );
-        return 0;
-}
-static void rtl8180_proc_module_init(void)
-{
-        DMESG("Initializing proc filesystem");
-        rtl8180_proc = proc_mkdir(RTL8180_MODULE_NAME, init_net.proc_net);
-}
-static void rtl8180_proc_module_remove(void)
-{
-        remove_proc_entry(RTL8180_MODULE_NAME, init_net.proc_net);
-}
-static void rtl8180_proc_remove_one(struct net_device *dev)
-{
-        remove_proc_subtree(dev->name, rtl8180_proc);
-}
-/*
- * seq_file wrappers for procfile show routines.
- */
-static int rtl8180_proc_open(struct inode *inode, struct file *file)
-{
-        struct net_device *dev = proc_get_parent_data(inode);
-        int (*show)(struct seq_file *, void *) = PDE_DATA(inode);
-        return single_open(file, show, dev);
-}
-static const struct file_operations rtl8180_proc_fops = {
-        .open           = rtl8180_proc_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
-/*
- * Table of proc files we need to create.
- */
-struct rtl8180_proc_file {
-        char name[12];
-        int (*show)(struct seq_file *, void *);
-};
-static const struct rtl8180_proc_file rtl8180_proc_files[] = {
-        { "stats-hw",   &proc_get_stats_hw },
-        { "stats-rx",   &proc_get_stats_rx },
-        { "stats-tx",   &proc_get_stats_tx },
-        { "registers",  &proc_get_registers },
-        { "" }
-};
-static void rtl8180_proc_init_one(struct net_device *dev)
-{
-        const struct rtl8180_proc_file *f;
-        struct proc_dir_entry *dir;
-        dir = proc_mkdir_data(dev->name, 0, rtl8180_proc, dev);
-        if (!dir) {
-                DMESGE("Unable to initialize /proc/net/r8180/%s\n", dev->name);
-                return;
-        }
-        for (f = rtl8180_proc_files; f->name[0]; f++) {
-                if (!proc_create_data(f->name, S_IFREG | S_IRUGO, dir,
-                                      &rtl8180_proc_fops, f->show)) {
-                        DMESGE("Unable to initialize /proc/net/r8180/%s/%s\n",
-                               dev->name, f->name);
-                        return;
-                }
-        }
-}
-/*
- * FIXME: check if we can use some standard already-existent
- * data type+functions in kernel.
- */
-static short buffer_add(struct buffer **buffer, u32 *buf, dma_addr_t dma,
-                        struct buffer **bufferhead)
-{
-        struct buffer *tmp;
-        if (!*buffer) {
-                *buffer = kmalloc(sizeof(struct buffer), GFP_KERNEL);
-                if (*buffer == NULL) {
-                        DMESGE("Failed to kmalloc head of TX/RX struct");
-                        return -1;
-                }
-                (*buffer)->next = *buffer;
-                (*buffer)->buf = buf;
-                (*buffer)->dma = dma;
-                if (bufferhead != NULL)
-                        (*bufferhead) = (*buffer);
-                return 0;
-        }
-        tmp = *buffer;
-        while (tmp->next != (*buffer))
-                tmp = tmp->next;
-        tmp->next = kmalloc(sizeof(struct buffer), GFP_KERNEL);
-        if (tmp->next == NULL) {
-                DMESGE("Failed to kmalloc TX/RX struct");
-                return -1;
-        }
-        tmp->next->buf = buf;
-        tmp->next->dma = dma;
-        tmp->next->next = *buffer;
-        return 0;
-}
-static void buffer_free(struct net_device *dev, struct buffer **buffer, int len,
-                 short consistent)
-{
-        struct buffer *tmp, *next;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct pci_dev *pdev = priv->pdev;
-        if (!*buffer)
-                return;
-        tmp = *buffer;
-        do {
-                next = tmp->next;
-                if (consistent) {
-                        pci_free_consistent(pdev, len,
-                                    tmp->buf, tmp->dma);
-                } else {
-                        pci_unmap_single(pdev, tmp->dma,
-                        len, PCI_DMA_FROMDEVICE);
-                        kfree(tmp->buf);
-                }
-                kfree(tmp);
-                tmp = next;
-        } while (next != *buffer);
-        *buffer = NULL;
-}
-int get_curr_tx_free_desc(struct net_device *dev, int priority)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u32 *tail;
-        u32 *head;
-        int ret;
-        switch (priority) {
-        case MANAGE_PRIORITY:
-                head = priv->txmapringhead;
-                tail = priv->txmapringtail;
-                break;
-        case BK_PRIORITY:
-                head = priv->txbkpringhead;
-                tail = priv->txbkpringtail;
-                break;
-        case BE_PRIORITY:
-                head = priv->txbepringhead;
-                tail = priv->txbepringtail;
-                break;
-        case VI_PRIORITY:
-                head = priv->txvipringhead;
-                tail = priv->txvipringtail;
-                break;
-        case VO_PRIORITY:
-                head = priv->txvopringhead;
-                tail = priv->txvopringtail;
-                break;
-        case HI_PRIORITY:
-                head = priv->txhpringhead;
-                tail = priv->txhpringtail;
-                break;
-        default:
-                return -1;
-        }
-        if (head <= tail)
-                ret = priv->txringcount - (tail - head)/8;
-        else
-                ret = (head - tail)/8;
-        if (ret > priv->txringcount)
-                DMESG("BUG");
-        return ret;
-}
-static short check_nic_enought_desc(struct net_device *dev, int priority)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct ieee80211_device *ieee = netdev_priv(dev);
-        int requiredbyte;
-        int required;
-        requiredbyte = priv->ieee80211->fts +
-                sizeof(struct ieee80211_header_data);
-        if (ieee->current_network.QoS_Enable)
-                requiredbyte += 2;
-        required = requiredbyte / (priv->txbuffsize-4);
-        if (requiredbyte % priv->txbuffsize)
-                required++;
-        /* for now we keep two free descriptor as a safety boundary
-         * between the tail and the head
-         */
-        return required + 2 < get_curr_tx_free_desc(dev, priority);
-}
-void fix_tx_fifo(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        u32 *tmp;
-        int i;
-        for (tmp = priv->txmapring, i = 0;
-             i < priv->txringcount;
-             tmp += 8, i++) {
-                *tmp = *tmp & ~(1<<31);
-        }
-        for (tmp = priv->txbkpring, i = 0;
-             i < priv->txringcount;
-             tmp += 8, i++) {
-                *tmp = *tmp & ~(1<<31);
-        }
-        for (tmp = priv->txbepring, i = 0;
-             i < priv->txringcount;
-             tmp += 8, i++) {
-                *tmp = *tmp & ~(1<<31);
-        }
-        for (tmp = priv->txvipring, i = 0;
-             i < priv->txringcount;
-             tmp += 8, i++) {
-                *tmp = *tmp & ~(1<<31);
-        }
-        for (tmp = priv->txvopring, i = 0;
-             i < priv->txringcount;
-             tmp += 8, i++) {
-                *tmp = *tmp & ~(1<<31);
-        }
-        for (tmp = priv->txhpring, i = 0;
-             i < priv->txringcount;
-             tmp += 8, i++) {
-                *tmp = *tmp & ~(1<<31);
-        }
-        for (tmp = priv->txbeaconring, i = 0;
-             i < priv->txbeaconcount;
-             tmp += 8, i++) {
-                *tmp = *tmp & ~(1<<31);
-        }
-        priv->txmapringtail = priv->txmapring;
-        priv->txmapringhead = priv->txmapring;
-        priv->txmapbufstail = priv->txmapbufs;
-        priv->txbkpringtail = priv->txbkpring;
-        priv->txbkpringhead = priv->txbkpring;
-        priv->txbkpbufstail = priv->txbkpbufs;
-        priv->txbepringtail = priv->txbepring;
-        priv->txbepringhead = priv->txbepring;
-        priv->txbepbufstail = priv->txbepbufs;
-        priv->txvipringtail = priv->txvipring;
-        priv->txvipringhead = priv->txvipring;
-        priv->txvipbufstail = priv->txvipbufs;
-        priv->txvopringtail = priv->txvopring;
-        priv->txvopringhead = priv->txvopring;
-        priv->txvopbufstail = priv->txvopbufs;
-        priv->txhpringtail = priv->txhpring;
-        priv->txhpringhead = priv->txhpring;
-        priv->txhpbufstail = priv->txhpbufs;
-        priv->txbeaconringtail = priv->txbeaconring;
-        priv->txbeaconbufstail = priv->txbeaconbufs;
-        set_nic_txring(dev);
-        ieee80211_reset_queue(priv->ieee80211);
-        priv->ack_tx_to_ieee = 0;
-}
-void fix_rx_fifo(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        u32 *tmp;
-        struct buffer *rxbuf;
-        u8 rx_desc_size;
-        rx_desc_size = 8; /* 4*8 = 32 bytes */
-        for (tmp = priv->rxring, rxbuf = priv->rxbufferhead;
-             (tmp < (priv->rxring)+(priv->rxringcount)*rx_desc_size);
-             tmp += rx_desc_size, rxbuf = rxbuf->next) {
-                *(tmp+2) = rxbuf->dma;
-                *tmp = *tmp & ~0xfff;
-                *tmp = *tmp | priv->rxbuffersize;
-                *tmp |= (1<<31);
-        }
-        priv->rxringtail = priv->rxring;
-        priv->rxbuffer = priv->rxbufferhead;
-        priv->rx_skb_complete = 1;
-        set_nic_rxring(dev);
-}
-static void rtl8180_irq_disable(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        write_nic_dword(dev, IMR, 0);
-        force_pci_posting(dev);
-        priv->irq_enabled = 0;
-}
-void rtl8180_set_mode(struct net_device *dev, int mode)
-{
-        u8 ecmd;
-        ecmd = read_nic_byte(dev, EPROM_CMD);
-        ecmd = ecmd & ~EPROM_CMD_OPERATING_MODE_MASK;
-        ecmd = ecmd | (mode<<EPROM_CMD_OPERATING_MODE_SHIFT);
-        ecmd = ecmd & ~(1<<EPROM_CS_SHIFT);
-        ecmd = ecmd & ~(1<<EPROM_CK_SHIFT);
-        write_nic_byte(dev, EPROM_CMD, ecmd);
-}
-void rtl8180_beacon_tx_enable(struct net_device *dev);
-void rtl8180_update_msr(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8 msr;
-        u32 rxconf;
-        msr  = read_nic_byte(dev, MSR);
-        msr &= ~MSR_LINK_MASK;
-        rxconf = read_nic_dword(dev, RX_CONF);
-        if (priv->ieee80211->state == IEEE80211_LINKED) {
-                if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
-                        msr |= (MSR_LINK_ADHOC<<MSR_LINK_SHIFT);
-                else if (priv->ieee80211->iw_mode == IW_MODE_MASTER)
-                        msr |= (MSR_LINK_MASTER<<MSR_LINK_SHIFT);
-                else if (priv->ieee80211->iw_mode == IW_MODE_INFRA)
-                        msr |= (MSR_LINK_MANAGED<<MSR_LINK_SHIFT);
-                else
-                        msr |= (MSR_LINK_NONE<<MSR_LINK_SHIFT);
-                rxconf |= (1<<RX_CHECK_BSSID_SHIFT);
-        } else {
-                msr |= (MSR_LINK_NONE<<MSR_LINK_SHIFT);
-                rxconf &= ~(1<<RX_CHECK_BSSID_SHIFT);
-        }
-        write_nic_byte(dev, MSR, msr);
-        write_nic_dword(dev, RX_CONF, rxconf);
-}
-void rtl8180_set_chan(struct net_device *dev, short ch)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        if ((ch > 14) || (ch < 1)) {
-                netdev_err(dev, "In %s: Invalid channel %d\n", __func__, ch);
-                return;
-        }
-        priv->chan = ch;
-        priv->rf_set_chan(dev, priv->chan);
-}
-void set_nic_txring(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        write_nic_dword(dev, TX_MANAGEPRIORITY_RING_ADDR, priv->txmapringdma);
-        write_nic_dword(dev, TX_BKPRIORITY_RING_ADDR, priv->txbkpringdma);
-        write_nic_dword(dev, TX_BEPRIORITY_RING_ADDR, priv->txbepringdma);
-        write_nic_dword(dev, TX_VIPRIORITY_RING_ADDR, priv->txvipringdma);
-        write_nic_dword(dev, TX_VOPRIORITY_RING_ADDR, priv->txvopringdma);
-        write_nic_dword(dev, TX_HIGHPRIORITY_RING_ADDR, priv->txhpringdma);
-        write_nic_dword(dev, TX_BEACON_RING_ADDR, priv->txbeaconringdma);
-}
-void rtl8180_beacon_tx_enable(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        priv->dma_poll_stop_mask &= ~(TPPOLLSTOP_BQ);
-        write_nic_byte(dev, TPPollStop, priv->dma_poll_mask);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-}
-void rtl8180_beacon_tx_disable(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        priv->dma_poll_stop_mask |= TPPOLLSTOP_BQ;
-        write_nic_byte(dev, TPPollStop, priv->dma_poll_stop_mask);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-}
-void rtl8180_rtx_disable(struct net_device *dev)
-{
-        u8 cmd;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        cmd = read_nic_byte(dev, CMD);
-        write_nic_byte(dev, CMD, cmd &
-                       ~((1<<CMD_RX_ENABLE_SHIFT)|(1<<CMD_TX_ENABLE_SHIFT)));
-        force_pci_posting(dev);
-        mdelay(10);
-        if (!priv->rx_skb_complete)
-                dev_kfree_skb_any(priv->rx_skb);
-}
-static short alloc_tx_desc_ring(struct net_device *dev, int bufsize, int count,
-                                int addr)
-{
-        int i;
-        u32 *desc;
-        u32 *tmp;
-        dma_addr_t dma_desc, dma_tmp;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct pci_dev *pdev = priv->pdev;
-        void *buf;
-        if ((bufsize & 0xfff) != bufsize) {
-                DMESGE("TX buffer allocation too large");
-                return 0;
-        }
-        desc = (u32 *)pci_alloc_consistent(pdev,
-                                          sizeof(u32)*8*count+256, &dma_desc);
-        if (desc == NULL)
-                return -1;
-        if (dma_desc & 0xff)
-                /*
-                 * descriptor's buffer must be 256 byte aligned
-                 * we shouldn't be here, since we set DMA mask !
-                 */
-                WARN(1, "DMA buffer is not aligned\n");
-        tmp = desc;
-        for (i = 0; i < count; i++) {
-                buf = (void *)pci_alloc_consistent(pdev, bufsize, &dma_tmp);
-                if (buf == NULL)
-                        return -ENOMEM;
-                switch (addr) {
-                case TX_MANAGEPRIORITY_RING_ADDR:
-                        if (-1 == buffer_add(&priv->txmapbufs,
-                                buf, dma_tmp, NULL)) {
-                                DMESGE("Unable to allocate mem for buffer NP");
-                                return -ENOMEM;
-                        }
-                        break;
-                case TX_BKPRIORITY_RING_ADDR:
-                        if (-1 == buffer_add(&priv->txbkpbufs,
-                                buf, dma_tmp, NULL)) {
-                                DMESGE("Unable to allocate mem for buffer LP");
-                                return -ENOMEM;
-                        }
-                        break;
-                case TX_BEPRIORITY_RING_ADDR:
-                        if (-1 == buffer_add(&priv->txbepbufs,
-                                buf, dma_tmp, NULL)) {
-                                DMESGE("Unable to allocate mem for buffer NP");
-                                return -ENOMEM;
-                        }
-                        break;
-                case TX_VIPRIORITY_RING_ADDR:
-                        if (-1 == buffer_add(&priv->txvipbufs,
-                                buf, dma_tmp, NULL)) {
-                                DMESGE("Unable to allocate mem for buffer LP");
-                                return -ENOMEM;
-                        }
-                        break;
-                case TX_VOPRIORITY_RING_ADDR:
-                        if (-1 == buffer_add(&priv->txvopbufs,
-                                buf, dma_tmp, NULL)) {
-                                DMESGE("Unable to allocate mem for buffer NP");
-                                return -ENOMEM;
-                        }
-                        break;
-                case TX_HIGHPRIORITY_RING_ADDR:
-                        if (-1 == buffer_add(&priv->txhpbufs,
-                                buf, dma_tmp, NULL)) {
-                                DMESGE("Unable to allocate mem for buffer HP");
-                                return -ENOMEM;
-                        }
-                        break;
-                case TX_BEACON_RING_ADDR:
-                        if (-1 == buffer_add(&priv->txbeaconbufs,
-                                buf, dma_tmp, NULL)) {
-                                DMESGE("Unable to allocate mem for buffer BP");
-                                return -ENOMEM;
-                        }
-                        break;
-                }
-                *tmp = *tmp & ~(1<<31); /* descriptor empty, owned by the drv */
-                *(tmp+2) = (u32)dma_tmp;
-                *(tmp+3) = bufsize;
-                if (i+1 < count)
-                        *(tmp+4) = (u32)dma_desc+((i+1)*8*4);
-                else
-                        *(tmp+4) = (u32)dma_desc;
-                tmp = tmp+8;
-        }
-        switch (addr) {
-        case TX_MANAGEPRIORITY_RING_ADDR:
-                priv->txmapringdma = dma_desc;
-                priv->txmapring = desc;
-                break;
-        case TX_BKPRIORITY_RING_ADDR:
-                priv->txbkpringdma = dma_desc;
-                priv->txbkpring = desc;
-                break;
-        case TX_BEPRIORITY_RING_ADDR:
-                priv->txbepringdma = dma_desc;
-                priv->txbepring = desc;
-                break;
-        case TX_VIPRIORITY_RING_ADDR:
-                priv->txvipringdma = dma_desc;
-                priv->txvipring = desc;
-                break;
-        case TX_VOPRIORITY_RING_ADDR:
-                priv->txvopringdma = dma_desc;
-                priv->txvopring = desc;
-                break;
-        case TX_HIGHPRIORITY_RING_ADDR:
-                priv->txhpringdma = dma_desc;
-                priv->txhpring = desc;
-                break;
-        case TX_BEACON_RING_ADDR:
-                priv->txbeaconringdma = dma_desc;
-                priv->txbeaconring = desc;
-                break;
-        }
-        return 0;
-}
-static void free_tx_desc_rings(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct pci_dev *pdev = priv->pdev;
-        int count = priv->txringcount;
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->txmapring, priv->txmapringdma);
-        buffer_free(dev, &(priv->txmapbufs), priv->txbuffsize, 1);
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->txbkpring, priv->txbkpringdma);
-        buffer_free(dev, &(priv->txbkpbufs), priv->txbuffsize, 1);
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->txbepring, priv->txbepringdma);
-        buffer_free(dev, &(priv->txbepbufs), priv->txbuffsize, 1);
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->txvipring, priv->txvipringdma);
-        buffer_free(dev, &(priv->txvipbufs), priv->txbuffsize, 1);
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->txvopring, priv->txvopringdma);
-        buffer_free(dev, &(priv->txvopbufs), priv->txbuffsize, 1);
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->txhpring, priv->txhpringdma);
-        buffer_free(dev, &(priv->txhpbufs), priv->txbuffsize, 1);
-        count = priv->txbeaconcount;
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->txbeaconring, priv->txbeaconringdma);
-        buffer_free(dev, &(priv->txbeaconbufs), priv->txbuffsize, 1);
-}
-static void free_rx_desc_ring(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct pci_dev *pdev = priv->pdev;
-        int count = priv->rxringcount;
-        pci_free_consistent(pdev, sizeof(u32)*8*count+256,
-                            priv->rxring, priv->rxringdma);
-        buffer_free(dev, &(priv->rxbuffer), priv->rxbuffersize, 0);
-}
-static short alloc_rx_desc_ring(struct net_device *dev, u16 bufsize, int count)
-{
-        int i;
-        u32 *desc;
-        u32 *tmp;
-        dma_addr_t dma_desc, dma_tmp;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct pci_dev *pdev = priv->pdev;
-        void *buf;
-        u8 rx_desc_size;
-        rx_desc_size = 8; /* 4*8 = 32 bytes */
-        if ((bufsize & 0xfff) != bufsize) {
-                DMESGE("RX buffer allocation too large");
-                return -1;
-        }
-        desc = (u32 *)pci_alloc_consistent(pdev,
-                sizeof(u32) * rx_desc_size * count + 256, &dma_desc);
-        if (dma_desc & 0xff)
-                /*
-                 * descriptor's buffer must be 256 byte aligned
-                 * should never happen since we specify the DMA mask
-                 */
-                WARN(1, "DMA buffer is not aligned\n");
-        priv->rxring = desc;
-        priv->rxringdma = dma_desc;
-        tmp = desc;
-        for (i = 0; i < count; i++) {
-                buf = kmalloc(bufsize * sizeof(u8), GFP_ATOMIC);
-                if (buf == NULL) {
-                        DMESGE("Failed to kmalloc RX buffer");
-                        return -1;
-                }
-                dma_tmp = pci_map_single(pdev, buf, bufsize * sizeof(u8),
-                                         PCI_DMA_FROMDEVICE);
-                if (pci_dma_mapping_error(pdev, dma_tmp))
-                        return -1;
-                if (-1 == buffer_add(&(priv->rxbuffer), buf, dma_tmp,
-                           &(priv->rxbufferhead))) {
-                        DMESGE("Unable to allocate mem RX buf");
-                        return -1;
-                }
-                *tmp = 0; /* zero pads the header of the descriptor */
-                *tmp = *tmp | (bufsize&0xfff);
-                *(tmp+2) = (u32)dma_tmp;
-                *tmp = *tmp | (1<<31); /* descriptor void, owned by the NIC */
-                tmp = tmp+rx_desc_size;
-        }
-        /* this is the last descriptor */
-        *(tmp - rx_desc_size) = *(tmp - rx_desc_size) | (1 << 30);
-        return 0;
-}
-void set_nic_rxring(struct net_device *dev)
-{
-        u8 pgreg;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        pgreg = read_nic_byte(dev, PGSELECT);
-        write_nic_byte(dev, PGSELECT, pgreg & ~(1<<PGSELECT_PG_SHIFT));
-        write_nic_dword(dev, RXRING_ADDR, priv->rxringdma);
-}
-void rtl8180_reset(struct net_device *dev)
-{
-        u8 cr;
-        rtl8180_irq_disable(dev);
-        cr = read_nic_byte(dev, CMD);
-        cr = cr & 2;
-        cr = cr | (1<<CMD_RST_SHIFT);
-        write_nic_byte(dev, CMD, cr);
-        force_pci_posting(dev);
-        mdelay(200);
-        if (read_nic_byte(dev, CMD) & (1<<CMD_RST_SHIFT))
-                DMESGW("Card reset timeout!");
-        else
-                DMESG("Card successfully reset");
-        rtl8180_set_mode(dev, EPROM_CMD_LOAD);
-        force_pci_posting(dev);
-        mdelay(200);
-}
-inline u16 ieeerate2rtlrate(int rate)
-{
-        switch (rate) {
-        case 10:
-                return 0;
-        case 20:
-                return 1;
-        case 55:
-                return 2;
-        case 110:
-                return 3;
-        case 60:
-                return 4;
-        case 90:
-                return 5;
-        case 120:
-                return 6;
-        case 180:
-                return 7;
-        case 240:
-                return 8;
-        case 360:
-                return 9;
-        case 480:
-                return 10;
-        case 540:
-                return 11;
-        default:
-                return 3;
-        }
-}
-static u16 rtl_rate[] = {10, 20, 55, 110, 60,
-        90, 120, 180, 240, 360, 480, 540, 720};
-inline u16 rtl8180_rate2rate(short rate)
-{
-        if (rate > 12)
-                return 10;
-        return rtl_rate[rate];
-}
-inline u8 rtl8180_IsWirelessBMode(u16 rate)
-{
-        if (((rate <= 110) && (rate != 60) && (rate != 90)) || (rate == 220))
-                return 1;
-        else
-                return 0;
-}
-u16 N_DBPSOfRate(u16 DataRate);
-static u16 ComputeTxTime(u16 FrameLength, u16 DataRate, u8 bManagementFrame,
-                  u8 bShortPreamble)
-{
-        u16     FrameTime;
-        u16     N_DBPS;
-        u16     Ceiling;
-        if (rtl8180_IsWirelessBMode(DataRate)) {
-                if (bManagementFrame || !bShortPreamble || DataRate == 10)
-                        /* long preamble */
-                        FrameTime = (u16)(144+48+(FrameLength*8/(DataRate/10)));
-                else
-                        /* short preamble */
-                        FrameTime = (u16)(72+24+(FrameLength*8/(DataRate/10)));
-                if ((FrameLength*8 % (DataRate/10)) != 0) /* get the ceilling */
-                        FrameTime++;
-        } else {        /* 802.11g DSSS-OFDM PLCP length field calculation. */
-                N_DBPS = N_DBPSOfRate(DataRate);
-                Ceiling = (16 + 8*FrameLength + 6) / N_DBPS
-                                + (((16 + 8*FrameLength + 6) % N_DBPS) ? 1 : 0);
-                FrameTime = (u16)(16 + 4 + 4*Ceiling + 6);
-        }
-        return FrameTime;
-}
-u16 N_DBPSOfRate(u16 DataRate)
-{
-         u16 N_DBPS = 24;
-        switch (DataRate) {
-        case 60:
-                N_DBPS = 24;
-                break;
-        case 90:
-                N_DBPS = 36;
-                break;
-        case 120:
-                N_DBPS = 48;
-                break;
-        case 180:
-                N_DBPS = 72;
-                break;
-        case 240:
-                N_DBPS = 96;
-                break;
-        case 360:
-                N_DBPS = 144;
-                break;
-        case 480:
-                N_DBPS = 192;
-                break;
-        case 540:
-                N_DBPS = 216;
-                break;
-        default:
-                break;
-        }
-        return N_DBPS;
-}
-/*
- * For Netgear case, they want good-looking signal strength.
- */
-static long NetgearSignalStrengthTranslate(long LastSS, long CurrSS)
-{
-        long RetSS;
-        /* Step 1. Scale mapping. */
-        if (CurrSS >= 71 && CurrSS <= 100)
-                RetSS = 90 + ((CurrSS - 70) / 3);
-        else if (CurrSS >= 41 && CurrSS <= 70)
-                RetSS = 78 + ((CurrSS - 40) / 3);
-        else if (CurrSS >= 31 && CurrSS <= 40)
-                RetSS = 66 + (CurrSS - 30);
-        else if (CurrSS >= 21 && CurrSS <= 30)
-                RetSS = 54 + (CurrSS - 20);
-        else if (CurrSS >= 5 && CurrSS <= 20)
-                RetSS = 42 + (((CurrSS - 5) * 2) / 3);
-        else if (CurrSS == 4)
-                RetSS = 36;
-        else if (CurrSS == 3)
-                RetSS = 27;
-        else if (CurrSS == 2)
-                RetSS = 18;
-        else if (CurrSS == 1)
-                RetSS = 9;
-        else
-                RetSS = CurrSS;
-        /* Step 2. Smoothing. */
-        if (LastSS > 0)
-                RetSS = ((LastSS * 5) + (RetSS) + 5) / 6;
-        return RetSS;
-}
-/*
- * Translate 0-100 signal strength index into dBm.
- */
-static long TranslateToDbm8185(u8 SignalStrengthIndex)
-{
-        long SignalPower;
-        /* Translate to dBm (x=0.5y-95). */
-        SignalPower = (long)((SignalStrengthIndex + 1) >> 1);
-        SignalPower -= 95;
-        return SignalPower;
-}
-/*
- * Perform signal smoothing for dynamic mechanism.
- * This is different with PerformSignalSmoothing8185 in smoothing formula.
- * No dramatic adjustment is applied because dynamic mechanism need some
- * degree of correctness. Ported from 8187B.
- */
-static void PerformUndecoratedSignalSmoothing8185(struct r8180_priv *priv,
-                                                  bool bCckRate)
-{
-        long smoothedSS;
-        long smoothedRx;
-        /* Determine the current packet is CCK rate. */
-        priv->bCurCCKPkt = bCckRate;
-        smoothedSS = priv->SignalStrength * 10;
-        if (priv->UndecoratedSmoothedSS >= 0)
-                smoothedSS = ((priv->UndecoratedSmoothedSS * 5) +
-                                smoothedSS) / 6;
-        priv->UndecoratedSmoothedSS = smoothedSS;
-        smoothedRx = ((priv->UndecoratedSmoothedRxPower * 50) +
-                        (priv->RxPower * 11)) / 60;
-        priv->UndecoratedSmoothedRxPower = smoothedRx;
-        if (bCckRate)
-                priv->CurCCKRSSI = priv->RSSI;
-        else
-                priv->CurCCKRSSI = 0;
-}
-/*
- * This is rough RX isr handling routine
- */
-static void rtl8180_rx(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct sk_buff *tmp_skb;
-        short first, last;
-        u32 len;
-        int lastlen;
-        unsigned char quality, signal;
-        u8 rate;
-        u32 *tmp, *tmp2;
-        u8 rx_desc_size;
-        u8 padding;
-        char rxpower = 0;
-        u32 RXAGC = 0;
-        long RxAGC_dBm = 0;
-        u8      LNA = 0, BB = 0;
-        u8      LNA_gain[4] = {02, 17, 29, 39};
-        u8  Antenna = 0;
-        struct ieee80211_hdr_4addr *hdr;
-        u16 fc, type;
-        u8 bHwError = 0, bCRC = 0, bICV = 0;
-        bool    bCckRate = false;
-        u8     RSSI = 0;
-        long    SignalStrengthIndex = 0;
-        struct ieee80211_rx_stats stats = {
-                .signal = 0,
-                .noise = -98,
-                .rate = 0,
-                .freq = IEEE80211_24GHZ_BAND,
-        };
-        stats.nic_type = NIC_8185B;
-        rx_desc_size = 8;
-        if ((*(priv->rxringtail)) & (1<<31)) {
-                /* we have got an RX int, but the descriptor. we are pointing
-                 * is empty.
-                 */
-                priv->stats.rxnodata++;
-                priv->ieee80211->stats.rx_errors++;
-                tmp2 = NULL;
-                tmp = priv->rxringtail;
-                do {
-                        if (tmp == priv->rxring)
-                                tmp  = priv->rxring + (priv->rxringcount - 1) *
-                                        rx_desc_size;
-                        else
-                                tmp -= rx_desc_size;
-                        if (!(*tmp & (1<<31)))
-                                tmp2 = tmp;
-                } while (tmp != priv->rxring);
-                if (tmp2)
-                        priv->rxringtail = tmp2;
-        }
-        /* while there are filled descriptors */
-        while (!(*(priv->rxringtail) & (1<<31))) {
-                if (*(priv->rxringtail) & (1<<26))
-                        DMESGW("RX buffer overflow");
-                if (*(priv->rxringtail) & (1<<12))
-                        priv->stats.rxicverr++;
-                if (*(priv->rxringtail) & (1<<27)) {
-                        priv->stats.rxdmafail++;
-                        goto drop;
-                }
-                pci_dma_sync_single_for_cpu(priv->pdev,
-                                    priv->rxbuffer->dma,
-                                    priv->rxbuffersize * sizeof(u8),
-                                    PCI_DMA_FROMDEVICE);
-                first = *(priv->rxringtail) & (1<<29) ? 1 : 0;
-                if (first)
-                        priv->rx_prevlen = 0;
-                last = *(priv->rxringtail) & (1<<28) ? 1 : 0;
-                if (last) {
-                        lastlen = ((*priv->rxringtail) & 0xfff);
-                        /* if the last descriptor (that should tell us the total
-                         * packet len) tell us something less than the
-                         * descriptors len we had until now, then there is some
-                         * problem..
-                         * workaround to prevent kernel panic
-                         */
-                        if (lastlen < priv->rx_prevlen)
-                                len = 0;
-                        else
-                                len = lastlen-priv->rx_prevlen;
-                        if (*(priv->rxringtail) & (1<<13)) {
-                                if ((*(priv->rxringtail) & 0xfff) < 500)
-                                        priv->stats.rxcrcerrmin++;
-                                else if ((*(priv->rxringtail) & 0x0fff) > 1000)
-                                        priv->stats.rxcrcerrmax++;
-                                else
-                                        priv->stats.rxcrcerrmid++;
-                        }
-                } else {
-                        len = priv->rxbuffersize;
-                }
-                if (first && last) {
-                        padding = ((*(priv->rxringtail+3))&(0x04000000))>>26;
-                } else if (first) {
-                        padding = ((*(priv->rxringtail+3))&(0x04000000))>>26;
-                        if (padding)
-                                len -= 2;
-                } else {
-                        padding = 0;
-                }
-                padding = 0;
-                priv->rx_prevlen += len;
-                if (priv->rx_prevlen > MAX_FRAG_THRESHOLD + 100) {
-                        /* HW is probably passing several buggy frames without
-                         * FD or LD flag set.
-                         * Throw this garbage away to prevent skb memory
-                         * exhausting
-                         */
-                        if (!priv->rx_skb_complete)
-                                dev_kfree_skb_any(priv->rx_skb);
-                        priv->rx_skb_complete = 1;
-                }
-                signal = (unsigned char)((*(priv->rxringtail + 3) &
-                        0x00ff0000) >> 16);
-                signal = (signal & 0xfe) >> 1;
-                quality = (unsigned char)((*(priv->rxringtail+3)) & (0xff));
-                stats.mac_time[0] = *(priv->rxringtail+1);
-                stats.mac_time[1] = *(priv->rxringtail+2);
-                rxpower = ((char)((*(priv->rxringtail + 4) &
-                        0x00ff0000) >> 16)) / 2 - 42;
-                RSSI = ((u8)((*(priv->rxringtail + 3) &
-                        0x0000ff00) >> 8)) & 0x7f;
-                rate = ((*(priv->rxringtail)) &
-                        ((1<<23)|(1<<22)|(1<<21)|(1<<20)))>>20;
-                stats.rate = rtl8180_rate2rate(rate);
-                Antenna = (*(priv->rxringtail + 3) & 0x00008000) == 0 ? 0 : 1;
-                if (!rtl8180_IsWirelessBMode(stats.rate)) { /* OFDM rate. */
-                        RxAGC_dBm = rxpower+1;  /* bias */
-                } else { /* CCK rate. */
-                        RxAGC_dBm = signal; /* bit 0 discard */
-                        LNA = (u8) (RxAGC_dBm & 0x60) >> 5; /* bit 6~ bit 5 */
-                        BB  = (u8) (RxAGC_dBm & 0x1F); /* bit 4 ~ bit 0 */
-                        /* Pin_11b=-(LNA_gain+BB_gain) (dBm) */
-                        RxAGC_dBm = -(LNA_gain[LNA] + (BB * 2));
-                        RxAGC_dBm += 4; /* bias */
-                }
-                if (RxAGC_dBm & 0x80) /* absolute value */
-                        RXAGC = ~(RxAGC_dBm)+1;
-                bCckRate = rtl8180_IsWirelessBMode(stats.rate);
-                /* Translate RXAGC into 1-100. */
-                if (!rtl8180_IsWirelessBMode(stats.rate)) { /* OFDM rate. */
-                        if (RXAGC > 90)
-                                RXAGC = 90;
-                        else if (RXAGC < 25)
-                                RXAGC = 25;
-                        RXAGC = (90-RXAGC)*100/65;
-                } else { /* CCK rate. */
-                        if (RXAGC > 95)
-                                RXAGC = 95;
-                        else if (RXAGC < 30)
-                                RXAGC = 30;
-                        RXAGC = (95-RXAGC)*100/65;
-                }
-                priv->SignalStrength = (u8)RXAGC;
-                priv->RecvSignalPower = RxAGC_dBm;
-                priv->RxPower = rxpower;
-                priv->RSSI = RSSI;
-                /* SQ translation formula is provided by SD3 DZ. 2006.06.27 */
-                if (quality >= 127)
-                        /* 0 causes epc to show signal zero, walk around now */
-                        quality = 1;
-                else if (quality < 27)
-                        quality = 100;
-                else
-                        quality = 127 - quality;
-                priv->SignalQuality = quality;
-                stats.signal = (u8) quality;
-                stats.signalstrength = RXAGC;
-                if (stats.signalstrength > 100)
-                        stats.signalstrength = 100;
-                stats.signalstrength = (stats.signalstrength * 70) / 100 + 30;
-                stats.rssi = priv->wstats.qual.qual = priv->SignalQuality;
-                stats.noise = priv->wstats.qual.noise =
-                        100 - priv->wstats.qual.qual;
-                bHwError = (((*(priv->rxringtail)) & (0x00000fff)) == 4080) |
-                           (((*(priv->rxringtail)) & (0x04000000)) != 0) |
-                           (((*(priv->rxringtail)) & (0x08000000)) != 0) |
-                           (((~(*(priv->rxringtail))) & (0x10000000)) != 0) |
-                           (((~(*(priv->rxringtail))) & (0x20000000)) != 0);
-                bCRC = ((*(priv->rxringtail)) & (0x00002000)) >> 13;
-                bICV = ((*(priv->rxringtail)) & (0x00001000)) >> 12;
-                hdr = (struct ieee80211_hdr_4addr *)priv->rxbuffer->buf;
-                    fc = le16_to_cpu(hdr->frame_ctl);
-                type = WLAN_FC_GET_TYPE(fc);
-                if (IEEE80211_FTYPE_CTL != type &&
-                    !bHwError && !bCRC && !bICV &&
-                    eqMacAddr(priv->ieee80211->current_network.bssid,
-                        fc & IEEE80211_FCTL_TODS ? hdr->addr1 :
-                        fc & IEEE80211_FCTL_FROMDS ? hdr->addr2 :
-                        hdr->addr3)) {
-                        /* Perform signal smoothing for dynamic
-                         * mechanism on demand. This is different
-                         * with PerformSignalSmoothing8185 in smoothing
-                         * fomula. No dramatic adjustion is apply
-                         * because dynamic mechanism need some degree
-                         * of correctness. */
-                        PerformUndecoratedSignalSmoothing8185(priv, bCckRate);
-                        /* For good-looking singal strength. */
-                        SignalStrengthIndex = NetgearSignalStrengthTranslate(
-                                priv->LastSignalStrengthInPercent,
-                                priv->SignalStrength);
-                        priv->LastSignalStrengthInPercent = SignalStrengthIndex;
-                        priv->Stats_SignalStrength =
-                                TranslateToDbm8185((u8)SignalStrengthIndex);
-                        /*
-                         * We need more correct power of received packets and
-                         * the "SignalStrength" of RxStats is beautified, so we
-                         * record the correct power here.
-                         */
-                        priv->Stats_SignalQuality = (long)(
-                                priv->Stats_SignalQuality * 5 +
-                                (long)priv->SignalQuality + 5) / 6;
-                        priv->Stats_RecvSignalPower = (long)(
-                                priv->Stats_RecvSignalPower * 5 +
-                                priv->RecvSignalPower - 1) / 6;
-                        /*
-                         * Figure out which antenna received the last packet.
-                         * 0: aux, 1: main
-                         */
-                        priv->LastRxPktAntenna = Antenna ? 1 : 0;
-                        SwAntennaDiversityRxOk8185(dev, priv->SignalStrength);
-                }
-                if (first) {
-                        if (!priv->rx_skb_complete) {
-                                /* seems that HW sometimes fails to receive and
-                                 * doesn't provide the last descriptor.
-                                 */
-                                dev_kfree_skb_any(priv->rx_skb);
-                                priv->stats.rxnolast++;
-                        }
-                        priv->rx_skb = dev_alloc_skb(len+2);
-                        if (!priv->rx_skb)
-                                goto drop;
-                        priv->rx_skb_complete = 0;
-                        priv->rx_skb->dev = dev;
-                } else {
-                        /* if we are here we should have already RXed the first
-                         * frame.
-                         * If we get here and the skb is not allocated then
-                         * we have just throw out garbage (skb not allocated)
-                         * and we are still rxing garbage....
-                         */
-                        if (!priv->rx_skb_complete) {
-                                tmp_skb = dev_alloc_skb(
-                                        priv->rx_skb->len + len + 2);
-                                if (!tmp_skb)
-                                        goto drop;
-                                tmp_skb->dev = dev;
-                                memcpy(skb_put(tmp_skb, priv->rx_skb->len),
-                                        priv->rx_skb->data,
-                                        priv->rx_skb->len);
-                                dev_kfree_skb_any(priv->rx_skb);
-                                priv->rx_skb = tmp_skb;
-                        }
-                }
-                if (!priv->rx_skb_complete) {
-                        memcpy(skb_put(priv->rx_skb, len), ((unsigned char *)
-                                priv->rxbuffer->buf) + (padding ? 2 : 0), len);
-                }
-                if (last && !priv->rx_skb_complete) {
-                        if (priv->rx_skb->len > 4)
-                                skb_trim(priv->rx_skb, priv->rx_skb->len-4);
-                        if (!ieee80211_rtl_rx(priv->ieee80211,
-                                         priv->rx_skb, &stats))
-                                dev_kfree_skb_any(priv->rx_skb);
-                        priv->rx_skb_complete = 1;
-                }
-                pci_dma_sync_single_for_device(priv->pdev,
-                                    priv->rxbuffer->dma,
-                                    priv->rxbuffersize * sizeof(u8),
-                                    PCI_DMA_FROMDEVICE);
-drop: /* this is used when we have not enough mem */
-                /* restore the descriptor */
-                *(priv->rxringtail+2) = priv->rxbuffer->dma;
-                *(priv->rxringtail) = *(priv->rxringtail) & ~0xfff;
-                *(priv->rxringtail) =
-                        *(priv->rxringtail) | priv->rxbuffersize;
-                *(priv->rxringtail) =
-                        *(priv->rxringtail) | (1<<31);
-                priv->rxringtail += rx_desc_size;
-                if (priv->rxringtail >=
-                   (priv->rxring)+(priv->rxringcount)*rx_desc_size)
-                        priv->rxringtail = priv->rxring;
-                priv->rxbuffer = (priv->rxbuffer->next);
-        }
-}
-static void rtl8180_dma_kick(struct net_device *dev, int priority)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        write_nic_byte(dev, TX_DMA_POLLING,
-                        (1 << (priority + 1)) | priv->dma_poll_mask);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-        force_pci_posting(dev);
-}
-static void rtl8180_data_hard_stop(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        priv->dma_poll_stop_mask |= TPPOLLSTOP_AC_VIQ;
-        write_nic_byte(dev, TPPollStop, priv->dma_poll_stop_mask);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-}
-static void rtl8180_data_hard_resume(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        priv->dma_poll_stop_mask &= ~(TPPOLLSTOP_AC_VIQ);
-        write_nic_byte(dev, TPPollStop, priv->dma_poll_stop_mask);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-}
-/*
- * This function TX data frames when the ieee80211 stack requires this.
- * It checks also if we need to stop the ieee tx queue, eventually do it
- */
-static void rtl8180_hard_data_xmit(struct sk_buff *skb, struct net_device *dev,
-                                   int rate)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        int mode;
-        struct ieee80211_hdr_3addr *h = (struct ieee80211_hdr_3addr *)skb->data;
-        bool morefrag = le16_to_cpu(h->frame_control) & IEEE80211_FCTL_MOREFRAGS;
-        unsigned long flags;
-        int priority;
-        mode = priv->ieee80211->iw_mode;
-        rate = ieeerate2rtlrate(rate);
-        /*
-         * This function doesn't require lock because we make sure it's called
-         * with the tx_lock already acquired.
-         * This come from the kernel's hard_xmit callback (through the ieee
-         * stack, or from the try_wake_queue (again through the ieee stack.
-         */
-        priority = AC2Q(skb->priority);
-        spin_lock_irqsave(&priv->tx_lock, flags);
-        if (priv->ieee80211->bHwRadioOff) {
-                spin_unlock_irqrestore(&priv->tx_lock, flags);
-                return;
-        }
-        if (!check_nic_enought_desc(dev, priority)) {
-                DMESGW("Error: no descriptor left by previous TX (avail %d) ",
-                        get_curr_tx_free_desc(dev, priority));
-                ieee80211_rtl_stop_queue(priv->ieee80211);
-        }
-        rtl8180_tx(dev, skb->data, skb->len, priority, morefrag, 0, rate);
-        if (!check_nic_enought_desc(dev, priority))
-                ieee80211_rtl_stop_queue(priv->ieee80211);
-        spin_unlock_irqrestore(&priv->tx_lock, flags);
-}
-/*
- * This is a rough attempt to TX a frame
- * This is called by the ieee 80211 stack to TX management frames.
- * If the ring is full packets are dropped (for data frame the queue
- * is stopped before this can happen). For this reason it is better
- * if the descriptors are larger than the largest management frame
- * we intend to TX: i'm unsure what the HW does if it will not find
- * the last fragment of a frame because it has been dropped...
- * Since queues for Management and Data frames are different we
- * might use a different lock than tx_lock (for example mgmt_tx_lock)
- */
-/* these function may loop if invoked with 0 descriptors or 0 len buffer */
-static int rtl8180_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        unsigned long flags;
-        int priority;
-        priority = MANAGE_PRIORITY;
-        spin_lock_irqsave(&priv->tx_lock, flags);
-        if (priv->ieee80211->bHwRadioOff) {
-                spin_unlock_irqrestore(&priv->tx_lock, flags);
-                dev_kfree_skb_any(skb);
-                return NETDEV_TX_OK;
-        }
-        rtl8180_tx(dev, skb->data, skb->len, priority,
-                0, 0, ieeerate2rtlrate(priv->ieee80211->basic_rate));
-        priv->ieee80211->stats.tx_bytes += skb->len;
-        priv->ieee80211->stats.tx_packets++;
-        spin_unlock_irqrestore(&priv->tx_lock, flags);
-        dev_kfree_skb_any(skb);
-        return NETDEV_TX_OK;
-}
-static void rtl8180_prepare_beacon(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct sk_buff *skb;
-        u16 word  = read_nic_word(dev, BcnItv);
-        word &= ~BcnItv_BcnItv; /* clear Bcn_Itv */
-        /* word |= 0x64; */
-        word |= cpu_to_le16(priv->ieee80211->current_network.beacon_interval);
-        write_nic_word(dev, BcnItv, word);
-        skb = ieee80211_get_beacon(priv->ieee80211);
-        if (skb) {
-                rtl8180_tx(dev, skb->data, skb->len, BEACON_PRIORITY,
-                        0, 0, ieeerate2rtlrate(priv->ieee80211->basic_rate));
-                dev_kfree_skb_any(skb);
-        }
-}
-/*
- * This function do the real dirty work: it enqueues a TX command descriptor in
- * the ring buffer, copyes the frame in a TX buffer and kicks the NIC to ensure
- * it does the DMA transfer.
- */
-short rtl8180_tx(struct net_device *dev, u8 *txbuf, int len, int priority,
-                 bool morefrag, short descfrag, int rate)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u32 *tail, *temp_tail;
-        u32 *begin;
-        u32 *buf;
-        int i;
-        int remain;
-        int buflen;
-        int count;
-        struct buffer *buflist;
-        struct ieee80211_hdr_3addr *frag_hdr =
-                (struct ieee80211_hdr_3addr *)txbuf;
-        u8 dest[ETH_ALEN];
-        u8 bUseShortPreamble = 0;
-        u8 bCTSEnable = 0;
-        u8 bRTSEnable = 0;
-        u16 Duration = 0;
-        u16 RtsDur = 0;
-        u16 ThisFrameTime = 0;
-        u16 TxDescDuration = 0;
-        bool ownbit_flag = false;
-        switch (priority) {
-        case MANAGE_PRIORITY:
-                tail = priv->txmapringtail;
-                begin = priv->txmapring;
-                buflist = priv->txmapbufstail;
-                count = priv->txringcount;
-                break;
-        case BK_PRIORITY:
-                tail = priv->txbkpringtail;
-                begin = priv->txbkpring;
-                buflist = priv->txbkpbufstail;
-                count = priv->txringcount;
-                break;
-        case BE_PRIORITY:
-                tail = priv->txbepringtail;
-                begin = priv->txbepring;
-                buflist = priv->txbepbufstail;
-                count = priv->txringcount;
-                break;
-        case VI_PRIORITY:
-                tail = priv->txvipringtail;
-                begin = priv->txvipring;
-                buflist = priv->txvipbufstail;
-                count = priv->txringcount;
-                break;
-        case VO_PRIORITY:
-                tail = priv->txvopringtail;
-                begin = priv->txvopring;
-                buflist = priv->txvopbufstail;
-                count = priv->txringcount;
-                break;
-        case HI_PRIORITY:
-                tail = priv->txhpringtail;
-                begin = priv->txhpring;
-                buflist = priv->txhpbufstail;
-                count = priv->txringcount;
-                break;
-        case BEACON_PRIORITY:
-                tail = priv->txbeaconringtail;
-                begin = priv->txbeaconring;
-                buflist = priv->txbeaconbufstail;
-                count = priv->txbeaconcount;
-                break;
-        default:
-                return -1;
-                break;
-        }
-        memcpy(&dest, frag_hdr->addr1, ETH_ALEN);
-        if (is_multicast_ether_addr(dest)) {
-                Duration = 0;
-                RtsDur = 0;
-                bRTSEnable = 0;
-                bCTSEnable = 0;
-                ThisFrameTime = ComputeTxTime(len + sCrcLng,
-                        rtl8180_rate2rate(rate), 0, bUseShortPreamble);
-                TxDescDuration = ThisFrameTime;
-        } else { /* Unicast packet */
-                u16 AckTime;
-                /* for Keep alive */
-                priv->NumTxUnicast++;
-                /* Figure out ACK rate according to BSS basic rate
-                 * and Tx rate.
-                 * AckCTSLng = 14 use 1M bps send
-                 */
-                AckTime = ComputeTxTime(14, 10, 0, 0);
-                if (((len + sCrcLng) > priv->rts) && priv->rts) { /* RTS/CTS. */
-                        u16 RtsTime, CtsTime;
-                        bRTSEnable = 1;
-                        bCTSEnable = 0;
-                        /* Rate and time required for RTS. */
-                        RtsTime = ComputeTxTime(sAckCtsLng / 8,
-                                priv->ieee80211->basic_rate, 0, 0);
-                        /* Rate and time required for CTS.
-                         * AckCTSLng = 14 use 1M bps send
-                         */
-                        CtsTime = ComputeTxTime(14, 10, 0, 0);
-                        /* Figure out time required to transmit this frame. */
-                        ThisFrameTime = ComputeTxTime(len + sCrcLng,
-                                rtl8180_rate2rate(rate), 0,
-                                bUseShortPreamble);
-                        /* RTS-CTS-ThisFrame-ACK. */
-                        RtsDur = CtsTime + ThisFrameTime +
-                                AckTime + 3 * aSifsTime;
-                        TxDescDuration = RtsTime + RtsDur;
-                } else { /* Normal case. */
-                        bCTSEnable = 0;
-                        bRTSEnable = 0;
-                        RtsDur = 0;
-                        ThisFrameTime = ComputeTxTime(len + sCrcLng,
-                                rtl8180_rate2rate(rate), 0, bUseShortPreamble);
-                        TxDescDuration = ThisFrameTime + aSifsTime + AckTime;
-                }
-                if (!(le16_to_cpu(frag_hdr->frame_control) & IEEE80211_FCTL_MOREFRAGS)) {
-                        /* ThisFrame-ACK. */
-                        Duration = aSifsTime + AckTime;
-                } else { /* One or more fragments remained. */
-                        u16 NextFragTime;
-                        /* pretend following packet length = current packet */
-                        NextFragTime = ComputeTxTime(len + sCrcLng,
-                                rtl8180_rate2rate(rate), 0, bUseShortPreamble);
-                        /* ThisFrag-ACk-NextFrag-ACK. */
-                        Duration = NextFragTime + 3 * aSifsTime + 2 * AckTime;
-                }
-        } /* End of Unicast packet */
-        frag_hdr->duration_id = Duration;
-        buflen = priv->txbuffsize;
-        remain = len;
-        temp_tail = tail;
-        while (remain != 0) {
-                mb();
-                if (!buflist) {
-                        DMESGE("TX buffer error, cannot TX frames. pri %d.",
-                                priority);
-                        return -1;
-                }
-                buf = buflist->buf;
-                if ((*tail & (1 << 31)) && (priority != BEACON_PRIORITY)) {
-                        DMESGW("No more TX desc, returning %x of %x",
-                               remain, len);
-                        priv->stats.txrdu++;
-                        return remain;
-                }
-                *tail = 0; /* zeroes header */
-                *(tail+1) = 0;
-                *(tail+3) = 0;
-                *(tail+5) = 0;
-                *(tail+6) = 0;
-                *(tail+7) = 0;
-                /* FIXME: should be triggered by HW encryption parameters.*/
-                *tail |= (1<<15); /* no encrypt */
-                if (remain == len && !descfrag) {
-                        ownbit_flag = false;
-                        *tail = *tail | (1 << 29); /* first segment of packet */
-                        *tail = *tail | (len);
-                } else {
-                        ownbit_flag = true;
-                }
-                for (i = 0; i < buflen && remain > 0; i++, remain--) {
-                        /* copy data into descriptor pointed DMAble buffer */
-                        ((u8 *)buf)[i] = txbuf[i];
-                        if (remain == 4 && i+4 >= buflen)
-                                break;
-                        /* ensure the last desc has at least 4 bytes payload */
-                }
-                txbuf = txbuf + i;
-                *(tail+3) = *(tail+3) & ~0xfff;
-                *(tail+3) = *(tail+3) | i; /* buffer length */
-                if (bCTSEnable)
-                        *tail |= (1<<18);
-                if (bRTSEnable) { /* rts enable */
-                        /* RTS RATE */
-                        *tail |= (ieeerate2rtlrate(
-                                priv->ieee80211->basic_rate) << 19);
-                        *tail |= (1<<23); /* rts enable */
-                        *(tail+1) |= (RtsDur&0xffff); /* RTS Duration */
-                }
-                *(tail+3) |= ((TxDescDuration&0xffff)<<16); /* DURATION */
-                *(tail + 5) |= (11 << 8); /* retry lim; */
-                *tail = *tail | ((rate&0xf) << 24);
-                if (morefrag)
-                        *tail = (*tail) | (1<<17); /* more fragment */
-                if (!remain)
-                        *tail = (*tail) | (1<<28); /* last segment of frame */
-                *(tail+5) = *(tail+5)|(2<<27);
-                *(tail+7) = *(tail+7)|(1<<4);
-                wmb();
-                if (ownbit_flag)
-                        /* descriptor ready to be txed */
-                        *tail |= (1 << 31);
-                if ((tail - begin)/8 == count-1)
-                        tail = begin;
-                else
-                        tail = tail+8;
-                buflist = buflist->next;
-                mb();
-                switch (priority) {
-                case MANAGE_PRIORITY:
-                        priv->txmapringtail = tail;
-                        priv->txmapbufstail = buflist;
-                        break;
-                case BK_PRIORITY:
-                        priv->txbkpringtail = tail;
-                        priv->txbkpbufstail = buflist;
-                        break;
-                case BE_PRIORITY:
-                        priv->txbepringtail = tail;
-                        priv->txbepbufstail = buflist;
-                        break;
-                case VI_PRIORITY:
-                        priv->txvipringtail = tail;
-                        priv->txvipbufstail = buflist;
-                        break;
-                case VO_PRIORITY:
-                        priv->txvopringtail = tail;
-                        priv->txvopbufstail = buflist;
-                        break;
-                case HI_PRIORITY:
-                        priv->txhpringtail = tail;
-                        priv->txhpbufstail = buflist;
-                        break;
-                case BEACON_PRIORITY:
-                        /*
-                         * The HW seems to be happy with the 1st
-                         * descriptor filled and the 2nd empty...
-                         * So always update descriptor 1 and never
-                         * touch 2nd
-                         */
-                        break;
-                }
-        }
-        *temp_tail = *temp_tail | (1<<31); /* descriptor ready to be txed */
-        rtl8180_dma_kick(dev, priority);
-        return 0;
-}
-void rtl8180_irq_rx_tasklet(struct r8180_priv *priv);
-static void rtl8180_link_change(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u16 beacon_interval;
-        struct ieee80211_network *net = &priv->ieee80211->current_network;
-        rtl8180_update_msr(dev);
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        write_nic_dword(dev, BSSID, ((u32 *)net->bssid)[0]);
-        write_nic_word(dev, BSSID+4, ((u16 *)net->bssid)[2]);
-        beacon_interval  = read_nic_word(dev, BEACON_INTERVAL);
-        beacon_interval &= ~BEACON_INTERVAL_MASK;
-        beacon_interval |= net->beacon_interval;
-        write_nic_word(dev, BEACON_INTERVAL, beacon_interval);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-        rtl8180_set_chan(dev, priv->chan);
-}
-static void rtl8180_rq_tx_ack(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        write_nic_byte(dev, CONFIG4,
-                read_nic_byte(dev, CONFIG4) | CONFIG4_PWRMGT);
-        priv->ack_tx_to_ieee = 1;
-}
-static short rtl8180_is_tx_queue_empty(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u32 *d;
-        for (d = priv->txmapring;
-                d < priv->txmapring + priv->txringcount; d += 8)
-                        if (*d & (1<<31))
-                                return 0;
-        for (d = priv->txbkpring;
-                d < priv->txbkpring + priv->txringcount; d += 8)
-                        if (*d & (1<<31))
-                                return 0;
-        for (d = priv->txbepring;
-                d < priv->txbepring + priv->txringcount; d += 8)
-                        if (*d & (1<<31))
-                                return 0;
-        for (d = priv->txvipring;
-                d < priv->txvipring + priv->txringcount; d += 8)
-                        if (*d & (1<<31))
-                                return 0;
-        for (d = priv->txvopring;
-                d < priv->txvopring + priv->txringcount; d += 8)
-                        if (*d & (1<<31))
-                                return 0;
-        for (d = priv->txhpring;
-                d < priv->txhpring + priv->txringcount; d += 8)
-                        if (*d & (1<<31))
-                                return 0;
-        return 1;
-}
-static void rtl8180_hw_wakeup(struct net_device *dev)
-{
-        unsigned long flags;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        spin_lock_irqsave(&priv->ps_lock, flags);
-        write_nic_byte(dev, CONFIG4,
-                read_nic_byte(dev, CONFIG4) & ~CONFIG4_PWRMGT);
-        if (priv->rf_wakeup)
-                priv->rf_wakeup(dev);
-        spin_unlock_irqrestore(&priv->ps_lock, flags);
-}
-static void rtl8180_hw_sleep_down(struct net_device *dev)
-{
-        unsigned long flags;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        spin_lock_irqsave(&priv->ps_lock, flags);
-        if (priv->rf_sleep)
-                priv->rf_sleep(dev);
-        spin_unlock_irqrestore(&priv->ps_lock, flags);
-}
-static void rtl8180_hw_sleep(struct net_device *dev, u32 th, u32 tl)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u32 rb = jiffies;
-        unsigned long flags;
-        spin_lock_irqsave(&priv->ps_lock, flags);
-        /*
-         * Writing HW register with 0 equals to disable
-         * the timer, that is not really what we want
-         */
-        tl -= MSECS(4+16+7);
-        /*
-         * If the interval in which we are requested to sleep is too
-         * short then give up and remain awake
-         */
-        if (((tl >= rb) && (tl-rb) <= MSECS(MIN_SLEEP_TIME))
-                || ((rb > tl) && (rb-tl) < MSECS(MIN_SLEEP_TIME))) {
-                spin_unlock_irqrestore(&priv->ps_lock, flags);
-                netdev_warn(dev, "too short to sleep\n");
-                return;
-        }
-        {
-                u32 tmp = (tl > rb) ? (tl-rb) : (rb-tl);
-                priv->DozePeriodInPast2Sec += jiffies_to_msecs(tmp);
-                /* as tl may be less than rb */
-                queue_delayed_work(priv->ieee80211->wq,
-                        &priv->ieee80211->hw_wakeup_wq, tmp);
-        }
-        /*
-         * If we suspect the TimerInt is gone beyond tl
-         * while setting it, then give up
-         */
-        if (((tl > rb) && ((tl-rb) > MSECS(MAX_SLEEP_TIME))) ||
-                ((tl < rb) && ((rb-tl) > MSECS(MAX_SLEEP_TIME)))) {
-                spin_unlock_irqrestore(&priv->ps_lock, flags);
-                return;
-        }
-        queue_work(priv->ieee80211->wq, (void *)&priv->ieee80211->hw_sleep_wq);
-        spin_unlock_irqrestore(&priv->ps_lock, flags);
-}
-static void rtl8180_wmm_single_param_update(struct net_device *dev,
-        u8 mode, AC_CODING eACI, PAC_PARAM param)
-{
-        u8 u1bAIFS;
-        u32 u4bAcParam;
-        /* Retrieve parameters to update. */
-        /* Mode G/A: slotTimeTimer = 9; Mode B: 20 */
-        u1bAIFS = param->f.AciAifsn.f.AIFSN * ((mode & IEEE_G) == IEEE_G ?
-                9 : 20) + aSifsTime;
-        u4bAcParam = (((u32)param->f.TXOPLimit << AC_PARAM_TXOP_LIMIT_OFFSET) |
-                ((u32)param->f.Ecw.f.ECWmax << AC_PARAM_ECW_MAX_OFFSET) |
-                ((u32)param->f.Ecw.f.ECWmin << AC_PARAM_ECW_MIN_OFFSET) |
-                ((u32)u1bAIFS << AC_PARAM_AIFS_OFFSET));
-        switch (eACI) {
-        case AC1_BK:
-                write_nic_dword(dev, AC_BK_PARAM, u4bAcParam);
-                return;
-        case AC0_BE:
-                write_nic_dword(dev, AC_BE_PARAM, u4bAcParam);
-                return;
-        case AC2_VI:
-                write_nic_dword(dev, AC_VI_PARAM, u4bAcParam);
-                return;
-        case AC3_VO:
-                write_nic_dword(dev, AC_VO_PARAM, u4bAcParam);
-                return;
-        default:
-                pr_warn("SetHwReg8185(): invalid ACI: %d!\n", eACI);
-                return;
-        }
-}
-static void rtl8180_wmm_param_update(struct work_struct *work)
-{
-        struct ieee80211_device *ieee = container_of(work,
-                struct ieee80211_device, wmm_param_update_wq);
-        struct net_device *dev = ieee->dev;
-        u8 *ac_param = (u8 *)(ieee->current_network.wmm_param);
-        u8 mode = ieee->current_network.mode;
-        AC_CODING eACI;
-        AC_PARAM AcParam;
-        if (!ieee->current_network.QoS_Enable) {
-                /* legacy ac_xx_param update */
-                AcParam.longData = 0;
-                AcParam.f.AciAifsn.f.AIFSN = 2; /* Follow 802.11 DIFS. */
-                AcParam.f.AciAifsn.f.ACM = 0;
-                AcParam.f.Ecw.f.ECWmin = 3; /* Follow 802.11 CWmin. */
-                AcParam.f.Ecw.f.ECWmax = 7; /* Follow 802.11 CWmax. */
-                AcParam.f.TXOPLimit = 0;
-                for (eACI = 0; eACI < AC_MAX; eACI++) {
-                        AcParam.f.AciAifsn.f.ACI = (u8)eACI;
-                        rtl8180_wmm_single_param_update(dev, mode, eACI,
-                                (PAC_PARAM)&AcParam);
-                }
-                return;
-        }
-        for (eACI = 0; eACI < AC_MAX; eACI++) {
-                rtl8180_wmm_single_param_update(dev, mode,
-                        ((PAC_PARAM)ac_param)->f.AciAifsn.f.ACI,
-                        (PAC_PARAM)ac_param);
-                ac_param += sizeof(AC_PARAM);
-        }
-}
-void rtl8180_restart_wq(struct work_struct *work);
-void rtl8180_watch_dog_wq(struct work_struct *work);
-void rtl8180_hw_wakeup_wq(struct work_struct *work);
-void rtl8180_hw_sleep_wq(struct work_struct *work);
-void rtl8180_sw_antenna_wq(struct work_struct *work);
-void rtl8180_watch_dog(struct net_device *dev);
-static void watch_dog_adaptive(unsigned long data)
-{
-        struct r8180_priv *priv = ieee80211_priv((struct net_device *)data);
-        if (!priv->up) {
-                DMESG("<----watch_dog_adaptive():driver is not up!\n");
-                return;
-        }
-        /* Tx High Power Mechanism. */
-        if (CheckHighPower((struct net_device *)data))
-                queue_work(priv->ieee80211->wq,
-                        (void *)&priv->ieee80211->tx_pw_wq);
-        /* Tx Power Tracking on 87SE. */
-        if (CheckTxPwrTracking((struct net_device *)data))
-                TxPwrTracking87SE((struct net_device *)data);
-        /* Perform DIG immediately. */
-        if (CheckDig((struct net_device *)data))
-                queue_work(priv->ieee80211->wq,
-                        (void *)&priv->ieee80211->hw_dig_wq);
-        rtl8180_watch_dog((struct net_device *)data);
-        queue_work(priv->ieee80211->wq,
-                (void *)&priv->ieee80211->GPIOChangeRFWorkItem);
-        priv->watch_dog_timer.expires = jiffies +
-                MSECS(IEEE80211_WATCH_DOG_TIME);
-        add_timer(&priv->watch_dog_timer);
-}
-static struct rtl8187se_channel_list channel_plan_list[] = {
-        /* FCC */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 36, 40,
-                44, 48, 52, 56, 60, 64}, 19},
-        /* IC */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},
-        /* ETSI */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40,
-                44, 48, 52, 56, 60, 64}, 21},
-        /* Spain. Change to ETSI. */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40,
-                44, 48, 52, 56, 60, 64}, 21},
-        /* France. Change to ETSI. */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40,
-                44, 48, 52, 56, 60, 64}, 21},
-        /* MKK */
-        {{14, 36, 40, 44, 48, 52, 56, 60, 64}, 9},
-        /* MKK1 */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 36,
-                40, 44, 48, 52, 56, 60, 64}, 22},
-        /* Israel. */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40,
-                44, 48, 52, 56, 60, 64}, 21},
-        /* For 11a , TELEC */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 34, 38, 42, 46}, 17},
-        /* For Global Domain. 1-11 active, 12-14 passive. */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},
-        /* world wide 13: ch1~ch11 active, ch12~13 passive */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13}
-};
-static void rtl8180_set_channel_map(u8 channel_plan,
-                                    struct ieee80211_device *ieee)
-{
-        int i;
-        ieee->MinPassiveChnlNum = MAX_CHANNEL_NUMBER+1;
-        ieee->IbssStartChnl = 0;
-        switch (channel_plan) {
-        case COUNTRY_CODE_FCC:
-        case COUNTRY_CODE_IC:
-        case COUNTRY_CODE_ETSI:
-        case COUNTRY_CODE_SPAIN:
-        case COUNTRY_CODE_FRANCE:
-        case COUNTRY_CODE_MKK:
-        case COUNTRY_CODE_MKK1:
-        case COUNTRY_CODE_ISRAEL:
-        case COUNTRY_CODE_TELEC:
-                {
-                        Dot11d_Init(ieee);
-                        ieee->bGlobalDomain = false;
-                        if (channel_plan_list[channel_plan].len != 0) {
-                                /* Clear old channel map */
-                                memset(GET_DOT11D_INFO(ieee)->channel_map, 0, sizeof(GET_DOT11D_INFO(ieee)->channel_map));
-                                /* Set new channel map */
-                                for (i = 0; i < channel_plan_list[channel_plan].len; i++) {
-                                        if (channel_plan_list[channel_plan].channel[i] <= 14)
-                                                GET_DOT11D_INFO(ieee)->channel_map[channel_plan_list[channel_plan].channel[i]] = 1;
-                                }
-                        }
-                        break;
-                }
-        case COUNTRY_CODE_GLOBAL_DOMAIN:
-                {
-                        GET_DOT11D_INFO(ieee)->bEnabled = false;
-                        Dot11d_Reset(ieee);
-                        ieee->bGlobalDomain = true;
-                        break;
-                }
-        case COUNTRY_CODE_WORLD_WIDE_13_INDEX:
-                {
-                        ieee->MinPassiveChnlNum = 12;
-                        ieee->IbssStartChnl = 10;
-                        break;
-                }
-        default:
-                {
-                        Dot11d_Init(ieee);
-                        ieee->bGlobalDomain = false;
-                        memset(GET_DOT11D_INFO(ieee)->channel_map, 0, sizeof(GET_DOT11D_INFO(ieee)->channel_map));
-                        for (i = 1; i <= 14; i++)
-                                GET_DOT11D_INFO(ieee)->channel_map[i] = 1;
-                        break;
-                }
-        }
-}
-void GPIOChangeRFWorkItemCallBack(struct work_struct *work);
-static void rtl8180_statistics_init(struct stats *pstats)
-{
-        memset(pstats, 0, sizeof(struct stats));
-}
-static void rtl8180_link_detect_init(struct link_detect_t *plink_detect)
-{
-        memset(plink_detect, 0, sizeof(struct link_detect_t));
-        plink_detect->slot_num = DEFAULT_SLOT_NUM;
-}
-static void rtl8187se_eeprom_register_read(struct eeprom_93cx6 *eeprom)
-{
-        struct net_device *dev = eeprom->data;
-        u8 reg = read_nic_byte(dev, EPROM_CMD);
-        eeprom->reg_data_in = reg & RTL818X_EEPROM_CMD_WRITE;
-        eeprom->reg_data_out = reg & RTL818X_EEPROM_CMD_READ;
-        eeprom->reg_data_clock = reg & RTL818X_EEPROM_CMD_CK;
-        eeprom->reg_chip_select = reg & RTL818X_EEPROM_CMD_CS;
-}
-static void rtl8187se_eeprom_register_write(struct eeprom_93cx6 *eeprom)
-{
-        struct net_device *dev = eeprom->data;
-        u8 reg = 2 << 6;
-        if (eeprom->reg_data_in)
-                reg |= RTL818X_EEPROM_CMD_WRITE;
-        if (eeprom->reg_data_out)
-                reg |= RTL818X_EEPROM_CMD_READ;
-        if (eeprom->reg_data_clock)
-                reg |= RTL818X_EEPROM_CMD_CK;
-        if (eeprom->reg_chip_select)
-                reg |= RTL818X_EEPROM_CMD_CS;
-        write_nic_byte(dev, EPROM_CMD, reg);
-        read_nic_byte(dev, EPROM_CMD);
-        udelay(10);
-}
-static short rtl8180_init(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u16 word;
-        u16 usValue;
-        u16 tmpu16;
-        int i, j;
-        struct eeprom_93cx6 eeprom;
-        u16 eeprom_val;
-        eeprom.data = dev;
-        eeprom.register_read = rtl8187se_eeprom_register_read;
-        eeprom.register_write = rtl8187se_eeprom_register_write;
-        eeprom.width = PCI_EEPROM_WIDTH_93C46;
-        eeprom_93cx6_read(&eeprom, EEPROM_COUNTRY_CODE>>1, &eeprom_val);
-        priv->channel_plan = eeprom_val & 0xFF;
-        if (priv->channel_plan > COUNTRY_CODE_GLOBAL_DOMAIN) {
-                netdev_err(dev, "rtl8180_init: Invalid channel plan! Set to default.\n");
-                priv->channel_plan = 0;
-        }
-        DMESG("Channel plan is %d\n", priv->channel_plan);
-        rtl8180_set_channel_map(priv->channel_plan, priv->ieee80211);
-        /* FIXME: these constants are placed in a bad pleace. */
-        priv->txbuffsize = 2048;        /* 1024; */
-        priv->txringcount = 32;         /* 32; */
-        priv->rxbuffersize = 2048;      /* 1024; */
-        priv->rxringcount = 64;         /* 32; */
-        priv->txbeaconcount = 2;
-        priv->rx_skb_complete = 1;
-        priv->RFChangeInProgress = false;
-        priv->SetRFPowerStateInProgress = false;
-        priv->RFProgType = 0;
-        priv->irq_enabled = 0;
-        rtl8180_statistics_init(&priv->stats);
-        rtl8180_link_detect_init(&priv->link_detect);
-        priv->ack_tx_to_ieee = 0;
-        priv->ieee80211->current_network.beacon_interval =
-                DEFAULT_BEACONINTERVAL;
-        priv->ieee80211->iw_mode = IW_MODE_INFRA;
-        priv->ieee80211->softmac_features  = IEEE_SOFTMAC_SCAN |
-                IEEE_SOFTMAC_ASSOCIATE | IEEE_SOFTMAC_PROBERQ |
-                IEEE_SOFTMAC_PROBERS | IEEE_SOFTMAC_TX_QUEUE;
-        priv->ieee80211->active_scan = 1;
-        priv->ieee80211->rate = 110; /* 11 mbps */
-        priv->ieee80211->modulation = IEEE80211_CCK_MODULATION;
-        priv->ieee80211->host_encrypt = 1;
-        priv->ieee80211->host_decrypt = 1;
-        priv->ieee80211->sta_wake_up = rtl8180_hw_wakeup;
-        priv->ieee80211->ps_request_tx_ack = rtl8180_rq_tx_ack;
-        priv->ieee80211->enter_sleep_state = rtl8180_hw_sleep;
-        priv->ieee80211->ps_is_queue_empty = rtl8180_is_tx_queue_empty;
-        priv->hw_wep = hwwep;
-        priv->dev = dev;
-        priv->retry_rts = DEFAULT_RETRY_RTS;
-        priv->retry_data = DEFAULT_RETRY_DATA;
-        priv->RFChangeInProgress = false;
-        priv->SetRFPowerStateInProgress = false;
-        priv->RFProgType = 0;
-        priv->bInactivePs = true; /* false; */
-        priv->ieee80211->bInactivePs = priv->bInactivePs;
-        priv->bSwRfProcessing = false;
-        priv->eRFPowerState = RF_OFF;
-        priv->RfOffReason = 0;
-        priv->led_strategy = SW_LED_MODE0;
-        priv->TxPollingTimes = 0;
-        priv->bLeisurePs = true;
-        priv->dot11PowerSaveMode = ACTIVE;
-        priv->AdMinCheckPeriod = 5;
-        priv->AdMaxCheckPeriod = 10;
-        priv->AdMaxRxSsThreshold = 30;  /* 60->30 */
-        priv->AdRxSsThreshold = 20;     /* 50->20 */
-        priv->AdCheckPeriod = priv->AdMinCheckPeriod;
-        priv->AdTickCount = 0;
-        priv->AdRxSignalStrength = -1;
-        priv->RegSwAntennaDiversityMechanism = 0;
-        priv->RegDefaultAntenna = 0;
-        priv->SignalStrength = 0;
-        priv->AdRxOkCnt = 0;
-        priv->CurrAntennaIndex = 0;
-        priv->AdRxSsBeforeSwitched = 0;
-        init_timer(&priv->SwAntennaDiversityTimer);
-        priv->SwAntennaDiversityTimer.data = (unsigned long)dev;
-        priv->SwAntennaDiversityTimer.function =
-                (void *)SwAntennaDiversityTimerCallback;
-        priv->bDigMechanism = true;
-        priv->InitialGain = 6;
-        priv->bXtalCalibration = false;
-        priv->XtalCal_Xin = 0;
-        priv->XtalCal_Xout = 0;
-        priv->bTxPowerTrack = false;
-        priv->ThermalMeter = 0;
-        priv->FalseAlarmRegValue = 0;
-        priv->RegDigOfdmFaUpTh = 0xc; /* Upper threshold of OFDM false alarm,
-                                        which is used in DIG. */
-        priv->DIG_NumberFallbackVote = 0;
-        priv->DIG_NumberUpgradeVote = 0;
-        priv->LastSignalStrengthInPercent = 0;
-        priv->Stats_SignalStrength = 0;
-        priv->LastRxPktAntenna = 0;
-        priv->SignalQuality = 0; /* in 0-100 index. */
-        priv->Stats_SignalQuality = 0;
-        priv->RecvSignalPower = 0; /* in dBm. */
-        priv->Stats_RecvSignalPower = 0;
-        priv->AdMainAntennaRxOkCnt = 0;
-        priv->AdAuxAntennaRxOkCnt = 0;
-        priv->bHWAdSwitched = false;
-        priv->bRegHighPowerMechanism = true;
-        priv->RegHiPwrUpperTh = 77;
-        priv->RegHiPwrLowerTh = 75;
-        priv->RegRSSIHiPwrUpperTh = 70;
-        priv->RegRSSIHiPwrLowerTh = 20;
-        priv->bCurCCKPkt = false;
-        priv->UndecoratedSmoothedSS = -1;
-        priv->bToUpdateTxPwr = false;
-        priv->CurCCKRSSI = 0;
-        priv->RxPower = 0;
-        priv->RSSI = 0;
-        priv->NumTxOkTotal = 0;
-        priv->NumTxUnicast = 0;
-        priv->keepAliveLevel = DEFAULT_KEEP_ALIVE_LEVEL;
-        priv->CurrRetryCnt = 0;
-        priv->LastRetryCnt = 0;
-        priv->LastTxokCnt = 0;
-        priv->LastRxokCnt = 0;
-        priv->LastRetryRate = 0;
-        priv->bTryuping = 0;
-        priv->CurrTxRate = 0;
-        priv->CurrRetryRate = 0;
-        priv->TryupingCount = 0;
-        priv->TryupingCountNoData = 0;
-        priv->TryDownCountLowData = 0;
-        priv->LastTxOKBytes = 0;
-        priv->LastFailTxRate = 0;
-        priv->LastFailTxRateSS = 0;
-        priv->FailTxRateCount = 0;
-        priv->LastTxThroughput = 0;
-        priv->NumTxOkBytesTotal = 0;
-        priv->ForcedDataRate = 0;
-        priv->RegBModeGainStage = 1;
-        priv->promisc = (dev->flags & IFF_PROMISC) ? 1 : 0;
-        spin_lock_init(&priv->irq_th_lock);
-        spin_lock_init(&priv->tx_lock);
-        spin_lock_init(&priv->ps_lock);
-        spin_lock_init(&priv->rf_ps_lock);
-        sema_init(&priv->wx_sem, 1);
-        INIT_WORK(&priv->reset_wq, (void *)rtl8180_restart_wq);
-        INIT_DELAYED_WORK(&priv->ieee80211->hw_wakeup_wq,
-                          (void *)rtl8180_hw_wakeup_wq);
-        INIT_DELAYED_WORK(&priv->ieee80211->hw_sleep_wq,
-                          (void *)rtl8180_hw_sleep_wq);
-        INIT_WORK(&priv->ieee80211->wmm_param_update_wq,
-                  (void *)rtl8180_wmm_param_update);
-        INIT_DELAYED_WORK(&priv->ieee80211->rate_adapter_wq,
-                          (void *)rtl8180_rate_adapter);
-        INIT_DELAYED_WORK(&priv->ieee80211->hw_dig_wq,
-                         (void *)rtl8180_hw_dig_wq);
-        INIT_DELAYED_WORK(&priv->ieee80211->tx_pw_wq,
-                         (void *)rtl8180_tx_pw_wq);
-        INIT_DELAYED_WORK(&priv->ieee80211->GPIOChangeRFWorkItem,
-                         (void *) GPIOChangeRFWorkItemCallBack);
-        tasklet_init(&priv->irq_rx_tasklet,
-                     (void(*)(unsigned long)) rtl8180_irq_rx_tasklet,
-                     (unsigned long)priv);
-        init_timer(&priv->watch_dog_timer);
-        priv->watch_dog_timer.data = (unsigned long)dev;
-        priv->watch_dog_timer.function = watch_dog_adaptive;
-        init_timer(&priv->rateadapter_timer);
-        priv->rateadapter_timer.data = (unsigned long)dev;
-        priv->rateadapter_timer.function = timer_rate_adaptive;
-        priv->RateAdaptivePeriod = RATE_ADAPTIVE_TIMER_PERIOD;
-        priv->bEnhanceTxPwr = false;
-        priv->ieee80211->softmac_hard_start_xmit = rtl8180_hard_start_xmit;
-        priv->ieee80211->set_chan = rtl8180_set_chan;
-        priv->ieee80211->link_change = rtl8180_link_change;
-        priv->ieee80211->softmac_data_hard_start_xmit = rtl8180_hard_data_xmit;
-        priv->ieee80211->data_hard_stop = rtl8180_data_hard_stop;
-        priv->ieee80211->data_hard_resume = rtl8180_data_hard_resume;
-        priv->ieee80211->init_wmmparam_flag = 0;
-        priv->ieee80211->start_send_beacons = rtl8180_start_tx_beacon;
-        priv->ieee80211->stop_send_beacons = rtl8180_beacon_tx_disable;
-        priv->ieee80211->fts = DEFAULT_FRAG_THRESHOLD;
-        priv->ShortRetryLimit = 7;
-        priv->LongRetryLimit = 7;
-        priv->EarlyRxThreshold = 7;
-        priv->TransmitConfig =  (1<<TCR_DurProcMode_OFFSET) |
-                                (7<<TCR_MXDMA_OFFSET) |
-                                (priv->ShortRetryLimit<<TCR_SRL_OFFSET) |
-                                (priv->LongRetryLimit<<TCR_LRL_OFFSET);
-        priv->ReceiveConfig =   RCR_AMF | RCR_ADF | RCR_ACF |
-                                RCR_AB | RCR_AM | RCR_APM |
-                                (7<<RCR_MXDMA_OFFSET) |
-                                (priv->EarlyRxThreshold<<RCR_FIFO_OFFSET) |
-                                (priv->EarlyRxThreshold == 7 ?
-                                         RCR_ONLYERLPKT : 0);
-        priv->IntrMask          = IMR_TMGDOK | IMR_TBDER |
-                                  IMR_THPDER | IMR_THPDOK |
-                                  IMR_TVODER | IMR_TVODOK |
-                                  IMR_TVIDER | IMR_TVIDOK |
-                                  IMR_TBEDER | IMR_TBEDOK |
-                                  IMR_TBKDER | IMR_TBKDOK |
-                                  IMR_RDU |
-                                  IMR_RER | IMR_ROK |
-                                  IMR_RQoSOK;
-        priv->InitialGain = 6;
-        DMESG("MAC controller is a RTL8187SE b/g");
-        priv->ieee80211->modulation |= IEEE80211_OFDM_MODULATION;
-        priv->ieee80211->short_slot = 1;
-        eeprom_93cx6_read(&eeprom, EEPROM_SW_REVD_OFFSET, &usValue);
-        DMESG("usValue is %#hx\n", usValue);
-        /* 3Read AntennaDiversity */
-        /* SW Antenna Diversity. */
-        priv->EEPROMSwAntennaDiversity = (usValue & EEPROM_SW_AD_MASK) ==
-                EEPROM_SW_AD_ENABLE;
-        /* Default Antenna to use. */
-        priv->EEPROMDefaultAntenna1 = (usValue & EEPROM_DEF_ANT_MASK) ==
-                EEPROM_DEF_ANT_1;
-        if (priv->RegSwAntennaDiversityMechanism == 0) /* Auto */
-                /* 0: default from EEPROM. */
-                priv->bSwAntennaDiverity = priv->EEPROMSwAntennaDiversity;
-        else
-                /* 1:disable antenna diversity, 2: enable antenna diversity. */
-                priv->bSwAntennaDiverity =
-                        priv->RegSwAntennaDiversityMechanism == 2;
-        if (priv->RegDefaultAntenna == 0)
-                /* 0: default from EEPROM. */
-                priv->bDefaultAntenna1 = priv->EEPROMDefaultAntenna1;
-        else
-                /* 1: main, 2: aux. */
-                priv->bDefaultAntenna1 = priv->RegDefaultAntenna == 2;
-        priv->plcp_preamble_mode = 2;
-        /* the eeprom type is stored in RCR register bit #6 */
-        if (RCR_9356SEL & read_nic_dword(dev, RCR))
-                priv->epromtype = EPROM_93c56;
-        else
-                priv->epromtype = EPROM_93c46;
-        eeprom_93cx6_multiread(&eeprom, 0x7, (__le16 *)
-                               dev->dev_addr, 3);
-        for (i = 1, j = 0; i < 14; i += 2, j++) {
-                eeprom_93cx6_read(&eeprom, EPROM_TXPW_CH1_2 + j, &word);
-                priv->chtxpwr[i] = word & 0xff;
-                priv->chtxpwr[i+1] = (word & 0xff00)>>8;
-        }
-        for (i = 1, j = 0; i < 14; i += 2, j++) {
-                eeprom_93cx6_read(&eeprom, EPROM_TXPW_OFDM_CH1_2 + j, &word);
-                priv->chtxpwr_ofdm[i] = word & 0xff;
-                priv->chtxpwr_ofdm[i+1] = (word & 0xff00) >> 8;
-        }
-        /* 3Read crystal calibration and thermal meter indication on 87SE. */
-        eeprom_93cx6_read(&eeprom, EEPROM_RSV>>1, &tmpu16);
-        /* Crystal calibration for Xin and Xout resp. */
-        priv->XtalCal_Xout = tmpu16 & EEPROM_XTAL_CAL_XOUT_MASK;
-        priv->XtalCal_Xin = (tmpu16 & EEPROM_XTAL_CAL_XIN_MASK) >> 4;
-        if ((tmpu16 & EEPROM_XTAL_CAL_ENABLE) >> 12)
-                priv->bXtalCalibration = true;
-        /* Thermal meter reference indication. */
-        priv->ThermalMeter =  (u8)((tmpu16 & EEPROM_THERMAL_METER_MASK) >> 8);
-        if ((tmpu16 & EEPROM_THERMAL_METER_ENABLE) >> 13)
-                priv->bTxPowerTrack = true;
-        priv->rf_sleep = rtl8225z4_rf_sleep;
-        priv->rf_wakeup = rtl8225z4_rf_wakeup;
-        DMESGW("**PLEASE** REPORT SUCCESSFUL/UNSUCCESSFUL TO Realtek!");
-        priv->rf_close = rtl8225z2_rf_close;
-        priv->rf_init = rtl8225z2_rf_init;
-        priv->rf_set_chan = rtl8225z2_rf_set_chan;
-        priv->rf_set_sens = NULL;
-        if (0 != alloc_rx_desc_ring(dev, priv->rxbuffersize, priv->rxringcount))
-                return -ENOMEM;
-        if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
-                                  TX_MANAGEPRIORITY_RING_ADDR))
-                return -ENOMEM;
-        if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
-                                 TX_BKPRIORITY_RING_ADDR))
-                return -ENOMEM;
-        if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
-                                 TX_BEPRIORITY_RING_ADDR))
-                return -ENOMEM;
-        if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
-                                  TX_VIPRIORITY_RING_ADDR))
-                return -ENOMEM;
-        if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
-                                  TX_VOPRIORITY_RING_ADDR))
-                return -ENOMEM;
-        if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txringcount,
-                                  TX_HIGHPRIORITY_RING_ADDR))
-                return -ENOMEM;
-        if (0 != alloc_tx_desc_ring(dev, priv->txbuffsize, priv->txbeaconcount,
-                                  TX_BEACON_RING_ADDR))
-                return -ENOMEM;
-        if (request_irq(dev->irq, rtl8180_interrupt,
-                IRQF_SHARED, dev->name, dev)) {
-                DMESGE("Error allocating IRQ %d", dev->irq);
-                return -1;
-        } else {
-                priv->irq = dev->irq;
-                DMESG("IRQ %d", dev->irq);
-        }
-        return 0;
-}
-void rtl8180_no_hw_wep(struct net_device *dev)
-{
-}
-void rtl8180_set_hw_wep(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8 pgreg;
-        u8 security;
-        u32 key0_word4;
-        pgreg = read_nic_byte(dev, PGSELECT);
-        write_nic_byte(dev, PGSELECT, pgreg & ~(1<<PGSELECT_PG_SHIFT));
-        key0_word4 = read_nic_dword(dev, KEY0+4+4+4);
-        key0_word4 &= ~0xff;
-        key0_word4 |= priv->key0[3] & 0xff;
-        write_nic_dword(dev, KEY0, (priv->key0[0]));
-        write_nic_dword(dev, KEY0+4, (priv->key0[1]));
-        write_nic_dword(dev, KEY0+4+4, (priv->key0[2]));
-        write_nic_dword(dev, KEY0+4+4+4, (key0_word4));
-        security  = read_nic_byte(dev, SECURITY);
-        security |= (1<<SECURITY_WEP_TX_ENABLE_SHIFT);
-        security |= (1<<SECURITY_WEP_RX_ENABLE_SHIFT);
-        security &= ~SECURITY_ENCRYP_MASK;
-        security |= (SECURITY_ENCRYP_104<<SECURITY_ENCRYP_SHIFT);
-        write_nic_byte(dev, SECURITY, security);
-        DMESG("key %x %x %x %x", read_nic_dword(dev, KEY0+4+4+4),
-              read_nic_dword(dev, KEY0+4+4), read_nic_dword(dev, KEY0+4),
-              read_nic_dword(dev, KEY0));
-}
-void rtl8185_rf_pins_enable(struct net_device *dev)
-{
-        write_nic_word(dev, RFPinsEnable, 0x1fff); /* | tmp); */
-}
-void rtl8185_set_anaparam2(struct net_device *dev, u32 a)
-{
-        u8 conf3;
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        conf3 = read_nic_byte(dev, CONFIG3);
-        write_nic_byte(dev, CONFIG3, conf3 | (1<<CONFIG3_ANAPARAM_W_SHIFT));
-        write_nic_dword(dev, ANAPARAM2, a);
-        conf3 = read_nic_byte(dev, CONFIG3);
-        write_nic_byte(dev, CONFIG3, conf3 & ~(1<<CONFIG3_ANAPARAM_W_SHIFT));
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-}
-void rtl8180_set_anaparam(struct net_device *dev, u32 a)
-{
-        u8 conf3;
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        conf3 = read_nic_byte(dev, CONFIG3);
-        write_nic_byte(dev, CONFIG3, conf3 | (1<<CONFIG3_ANAPARAM_W_SHIFT));
-        write_nic_dword(dev, ANAPARAM, a);
-        conf3 = read_nic_byte(dev, CONFIG3);
-        write_nic_byte(dev, CONFIG3, conf3 & ~(1<<CONFIG3_ANAPARAM_W_SHIFT));
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-}
-void rtl8185_tx_antenna(struct net_device *dev, u8 ant)
-{
-        write_nic_byte(dev, TX_ANTENNA, ant);
-        force_pci_posting(dev);
-        mdelay(1);
-}
-static void rtl8185_write_phy(struct net_device *dev, u8 adr, u32 data)
-{
-        u32 phyw;
-        adr |= 0x80;
-        phyw = ((data<<8) | adr);
-        /* Note: we must write 0xff7c after 0x7d-0x7f to write BB register. */
-        write_nic_byte(dev, 0x7f, ((phyw & 0xff000000) >> 24));
-        write_nic_byte(dev, 0x7e, ((phyw & 0x00ff0000) >> 16));
-        write_nic_byte(dev, 0x7d, ((phyw & 0x0000ff00) >> 8));
-        write_nic_byte(dev, 0x7c, ((phyw & 0x000000ff)));
-}
-inline void write_phy_ofdm(struct net_device *dev, u8 adr, u32 data)
-{
-        data = data & 0xff;
-        rtl8185_write_phy(dev, adr, data);
-}
-void write_phy_cck(struct net_device *dev, u8 adr, u32 data)
-{
-        data = data & 0xff;
-        rtl8185_write_phy(dev, adr, data | 0x10000);
-}
-/*
- * This configures registers for beacon tx and enables it via
- * rtl8180_beacon_tx_enable(). rtl8180_beacon_tx_disable() might
- * be used to stop beacon transmission
- */
-void rtl8180_start_tx_beacon(struct net_device *dev)
-{
-        u16 word;
-        DMESG("Enabling beacon TX");
-        rtl8180_prepare_beacon(dev);
-        rtl8180_irq_disable(dev);
-        rtl8180_beacon_tx_enable(dev);
-        word = read_nic_word(dev, AtimWnd) & ~AtimWnd_AtimWnd;
-        write_nic_word(dev, AtimWnd, word); /* word |= */
-        word  = read_nic_word(dev, BintrItv);
-        word &= ~BintrItv_BintrItv;
-        word |= 1000; /* priv->ieee80211->current_network.beacon_interval *
-                       * ((priv->txbeaconcount > 1)?(priv->txbeaconcount-1):1);
-                       * FIXME: check if correct ^^ worked with 0x3e8;
-                       */
-        write_nic_word(dev, BintrItv, word);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-        rtl8185b_irq_enable(dev);
-}
-static struct net_device_stats *rtl8180_stats(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        return &priv->ieee80211->stats;
-}
-/*
- * Change current and default preamble mode.
- */
-static bool MgntActSet_802_11_PowerSaveMode(struct r8180_priv *priv,
-                                     enum rt_ps_mode rtPsMode)
-{
-        /* Currently, we do not change power save mode on IBSS mode. */
-        if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
-                return false;
-        priv->ieee80211->ps = rtPsMode;
-        return true;
-}
-static void LeisurePSEnter(struct r8180_priv *priv)
-{
-        if (priv->bLeisurePs)
-                if (priv->ieee80211->ps == IEEE80211_PS_DISABLED)
-                        /* IEEE80211_PS_ENABLE */
-                        MgntActSet_802_11_PowerSaveMode(priv,
-                                IEEE80211_PS_MBCAST | IEEE80211_PS_UNICAST);
-}
-static void LeisurePSLeave(struct r8180_priv *priv)
-{
-        if (priv->bLeisurePs)
-                if (priv->ieee80211->ps != IEEE80211_PS_DISABLED)
-                        MgntActSet_802_11_PowerSaveMode(
-                                priv, IEEE80211_PS_DISABLED);
-}
-void rtl8180_hw_wakeup_wq(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(
-                dwork, struct ieee80211_device, hw_wakeup_wq);
-        struct net_device *dev = ieee->dev;
-        rtl8180_hw_wakeup(dev);
-}
-void rtl8180_hw_sleep_wq(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(
-                dwork, struct ieee80211_device, hw_sleep_wq);
-        struct net_device *dev = ieee->dev;
-        rtl8180_hw_sleep_down(dev);
-}
-static void MgntLinkKeepAlive(struct r8180_priv *priv)
-{
-        if (priv->keepAliveLevel == 0)
-                return;
-        if (priv->ieee80211->state == IEEE80211_LINKED) {
-                /*
-                 * Keep-Alive.
-                 */
-                if ((priv->keepAliveLevel == 2) ||
-                        (priv->link_detect.last_num_tx_unicast ==
-                                priv->NumTxUnicast &&
-                        priv->link_detect.last_num_rx_unicast ==
-                                priv->ieee80211->NumRxUnicast)
-                        ) {
-                        priv->link_detect.idle_count++;
-                        /*
-                         * Send a Keep-Alive packet packet to AP if we had
-                         * been idle for a while.
-                         */
-                        if (priv->link_detect.idle_count >=
-                                KEEP_ALIVE_INTERVAL /
-                                CHECK_FOR_HANG_PERIOD - 1) {
-                                priv->link_detect.idle_count = 0;
-                                ieee80211_sta_ps_send_null_frame(
-                                        priv->ieee80211, false);
-                        }
-                } else {
-                        priv->link_detect.idle_count = 0;
-                }
-                priv->link_detect.last_num_tx_unicast = priv->NumTxUnicast;
-                priv->link_detect.last_num_rx_unicast =
-                        priv->ieee80211->NumRxUnicast;
-        }
-}
-void rtl8180_watch_dog(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        bool bEnterPS = false;
-        bool bBusyTraffic = false;
-        u32 TotalRxNum = 0;
-        u16 SlotIndex = 0;
-        u16 i = 0;
-        if (priv->ieee80211->actscanning == false) {
-                if ((priv->ieee80211->iw_mode != IW_MODE_ADHOC) &&
-                    (priv->ieee80211->state == IEEE80211_NOLINK) &&
-                    (priv->ieee80211->beinretry == false) &&
-                    (priv->eRFPowerState == RF_ON))
-                        IPSEnter(dev);
-        }
-        if ((priv->ieee80211->state == IEEE80211_LINKED) &&
-                (priv->ieee80211->iw_mode == IW_MODE_INFRA)) {
-                SlotIndex = (priv->link_detect.slot_index++) %
-                        priv->link_detect.slot_num;
-                priv->link_detect.rx_frame_num[SlotIndex] =
-                        priv->ieee80211->NumRxDataInPeriod +
-                        priv->ieee80211->NumRxBcnInPeriod;
-                for (i = 0; i < priv->link_detect.slot_num; i++)
-                        TotalRxNum += priv->link_detect.rx_frame_num[i];
-                if (TotalRxNum == 0) {
-                        priv->ieee80211->state = IEEE80211_ASSOCIATING;
-                        queue_work(priv->ieee80211->wq,
-                                &priv->ieee80211->associate_procedure_wq);
-                }
-        }
-        MgntLinkKeepAlive(priv);
-        LeisurePSLeave(priv);
-        if (priv->ieee80211->state == IEEE80211_LINKED) {
-                priv->link_detect.num_rx_ok_in_period =
-                        priv->ieee80211->NumRxDataInPeriod;
-                if (priv->link_detect.num_rx_ok_in_period > 666 ||
-                        priv->link_detect.num_tx_ok_in_period > 666) {
-                        bBusyTraffic = true;
-                }
-                if ((priv->link_detect.num_rx_ok_in_period +
-                        priv->link_detect.num_tx_ok_in_period > 8)
-                        || (priv->link_detect.num_rx_ok_in_period > 2)) {
-                        bEnterPS = false;
-                } else
-                        bEnterPS = true;
-                if (bEnterPS)
-                        LeisurePSEnter(priv);
-                else
-                        LeisurePSLeave(priv);
-        } else
-                LeisurePSLeave(priv);
-        priv->link_detect.b_busy_traffic = bBusyTraffic;
-        priv->link_detect.num_rx_ok_in_period = 0;
-        priv->link_detect.num_tx_ok_in_period = 0;
-        priv->ieee80211->NumRxDataInPeriod = 0;
-        priv->ieee80211->NumRxBcnInPeriod = 0;
-}
-static int _rtl8180_up(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        priv->up = 1;
-        DMESG("Bringing up iface");
-        rtl8185b_adapter_start(dev);
-        rtl8185b_rx_enable(dev);
-        rtl8185b_tx_enable(dev);
-        if (priv->bInactivePs) {
-                if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
-                        IPSLeave(dev);
-        }
-        timer_rate_adaptive((unsigned long)dev);
-        watch_dog_adaptive((unsigned long)dev);
-        if (priv->bSwAntennaDiverity)
-                        SwAntennaDiversityTimerCallback(dev);
-        ieee80211_softmac_start_protocol(priv->ieee80211);
-        return 0;
-}
-static int rtl8180_open(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret;
-        down(&priv->wx_sem);
-        ret = rtl8180_up(dev);
-        up(&priv->wx_sem);
-        return ret;
-}
-int rtl8180_up(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->up == 1)
-                return -1;
-        return _rtl8180_up(dev);
-}
-static int rtl8180_close(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret;
-        down(&priv->wx_sem);
-        ret = rtl8180_down(dev);
-        up(&priv->wx_sem);
-        return ret;
-}
-int rtl8180_down(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->up == 0)
-                return -1;
-        priv->up = 0;
-        ieee80211_softmac_stop_protocol(priv->ieee80211);
-        /* FIXME */
-        if (!netif_queue_stopped(dev))
-                netif_stop_queue(dev);
-        rtl8180_rtx_disable(dev);
-        rtl8180_irq_disable(dev);
-        del_timer_sync(&priv->watch_dog_timer);
-        del_timer_sync(&priv->rateadapter_timer);
-        cancel_delayed_work(&priv->ieee80211->rate_adapter_wq);
-        cancel_delayed_work(&priv->ieee80211->hw_wakeup_wq);
-        cancel_delayed_work(&priv->ieee80211->hw_sleep_wq);
-        cancel_delayed_work(&priv->ieee80211->hw_dig_wq);
-        cancel_delayed_work(&priv->ieee80211->tx_pw_wq);
-        del_timer_sync(&priv->SwAntennaDiversityTimer);
-        SetZebraRFPowerState8185(dev, RF_OFF);
-        memset(&priv->ieee80211->current_network,
-                0, sizeof(struct ieee80211_network));
-        priv->ieee80211->state = IEEE80211_NOLINK;
-        return 0;
-}
-void rtl8180_restart_wq(struct work_struct *work)
-{
-        struct r8180_priv *priv = container_of(
-                work, struct r8180_priv, reset_wq);
-        struct net_device *dev = priv->dev;
-        down(&priv->wx_sem);
-        rtl8180_commit(dev);
-        up(&priv->wx_sem);
-}
-static void rtl8180_restart(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        schedule_work(&priv->reset_wq);
-}
-void rtl8180_commit(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->up == 0)
-                return;
-        del_timer_sync(&priv->watch_dog_timer);
-        del_timer_sync(&priv->rateadapter_timer);
-        cancel_delayed_work(&priv->ieee80211->rate_adapter_wq);
-        cancel_delayed_work(&priv->ieee80211->hw_wakeup_wq);
-        cancel_delayed_work(&priv->ieee80211->hw_sleep_wq);
-        cancel_delayed_work(&priv->ieee80211->hw_dig_wq);
-        cancel_delayed_work(&priv->ieee80211->tx_pw_wq);
-        del_timer_sync(&priv->SwAntennaDiversityTimer);
-        ieee80211_softmac_stop_protocol(priv->ieee80211);
-        rtl8180_irq_disable(dev);
-        rtl8180_rtx_disable(dev);
-        _rtl8180_up(dev);
-}
-static void r8180_set_multicast(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        short promisc;
-        promisc = (dev->flags & IFF_PROMISC) ? 1 : 0;
-        if (promisc != priv->promisc)
-                rtl8180_restart(dev);
-        priv->promisc = promisc;
-}
-static int r8180_set_mac_adr(struct net_device *dev, void *mac)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct sockaddr *addr = mac;
-        down(&priv->wx_sem);
-        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
-        if (priv->ieee80211->iw_mode == IW_MODE_MASTER)
-                memcpy(priv->ieee80211->current_network.bssid,
-                        dev->dev_addr, ETH_ALEN);
-        if (priv->up) {
-                rtl8180_down(dev);
-                rtl8180_up(dev);
-        }
-        up(&priv->wx_sem);
-        return 0;
-}
-/* based on ipw2200 driver */
-static int rtl8180_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct iwreq *wrq = (struct iwreq *) rq;
-        int ret = -1;
-        switch (cmd) {
-        case RTL_IOCTL_WPA_SUPPLICANT:
-                ret = ieee80211_wpa_supplicant_ioctl(
-                        priv->ieee80211, &wrq->u.data);
-                return ret;
-        default:
-                return -EOPNOTSUPP;
-        }
-        return -EOPNOTSUPP;
-}
-static const struct net_device_ops rtl8180_netdev_ops = {
-        .ndo_open               = rtl8180_open,
-        .ndo_stop               = rtl8180_close,
-        .ndo_get_stats          = rtl8180_stats,
-        .ndo_tx_timeout         = rtl8180_restart,
-        .ndo_do_ioctl           = rtl8180_ioctl,
-        .ndo_set_rx_mode        = r8180_set_multicast,
-        .ndo_set_mac_address    = r8180_set_mac_adr,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_start_xmit         = ieee80211_rtl_xmit,
-};
-static int rtl8180_pci_probe(struct pci_dev *pdev,
-                             const struct pci_device_id *id)
-{
-        unsigned long ioaddr = 0;
-        struct net_device *dev = NULL;
-        struct r8180_priv *priv = NULL;
-        u8 unit = 0;
-        int ret = -ENODEV;
-        unsigned long pmem_start, pmem_len, pmem_flags;
-        DMESG("Configuring chip resources");
-        if (pci_enable_device(pdev)) {
-                DMESG("Failed to enable PCI device");
-                return -EIO;
-        }
-        pci_set_master(pdev);
-        pci_set_dma_mask(pdev, 0xffffff00ULL);
-        pci_set_consistent_dma_mask(pdev, 0xffffff00ULL);
-        dev = alloc_ieee80211(sizeof(struct r8180_priv));
-        if (!dev) {
-                ret = -ENOMEM;
-                goto fail_free;
-        }
-        priv = ieee80211_priv(dev);
-        priv->ieee80211 = netdev_priv(dev);
-        pci_set_drvdata(pdev, dev);
-        SET_NETDEV_DEV(dev, &pdev->dev);
-        priv = ieee80211_priv(dev);
-        priv->pdev = pdev;
-        pmem_start = pci_resource_start(pdev, 1);
-        pmem_len = pci_resource_len(pdev, 1);
-        pmem_flags = pci_resource_flags(pdev, 1);
-        if (!(pmem_flags & IORESOURCE_MEM)) {
-                DMESG("region #1 not a MMIO resource, aborting");
-                goto fail;
-        }
-        if (!request_mem_region(pmem_start, pmem_len, RTL8180_MODULE_NAME)) {
-                DMESG("request_mem_region failed!");
-                goto fail;
-        }
-        ioaddr = (unsigned long)ioremap_nocache(pmem_start, pmem_len);
-        if (ioaddr == (unsigned long)NULL) {
-                DMESG("ioremap failed!");
-                goto fail1;
-        }
-        dev->mem_start = ioaddr; /* shared mem start */
-        dev->mem_end = ioaddr + pci_resource_len(pdev, 0); /* shared mem end */
-        pci_read_config_byte(pdev, 0x05, &unit);
-        pci_write_config_byte(pdev, 0x05, unit & (~0x04));
-        dev->irq = pdev->irq;
-        priv->irq = 0;
-        dev->netdev_ops = &rtl8180_netdev_ops;
-        dev->wireless_handlers = &r8180_wx_handlers_def;
-        dev->type = ARPHRD_ETHER;
-        dev->watchdog_timeo = HZ*3;
-        if (dev_alloc_name(dev, ifname) < 0) {
-                DMESG("Oops: devname already taken! Trying wlan%%d...\n");
-                strcpy(ifname, "wlan%d");
-                dev_alloc_name(dev, ifname);
-        }
-        if (rtl8180_init(dev) != 0) {
-                DMESG("Initialization failed");
-                goto fail1;
-        }
-        netif_carrier_off(dev);
-        if (register_netdev(dev))
-                goto fail1;
-        rtl8180_proc_init_one(dev);
-        DMESG("Driver probe completed\n");
-        return 0;
-fail1:
-        if (dev->mem_start != (unsigned long)NULL) {
-                iounmap((void __iomem *)dev->mem_start);
-                release_mem_region(pci_resource_start(pdev, 1),
-                                   pci_resource_len(pdev, 1));
-        }
-fail:
-        if (dev) {
-                if (priv->irq) {
-                        free_irq(dev->irq, dev);
-                        dev->irq = 0;
-                }
-                free_ieee80211(dev);
-        }
-fail_free:
-        pci_disable_device(pdev);
-        DMESG("wlan driver load failed\n");
-        return ret;
-}
-static void rtl8180_pci_remove(struct pci_dev *pdev)
-{
-        struct r8180_priv *priv;
-        struct net_device *dev = pci_get_drvdata(pdev);
-        if (dev) {
-                unregister_netdev(dev);
-                priv = ieee80211_priv(dev);
-                rtl8180_proc_remove_one(dev);
-                rtl8180_down(dev);
-                priv->rf_close(dev);
-                rtl8180_reset(dev);
-                mdelay(10);
-                if (priv->irq) {
-                        DMESG("Freeing irq %d", dev->irq);
-                        free_irq(dev->irq, dev);
-                        priv->irq = 0;
-                }
-                free_rx_desc_ring(dev);
-                free_tx_desc_rings(dev);
-                if (dev->mem_start != (unsigned long)NULL) {
-                        iounmap((void __iomem *)dev->mem_start);
-                        release_mem_region(pci_resource_start(pdev, 1),
-                                           pci_resource_len(pdev, 1));
-                }
-                free_ieee80211(dev);
-        }
-        pci_disable_device(pdev);
-        DMESG("wlan driver removed\n");
-}
-static int __init rtl8180_pci_module_init(void)
-{
-        int ret;
-        ret = ieee80211_crypto_init();
-        if (ret) {
-                pr_err("ieee80211_crypto_init() failed %d\n", ret);
-                return ret;
-        }
-        ret = ieee80211_crypto_tkip_init();
-        if (ret) {
-                pr_err("ieee80211_crypto_tkip_init() failed %d\n", ret);
-                return ret;
-        }
-        ret = ieee80211_crypto_ccmp_init();
-        if (ret) {
-                pr_err("ieee80211_crypto_ccmp_init() failed %d\n", ret);
-                return ret;
-        }
-        ret = ieee80211_crypto_wep_init();
-        if (ret) {
-                pr_err("ieee80211_crypto_wep_init() failed %d\n", ret);
-                return ret;
-        }
-        pr_info("\nLinux kernel driver for RTL8180 / RTL8185 based WLAN cards\n");
-        pr_info("Copyright (c) 2004-2005, Andrea Merello\n");
-        DMESG("Initializing module");
-        DMESG("Wireless extensions version %d", WIRELESS_EXT);
-        rtl8180_proc_module_init();
-        if (pci_register_driver(&rtl8180_pci_driver)) {
-                DMESG("No device found");
-                return -ENODEV;
-        }
-        return 0;
-}
-static void __exit rtl8180_pci_module_exit(void)
-{
-        pci_unregister_driver(&rtl8180_pci_driver);
-        rtl8180_proc_module_remove();
-        ieee80211_crypto_tkip_exit();
-        ieee80211_crypto_ccmp_exit();
-        ieee80211_crypto_wep_exit();
-        ieee80211_crypto_deinit();
-        DMESG("Exiting");
-}
-static void rtl8180_try_wake_queue(struct net_device *dev, int pri)
-{
-        unsigned long flags;
-        short enough_desc;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        spin_lock_irqsave(&priv->tx_lock, flags);
-        enough_desc = check_nic_enought_desc(dev, pri);
-        spin_unlock_irqrestore(&priv->tx_lock, flags);
-        if (enough_desc)
-                ieee80211_rtl_wake_queue(priv->ieee80211);
-}
-static void rtl8180_tx_isr(struct net_device *dev, int pri, short error)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        u32 *tail; /* tail virtual addr */
-        u32 *head; /* head virtual addr */
-        u32 *begin; /* start of ring virtual addr */
-        u32 *nicv; /* nic pointer virtual addr */
-        u32 nic; /* nic pointer physical addr */
-        u32 nicbegin; /* start of ring physical addr */
-        unsigned long flag;
-        /* physical addr are ok on 32 bits since we set DMA mask */
-        int offs;
-        int j, i;
-        int hd;
-        if (error)
-                priv->stats.txretry++;
-        spin_lock_irqsave(&priv->tx_lock, flag);
-        switch (pri) {
-        case MANAGE_PRIORITY:
-                tail = priv->txmapringtail;
-                begin = priv->txmapring;
-                head = priv->txmapringhead;
-                nic = read_nic_dword(dev, TX_MANAGEPRIORITY_RING_ADDR);
-                nicbegin = priv->txmapringdma;
-                break;
-        case BK_PRIORITY:
-                tail = priv->txbkpringtail;
-                begin = priv->txbkpring;
-                head = priv->txbkpringhead;
-                nic = read_nic_dword(dev, TX_BKPRIORITY_RING_ADDR);
-                nicbegin = priv->txbkpringdma;
-                break;
-        case BE_PRIORITY:
-                tail = priv->txbepringtail;
-                begin = priv->txbepring;
-                head = priv->txbepringhead;
-                nic = read_nic_dword(dev, TX_BEPRIORITY_RING_ADDR);
-                nicbegin = priv->txbepringdma;
-                break;
-        case VI_PRIORITY:
-                tail = priv->txvipringtail;
-                begin = priv->txvipring;
-                head = priv->txvipringhead;
-                nic = read_nic_dword(dev, TX_VIPRIORITY_RING_ADDR);
-                nicbegin = priv->txvipringdma;
-                break;
-        case VO_PRIORITY:
-                tail = priv->txvopringtail;
-                begin = priv->txvopring;
-                head = priv->txvopringhead;
-                nic = read_nic_dword(dev, TX_VOPRIORITY_RING_ADDR);
-                nicbegin = priv->txvopringdma;
-                break;
-        case HI_PRIORITY:
-                tail = priv->txhpringtail;
-                begin = priv->txhpring;
-                head = priv->txhpringhead;
-                nic = read_nic_dword(dev, TX_HIGHPRIORITY_RING_ADDR);
-                nicbegin = priv->txhpringdma;
-                break;
-        default:
-                spin_unlock_irqrestore(&priv->tx_lock, flag);
-                return;
-        }
-        nicv = (u32 *)((nic - nicbegin) + (u8 *)begin);
-        if ((head <= tail && (nicv > tail || nicv < head)) ||
-                (head > tail && (nicv > tail && nicv < head))) {
-                        DMESGW("nic has lost pointer");
-                        spin_unlock_irqrestore(&priv->tx_lock, flag);
-                        rtl8180_restart(dev);
-                        return;
-                }
-        /*
-         * We check all the descriptors between the head and the nic,
-         * but not the currently pointed by the nic (the next to be txed)
-         * and the previous of the pointed (might be in process ??)
-         */
-        offs = (nic - nicbegin);
-        offs = offs / 8 / 4;
-        hd = (head - begin) / 8;
-        if (offs >= hd)
-                j = offs - hd;
-        else
-                j = offs + (priv->txringcount-1-hd);
-        j -= 2;
-        if (j < 0)
-                j = 0;
-        for (i = 0; i < j; i++) {
-                if ((*head) & (1<<31))
-                        break;
-                if (((*head)&(0x10000000)) != 0) {
-                        priv->CurrRetryCnt += (u16)((*head) & (0x000000ff));
-                        if (!error)
-                                priv->NumTxOkTotal++;
-                }
-                if (!error)
-                        priv->NumTxOkBytesTotal += (*(head+3)) & (0x00000fff);
-                *head = *head & ~(1<<31);
-                if ((head - begin)/8 == priv->txringcount-1)
-                        head = begin;
-                else
-                        head += 8;
-        }
-        /*
-         * The head has been moved to the last certainly TXed
-         * (or at least processed by the nic) packet.
-         * The driver take forcefully owning of all these packets
-         * If the packet previous of the nic pointer has been
-         * processed this doesn't matter: it will be checked
-         * here at the next round. Anyway if no more packet are
-         * TXed no memory leak occur at all.
-         */
-        switch (pri) {
-        case MANAGE_PRIORITY:
-                priv->txmapringhead = head;
-                if (priv->ack_tx_to_ieee) {
-                        if (rtl8180_is_tx_queue_empty(dev)) {
-                                priv->ack_tx_to_ieee = 0;
-                                ieee80211_ps_tx_ack(priv->ieee80211, !error);
-                        }
-                }
-                break;
-        case BK_PRIORITY:
-                priv->txbkpringhead = head;
-                break;
-        case BE_PRIORITY:
-                priv->txbepringhead = head;
-                break;
-        case VI_PRIORITY:
-                priv->txvipringhead = head;
-                break;
-        case VO_PRIORITY:
-                priv->txvopringhead = head;
-                break;
-        case HI_PRIORITY:
-                priv->txhpringhead = head;
-                break;
-        }
-        spin_unlock_irqrestore(&priv->tx_lock, flag);
-}
-static irqreturn_t rtl8180_interrupt(int irq, void *netdev)
-{
-        struct net_device *dev = (struct net_device *) netdev;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        unsigned long flags;
-        u32 inta;
-        /* We should return IRQ_NONE, but for now let me keep this */
-        if (priv->irq_enabled == 0)
-                return IRQ_HANDLED;
-        spin_lock_irqsave(&priv->irq_th_lock, flags);
-        /* ISR: 4bytes */
-        inta = read_nic_dword(dev, ISR);
-        write_nic_dword(dev, ISR, inta); /* reset int situation */
-        priv->stats.shints++;
-        if (!inta) {
-                spin_unlock_irqrestore(&priv->irq_th_lock, flags);
-                return IRQ_HANDLED;
-        /*
-         * most probably we can safely return IRQ_NONE,
-         * but for now is better to avoid problems
-         */
-        }
-        if (inta == 0xffff) {
-                /* HW disappeared */
-                spin_unlock_irqrestore(&priv->irq_th_lock, flags);
-                return IRQ_HANDLED;
-        }
-        priv->stats.ints++;
-        if (!netif_running(dev)) {
-                spin_unlock_irqrestore(&priv->irq_th_lock, flags);
-                return IRQ_HANDLED;
-        }
-        if (inta & ISR_TimeOut)
-                write_nic_dword(dev, TimerInt, 0);
-        if (inta & ISR_TBDOK)
-                priv->stats.txbeacon++;
-        if (inta & ISR_TBDER)
-                priv->stats.txbeaconerr++;
-        if (inta & IMR_TMGDOK)
-                rtl8180_tx_isr(dev, MANAGE_PRIORITY, 0);
-        if (inta & ISR_THPDER) {
-                priv->stats.txhperr++;
-                rtl8180_tx_isr(dev, HI_PRIORITY, 1);
-                priv->ieee80211->stats.tx_errors++;
-        }
-        if (inta & ISR_THPDOK) { /* High priority tx ok */
-                priv->link_detect.num_tx_ok_in_period++;
-                priv->stats.txhpokint++;
-                rtl8180_tx_isr(dev, HI_PRIORITY, 0);
-        }
-        if (inta & ISR_RER)
-                priv->stats.rxerr++;
-        if (inta & ISR_TBKDER) { /* corresponding to BK_PRIORITY */
-                priv->stats.txbkperr++;
-                priv->ieee80211->stats.tx_errors++;
-                rtl8180_tx_isr(dev, BK_PRIORITY, 1);
-                rtl8180_try_wake_queue(dev, BK_PRIORITY);
-        }
-        if (inta & ISR_TBEDER) { /* corresponding to BE_PRIORITY */
-                priv->stats.txbeperr++;
-                priv->ieee80211->stats.tx_errors++;
-                rtl8180_tx_isr(dev, BE_PRIORITY, 1);
-                rtl8180_try_wake_queue(dev, BE_PRIORITY);
-        }
-        if (inta & ISR_TNPDER) { /* corresponding to VO_PRIORITY */
-                priv->stats.txnperr++;
-                priv->ieee80211->stats.tx_errors++;
-                rtl8180_tx_isr(dev, NORM_PRIORITY, 1);
-                rtl8180_try_wake_queue(dev, NORM_PRIORITY);
-        }
-        if (inta & ISR_TLPDER) { /* corresponding to VI_PRIORITY */
-                priv->stats.txlperr++;
-                priv->ieee80211->stats.tx_errors++;
-                rtl8180_tx_isr(dev, LOW_PRIORITY, 1);
-                rtl8180_try_wake_queue(dev, LOW_PRIORITY);
-        }
-        if (inta & ISR_ROK) {
-                priv->stats.rxint++;
-                tasklet_schedule(&priv->irq_rx_tasklet);
-        }
-        if (inta & ISR_RQoSOK) {
-                priv->stats.rxint++;
-                tasklet_schedule(&priv->irq_rx_tasklet);
-        }
-        if (inta & ISR_BcnInt)
-                rtl8180_prepare_beacon(dev);
-        if (inta & ISR_RDU) {
-                DMESGW("No RX descriptor available");
-                priv->stats.rxrdu++;
-                tasklet_schedule(&priv->irq_rx_tasklet);
-        }
-        if (inta & ISR_RXFOVW) {
-                priv->stats.rxoverflow++;
-                tasklet_schedule(&priv->irq_rx_tasklet);
-        }
-        if (inta & ISR_TXFOVW)
-                priv->stats.txoverflow++;
-        if (inta & ISR_TNPDOK) { /* Normal priority tx ok */
-                priv->link_detect.num_tx_ok_in_period++;
-                priv->stats.txnpokint++;
-                rtl8180_tx_isr(dev, NORM_PRIORITY, 0);
-                rtl8180_try_wake_queue(dev, NORM_PRIORITY);
-        }
-        if (inta & ISR_TLPDOK) { /* Low priority tx ok */
-                priv->link_detect.num_tx_ok_in_period++;
-                priv->stats.txlpokint++;
-                rtl8180_tx_isr(dev, LOW_PRIORITY, 0);
-                rtl8180_try_wake_queue(dev, LOW_PRIORITY);
-        }
-        if (inta & ISR_TBKDOK) { /* corresponding to BK_PRIORITY */
-                priv->stats.txbkpokint++;
-                priv->link_detect.num_tx_ok_in_period++;
-                rtl8180_tx_isr(dev, BK_PRIORITY, 0);
-                rtl8180_try_wake_queue(dev, BE_PRIORITY);
-        }
-        if (inta & ISR_TBEDOK) { /* corresponding to BE_PRIORITY */
-                priv->stats.txbeperr++;
-                priv->link_detect.num_tx_ok_in_period++;
-                rtl8180_tx_isr(dev, BE_PRIORITY, 0);
-                rtl8180_try_wake_queue(dev, BE_PRIORITY);
-        }
-        force_pci_posting(dev);
-        spin_unlock_irqrestore(&priv->irq_th_lock, flags);
-        return IRQ_HANDLED;
-}
-void rtl8180_irq_rx_tasklet(struct r8180_priv *priv)
-{
-        rtl8180_rx(priv->dev);
-}
-void GPIOChangeRFWorkItemCallBack(struct work_struct *work)
-{
-        struct ieee80211_device *ieee = container_of(
-                work, struct ieee80211_device, GPIOChangeRFWorkItem.work);
-        struct net_device *dev = ieee->dev;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8 btPSR;
-        u8 btConfig0;
-        enum rt_rf_power_state eRfPowerStateToSet;
-        bool bActuallySet = false;
-        char *argv[3];
-        static char *RadioPowerPath = "/etc/acpi/events/RadioPower.sh";
-        static char *envp[] = {"HOME=/", "TERM=linux",
-                "PATH=/usr/bin:/bin", NULL};
-        static int readf_count;
-        readf_count = (readf_count+1)%0xffff;
-        /* We should turn off LED before polling FF51[4]. */
-        /* Turn off LED. */
-        btPSR = read_nic_byte(dev, PSR);
-        write_nic_byte(dev, PSR, (btPSR & ~BIT3));
-        /* It need to delay 4us suggested */
-        udelay(4);
-        /* HW radio On/Off according to the value of FF51[4](config0) */
-        btConfig0 = btPSR = read_nic_byte(dev, CONFIG0);
-        eRfPowerStateToSet = (btConfig0 & BIT4) ?  RF_ON : RF_OFF;
-        /* Turn LED back on when radio enabled */
-        if (eRfPowerStateToSet == RF_ON)
-                write_nic_byte(dev, PSR, btPSR | BIT3);
-        if ((priv->ieee80211->bHwRadioOff == true) &&
-           (eRfPowerStateToSet == RF_ON)) {
-                priv->ieee80211->bHwRadioOff = false;
-                bActuallySet = true;
-        } else if ((priv->ieee80211->bHwRadioOff == false) &&
-                  (eRfPowerStateToSet == RF_OFF)) {
-                priv->ieee80211->bHwRadioOff = true;
-                bActuallySet = true;
-        }
-        if (bActuallySet) {
-                MgntActSet_RF_State(dev, eRfPowerStateToSet, RF_CHANGE_BY_HW);
-                /* To update the UI status for Power status changed */
-                if (priv->ieee80211->bHwRadioOff == true)
-                        argv[1] = "RFOFF";
-                else
-                        argv[1] = "RFON";
-                argv[0] = RadioPowerPath;
-                argv[2] = NULL;
-                call_usermodehelper(RadioPowerPath, argv, envp, UMH_WAIT_PROC);
-        }
-}
-module_init(rtl8180_pci_module_init);
-module_exit(rtl8180_pci_module_exit);
diff --git a/drivers/staging/rtl8187se/r8180_dm.c b/drivers/staging/rtl8187se/r8180_dm.c
deleted file mode 100644
index 8c020e064869..000000000000
--- a/drivers/staging/rtl8187se/r8180_dm.c
+++ /dev/null
@@ -1,1139 +0,0 @@
-#include "r8180_dm.h"
-#include "r8180_hw.h"
-#include "r8180_93cx6.h"
- /*     Return TRUE if we shall perform High Power Mechanism, FALSE otherwise. */
-#define RATE_ADAPTIVE_TIMER_PERIOD      300
-bool CheckHighPower(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct ieee80211_device *ieee = priv->ieee80211;
-        if (!priv->bRegHighPowerMechanism)
-                return false;
-        if (ieee->state == IEEE80211_LINKED_SCANNING)
-                return false;
-        return true;
-}
-/*
- *      Description:
- *              Update Tx power level if necessary.
- *              See also DoRxHighPower() and SetTxPowerLevel8185() for reference.
- *
- *      Note:
- *              The reason why we udpate Tx power level here instead of DoRxHighPower()
- *              is the number of IO to change Tx power is much more than channel TR switch
- *              and they are related to OFDM and MAC registers.
- *              So, we don't want to update it so frequently in per-Rx packet base.
- */
-static void DoTxHighPower(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u16                     HiPwrUpperTh = 0;
-        u16                     HiPwrLowerTh = 0;
-        u8                      RSSIHiPwrUpperTh;
-        u8                      RSSIHiPwrLowerTh;
-        u8                      u1bTmp;
-        char                    OfdmTxPwrIdx, CckTxPwrIdx;
-        HiPwrUpperTh = priv->RegHiPwrUpperTh;
-        HiPwrLowerTh = priv->RegHiPwrLowerTh;
-        HiPwrUpperTh = HiPwrUpperTh * 10;
-        HiPwrLowerTh = HiPwrLowerTh * 10;
-        RSSIHiPwrUpperTh = priv->RegRSSIHiPwrUpperTh;
-        RSSIHiPwrLowerTh = priv->RegRSSIHiPwrLowerTh;
-        /* lzm add 080826 */
-        OfdmTxPwrIdx  = priv->chtxpwr_ofdm[priv->ieee80211->current_network.channel];
-        CckTxPwrIdx  = priv->chtxpwr[priv->ieee80211->current_network.channel];
-        if ((priv->UndecoratedSmoothedSS > HiPwrUpperTh) ||
-                (priv->bCurCCKPkt && (priv->CurCCKRSSI > RSSIHiPwrUpperTh))) {
-                /* Stevenl suggested that degrade 8dbm in high power sate. 2007-12-04 Isaiah */
-                priv->bToUpdateTxPwr = true;
-                u1bTmp = read_nic_byte(dev, CCK_TXAGC);
-                /* If it never enter High Power. */
-                if (CckTxPwrIdx == u1bTmp) {
-                        u1bTmp = (u1bTmp > 16) ? (u1bTmp - 16) : 0;  /* 8dbm */
-                        write_nic_byte(dev, CCK_TXAGC, u1bTmp);
-                        u1bTmp = read_nic_byte(dev, OFDM_TXAGC);
-                        u1bTmp = (u1bTmp > 16) ? (u1bTmp - 16) : 0;  /* 8dbm */
-                        write_nic_byte(dev, OFDM_TXAGC, u1bTmp);
-                }
-        } else if ((priv->UndecoratedSmoothedSS < HiPwrLowerTh) &&
-                (!priv->bCurCCKPkt || priv->CurCCKRSSI < RSSIHiPwrLowerTh)) {
-                if (priv->bToUpdateTxPwr) {
-                        priv->bToUpdateTxPwr = false;
-                        /* SD3 required. */
-                        u1bTmp = read_nic_byte(dev, CCK_TXAGC);
-                        if (u1bTmp < CckTxPwrIdx) {
-                                write_nic_byte(dev, CCK_TXAGC, CckTxPwrIdx);
-                        }
-                        u1bTmp = read_nic_byte(dev, OFDM_TXAGC);
-                        if (u1bTmp < OfdmTxPwrIdx) {
-                                write_nic_byte(dev, OFDM_TXAGC, OfdmTxPwrIdx);
-                        }
-                }
-        }
-}
-/*
- *      Description:
- *              Callback function of UpdateTxPowerWorkItem.
- *              Because of some event happened, e.g. CCX TPC, High Power Mechanism,
- *              We update Tx power of current channel again.
- */
-void rtl8180_tx_pw_wq(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, tx_pw_wq);
-        struct net_device *dev = ieee->dev;
-        DoTxHighPower(dev);
-}
-/*
- *      Return TRUE if we shall perform DIG Mechanism, FALSE otherwise.
- */
-bool CheckDig(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct ieee80211_device *ieee = priv->ieee80211;
-        if (!priv->bDigMechanism)
-                return false;
-        if (ieee->state != IEEE80211_LINKED)
-                return false;
-        if ((priv->ieee80211->rate / 5) < 36) /* Schedule Dig under all OFDM rates. By Bruce, 2007-06-01. */
-                return false;
-        return true;
-}
-/*
- *      Implementation of DIG for Zebra and Zebra2.
- */
-static void DIG_Zebra(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u16                     CCKFalseAlarm, OFDMFalseAlarm;
-        u16                     OfdmFA1, OfdmFA2;
-        int                     InitialGainStep = 7; /* The number of initial gain stages. */
-        int                     LowestGainStage = 4; /* The capable lowest stage of performing dig workitem. */
-        u32                     AwakePeriodIn2Sec = 0;
-        CCKFalseAlarm = (u16)(priv->FalseAlarmRegValue & 0x0000ffff);
-        OFDMFalseAlarm = (u16)((priv->FalseAlarmRegValue >> 16) & 0x0000ffff);
-        OfdmFA1 =  0x15;
-        OfdmFA2 = ((u16)(priv->RegDigOfdmFaUpTh)) << 8;
-        /* The number of initial gain steps is different, by Bruce, 2007-04-13. */
-        if (priv->InitialGain == 0) { /* autoDIG */
-                /* Advised from SD3 DZ */
-                priv->InitialGain = 4; /* In 87B, m74dBm means State 4 (m82dBm) */
-        }
-        /* Advised from SD3 DZ */
-        OfdmFA1 = 0x20;
-#if 1 /* lzm reserved 080826 */
-        AwakePeriodIn2Sec = (2000 - priv->DozePeriodInPast2Sec);
-        priv->DozePeriodInPast2Sec = 0;
-        if (AwakePeriodIn2Sec) {
-                OfdmFA1 = (u16)((OfdmFA1 * AwakePeriodIn2Sec) / 2000);
-                OfdmFA2 = (u16)((OfdmFA2 * AwakePeriodIn2Sec) / 2000);
-        } else {
-                ;
-        }
-#endif
-        InitialGainStep = 8;
-        LowestGainStage = priv->RegBModeGainStage; /* Lowest gain stage. */
-        if (OFDMFalseAlarm > OfdmFA1) {
-                if (OFDMFalseAlarm > OfdmFA2) {
-                        priv->DIG_NumberFallbackVote++;
-                        if (priv->DIG_NumberFallbackVote > 1) {
-                                /* serious OFDM  False Alarm, need fallback */
-                                if (priv->InitialGain < InitialGainStep) {
-                                        priv->InitialGainBackUp = priv->InitialGain;
-                                        priv->InitialGain = (priv->InitialGain + 1);
-                                        UpdateInitialGain(dev);
-                                }
-                                priv->DIG_NumberFallbackVote = 0;
-                                priv->DIG_NumberUpgradeVote = 0;
-                        }
-                } else {
-                        if (priv->DIG_NumberFallbackVote)
-                                priv->DIG_NumberFallbackVote--;
-                }
-                priv->DIG_NumberUpgradeVote = 0;
-        } else {
-                if (priv->DIG_NumberFallbackVote)
-                        priv->DIG_NumberFallbackVote--;
-                priv->DIG_NumberUpgradeVote++;
-                if (priv->DIG_NumberUpgradeVote > 9) {
-                        if (priv->InitialGain > LowestGainStage) { /* In 87B, m78dBm means State 4 (m864dBm) */
-                                priv->InitialGainBackUp = priv->InitialGain;
-                                priv->InitialGain = (priv->InitialGain - 1);
-                                UpdateInitialGain(dev);
-                        }
-                        priv->DIG_NumberFallbackVote = 0;
-                        priv->DIG_NumberUpgradeVote = 0;
-                }
-        }
-}
-/*
- *      Dispatch DIG implementation according to RF.
- */
-static void DynamicInitGain(struct net_device *dev)
-{
-        DIG_Zebra(dev);
-}
-void rtl8180_hw_dig_wq(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, hw_dig_wq);
-        struct net_device *dev = ieee->dev;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        /* Read CCK and OFDM False Alarm. */
-        priv->FalseAlarmRegValue = read_nic_dword(dev, CCK_FALSE_ALARM);
-        /* Adjust Initial Gain dynamically. */
-        DynamicInitGain(dev);
-}
-static int IncludedInSupportedRates(struct r8180_priv *priv, u8 TxRate)
-{
-        u8 rate_len;
-        u8 rate_ex_len;
-        u8                      RateMask = 0x7F;
-        u8                      idx;
-        unsigned short          Found = 0;
-        u8                      NaiveTxRate = TxRate&RateMask;
-        rate_len = priv->ieee80211->current_network.rates_len;
-        rate_ex_len = priv->ieee80211->current_network.rates_ex_len;
-        for (idx = 0; idx < rate_len; idx++) {
-                if ((priv->ieee80211->current_network.rates[idx] & RateMask) == NaiveTxRate) {
-                        Found = 1;
-                        goto found_rate;
-                }
-        }
-        for (idx = 0; idx < rate_ex_len; idx++) {
-                if ((priv->ieee80211->current_network.rates_ex[idx] & RateMask) == NaiveTxRate) {
-                        Found = 1;
-                        goto found_rate;
-                }
-        }
-        return Found;
-found_rate:
-        return Found;
-}
-/*
- *      Get the Tx rate one degree up form the input rate in the supported rates.
- *      Return the upgrade rate if it is successed, otherwise return the input rate.
- */
-static u8 GetUpgradeTxRate(struct net_device *dev, u8 rate)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8                      UpRate;
-        /* Upgrade 1 degree. */
-        switch (rate) {
-        case 108: /* Up to 54Mbps. */
-                UpRate = 108;
-                break;
-        case 96: /* Up to 54Mbps. */
-                UpRate = 108;
-                break;
-        case 72: /* Up to 48Mbps. */
-                UpRate = 96;
-                break;
-        case 48: /* Up to 36Mbps. */
-                UpRate = 72;
-                break;
-        case 36: /* Up to 24Mbps. */
-                UpRate = 48;
-                break;
-        case 22: /* Up to 18Mbps. */
-                UpRate = 36;
-                break;
-        case 11: /* Up to 11Mbps. */
-                UpRate = 22;
-                break;
-        case 4: /* Up to 5.5Mbps. */
-                UpRate = 11;
-                break;
-        case 2: /* Up to 2Mbps. */
-                UpRate = 4;
-                break;
-        default:
-                printk("GetUpgradeTxRate(): Input Tx Rate(%d) is undefined!\n", rate);
-                return rate;
-        }
-        /* Check if the rate is valid. */
-        if (IncludedInSupportedRates(priv, UpRate)) {
-                return UpRate;
-        } else {
-                return rate;
-        }
-        return rate;
-}
-/*
- *      Get the Tx rate one degree down form the input rate in the supported rates.
- *      Return the degrade rate if it is successed, otherwise return the input rate.
- */
-static u8 GetDegradeTxRate(struct net_device *dev, u8 rate)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8                      DownRate;
-        /* Upgrade 1 degree. */
-        switch (rate) {
-        case 108: /* Down to 48Mbps. */
-                DownRate = 96;
-                break;
-        case 96: /* Down to 36Mbps. */
-                DownRate = 72;
-                break;
-        case 72: /* Down to 24Mbps. */
-                DownRate = 48;
-                break;
-        case 48: /* Down to 18Mbps. */
-                DownRate = 36;
-                break;
-        case 36: /* Down to 11Mbps. */
-                DownRate = 22;
-                break;
-        case 22: /* Down to 5.5Mbps. */
-                DownRate = 11;
-                break;
-        case 11: /* Down to 2Mbps. */
-                DownRate = 4;
-                break;
-        case 4: /* Down to 1Mbps. */
-                DownRate = 2;
-                break;
-        case 2: /* Down to 1Mbps. */
-                DownRate = 2;
-                break;
-        default:
-                printk("GetDegradeTxRate(): Input Tx Rate(%d) is undefined!\n", rate);
-                return rate;
-        }
-        /* Check if the rate is valid. */
-        if (IncludedInSupportedRates(priv, DownRate)) {
-                return DownRate;
-        } else {
-                return rate;
-        }
-        return rate;
-}
-/*
- *      Helper function to determine if specified data rate is
- *      CCK rate.
- */
-static bool MgntIsCckRate(u16 rate)
-{
-        bool bReturn = false;
-        if ((rate <= 22) && (rate != 12) && (rate != 18)) {
-                bReturn = true;
-        }
-        return bReturn;
-}
-/*
- *      Description:
- *              Tx Power tracking mechanism routine on 87SE.
- */
-void TxPwrTracking87SE(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        u8      tmpu1Byte, CurrentThermal, Idx;
-        char    CckTxPwrIdx, OfdmTxPwrIdx;
-        tmpu1Byte = read_nic_byte(dev, EN_LPF_CAL);
-        CurrentThermal = (tmpu1Byte & 0xf0) >> 4; /*[ 7:4]: thermal meter indication. */
-        CurrentThermal = (CurrentThermal > 0x0c) ? 0x0c : CurrentThermal;/* lzm add 080826 */
-        if (CurrentThermal != priv->ThermalMeter) {
-                /* Update Tx Power level on each channel. */
-                for (Idx = 1; Idx < 15; Idx++) {
-                        CckTxPwrIdx = priv->chtxpwr[Idx];
-                        OfdmTxPwrIdx = priv->chtxpwr_ofdm[Idx];
-                        if (CurrentThermal > priv->ThermalMeter) {
-                                /* higher thermal meter. */
-                                CckTxPwrIdx += (CurrentThermal - priv->ThermalMeter) * 2;
-                                OfdmTxPwrIdx += (CurrentThermal - priv->ThermalMeter) * 2;
-                                if (CckTxPwrIdx > 35)
-                                        CckTxPwrIdx = 35; /* Force TxPower to maximal index. */
-                                if (OfdmTxPwrIdx > 35)
-                                        OfdmTxPwrIdx = 35;
-                        } else {
-                                /* lower thermal meter. */
-                                CckTxPwrIdx -= (priv->ThermalMeter - CurrentThermal) * 2;
-                                OfdmTxPwrIdx -= (priv->ThermalMeter - CurrentThermal) * 2;
-                                if (CckTxPwrIdx < 0)
-                                        CckTxPwrIdx = 0;
-                                if (OfdmTxPwrIdx < 0)
-                                        OfdmTxPwrIdx = 0;
-                        }
-                        /* Update TxPower level on CCK and OFDM resp. */
-                        priv->chtxpwr[Idx] = CckTxPwrIdx;
-                        priv->chtxpwr_ofdm[Idx] = OfdmTxPwrIdx;
-                }
-                /* Update TxPower level immediately. */
-                rtl8225z2_SetTXPowerLevel(dev, priv->ieee80211->current_network.channel);
-        }
-        priv->ThermalMeter = CurrentThermal;
-}
-static void StaRateAdaptive87SE(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        unsigned long   CurrTxokCnt;
-        u16             CurrRetryCnt;
-        u16             CurrRetryRate;
-        unsigned long   CurrRxokCnt;
-        bool            bTryUp = false;
-        bool            bTryDown = false;
-        u8              TryUpTh = 1;
-        u8              TryDownTh = 2;
-        u32             TxThroughput;
-        long            CurrSignalStrength;
-        bool            bUpdateInitialGain = false;
-        u8              u1bOfdm = 0, u1bCck = 0;
-        char            OfdmTxPwrIdx, CckTxPwrIdx;
-        priv->RateAdaptivePeriod = RATE_ADAPTIVE_TIMER_PERIOD;
-        CurrRetryCnt    = priv->CurrRetryCnt;
-        CurrTxokCnt     = priv->NumTxOkTotal - priv->LastTxokCnt;
-        CurrRxokCnt     = priv->ieee80211->NumRxOkTotal - priv->LastRxokCnt;
-        CurrSignalStrength = priv->Stats_RecvSignalPower;
-        TxThroughput = (u32)(priv->NumTxOkBytesTotal - priv->LastTxOKBytes);
-        priv->LastTxOKBytes = priv->NumTxOkBytesTotal;
-        priv->CurrentOperaRate = priv->ieee80211->rate / 5;
-        /* 2 Compute retry ratio. */
-        if (CurrTxokCnt > 0) {
-                CurrRetryRate = (u16)(CurrRetryCnt * 100 / CurrTxokCnt);
-        } else {
-        /* It may be serious retry. To distinguish serious retry or no packets modified by Bruce */
-                CurrRetryRate = (u16)(CurrRetryCnt * 100 / 1);
-        }
-        priv->LastRetryCnt = priv->CurrRetryCnt;
-        priv->LastTxokCnt = priv->NumTxOkTotal;
-        priv->LastRxokCnt = priv->ieee80211->NumRxOkTotal;
-        priv->CurrRetryCnt = 0;
-        /* 2No Tx packets, return to init_rate or not? */
-        if (CurrRetryRate == 0 && CurrTxokCnt == 0) {
-                /*
-                 * After 9 (30*300ms) seconds in this condition, we try to raise rate.
-                 */
-                priv->TryupingCountNoData++;
-                /* [TRC Dell Lab] Extend raised period from 4.5sec to 9sec, Isaiah 2008-02-15 18:00 */
-                if (priv->TryupingCountNoData > 30) {
-                        priv->TryupingCountNoData = 0;
-                        priv->CurrentOperaRate = GetUpgradeTxRate(dev, priv->CurrentOperaRate);
-                        /* Reset Fail Record */
-                        priv->LastFailTxRate = 0;
-                        priv->LastFailTxRateSS = -200;
-                        priv->FailTxRateCount = 0;
-                }
-                goto SetInitialGain;
-        } else {
-                priv->TryupingCountNoData = 0; /*Reset trying up times. */
-        }
-        /*
-         * For Netgear case, I comment out the following signal strength estimation,
-         * which can results in lower rate to transmit when sample is NOT enough (e.g. PING request).
-         *
-         * Restructure rate adaptive as the following main stages:
-         * (1) Add retry threshold in 54M upgrading condition with signal strength.
-         * (2) Add the mechanism to degrade to CCK rate according to signal strength
-         *              and retry rate.
-         * (3) Remove all Initial Gain Updates over OFDM rate. To avoid the complicated
-         *              situation, Initial Gain Update is upon on DIG mechanism except CCK rate.
-         * (4) Add the mechanism of trying to upgrade tx rate.
-         * (5) Record the information of upping tx rate to avoid trying upping tx rate constantly.
-         *
-         */
-        /*
-         * 11Mbps or 36Mbps
-         * Check more times in these rate(key rates).
-         */
-        if (priv->CurrentOperaRate == 22 || priv->CurrentOperaRate == 72)
-                TryUpTh += 9;
-        /*
-         * Let these rates down more difficult.
-         */
-        if (MgntIsCckRate(priv->CurrentOperaRate) || priv->CurrentOperaRate == 36)
-                TryDownTh += 1;
-        /* 1 Adjust Rate. */
-        if (priv->bTryuping == true) {
-                /* 2 For Test Upgrading mechanism
-                 * Note:
-                 *      Sometimes the throughput is upon on the capability between the AP and NIC,
-                 *      thus the low data rate does not improve the performance.
-                 *      We randomly upgrade the data rate and check if the retry rate is improved.
-                 */
-                /* Upgrading rate did not improve the retry rate, fallback to the original rate. */
-                if ((CurrRetryRate > 25) && TxThroughput < priv->LastTxThroughput) {
-                        /*Not necessary raising rate, fall back rate. */
-                        bTryDown = true;
-                } else {
-                        priv->bTryuping = false;
-                }
-        } else if (CurrSignalStrength > -47 && (CurrRetryRate < 50)) {
-                /*
-                 * 2For High Power
-                 *
-                 * Return to highest data rate, if signal strength is good enough.
-                 * SignalStrength threshold(-50dbm) is for RTL8186.
-                 * Revise SignalStrength threshold to -51dbm.
-                 */
-                /* Also need to check retry rate for safety, by Bruce, 2007-06-05. */
-                if (priv->CurrentOperaRate != priv->ieee80211->current_network.HighestOperaRate) {
-                        bTryUp = true;
-                        /* Upgrade Tx Rate directly. */
-                        priv->TryupingCount += TryUpTh;
-                }
-        } else if (CurrTxokCnt > 9 && CurrTxokCnt < 100 && CurrRetryRate >= 600) {
-                /*
-                 *2 For Serious Retry
-                 *
-                 * Traffic is not busy but our Tx retry is serious.
-                 */
-                bTryDown = true;
-                /* Let Rate Mechanism to degrade tx rate directly. */
-                priv->TryDownCountLowData += TryDownTh;
-        } else if (priv->CurrentOperaRate == 108) {
-                /* 2For 54Mbps */
-                /* Air Link */
-                if ((CurrRetryRate > 26) && (priv->LastRetryRate > 25)) {
-                        bTryDown = true;
-                }
-                /* Cable Link */
-                else if ((CurrRetryRate > 17) && (priv->LastRetryRate > 16) && (CurrSignalStrength > -72)) {
-                        bTryDown = true;
-                }
-                if (bTryDown && (CurrSignalStrength < -75)) /* cable link */
-                        priv->TryDownCountLowData += TryDownTh;
-        } else if (priv->CurrentOperaRate == 96) {
-                /* 2For 48Mbps */
-                /* Air Link */
-                if (((CurrRetryRate > 48) && (priv->LastRetryRate > 47))) {
-                        bTryDown = true;
-                } else if (((CurrRetryRate > 21) && (priv->LastRetryRate > 20)) && (CurrSignalStrength > -74)) { /* Cable Link */
-                        /* Down to rate 36Mbps. */
-                        bTryDown = true;
-                } else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2)) {
-                        bTryDown = true;
-                        priv->TryDownCountLowData += TryDownTh;
-                } else if ((CurrRetryRate < 8) && (priv->LastRetryRate < 8)) { /* TO DO: need to consider (RSSI) */
-                        bTryUp = true;
-                }
-                if (bTryDown && (CurrSignalStrength < -75)) {
-                        priv->TryDownCountLowData += TryDownTh;
-                }
-        } else if (priv->CurrentOperaRate == 72) {
-                /* 2For 36Mbps */
-                if ((CurrRetryRate > 43) && (priv->LastRetryRate > 41)) {
-                        /* Down to rate 24Mbps. */
-                        bTryDown = true;
-                } else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2)) {
-                        bTryDown = true;
-                        priv->TryDownCountLowData += TryDownTh;
-                } else if ((CurrRetryRate < 15) &&  (priv->LastRetryRate < 16)) { /* TO DO: need to consider (RSSI) */
-                        bTryUp = true;
-                }
-                if (bTryDown && (CurrSignalStrength < -80))
-                        priv->TryDownCountLowData += TryDownTh;
-        } else if (priv->CurrentOperaRate == 48) {
-                /* 2For 24Mbps */
-                /* Air Link */
-                if (((CurrRetryRate > 63) && (priv->LastRetryRate > 62))) {
-                        bTryDown = true;
-                } else if (((CurrRetryRate > 33) && (priv->LastRetryRate > 32)) && (CurrSignalStrength > -82)) { /* Cable Link */
-                        bTryDown = true;
-                } else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2)) {
-                        bTryDown = true;
-                        priv->TryDownCountLowData += TryDownTh;
-                } else if ((CurrRetryRate < 20) && (priv->LastRetryRate < 21)) { /* TO DO: need to consider (RSSI) */
-                        bTryUp = true;
-                }
-                if (bTryDown && (CurrSignalStrength < -82))
-                        priv->TryDownCountLowData += TryDownTh;
-        } else if (priv->CurrentOperaRate == 36) {
-                if (((CurrRetryRate > 85) && (priv->LastRetryRate > 86))) {
-                        bTryDown = true;
-                } else if ((CurrRetryRate > (priv->LastRetryRate + 50)) && (priv->FailTxRateCount > 2)) {
-                        bTryDown = true;
-                        priv->TryDownCountLowData += TryDownTh;
-                } else if ((CurrRetryRate < 22) && (priv->LastRetryRate < 23)) { /* TO DO: need to consider (RSSI) */
-                        bTryUp = true;
-                }
-        } else if (priv->CurrentOperaRate == 22) {
-                /* 2For 11Mbps */
-                if (CurrRetryRate > 95) {
-                        bTryDown = true;
-                } else if ((CurrRetryRate < 29) && (priv->LastRetryRate < 30)) { /*TO DO: need to consider (RSSI) */
-                        bTryUp = true;
-                }
-        } else if (priv->CurrentOperaRate == 11) {
-                /* 2For 5.5Mbps */
-                if (CurrRetryRate > 149) {
-                        bTryDown = true;
-                } else if ((CurrRetryRate < 60) && (priv->LastRetryRate < 65)) {
-                        bTryUp = true;
-                }
-        } else if (priv->CurrentOperaRate == 4) {
-                /* 2For 2 Mbps */
-                if ((CurrRetryRate > 99) && (priv->LastRetryRate > 99)) {
-                        bTryDown = true;
-                } else if ((CurrRetryRate < 65) && (priv->LastRetryRate < 70)) {
-                        bTryUp = true;
-                }
-        } else if (priv->CurrentOperaRate == 2) {
-                /* 2For 1 Mbps */
-                if ((CurrRetryRate < 70) && (priv->LastRetryRate < 75)) {
-                        bTryUp = true;
-                }
-        }
-        if (bTryUp && bTryDown)
-                printk("StaRateAdaptive87B(): Tx Rate tried upping and downing simultaneously!\n");
-        /* 1 Test Upgrading Tx Rate
-         * Sometimes the cause of the low throughput (high retry rate) is the compatibility between the AP and NIC.
-         * To test if the upper rate may cause lower retry rate, this mechanism randomly occurs to test upgrading tx rate.
-         */
-        if (!bTryUp && !bTryDown && (priv->TryupingCount == 0) && (priv->TryDownCountLowData == 0)
-                && priv->CurrentOperaRate != priv->ieee80211->current_network.HighestOperaRate && priv->FailTxRateCount < 2) {
-                if (jiffies % (CurrRetryRate + 101) == 0) {
-                        bTryUp = true;
-                        priv->bTryuping = true;
-                }
-        }
-        /* 1 Rate Mechanism */
-        if (bTryUp) {
-                priv->TryupingCount++;
-                priv->TryDownCountLowData = 0;
-                /*
-                 * Check more times if we need to upgrade indeed.
-                 * Because the largest value of pHalData->TryupingCount is 0xFFFF and
-                 * the largest value of pHalData->FailTxRateCount is 0x14,
-                 * this condition will be satisfied at most every 2 min.
-                 */
-                if ((priv->TryupingCount > (TryUpTh + priv->FailTxRateCount * priv->FailTxRateCount)) ||
-                        (CurrSignalStrength > priv->LastFailTxRateSS) || priv->bTryuping) {
-                        priv->TryupingCount = 0;
-                        /*
-                         * When transferring from CCK to OFDM, DIG is an important issue.
-                         */
-                        if (priv->CurrentOperaRate == 22)
-                                bUpdateInitialGain = true;
-                        /*
-                         * The difference in throughput between 48Mbps and 36Mbps is 8M.
-                         * So, we must be careful in this rate scale. Isaiah 2008-02-15.
-                         */
-                        if (((priv->CurrentOperaRate == 72) || (priv->CurrentOperaRate == 48) || (priv->CurrentOperaRate == 36)) &&
-                                (priv->FailTxRateCount > 2))
-                                priv->RateAdaptivePeriod = (RATE_ADAPTIVE_TIMER_PERIOD / 2);
-                        /* (1)To avoid upgrade frequently to the fail tx rate, add the FailTxRateCount into the threshold. */
-                        /* (2)If the signal strength is increased, it may be able to upgrade. */
-                        priv->CurrentOperaRate = GetUpgradeTxRate(dev, priv->CurrentOperaRate);
-                        if (priv->CurrentOperaRate == 36) {
-                                priv->bUpdateARFR = true;
-                                write_nic_word(dev, ARFR, 0x0F8F); /* bypass 12/9/6 */
-                        } else if (priv->bUpdateARFR) {
-                                priv->bUpdateARFR = false;
-                                write_nic_word(dev, ARFR, 0x0FFF); /* set 1M ~ 54Mbps. */
-                        }
-                        /* Update Fail Tx rate and count. */
-                        if (priv->LastFailTxRate != priv->CurrentOperaRate) {
-                                priv->LastFailTxRate = priv->CurrentOperaRate;
-                                priv->FailTxRateCount = 0;
-                                priv->LastFailTxRateSS = -200; /* Set lowest power. */
-                        }
-                }
-        } else {
-                if (priv->TryupingCount > 0)
-                        priv->TryupingCount--;
-        }
-        if (bTryDown) {
-                priv->TryDownCountLowData++;
-                priv->TryupingCount = 0;
-                /* Check if Tx rate can be degraded or Test trying upgrading should fallback. */
-                if (priv->TryDownCountLowData > TryDownTh || priv->bTryuping) {
-                        priv->TryDownCountLowData = 0;
-                        priv->bTryuping = false;
-                        /* Update fail information. */
-                        if (priv->LastFailTxRate == priv->CurrentOperaRate) {
-                                priv->FailTxRateCount++;
-                                /* Record the Tx fail rate signal strength. */
-                                if (CurrSignalStrength > priv->LastFailTxRateSS)
-                                        priv->LastFailTxRateSS = CurrSignalStrength;
-                        } else {
-                                priv->LastFailTxRate = priv->CurrentOperaRate;
-                                priv->FailTxRateCount = 1;
-                                priv->LastFailTxRateSS = CurrSignalStrength;
-                        }
-                        priv->CurrentOperaRate = GetDegradeTxRate(dev, priv->CurrentOperaRate);
-                        /* Reduce chariot training time at weak signal strength situation. SD3 ED demand. */
-                        if ((CurrSignalStrength < -80) && (priv->CurrentOperaRate > 72)) {
-                                priv->CurrentOperaRate = 72;
-                        }
-                        if (priv->CurrentOperaRate == 36) {
-                                priv->bUpdateARFR = true;
-                                write_nic_word(dev, ARFR, 0x0F8F); /* bypass 12/9/6 */
-                        } else if (priv->bUpdateARFR) {
-                                priv->bUpdateARFR = false;
-                                write_nic_word(dev, ARFR, 0x0FFF); /* set 1M ~ 54Mbps. */
-                        }
-                        /*
-                         * When it is CCK rate, it may need to update initial gain to receive lower power packets.
-                         */
-                        if (MgntIsCckRate(priv->CurrentOperaRate)) {
-                                bUpdateInitialGain = true;
-                        }
-                }
-        } else {
-                if (priv->TryDownCountLowData > 0)
-                        priv->TryDownCountLowData--;
-        }
-        /*
-         * Keep the Tx fail rate count to equal to 0x15 at most.
-         * Reduce the fail count at least to 10 sec if tx rate is tending stable.
-         */
-        if (priv->FailTxRateCount >= 0x15 ||
-                (!bTryUp && !bTryDown && priv->TryDownCountLowData == 0 && priv->TryupingCount && priv->FailTxRateCount > 0x6)) {
-                priv->FailTxRateCount--;
-        }
-        OfdmTxPwrIdx  = priv->chtxpwr_ofdm[priv->ieee80211->current_network.channel];
-        CckTxPwrIdx  = priv->chtxpwr[priv->ieee80211->current_network.channel];
-        /* Mac0x9e increase 2 level in 36M~18M situation */
-        if ((priv->CurrentOperaRate < 96) && (priv->CurrentOperaRate > 22)) {
-                u1bCck = read_nic_byte(dev, CCK_TXAGC);
-                u1bOfdm = read_nic_byte(dev, OFDM_TXAGC);
-                /* case 1: Never enter High power */
-                if (u1bCck == CckTxPwrIdx) {
-                        if (u1bOfdm != (OfdmTxPwrIdx + 2)) {
-                        priv->bEnhanceTxPwr = true;
-                        u1bOfdm = ((u1bOfdm + 2) > 35) ? 35 : (u1bOfdm + 2);
-                        write_nic_byte(dev, OFDM_TXAGC, u1bOfdm);
-                        }
-                } else if (u1bCck < CckTxPwrIdx) {
-                /* case 2: enter high power */
-                        if (!priv->bEnhanceTxPwr) {
-                                priv->bEnhanceTxPwr = true;
-                                u1bOfdm = ((u1bOfdm + 2) > 35) ? 35 : (u1bOfdm + 2);
-                                write_nic_byte(dev, OFDM_TXAGC, u1bOfdm);
-                        }
-                }
-        } else if (priv->bEnhanceTxPwr) {  /* 54/48/11/5.5/2/1 */
-                u1bCck = read_nic_byte(dev, CCK_TXAGC);
-                u1bOfdm = read_nic_byte(dev, OFDM_TXAGC);
-                /* case 1: Never enter High power */
-                if (u1bCck == CckTxPwrIdx) {
-                        priv->bEnhanceTxPwr = false;
-                        write_nic_byte(dev, OFDM_TXAGC, OfdmTxPwrIdx);
-                }
-                /* case 2: enter high power */
-                else if (u1bCck < CckTxPwrIdx) {
-                        priv->bEnhanceTxPwr = false;
-                        u1bOfdm = ((u1bOfdm - 2) > 0) ? (u1bOfdm - 2) : 0;
-                        write_nic_byte(dev, OFDM_TXAGC, u1bOfdm);
-                }
-        }
-        /*
-         * We need update initial gain when we set tx rate "from OFDM to CCK" or
-         * "from CCK to OFDM".
-         */
-SetInitialGain:
-        if (bUpdateInitialGain) {
-                if (MgntIsCckRate(priv->CurrentOperaRate)) { /* CCK */
-                        if (priv->InitialGain > priv->RegBModeGainStage) {
-                                priv->InitialGainBackUp = priv->InitialGain;
-                                if (CurrSignalStrength < -85) /* Low power, OFDM [0x17] = 26. */
-                                        /* SD3 SYs suggest that CurrSignalStrength < -65, ofdm 0x17=26. */
-                                        priv->InitialGain = priv->RegBModeGainStage;
-                                else if (priv->InitialGain > priv->RegBModeGainStage + 1)
-                                        priv->InitialGain -= 2;
-                                else
-                                        priv->InitialGain--;
-                                printk("StaRateAdaptive87SE(): update init_gain to index %d for date rate %d\n", priv->InitialGain, priv->CurrentOperaRate);
-                                UpdateInitialGain(dev);
-                        }
-                } else { /* OFDM */
-                        if (priv->InitialGain < 4) {
-                                priv->InitialGainBackUp = priv->InitialGain;
-                                priv->InitialGain++;
-                                printk("StaRateAdaptive87SE(): update init_gain to index %d for date rate %d\n", priv->InitialGain, priv->CurrentOperaRate);
-                                UpdateInitialGain(dev);
-                        }
-                }
-        }
-        /* Record the related info */
-        priv->LastRetryRate = CurrRetryRate;
-        priv->LastTxThroughput = TxThroughput;
-        priv->ieee80211->rate = priv->CurrentOperaRate * 5;
-}
-void rtl8180_rate_adapter(struct work_struct *work)
-{
-        struct delayed_work *dwork = to_delayed_work(work);
-        struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, rate_adapter_wq);
-        struct net_device *dev = ieee->dev;
-        StaRateAdaptive87SE(dev);
-}
-void timer_rate_adaptive(unsigned long data)
-{
-        struct r8180_priv *priv = ieee80211_priv((struct net_device *)data);
-        if (!priv->up) {
-                return;
-        }
-        if ((priv->ieee80211->iw_mode != IW_MODE_MASTER)
-                        && (priv->ieee80211->state == IEEE80211_LINKED) &&
-                        (priv->ForcedDataRate == 0)) {
-                queue_work(priv->ieee80211->wq, (void *)&priv->ieee80211->rate_adapter_wq);
-        }
-        priv->rateadapter_timer.expires = jiffies + MSECS(priv->RateAdaptivePeriod);
-        add_timer(&priv->rateadapter_timer);
-}
-void SwAntennaDiversityRxOk8185(struct net_device *dev, u8 SignalStrength)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        priv->AdRxOkCnt++;
-        if (priv->AdRxSignalStrength != -1) {
-                priv->AdRxSignalStrength = ((priv->AdRxSignalStrength * 7) + (SignalStrength * 3)) / 10;
-        } else { /* Initialization case. */
-                priv->AdRxSignalStrength = SignalStrength;
-        }
-        if (priv->LastRxPktAntenna) /* Main antenna. */
-                priv->AdMainAntennaRxOkCnt++;
-        else     /* Aux antenna. */
-                priv->AdAuxAntennaRxOkCnt++;
-}
- /*     Change Antenna Switch. */
-bool SetAntenna8185(struct net_device *dev, u8 u1bAntennaIndex)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        bool bAntennaSwitched = false;
-        switch (u1bAntennaIndex) {
-        case 0:
-                /* Mac register, main antenna */
-                write_nic_byte(dev, ANTSEL, 0x03);
-                /* base band */
-                write_phy_cck(dev, 0x11, 0x9b); /* Config CCK RX antenna. */
-                write_phy_ofdm(dev, 0x0d, 0x5c); /* Config OFDM RX antenna. */
-                bAntennaSwitched = true;
-                break;
-        case 1:
-                /* Mac register, aux antenna */
-                write_nic_byte(dev, ANTSEL, 0x00);
-                /* base band */
-                write_phy_cck(dev, 0x11, 0xbb); /* Config CCK RX antenna. */
-                write_phy_ofdm(dev, 0x0d, 0x54); /* Config OFDM RX antenna. */
-                bAntennaSwitched = true;
-                break;
-        default:
-                printk("SetAntenna8185: unknown u1bAntennaIndex(%d)\n", u1bAntennaIndex);
-                break;
-        }
-        if (bAntennaSwitched)
-                priv->CurrAntennaIndex = u1bAntennaIndex;
-        return bAntennaSwitched;
-}
- /*     Toggle Antenna switch. */
-bool SwitchAntenna(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        bool            bResult;
-        if (priv->CurrAntennaIndex == 0) {
-                bResult = SetAntenna8185(dev, 1);
-        } else {
-                bResult = SetAntenna8185(dev, 0);
-        }
-        return bResult;
-}
-/*
- * Engine of SW Antenna Diversity mechanism.
- * Since 8187 has no Tx part information,
- * this implementation is only dependend on Rx part information.
- */
-void SwAntennaDiversity(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        bool   bSwCheckSS = false;
-        if (bSwCheckSS) {
-                priv->AdTickCount++;
-                printk("(1) AdTickCount: %d, AdCheckPeriod: %d\n",
-                        priv->AdTickCount, priv->AdCheckPeriod);
-                printk("(2) AdRxSignalStrength: %ld, AdRxSsThreshold: %ld\n",
-                        priv->AdRxSignalStrength, priv->AdRxSsThreshold);
-        }
-        /* Case 1. No Link. */
-        if (priv->ieee80211->state != IEEE80211_LINKED) {
-                priv->bAdSwitchedChecking = false;
-                /* I switch antenna here to prevent any one of antenna is broken before link established, 2006.04.18, by rcnjko.. */
-                SwitchAntenna(dev);
-          /* Case 2. Linked but no packet receive.d */
-        } else if (priv->AdRxOkCnt == 0) {
-                priv->bAdSwitchedChecking = false;
-                SwitchAntenna(dev);
-          /* Case 3. Evaluate last antenna switch action and undo it if necessary. */
-        } else if (priv->bAdSwitchedChecking == true) {
-                priv->bAdSwitchedChecking = false;
-                /* Adjust Rx signal strength threshold. */
-                priv->AdRxSsThreshold = (priv->AdRxSignalStrength + priv->AdRxSsBeforeSwitched) / 2;
-                priv->AdRxSsThreshold = (priv->AdRxSsThreshold > priv->AdMaxRxSsThreshold) ?
-                                        priv->AdMaxRxSsThreshold : priv->AdRxSsThreshold;
-                if (priv->AdRxSignalStrength < priv->AdRxSsBeforeSwitched) {
-                /* Rx signal strength is not improved after we swtiched antenna. => Swich back. */
-                        /* Increase Antenna Diversity checking period due to bad decision. */
-                        priv->AdCheckPeriod *= 2;
-                        /* Increase Antenna Diversity checking period. */
-                        if (priv->AdCheckPeriod > priv->AdMaxCheckPeriod)
-                                priv->AdCheckPeriod = priv->AdMaxCheckPeriod;
-                        /* Wrong decision => switch back. */
-                        SwitchAntenna(dev);
-                } else {
-                /* Rx Signal Strength is improved. */
-                        /* Reset Antenna Diversity checking period to its min value. */
-                        priv->AdCheckPeriod = priv->AdMinCheckPeriod;
-                }
-        }
-        /* Case 4. Evaluate if we shall switch antenna now. */
-        /* Cause Table Speed is very fast in TRC Dell Lab, we check it every time. */
-        else {
-                priv->AdTickCount = 0;
-                /*
-                 * <Roger_Notes> We evaluate RxOk counts for each antenna first and than
-                 * evaluate signal strength.
-                 * The following operation can overcome the disability of CCA on both two antennas
-                 * When signal strength was extremely low or high.
-                 * 2008.01.30.
-                 */
-                /*
-                 * Evaluate RxOk count from each antenna if we shall switch default antenna now.
-                 */
-                if ((priv->AdMainAntennaRxOkCnt < priv->AdAuxAntennaRxOkCnt)
-                        && (priv->CurrAntennaIndex == 0)) {
-                /* We set Main antenna as default but RxOk count was less than Aux ones. */
-                        /* Switch to Aux antenna. */
-                        SwitchAntenna(dev);
-                        priv->bHWAdSwitched = true;
-                } else if ((priv->AdAuxAntennaRxOkCnt < priv->AdMainAntennaRxOkCnt)
-                        && (priv->CurrAntennaIndex == 1)) {
-                /* We set Aux antenna as default but RxOk count was less than Main ones. */
-                        /* Switch to Main antenna. */
-                        SwitchAntenna(dev);
-                        priv->bHWAdSwitched = true;
-                } else {
-                /* Default antenna is better. */
-                        /* Still need to check current signal strength. */
-                        priv->bHWAdSwitched = false;
-                }
-                /*
-                 * <Roger_Notes> We evaluate Rx signal strength ONLY when default antenna
-                 * didn't change by HW evaluation.
-                 * 2008.02.27.
-                 *
-                 * [TRC Dell Lab] SignalStrength is inaccuracy. Isaiah 2008-03-05
-                 * For example, Throughput of aux is better than main antenna(about 10M v.s 2M),
-                 * but AdRxSignalStrength is less than main.
-                 * Our guess is that main antenna have lower throughput and get many change
-                 * to receive more CCK packets(ex.Beacon) which have stronger SignalStrength.
-                 */
-                if ((!priv->bHWAdSwitched) && (bSwCheckSS)) {
-                        /* Evaluate Rx signal strength if we shall switch antenna now. */
-                        if (priv->AdRxSignalStrength < priv->AdRxSsThreshold) {
-                        /* Rx signal strength is weak => Switch Antenna. */
-                                priv->AdRxSsBeforeSwitched = priv->AdRxSignalStrength;
-                                priv->bAdSwitchedChecking = true;
-                                SwitchAntenna(dev);
-                        } else {
-                        /* Rx signal strength is OK. */
-                                priv->bAdSwitchedChecking = false;
-                                /* Increase Rx signal strength threshold if necessary. */
-                                if ((priv->AdRxSignalStrength > (priv->AdRxSsThreshold + 10)) && /* Signal is much stronger than current threshold */
-                                        priv->AdRxSsThreshold <= priv->AdMaxRxSsThreshold) { /* Current threhold is not yet reach upper limit. */
-                                        priv->AdRxSsThreshold = (priv->AdRxSsThreshold + priv->AdRxSignalStrength) / 2;
-                                        priv->AdRxSsThreshold = (priv->AdRxSsThreshold > priv->AdMaxRxSsThreshold) ?
-                                                                priv->AdMaxRxSsThreshold : priv->AdRxSsThreshold;/* +by amy 080312 */
-                                }
-                                /* Reduce Antenna Diversity checking period if possible. */
-                                if (priv->AdCheckPeriod > priv->AdMinCheckPeriod)
-                                        priv->AdCheckPeriod /= 2;
-                        }
-                }
-        }
-        /* Reset antenna diversity Rx related statistics. */
-        priv->AdRxOkCnt = 0;
-        priv->AdMainAntennaRxOkCnt = 0;
-        priv->AdAuxAntennaRxOkCnt = 0;
-}
- /*     Return TRUE if we shall perform Tx Power Tracking Mechanism, FALSE otherwise. */
-bool CheckTxPwrTracking(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        if (!priv->bTxPowerTrack)
-                return false;
-        /* if 87SE is in High Power , don't do Tx Power Tracking. asked by SD3 ED. 2008-08-08 Isaiah */
-        if (priv->bToUpdateTxPwr)
-                return false;
-        return true;
-}
- /*     Timer callback function of SW Antenna Diversity. */
-void SwAntennaDiversityTimerCallback(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        enum rt_rf_power_state rtState;
-         /* We do NOT need to switch antenna while RF is off. */
-        rtState = priv->eRFPowerState;
-        do {
-                if (rtState == RF_OFF) {
-                        break;
-                } else if (rtState == RF_SLEEP) {
-                        /* Don't access BB/RF under Disable PLL situation. */
-                        break;
-                }
-                SwAntennaDiversity(dev);
-        } while (false);
-        if (priv->up) {
-                priv->SwAntennaDiversityTimer.expires = jiffies + MSECS(ANTENNA_DIVERSITY_TIMER_PERIOD);
-                add_timer(&priv->SwAntennaDiversityTimer);
-        }
-}
diff --git a/drivers/staging/rtl8187se/r8180_dm.h b/drivers/staging/rtl8187se/r8180_dm.h
deleted file mode 100644
index cb4046f346ef..000000000000
--- a/drivers/staging/rtl8187se/r8180_dm.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#ifndef R8180_DM_H
-#define R8180_DM_H
-#include "r8180.h"
-/* #include "r8180_hw.h"        */
-/* #include "r8180_93cx6.h"     */
-void SwAntennaDiversityRxOk8185(struct net_device *dev, u8 SignalStrength);
-bool SetAntenna8185(struct net_device *dev, u8 u1bAntennaIndex);
-bool SwitchAntenna(struct net_device *dev);
-void SwAntennaDiversity(struct net_device *dev);
-void SwAntennaDiversityTimerCallback(struct net_device *dev);
-bool CheckDig(struct net_device *dev);
-bool CheckHighPower(struct net_device *dev);
-void rtl8180_hw_dig_wq(struct work_struct *work);
-void rtl8180_tx_pw_wq(struct work_struct *work);
-void rtl8180_rate_adapter(struct work_struct *work);
-void TxPwrTracking87SE(struct net_device *dev);
-bool CheckTxPwrTracking(struct net_device *dev);
-void rtl8180_rate_adapter(struct work_struct *work);
-void timer_rate_adaptive(unsigned long data);
-#endif
diff --git a/drivers/staging/rtl8187se/r8180_hw.h b/drivers/staging/rtl8187se/r8180_hw.h
deleted file mode 100644
index e59d74f8ecfc..000000000000
--- a/drivers/staging/rtl8187se/r8180_hw.h
+++ /dev/null
@@ -1,588 +0,0 @@
-/*
-        This is part of rtl8180 OpenSource driver.
-        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
-        Released under the terms of GPL (General Public Licence)
-        Parts of this driver are based on the GPL part of the
-        official Realtek driver.
-        Parts of this driver are based on the rtl8180 driver skeleton
-        from Patric Schenke & Andres Salomon.
-        Parts of this driver are based on the Intel Pro Wireless
-        2100 GPL driver.
-        We want to tanks the Authors of those projects
-        and the Ndiswrapper project Authors.
-*/
-/* Mariusz Matuszek added full registers definition with Realtek's name */
-/* this file contains register definitions for the rtl8180 MAC controller */
-#ifndef R8180_HW
-#define R8180_HW
-#define BIT0    0x00000001
-#define BIT1    0x00000002
-#define BIT2    0x00000004
-#define BIT3    0x00000008
-#define BIT4    0x00000010
-#define BIT5    0x00000020
-#define BIT6    0x00000040
-#define BIT7    0x00000080
-#define BIT9    0x00000200
-#define BIT11   0x00000800
-#define BIT13   0x00002000
-#define BIT15   0x00008000
-#define BIT20   0x00100000
-#define BIT21   0x00200000
-#define BIT22   0x00400000
-#define BIT23   0x00800000
-#define BIT24   0x01000000
-#define BIT25   0x02000000
-#define BIT26   0x04000000
-#define BIT27   0x08000000
-#define BIT28   0x10000000
-#define BIT29   0x20000000
-#define BIT30   0x40000000
-#define BIT31   0x80000000
-#define MAX_SLEEP_TIME (10000)
-#define MIN_SLEEP_TIME (50)
-#define BB_HOST_BANG_EN (1<<2)
-#define BB_HOST_BANG_CLK (1<<1)
-#define MAC0 0
-#define MAC4 4
-#define CMD 0x37
-#define CMD_RST_SHIFT 4
-#define CMD_RX_ENABLE_SHIFT 3
-#define CMD_TX_ENABLE_SHIFT 2
-#define EPROM_CMD 0x50
-#define EPROM_CMD_RESERVED_MASK ((1<<5)|(1<<4))
-#define EPROM_CMD_OPERATING_MODE_SHIFT 6
-#define EPROM_CMD_OPERATING_MODE_MASK ((1<<7)|(1<<6))
-#define EPROM_CMD_CONFIG 0x3
-#define EPROM_CMD_NORMAL 0
-#define EPROM_CMD_LOAD 1
-#define EPROM_CMD_PROGRAM 2
-#define EPROM_CS_SHIFT 3
-#define EPROM_CK_SHIFT 2
-#define EPROM_W_SHIFT 1
-#define EPROM_R_SHIFT 0
-#define CONFIG2_DMA_POLLING_MODE_SHIFT 3
-#define INTA_TXOVERFLOW (1<<15)
-#define INTA_TIMEOUT (1<<14)
-#define INTA_HIPRIORITYDESCERR (1<<9)
-#define INTA_HIPRIORITYDESCOK (1<<8)
-#define INTA_NORMPRIORITYDESCERR (1<<7)
-#define INTA_NORMPRIORITYDESCOK (1<<6)
-#define INTA_RXOVERFLOW (1<<5)
-#define INTA_RXDESCERR (1<<4)
-#define INTA_LOWPRIORITYDESCERR (1<<3)
-#define INTA_LOWPRIORITYDESCOK (1<<2)
-#define INTA_RXOK (1)
-#define INTA_MASK 0x3c
-#define RXRING_ADDR 0xe4 /* page 0 */
-#define PGSELECT 0x5e
-#define PGSELECT_PG_SHIFT 0
-#define RX_CONF 0x44
-#define MAC_FILTER_MASK ((1<<0) | (1<<1) | (1<<2) | (1<<3) | (1<<5) | \
-(1<<12) | (1<<18) | (1<<19) | (1<<20) | (1<<21) | (1<<22) | (1<<23))
-#define RX_CHECK_BSSID_SHIFT 23
-#define ACCEPT_PWR_FRAME_SHIFT 22
-#define ACCEPT_MNG_FRAME_SHIFT 20
-#define ACCEPT_CTL_FRAME_SHIFT 19
-#define ACCEPT_DATA_FRAME_SHIFT 18
-#define ACCEPT_ICVERR_FRAME_SHIFT 12
-#define ACCEPT_CRCERR_FRAME_SHIFT 5
-#define ACCEPT_BCAST_FRAME_SHIFT 3
-#define ACCEPT_MCAST_FRAME_SHIFT 2
-#define ACCEPT_ALLMAC_FRAME_SHIFT 0
-#define ACCEPT_NICMAC_FRAME_SHIFT 1
-#define RX_FIFO_THRESHOLD_MASK ((1<<13) | (1<<14) | (1<<15))
-#define RX_FIFO_THRESHOLD_SHIFT 13
-#define RX_FIFO_THRESHOLD_NONE 7
-#define RX_AUTORESETPHY_SHIFT 28
-#define TX_CONF 0x40
-#define TX_CONF_HEADER_AUTOICREMENT_SHIFT 30
-#define TX_LOOPBACK_SHIFT 17
-#define TX_LOOPBACK_NONE 0
-#define TX_LOOPBACK_CONTINUE 3
-#define TX_LOOPBACK_MASK ((1<<17)|(1<<18))
-#define TX_DPRETRY_SHIFT 0
-#define R8180_MAX_RETRY 255
-#define TX_RTSRETRY_SHIFT 8
-#define TX_NOICV_SHIFT 19
-#define TX_NOCRC_SHIFT 16
-#define TX_DMA_POLLING 0xd9
-#define TX_DMA_POLLING_BEACON_SHIFT 7
-#define TX_DMA_POLLING_HIPRIORITY_SHIFT 6
-#define TX_DMA_POLLING_NORMPRIORITY_SHIFT 5
-#define TX_DMA_POLLING_LOWPRIORITY_SHIFT 4
-#define TX_MANAGEPRIORITY_RING_ADDR 0x0C
-#define TX_BKPRIORITY_RING_ADDR 0x10
-#define TX_BEPRIORITY_RING_ADDR 0x14
-#define TX_VIPRIORITY_RING_ADDR 0x20
-#define TX_VOPRIORITY_RING_ADDR 0x24
-#define TX_HIGHPRIORITY_RING_ADDR 0x28
-#define MAX_RX_DMA_MASK ((1<<8) | (1<<9) | (1<<10))
-#define MAX_RX_DMA_2048 7
-#define MAX_RX_DMA_1024 6
-#define MAX_RX_DMA_SHIFT 10
-#define INT_TIMEOUT 0x48
-#define CONFIG3_CLKRUN_SHIFT 2
-#define CONFIG3_ANAPARAM_W_SHIFT 6
-#define ANAPARAM 0x54
-#define BEACON_INTERVAL 0x70
-#define BEACON_INTERVAL_MASK ((1<<0)|(1<<1)|(1<<2)|(1<<3)|(1<<4)|(1<<5)| \
-(1<<6)|(1<<7)|(1<<8)|(1<<9))
-#define ATIM_MASK ((1<<0)|(1<<1)|(1<<2)|(1<<3)|(1<<4)|(1<<5)|(1<<6)|(1<<7)| \
-(1<<8)|(1<<9))
-#define ATIM 0x72
-#define EPROM_CS_SHIFT 3
-#define EPROM_CK_SHIFT 2
-#define PHY_ADR 0x7c
-#define SECURITY 0x5f /* 1209 this is sth wrong */
-#define SECURITY_WEP_TX_ENABLE_SHIFT 1
-#define SECURITY_WEP_RX_ENABLE_SHIFT 0
-#define SECURITY_ENCRYP_104 1
-#define SECURITY_ENCRYP_SHIFT 4
-#define SECURITY_ENCRYP_MASK ((1<<4)|(1<<5))
-#define KEY0 0x90  /* 1209 this is sth wrong */
-#define CONFIG2_ANTENNA_SHIFT 6
-#define TX_BEACON_RING_ADDR 0x4c
-#define CONFIG0_WEP40_SHIFT 7
-#define CONFIG0_WEP104_SHIFT 6
-#define AGCRESET_SHIFT 5
-/*
- * Operational registers offsets in PCI (I/O) space.
- * RealTek names are used.
- */
-#define TSFTR 0x0018
-#define TLPDA 0x0020
-#define BSSID 0x002E
-#define CR 0x0037
-#define RF_SW_CONFIG            0x8                     /* store data which is transmitted to RF for driver     */
-#define RF_SW_CFG_SI            BIT1
-#define EIFS                    0x2D                    /* Extended InterFrame Space Timer, in unit of 4 us.    */
-#define BRSR                    0x34                    /* Basic rate set                                                                               */
-#define IMR 0x006C
-#define ISR 0x003C
-#define TCR 0x0040
-#define RCR 0x0044
-#define TimerInt 0x0048
-#define CR9346 0x0050
-#define CONFIG0 0x0051
-#define CONFIG2 0x0053
-#define MSR 0x0058
-#define CONFIG3 0x0059
-#define CONFIG4 0x005A
-        /* SD3 szuyitasi: Mac0x57= CC -> B0 Mac0x60= D1 -> C6   */
-        /* Mac0x60 = 0x000004C6 power save parameters                   */
-        #define ANAPARM_ASIC_ON    0xB0054D00
-        #define ANAPARM2_ASIC_ON  0x000004C6
-        #define ANAPARM_ON ANAPARM_ASIC_ON
-        #define ANAPARM2_ON ANAPARM2_ASIC_ON
-#define TESTR 0x005B
-#define PSR 0x005E
-#define BcnItv 0x0070
-#define AtimWnd 0x0072
-#define BintrItv 0x0074
-#define PhyAddr 0x007C
-#define PhyDataR 0x007E
-/* following are for rtl8185 */
-#define RFPinsOutput 0x80
-#define RFPinsEnable 0x82
-#define RF_TIMING 0x8c
-#define RFPinsSelect 0x84
-#define ANAPARAM2 0x60
-#define RF_PARA 0x88
-#define RFPinsInput 0x86
-#define GP_ENABLE 0x90
-#define GPIO 0x91
-#define SW_CONTROL_GPIO 0x400
-#define TX_ANTENNA 0x9f
-#define TX_GAIN_OFDM 0x9e
-#define TX_GAIN_CCK 0x9d
-#define WPA_CONFIG 0xb0
-#define TX_AGC_CTL 0x9c
-#define TX_AGC_CTL_PERPACKET_GAIN_SHIFT 0
-#define TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT 1
-#define TX_AGC_CTL_FEEDBACK_ANT 2
-#define RESP_RATE 0x34
-#define SIFS 0xb4
-#define DIFS 0xb5
-#define SLOT 0xb6
-#define CW_CONF 0xbc
-#define CW_CONF_PERPACKET_RETRY_SHIFT 1
-#define CW_CONF_PERPACKET_CW_SHIFT 0
-#define CW_VAL 0xbd
-#define MAX_RESP_RATE_SHIFT 4
-#define MIN_RESP_RATE_SHIFT 0
-#define RATE_FALLBACK 0xbe
-#define CONFIG5 0x00D8
-#define PHYPR                   0xDA                    /* 0xDA - 0x0B PHY Parameter Register.  */
-#define FEMR                    0x1D4   /* Function Event Mask register */
-#define FFER 0x00FC
-#define FFER_END 0x00FF
-/*
- * Bitmasks for specific register functions.
- * Names are derived from the register name and function name.
- *
- * <REGISTER>_<FUNCTION>[<bit>]
- *
- * this leads to some awkward names...
- */
-#define BRSR_BPLCP  ((1 << 8))
-#define BRSR_MBR    ((1 << 1)|(1 << 0))
-#define BRSR_MBR_8185 ((1 << 11)|(1 << 10)|(1 << 9)|(1 << 8)|(1 << 7)|(1 << 6)|(1 << 5)|(1 << 4)|(1 << 3)|(1 << 2)|(1 << 1)|(1 << 0))
-#define BRSR_MBR0   ((1 << 0))
-#define BRSR_MBR1   ((1 << 1))
-#define CR_RST      ((1 << 4))
-#define CR_RE       ((1 << 3))
-#define CR_TE       ((1 << 2))
-#define CR_MulRW    ((1 << 0))
-#define IMR_Dot11hInt   ((1 << 25))                     /*802.11h Measurement Interrupt                                 */
-#define IMR_BcnDmaInt   ((1 << 24))                     /*Beacon DMA Interrupt */ /*What differenct between BcnDmaInt and BcnInt???     */
-#define IMR_WakeInt             ((1 << 23))                     /*Wake Up Interrupt                                                             */
-#define IMR_TXFOVW              ((1 << 22))                     /*Tx FIFO Overflow Interrupt                                    */
-#define IMR_TimeOut1    ((1 << 21))                     /*Time Out Interrupt 1                                                  */
-#define IMR_BcnInt              ((1 << 20))                     /*Beacon Time out Interrupt                                             */
-#define IMR_ATIMInt             ((1 << 19))                     /*ATIM Time Out Interrupt                                               */
-#define IMR_TBDER               ((1 << 18))                     /*Tx Beacon Descriptor Error Interrupt                  */
-#define IMR_TBDOK               ((1 << 17))                     /*Tx Beacon Descriptor OK Interrupt                             */
-#define IMR_THPDER              ((1 << 16))                     /*Tx High Priority Descriptor Error Interrupt   */
-#define IMR_THPDOK              ((1 << 15))                     /*Tx High Priority Descriptor OK Interrupt              */
-#define IMR_TVODER              ((1 << 14))                     /*Tx AC_VO Descriptor Error Interrupt                   */
-#define IMR_TVODOK              ((1 << 13))                     /*Tx AC_VO Descriptor OK Interrupt                              */
-#define IMR_FOVW                ((1 << 12))                     /*Rx FIFO Overflow Interrupt                                    */
-#define IMR_RDU                 ((1 << 11))                     /*Rx Descriptor Unavailable Interrupt                   */
-#define IMR_TVIDER              ((1 << 10))                     /*Tx AC_VI Descriptor Error Interrupt                   */
-#define IMR_TVIDOK              ((1 << 9))                      /*Tx AC_VI Descriptor OK Interrupt                              */
-#define IMR_RER                 ((1 << 8))                      /*Rx Error Interrupt                                                    */
-#define IMR_ROK                 ((1 << 7))                      /*Receive OK Interrupt                                                  */
-#define IMR_TBEDER              ((1 << 6))                      /*Tx AC_BE Descriptor Error Interrupt                   */
-#define IMR_TBEDOK              ((1 << 5))                      /*Tx AC_BE Descriptor OK Interrupt                              */
-#define IMR_TBKDER              ((1 << 4))                      /*Tx AC_BK Descriptor Error Interrupt                   */
-#define IMR_TBKDOK              ((1 << 3))                      /*Tx AC_BK Descriptor OK Interrupt                              */
-#define IMR_RQoSOK              ((1 << 2))                      /*Rx QoS OK Interrupt                                                   */
-#define IMR_TimeOut2    ((1 << 1))                      /*Time Out Interrupt 2                                                  */
-#define IMR_TimeOut3    ((1 << 0))                      /*Time Out Interrupt 3                                                  */
-#define IMR_TMGDOK      ((1 << 30))
-#define ISR_Dot11hInt   ((1 << 25))                     /*802.11h Measurement Interrupt                                 */
-#define ISR_BcnDmaInt   ((1 << 24))                     /*Beacon DMA Interrupt  */ /*What differenct between BcnDmaInt and BcnInt???    */
-#define ISR_WakeInt             ((1 << 23))                     /*Wake Up Interrupt                                                             */
-#define ISR_TXFOVW              ((1 << 22))                     /*Tx FIFO Overflow Interrupt                                    */
-#define ISR_TimeOut1    ((1 << 21))                     /*Time Out Interrupt 1                                                  */
-#define ISR_BcnInt              ((1 << 20))                     /*Beacon Time out Interrupt                                             */
-#define ISR_ATIMInt             ((1 << 19))                     /*ATIM Time Out Interrupt                                               */
-#define ISR_TBDER               ((1 << 18))                     /*Tx Beacon Descriptor Error Interrupt                  */
-#define ISR_TBDOK               ((1 << 17))                     /*Tx Beacon Descriptor OK Interrupt                             */
-#define ISR_THPDER              ((1 << 16))                     /*Tx High Priority Descriptor Error Interrupt   */
-#define ISR_THPDOK              ((1 << 15))                     /*Tx High Priority Descriptor OK Interrupt              */
-#define ISR_TVODER              ((1 << 14))                     /*Tx AC_VO Descriptor Error Interrupt                   */
-#define ISR_TVODOK              ((1 << 13))                     /*Tx AC_VO Descriptor OK Interrupt                              */
-#define ISR_FOVW                ((1 << 12))                     /*Rx FIFO Overflow Interrupt                                    */
-#define ISR_RDU                 ((1 << 11))                     /*Rx Descriptor Unavailable Interrupt                   */
-#define ISR_TVIDER              ((1 << 10))                     /*Tx AC_VI Descriptor Error Interrupt                   */
-#define ISR_TVIDOK              ((1 << 9))                      /*Tx AC_VI Descriptor OK Interrupt                              */
-#define ISR_RER                 ((1 << 8))                      /*Rx Error Interrupt                                                    */
-#define ISR_ROK                 ((1 << 7))                      /*Receive OK Interrupt                                                  */
-#define ISR_TBEDER              ((1 << 6))                      /*Tx AC_BE Descriptor Error Interrupt                   */
-#define ISR_TBEDOK              ((1 << 5))                      /*Tx AC_BE Descriptor OK Interrupt                              */
-#define ISR_TBKDER              ((1 << 4))                      /*Tx AC_BK Descriptor Error Interrupt                   */
-#define ISR_TBKDOK              ((1 << 3))                      /*Tx AC_BK Descriptor OK Interrupt                              */
-#define ISR_RQoSOK              ((1 << 2))                      /*Rx QoS OK Interrupt                                                   */
-#define ISR_TimeOut2    ((1 << 1))                      /*Time Out Interrupt 2                                                  */
-#define ISR_TimeOut3    ((1 << 0))                      /*Time Out Interrupt 3                                                  */
-/* these definition is used for Tx/Rx test temporarily */
-#define ISR_TLPDER  ISR_TVIDER
-#define ISR_TLPDOK  ISR_TVIDOK
-#define ISR_TNPDER  ISR_TVODER
-#define ISR_TNPDOK  ISR_TVODOK
-#define ISR_TimeOut ISR_TimeOut1
-#define ISR_RXFOVW ISR_FOVW
-#define HW_VERID_R8180_F 3
-#define HW_VERID_R8180_ABCD 2
-#define HW_VERID_R8185_ABC 4
-#define HW_VERID_R8185_D 5
-#define HW_VERID_R8185B_B 6
-#define TCR_CWMIN   ((1 << 31))
-#define TCR_SWSEQ   ((1 << 30))
-#define TCR_HWVERID_MASK ((1 << 27)|(1 << 26)|(1 << 25))
-#define TCR_HWVERID_SHIFT 25
-#define TCR_SAT     ((1 << 24))
-#define TCR_PLCP_LEN TCR_SAT /* rtl8180 */
-#define TCR_MXDMA_MASK   ((1 << 23)|(1 << 22)|(1 << 21))
-#define TCR_MXDMA_1024 6
-#define TCR_MXDMA_2048 7
-#define TCR_MXDMA_SHIFT  21
-#define TCR_DISCW   ((1 << 20))
-#define TCR_ICV     ((1 << 19))
-#define TCR_LBK     ((1 << 18)|(1 << 17))
-#define TCR_LBK1    ((1 << 18))
-#define TCR_LBK0    ((1 << 17))
-#define TCR_CRC     ((1 << 16))
-#define TCR_DPRETRY_MASK   ((1 << 15)|(1 << 14)|(1 << 13)|(1 << 12)|(1 << 11)|(1 << 10)|(1 << 9)|(1 << 8))
-#define TCR_RTSRETRY_MASK   ((1 << 0)|(1 << 1)|(1 << 2)|(1 << 3)|(1 << 4)|(1 << 5)|(1 << 6)|(1 << 7))
-#define TCR_PROBE_NOTIMESTAMP_SHIFT 29 /* rtl8185 */
-#define RCR_ONLYERLPKT ((1 << 31))
-#define RCR_CS_SHIFT   29
-#define RCR_CS_MASK    ((1 << 30) | (1 << 29))
-#define RCR_ENMARP     ((1 << 28))
-#define RCR_CBSSID     ((1 << 23))
-#define RCR_APWRMGT    ((1 << 22))
-#define RCR_ADD3       ((1 << 21))
-#define RCR_AMF        ((1 << 20))
-#define RCR_ACF        ((1 << 19))
-#define RCR_ADF        ((1 << 18))
-#define RCR_RXFTH      ((1 << 15)|(1 << 14)|(1 << 13))
-#define RCR_RXFTH2     ((1 << 15))
-#define RCR_RXFTH1     ((1 << 14))
-#define RCR_RXFTH0     ((1 << 13))
-#define RCR_AICV       ((1 << 12))
-#define RCR_MXDMA      ((1 << 10)|(1 << 9)|(1 << 8))
-#define RCR_MXDMA2     ((1 << 10))
-#define RCR_MXDMA1     ((1 << 9))
-#define RCR_MXDMA0     ((1 << 8))
-#define RCR_9356SEL    ((1 << 6))
-#define RCR_ACRC32     ((1 << 5))
-#define RCR_AB         ((1 << 3))
-#define RCR_AM         ((1 << 2))
-#define RCR_APM        ((1 << 1))
-#define RCR_AAP        ((1 << 0))
-#define CR9346_EEM     ((1 << 7)|(1 << 6))
-#define CR9346_EEM1    ((1 << 7))
-#define CR9346_EEM0    ((1 << 6))
-#define CR9346_EECS    ((1 << 3))
-#define CR9346_EESK    ((1 << 2))
-#define CR9346_EED1    ((1 << 1))
-#define CR9346_EED0    ((1 << 0))
-#define CONFIG3_PARM_En    ((1 << 6))
-#define CONFIG3_FuncRegEn  ((1 << 1))
-#define CONFIG4_PWRMGT     ((1 << 5))
-#define MSR_LINK_MASK      ((1 << 2)|(1 << 3))
-#define MSR_LINK_MANAGED   2
-#define MSR_LINK_NONE      0
-#define MSR_LINK_SHIFT     2
-#define MSR_LINK_ADHOC     1
-#define MSR_LINK_MASTER    3
-#define BcnItv_BcnItv      (0x01FF)
-#define AtimWnd_AtimWnd    (0x01FF)
-#define BintrItv_BintrItv  (0x01FF)
-#define FEMR_INTR    ((1 << 15))
-#define FEMR_WKUP    ((1 << 14))
-#define FEMR_GWAKE   ((1 << 4))
-#define FFER_INTR    ((1 << 15))
-#define FFER_GWAKE   ((1 << 4))
-/* Three wire mode.                                     */
-#define SW_THREE_WIRE                   0
-#define HW_THREE_WIRE                   2
-/* RTL8187S by amy                                      */
-#define HW_THREE_WIRE_PI                5
-#define HW_THREE_WIRE_SI                6
-/* by amy                                                       */
-#define TCR_LRL_OFFSET          0
-#define TCR_SRL_OFFSET          8
-#define TCR_MXDMA_OFFSET        21
-#define TCR_DISReqQsize_OFFSET          28
-#define TCR_DurProcMode_OFFSET          30
-#define RCR_MXDMA_OFFSET                                8
-#define RCR_FIFO_OFFSET                                 13
-#define AckTimeOutReg   0x79            /* ACK timeout register, in unit of 4 us. */
-#define RFTiming                        0x8C
-#define TPPollStop              0x93
-#define TXAGC_CTL               0x9C                    /*< RJ_TODO_8185B> TX_AGC_CONTROL (0x9C seems be removed at 8185B, see p37). */
-#define CCK_TXAGC               0x9D
-#define OFDM_TXAGC              0x9E
-#define ANTSEL                  0x9F
-#define ACM_CONTROL             0x00BF      /* ACM Control Registe */
-#define IntMig                  0xE2                    /* Interrupt Migration (0xE2 ~ 0xE3)    */
-#define TID_AC_MAP              0xE8                    /* TID to AC Mapping Register                   */
-#define ANAPARAM3               0xEE                    /* <RJ_TODO_8185B> How to use it?               */
-#define AC_VO_PARAM             0xF0                    /* AC_VO Parameters Record                              */
-#define AC_VI_PARAM             0xF4                    /* AC_VI Parameters Record                              */
-#define AC_BE_PARAM             0xF8                    /* AC_BE Parameters Record                              */
-#define AC_BK_PARAM             0xFC                    /* AC_BK Parameters Record                              */
-#define GPIOCtrl                        0x16B                   /*GPIO Control Register.                        */
-#define ARFR                    0x1E0   /* Auto Rate Fallback Register (0x1e0 ~ 0x1e2)  */
-#define RFSW_CTRL                       0x272   /* 0x272-0x273.                                                         */
-#define SW_3W_DB0                       0x274   /* Software 3-wire data buffer bit 31~0.                */
-#define SW_3W_DB1                       0x278   /* Software 3-wire data buffer bit 63~32.       */
-#define SW_3W_CMD0                      0x27C   /* Software 3-wire Control/Status Register.     */
-#define SW_3W_CMD1                      0x27D   /* Software 3-wire Control/Status Register.     */
-#define PI_DATA_READ            0X360   /* 0x360 - 0x361  Parallel Interface Data Register.     */
-#define SI_DATA_READ            0x362   /* 0x362 - 0x363  Serial Interface Data Register.       */
-/*
----------------------------------------------------------------------------
-                8185B TPPollStop bits                                   (offset 0x93, 1 byte)
----------------------------------------------------------------------------
-*/
-#define TPPOLLSTOP_BQ                   (0x01 << 7)
-#define TPPOLLSTOP_AC_VIQ               (0x01 << 4)
-#define MSR_LINK_ENEDCA    (1<<4)
-/*
----------------------------------------------------------------------------
-                8187B AC_XX_PARAM bits
----------------------------------------------------------------------------
-*/
-#define AC_PARAM_TXOP_LIMIT_OFFSET              16
-#define AC_PARAM_ECW_MAX_OFFSET                 12
-#define AC_PARAM_ECW_MIN_OFFSET                 8
-#define AC_PARAM_AIFS_OFFSET                    0
-/*
----------------------------------------------------------------------------
-                8187B ACM_CONTROL bits                                  (Offset 0xBF, 1 Byte)
----------------------------------------------------------------------------
-*/
-#define VOQ_ACM_EN                              (0x01 << 7)     /*BIT7  */
-#define VIQ_ACM_EN                              (0x01 << 6)     /*BIT6  */
-#define BEQ_ACM_EN                              (0x01 << 5)     /*BIT5  */
-#define ACM_HW_EN                               (0x01 << 4)     /*BIT4  */
-#define VOQ_ACM_CTL                             (0x01 << 2)     /*BIT2  */      /* Set to 1 when AC_VO used time reaches or exceeds the admitted time   */
-#define VIQ_ACM_CTL                             (0x01 << 1)     /*BIT1  */      /* Set to 1 when AC_VI used time reaches or exceeds the admitted time   */
-#define BEQ_ACM_CTL                             (0x01 << 0)     /*BIT0  */      /* Set to 1 when AC_BE used time reaches or exceeds the admitted time   */
-/*
----------------------------------------------------------------------------
-                8185B SW_3W_CMD bits                                    (Offset 0x27C-0x27D, 16bit)
----------------------------------------------------------------------------
-*/
-#define SW_3W_CMD0_HOLD         ((1 << 7))
-#define SW_3W_CMD1_RE           ((1 << 0)) /* BIT8              */
-#define SW_3W_CMD1_WE           ((1 << 1)) /* BIT9              */
-#define SW_3W_CMD1_DONE         ((1 << 2)) /* BIT10             */
-#define BB_HOST_BANG_RW         (1 << 3)
-/*
----------------------------------------------------------------------------
-                8185B RATE_FALLBACK_CTL bits                    (Offset 0xBE, 8bit)
----------------------------------------------------------------------------
-*/
-#define RATE_FALLBACK_CTL_ENABLE                                ((1 << 7))
-#define RATE_FALLBACK_CTL_ENABLE_RTSCTS         ((1 << 6))
-/* Auto rate fallback per 2^n retry. */
-#define RATE_FALLBACK_CTL_AUTO_STEP0    0x00
-#define RATE_FALLBACK_CTL_AUTO_STEP1    0x01
-#define RATE_FALLBACK_CTL_AUTO_STEP2    0x02
-#define RATE_FALLBACK_CTL_AUTO_STEP3    0x03
-#define RTL8225z2_ANAPARAM_OFF  0x55480658
-#define RTL8225z2_ANAPARAM2_OFF 0x72003f70
-/* by amy for power save                */
-#define RF_CHANGE_BY_HW BIT30
-#define RF_CHANGE_BY_PS BIT29
-#define RF_CHANGE_BY_IPS BIT28
-/* by amy for power save                */
-/* by amy for antenna                   */
-#define EEPROM_SW_REVD_OFFSET 0x3f
-/*  BIT[8-9] is for SW Antenna Diversity.
- *  Only the value EEPROM_SW_AD_ENABLE means enable, other values are disable.
- */
-#define EEPROM_SW_AD_MASK                       0x0300
-#define EEPROM_SW_AD_ENABLE                     0x0100
-/* BIT[10-11] determine if Antenna 1 is the Default Antenna.
- * Only the value EEPROM_DEF_ANT_1 means TRUE, other values are FALSE.
- */
-#define EEPROM_DEF_ANT_MASK                     0x0C00
-#define EEPROM_DEF_ANT_1                        0x0400
-/*by amy for antenna                                                                                                                                                            */
-/* {by amy 080312                                                                                                                                                                       */
-/* 0x7C, 0x7D Crystal calibration and Tx Power tracking mechanism. Added by Roger. 2007.12.10.          */
-#define EEPROM_RSV                                              0x7C
-#define EEPROM_XTAL_CAL_XOUT_MASK       0x0F    /* 0x7C[3:0], Crystal calibration for Xout.                             */
-#define EEPROM_XTAL_CAL_XIN_MASK                0xF0    /* 0x7C[7:4], Crystal calibration for Xin.                      */
-#define EEPROM_THERMAL_METER_MASK       0x0F00  /* 0x7D[3:0], Thermal meter reference level.                    */
-#define EEPROM_XTAL_CAL_ENABLE          0x1000  /* 0x7D[4], Crystal calibration enabled/disabled BIT.   */
-#define EEPROM_THERMAL_METER_ENABLE     0x2000  /* 0x7D[5], Thermal meter enabled/disabled BIT.                 */
-#define EN_LPF_CAL                      0x238   /* Enable LPF Calibration.                                                                              */
-#define PWR_METER_EN            BIT1
-/* <RJ_TODO_8185B> where are false alarm counters in 8185B? */
-#define CCK_FALSE_ALARM         0xD0
-/* by amy 080312} */
-/* YJ,add for Country IE, 080630 */
-#define EEPROM_COUNTRY_CODE  0x2E
-/* YJ,add,080630,end */
-#endif
diff --git a/drivers/staging/rtl8187se/r8180_rtl8225.h b/drivers/staging/rtl8187se/r8180_rtl8225.h
deleted file mode 100644
index 7df73927b3cc..000000000000
--- a/drivers/staging/rtl8187se/r8180_rtl8225.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * This is part of the rtl8180-sa2400 driver released under the GPL (See file
- * COPYING for details).
- *
- * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
- *
- * This files contains programming code for the rtl8225 radio frontend.
- *
- * *Many* thanks to Realtek Corp. for their great support!
- */
-#include "r8180.h"
-#define RTL8225_ANAPARAM_ON  0xa0000b59
-#define RTL8225_ANAPARAM_OFF 0xa00beb59
-#define RTL8225_ANAPARAM2_OFF 0x840dec11
-#define RTL8225_ANAPARAM2_ON  0x860dec11
-#define RTL8225_ANAPARAM_SLEEP 0xa00bab59
-#define RTL8225_ANAPARAM2_SLEEP 0x840dec11
-void rtl8225z2_rf_init(struct net_device *dev);
-void rtl8225z2_rf_set_chan(struct net_device *dev, short ch);
-void rtl8225z2_rf_close(struct net_device *dev);
-void RF_WriteReg(struct net_device *dev, u8 offset, u16 data);
-u16 RF_ReadReg(struct net_device *dev, u8 offset);
-void rtl8180_set_mode(struct net_device *dev, int mode);
-void rtl8180_set_mode(struct net_device *dev, int mode);
-bool SetZebraRFPowerState8185(struct net_device *dev,
-                              enum rt_rf_power_state eRFPowerState);
-void rtl8225z4_rf_sleep(struct net_device *dev);
-void rtl8225z4_rf_wakeup(struct net_device *dev);
diff --git a/drivers/staging/rtl8187se/r8180_rtl8225z2.c b/drivers/staging/rtl8187se/r8180_rtl8225z2.c
deleted file mode 100644
index 47104fa05c55..000000000000
--- a/drivers/staging/rtl8187se/r8180_rtl8225z2.c
+++ /dev/null
@@ -1,811 +0,0 @@
-/*
- * This is part of the rtl8180-sa2400 driver
- * released under the GPL (See file COPYING for details).
- * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
- *
- * This files contains programming code for the rtl8225
- * radio frontend.
- *
- * *Many* thanks to Realtek Corp. for their great support!
- */
-#include "r8180_hw.h"
-#include "r8180_rtl8225.h"
-#include "r8180_93cx6.h"
-#include "ieee80211/dot11d.h"
-static void write_rtl8225(struct net_device *dev, u8 adr, u16 data)
-{
-        int i;
-        u16 out, select;
-        u8 bit;
-        u32 bangdata = (data << 4) | (adr & 0xf);
-        out = read_nic_word(dev, RFPinsOutput) & 0xfff3;
-        write_nic_word(dev, RFPinsEnable,
-                (read_nic_word(dev, RFPinsEnable) | 0x7));
-        select = read_nic_word(dev, RFPinsSelect);
-        write_nic_word(dev, RFPinsSelect, select | 0x7 |
-                       SW_CONTROL_GPIO);
-        force_pci_posting(dev);
-        udelay(10);
-        write_nic_word(dev, RFPinsOutput, out | BB_HOST_BANG_EN);
-        force_pci_posting(dev);
-        udelay(2);
-        write_nic_word(dev, RFPinsOutput, out);
-        force_pci_posting(dev);
-        udelay(10);
-        for (i = 15; i >= 0; i--) {
-                bit = (bangdata & (1 << i)) >> i;
-                write_nic_word(dev, RFPinsOutput, bit | out);
-                write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
-                write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
-                i--;
-                bit = (bangdata & (1 << i)) >> i;
-                write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
-                write_nic_word(dev, RFPinsOutput, bit | out | BB_HOST_BANG_CLK);
-                write_nic_word(dev, RFPinsOutput, bit | out);
-        }
-        write_nic_word(dev, RFPinsOutput, out | BB_HOST_BANG_EN);
-        force_pci_posting(dev);
-        udelay(10);
-        write_nic_word(dev, RFPinsOutput, out | BB_HOST_BANG_EN);
-        write_nic_word(dev, RFPinsSelect, select | SW_CONTROL_GPIO);
-        rtl8185_rf_pins_enable(dev);
-}
-static const u8 rtl8225_agc[] = {
-        0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e,
-        0x9d, 0x9c, 0x9b, 0x9a, 0x99, 0x98, 0x97, 0x96,
-        0x95, 0x94, 0x93, 0x92, 0x91, 0x90, 0x8f, 0x8e,
-        0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86,
-        0x85, 0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e,
-        0x3d, 0x3c, 0x3b, 0x3a, 0x39, 0x38, 0x37, 0x36,
-        0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f, 0x2e,
-        0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26,
-        0x25, 0x24, 0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e,
-        0x1d, 0x1c, 0x1b, 0x1a, 0x19, 0x18, 0x17, 0x16,
-        0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
-        0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06,
-        0x05, 0x04, 0x03, 0x02, 0x01, 0x01, 0x01, 0x01,
-        0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
-        0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
-        0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
-};
-static const u32 rtl8225_chan[] = {
-        0,
-        0x0080, 0x0100, 0x0180, 0x0200, 0x0280, 0x0300, 0x0380,
-        0x0400, 0x0480, 0x0500, 0x0580, 0x0600, 0x0680, 0x074A,
-};
-static const u8 rtl8225z2_gain_bg[] = {
-        0x23, 0x15, 0xa5, /* -82-1dBm */
-        0x23, 0x15, 0xb5, /* -82-2dBm */
-        0x23, 0x15, 0xc5, /* -82-3dBm */
-        0x33, 0x15, 0xc5, /* -78dBm */
-        0x43, 0x15, 0xc5, /* -74dBm */
-        0x53, 0x15, 0xc5, /* -70dBm */
-        0x63, 0x15, 0xc5, /* -66dBm */
-};
-static const u8 rtl8225z2_gain_a[] = {
-        0x13, 0x27, 0x5a, /* -82dBm */
-        0x23, 0x23, 0x58, /* -82dBm */
-        0x33, 0x1f, 0x56, /* -82dBm */
-        0x43, 0x1b, 0x54, /* -78dBm */
-        0x53, 0x17, 0x51, /* -74dBm */
-        0x63, 0x24, 0x4f, /* -70dBm */
-        0x73, 0x0f, 0x4c, /* -66dBm */
-};
-static const u16 rtl8225z2_rxgain[] = {
-        0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
-        0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
-        0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
-        0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
-        0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
-        0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
-        0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
-        0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
-        0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
-        0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
-        0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
-        0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb
-};
-static void rtl8225z2_set_gain(struct net_device *dev, short gain)
-{
-        const u8 *rtl8225_gain;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8 mode = priv->ieee80211->mode;
-        if (mode == IEEE_B || mode == IEEE_G)
-                rtl8225_gain = rtl8225z2_gain_bg;
-        else
-                rtl8225_gain = rtl8225z2_gain_a;
-        write_phy_ofdm(dev, 0x0b, rtl8225_gain[gain * 3]);
-        write_phy_ofdm(dev, 0x1b, rtl8225_gain[gain * 3 + 1]);
-        write_phy_ofdm(dev, 0x1d, rtl8225_gain[gain * 3 + 2]);
-        write_phy_ofdm(dev, 0x21, 0x37);
-}
-static u32 read_rtl8225(struct net_device *dev, u8 adr)
-{
-        u32 data2Write = ((u32)(adr & 0x1f)) << 27;
-        u32 dataRead;
-        u32 mask;
-        u16 oval, oval2, oval3, tmp;
-        int i;
-        short bit, rw;
-        u8 wLength = 6;
-        u8 rLength = 12;
-        u8 low2high = 0;
-        oval = read_nic_word(dev, RFPinsOutput);
-        oval2 = read_nic_word(dev, RFPinsEnable);
-        oval3 = read_nic_word(dev, RFPinsSelect);
-        write_nic_word(dev, RFPinsEnable, (oval2|0xf));
-        write_nic_word(dev, RFPinsSelect, (oval3|0xf));
-        dataRead = 0;
-        oval &= ~0xf;
-        write_nic_word(dev, RFPinsOutput, oval | BB_HOST_BANG_EN);
-        udelay(4);
-        write_nic_word(dev, RFPinsOutput, oval);
-        udelay(5);
-        rw = 0;
-        mask = (low2high) ? 0x01 : (((u32)0x01)<<(32-1));
-        for (i = 0; i < wLength/2; i++) {
-                bit = ((data2Write&mask) != 0) ? 1 : 0;
-                write_nic_word(dev, RFPinsOutput, bit | oval | rw);
-                udelay(1);
-                write_nic_word(dev, RFPinsOutput,
-                                bit | oval | BB_HOST_BANG_CLK | rw);
-                udelay(2);
-                write_nic_word(dev, RFPinsOutput,
-                                bit | oval | BB_HOST_BANG_CLK | rw);
-                udelay(2);
-                mask = (low2high) ? (mask<<1) : (mask>>1);
-                if (i == 2) {
-                        rw = BB_HOST_BANG_RW;
-                        write_nic_word(dev, RFPinsOutput,
-                                        bit | oval | BB_HOST_BANG_CLK | rw);
-                        udelay(2);
-                        write_nic_word(dev, RFPinsOutput, bit | oval | rw);
-                        udelay(2);
-                        break;
-                }
-                bit = ((data2Write&mask) != 0) ? 1 : 0;
-                write_nic_word(dev, RFPinsOutput,
-                                oval | bit | rw | BB_HOST_BANG_CLK);
-                udelay(2);
-                write_nic_word(dev, RFPinsOutput,
-                                oval | bit | rw | BB_HOST_BANG_CLK);
-                udelay(2);
-                write_nic_word(dev, RFPinsOutput, oval | bit | rw);
-                udelay(1);
-                mask = (low2high) ? (mask<<1) : (mask>>1);
-        }
-        write_nic_word(dev, RFPinsOutput, rw|oval);
-        udelay(2);
-        mask = (low2high) ? 0x01 : (((u32)0x01) << (12-1));
-        /*
-         * We must set data pin to HW controlled, otherwise RF can't driver it
-         * and value RF register won't be able to read back properly.
-         */
-        write_nic_word(dev, RFPinsEnable, (oval2 & (~0x01)));
-        for (i = 0; i < rLength; i++) {
-                write_nic_word(dev, RFPinsOutput, rw|oval); udelay(1);
-                write_nic_word(dev, RFPinsOutput, rw|oval|BB_HOST_BANG_CLK);
-                udelay(2);
-                write_nic_word(dev, RFPinsOutput, rw|oval|BB_HOST_BANG_CLK);
-                udelay(2);
-                write_nic_word(dev, RFPinsOutput, rw|oval|BB_HOST_BANG_CLK);
-                udelay(2);
-                tmp = read_nic_word(dev, RFPinsInput);
-                dataRead |= (tmp & BB_HOST_BANG_CLK ? mask : 0);
-                write_nic_word(dev, RFPinsOutput, (rw|oval)); udelay(2);
-                mask = (low2high) ? (mask<<1) : (mask>>1);
-        }
-        write_nic_word(dev, RFPinsOutput,
-                        BB_HOST_BANG_EN | BB_HOST_BANG_RW | oval);
-        udelay(2);
-        write_nic_word(dev, RFPinsEnable, oval2);
-        write_nic_word(dev, RFPinsSelect, oval3); /* Set To SW Switch */
-        write_nic_word(dev, RFPinsOutput, 0x3a0);
-        return dataRead;
-}
-void rtl8225z2_rf_close(struct net_device *dev)
-{
-        RF_WriteReg(dev, 0x4, 0x1f);
-        force_pci_posting(dev);
-        mdelay(1);
-        rtl8180_set_anaparam(dev, RTL8225z2_ANAPARAM_OFF);
-        rtl8185_set_anaparam2(dev, RTL8225z2_ANAPARAM2_OFF);
-}
-/*
- * Map dBm into Tx power index according to current HW model, for example,
- * RF and PA, and current wireless mode.
- */
-static s8 DbmToTxPwrIdx(struct r8180_priv *priv,
-                        enum wireless_mode mode, s32 PowerInDbm)
-{
-        bool bUseDefault = true;
-        s8 TxPwrIdx = 0;
-        /*
-         * OFDM Power in dBm = Index * 0.5 + 0
-         * CCK Power in dBm = Index * 0.25 + 13
-         */
-        s32 tmp = 0;
-        if (mode == WIRELESS_MODE_G) {
-                bUseDefault = false;
-                tmp = (2 * PowerInDbm);
-                if (tmp < 0)
-                        TxPwrIdx = 0;
-                else if (tmp > 40) /* 40 means 20 dBm. */
-                        TxPwrIdx = 40;
-                else
-                        TxPwrIdx = (s8)tmp;
-        } else if (mode == WIRELESS_MODE_B) {
-                bUseDefault = false;
-                tmp = (4 * PowerInDbm) - 52;
-                if (tmp < 0)
-                        TxPwrIdx = 0;
-                else if (tmp > 28) /* 28 means 20 dBm. */
-                        TxPwrIdx = 28;
-                else
-                        TxPwrIdx = (s8)tmp;
-        }
-        /*
-         * TRUE if we want to use a default implementation.
-         * We shall set it to FALSE when we have exact translation formula
-         * for target IC. 070622, by rcnjko.
-         */
-        if (bUseDefault) {
-                if (PowerInDbm < 0)
-                        TxPwrIdx = 0;
-                else if (PowerInDbm > 35)
-                        TxPwrIdx = 35;
-                else
-                        TxPwrIdx = (u8)PowerInDbm;
-        }
-        return TxPwrIdx;
-}
-void rtl8225z2_SetTXPowerLevel(struct net_device *dev, short ch)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8 max_cck_power_level;
-        u8 max_ofdm_power_level;
-        u8 min_ofdm_power_level;
-        char cck_power_level = (char)(0xff & priv->chtxpwr[ch]);
-        char ofdm_power_level = (char)(0xff & priv->chtxpwr_ofdm[ch]);
-        if (IS_DOT11D_ENABLE(priv->ieee80211) &&
-            IS_DOT11D_STATE_DONE(priv->ieee80211)) {
-                u8 MaxTxPwrInDbm = DOT11D_GetMaxTxPwrInDbm(priv->ieee80211, ch);
-                u8 CckMaxPwrIdx = DbmToTxPwrIdx(priv, WIRELESS_MODE_B,
-                                                        MaxTxPwrInDbm);
-                u8 OfdmMaxPwrIdx = DbmToTxPwrIdx(priv, WIRELESS_MODE_G,
-                                                        MaxTxPwrInDbm);
-                if (cck_power_level > CckMaxPwrIdx)
-                        cck_power_level = CckMaxPwrIdx;
-                if (ofdm_power_level > OfdmMaxPwrIdx)
-                        ofdm_power_level = OfdmMaxPwrIdx;
-        }
-        max_cck_power_level = 15;
-        max_ofdm_power_level = 25;
-        min_ofdm_power_level = 10;
-        if (cck_power_level > 35)
-                cck_power_level = 35;
-        write_nic_byte(dev, CCK_TXAGC, cck_power_level);
-        force_pci_posting(dev);
-        mdelay(1);
-        if (ofdm_power_level > 35)
-                ofdm_power_level = 35;
-        if (priv->up == 0) {
-                write_phy_ofdm(dev, 2, 0x42);
-                write_phy_ofdm(dev, 5, 0x00);
-                write_phy_ofdm(dev, 6, 0x40);
-                write_phy_ofdm(dev, 7, 0x00);
-                write_phy_ofdm(dev, 8, 0x40);
-        }
-        write_nic_byte(dev, OFDM_TXAGC, ofdm_power_level);
-        if (ofdm_power_level <= 11) {
-                write_phy_ofdm(dev, 0x07, 0x5c);
-                write_phy_ofdm(dev, 0x09, 0x5c);
-        }
-        if (ofdm_power_level <= 17) {
-                write_phy_ofdm(dev, 0x07, 0x54);
-                write_phy_ofdm(dev, 0x09, 0x54);
-        } else {
-                write_phy_ofdm(dev, 0x07, 0x50);
-                write_phy_ofdm(dev, 0x09, 0x50);
-        }
-        force_pci_posting(dev);
-        mdelay(1);
-}
-void rtl8225z2_rf_set_chan(struct net_device *dev, short ch)
-{
-        rtl8225z2_SetTXPowerLevel(dev, ch);
-        RF_WriteReg(dev, 0x7, rtl8225_chan[ch]);
-        if ((RF_ReadReg(dev, 0x7) & 0x0F80) != rtl8225_chan[ch])
-                RF_WriteReg(dev, 0x7, rtl8225_chan[ch]);
-        mdelay(1);
-        force_pci_posting(dev);
-        mdelay(10);
-}
-static void rtl8225_host_pci_init(struct net_device *dev)
-{
-        write_nic_word(dev, RFPinsOutput, 0x480);
-        rtl8185_rf_pins_enable(dev);
-        write_nic_word(dev, RFPinsSelect, 0x88 | SW_CONTROL_GPIO);
-        write_nic_byte(dev, GP_ENABLE, 0);
-        force_pci_posting(dev);
-        mdelay(200);
-        /* bit 6 is for RF on/off detection */
-        write_nic_word(dev, GP_ENABLE, 0xff & (~(1 << 6)));
-}
-void rtl8225z2_rf_init(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int i;
-        short channel = 1;
-        u16 brsr;
-        u32 data;
-        priv->chan = channel;
-        rtl8225_host_pci_init(dev);
-        write_nic_dword(dev, RF_TIMING, 0x000a8008);
-        brsr = read_nic_word(dev, BRSR);
-        write_nic_word(dev, BRSR, 0xffff);
-        write_nic_dword(dev, RF_PARA, 0x100044);
-        rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-        write_nic_byte(dev, CONFIG3, 0x44);
-        rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-        rtl8185_rf_pins_enable(dev);
-        write_rtl8225(dev, 0x0, 0x2bf); mdelay(1);
-        write_rtl8225(dev, 0x1, 0xee0); mdelay(1);
-        write_rtl8225(dev, 0x2, 0x44d); mdelay(1);
-        write_rtl8225(dev, 0x3, 0x441); mdelay(1);
-        write_rtl8225(dev, 0x4, 0x8c3); mdelay(1);
-        write_rtl8225(dev, 0x5, 0xc72); mdelay(1);
-        write_rtl8225(dev, 0x6, 0xe6);  mdelay(1);
-        write_rtl8225(dev, 0x7, rtl8225_chan[channel]);  mdelay(1);
-        write_rtl8225(dev, 0x8, 0x3f);  mdelay(1);
-        write_rtl8225(dev, 0x9, 0x335); mdelay(1);
-        write_rtl8225(dev, 0xa, 0x9d4); mdelay(1);
-        write_rtl8225(dev, 0xb, 0x7bb); mdelay(1);
-        write_rtl8225(dev, 0xc, 0x850); mdelay(1);
-        write_rtl8225(dev, 0xd, 0xcdf); mdelay(1);
-        write_rtl8225(dev, 0xe, 0x2b);  mdelay(1);
-        write_rtl8225(dev, 0xf, 0x114);
-        mdelay(100);
-        write_rtl8225(dev, 0x0, 0x1b7);
-        for (i = 0; i < ARRAY_SIZE(rtl8225z2_rxgain); i++) {
-                write_rtl8225(dev, 0x1, i + 1);
-                write_rtl8225(dev, 0x2, rtl8225z2_rxgain[i]);
-        }
-        write_rtl8225(dev, 0x3, 0x80);
-        write_rtl8225(dev, 0x5, 0x4);
-        write_rtl8225(dev, 0x0, 0xb7);
-        write_rtl8225(dev, 0x2, 0xc4d);
-        /* FIXME!! rtl8187 we have to check if calibrarion
-         * is successful and eventually cal. again (repeat
-         * the two write on reg 2)
-         */
-        data = read_rtl8225(dev, 6);
-        if (!(data & 0x00000080)) {
-                write_rtl8225(dev, 0x02, 0x0c4d);
-                force_pci_posting(dev); mdelay(200);
-                write_rtl8225(dev, 0x02, 0x044d);
-                force_pci_posting(dev); mdelay(100);
-                data = read_rtl8225(dev, 6);
-                if (!(data & 0x00000080))
-                        DMESGW("RF Calibration Failed!!!!\n");
-        }
-        mdelay(200);
-        write_rtl8225(dev, 0x0, 0x2bf);
-        for (i = 0; i < ARRAY_SIZE(rtl8225_agc); i++) {
-                write_phy_ofdm(dev, 0xb, rtl8225_agc[i]);
-                mdelay(1);
-                /* enable writing AGC table */
-                write_phy_ofdm(dev, 0xa, i + 0x80);
-                mdelay(1);
-        }
-        force_pci_posting(dev);
-        mdelay(1);
-        write_phy_ofdm(dev, 0x00, 0x01); mdelay(1);
-        write_phy_ofdm(dev, 0x01, 0x02); mdelay(1);
-        write_phy_ofdm(dev, 0x02, 0x62); mdelay(1);
-        write_phy_ofdm(dev, 0x03, 0x00); mdelay(1);
-        write_phy_ofdm(dev, 0x04, 0x00); mdelay(1);
-        write_phy_ofdm(dev, 0x05, 0x00); mdelay(1);
-        write_phy_ofdm(dev, 0x06, 0x40); mdelay(1);
-        write_phy_ofdm(dev, 0x07, 0x00); mdelay(1);
-        write_phy_ofdm(dev, 0x08, 0x40); mdelay(1);
-        write_phy_ofdm(dev, 0x09, 0xfe); mdelay(1);
-        write_phy_ofdm(dev, 0x0a, 0x08); mdelay(1);
-        write_phy_ofdm(dev, 0x0b, 0x80); mdelay(1);
-        write_phy_ofdm(dev, 0x0c, 0x01); mdelay(1);
-        write_phy_ofdm(dev, 0x0d, 0x43);
-        write_phy_ofdm(dev, 0x0e, 0xd3); mdelay(1);
-        write_phy_ofdm(dev, 0x0f, 0x38); mdelay(1);
-        write_phy_ofdm(dev, 0x10, 0x84); mdelay(1);
-        write_phy_ofdm(dev, 0x11, 0x07); mdelay(1);
-        write_phy_ofdm(dev, 0x12, 0x20); mdelay(1);
-        write_phy_ofdm(dev, 0x13, 0x20); mdelay(1);
-        write_phy_ofdm(dev, 0x14, 0x00); mdelay(1);
-        write_phy_ofdm(dev, 0x15, 0x40); mdelay(1);
-        write_phy_ofdm(dev, 0x16, 0x00); mdelay(1);
-        write_phy_ofdm(dev, 0x17, 0x40); mdelay(1);
-        write_phy_ofdm(dev, 0x18, 0xef); mdelay(1);
-        write_phy_ofdm(dev, 0x19, 0x19); mdelay(1);
-        write_phy_ofdm(dev, 0x1a, 0x20); mdelay(1);
-        write_phy_ofdm(dev, 0x1b, 0x15); mdelay(1);
-        write_phy_ofdm(dev, 0x1c, 0x04); mdelay(1);
-        write_phy_ofdm(dev, 0x1d, 0xc5); mdelay(1);
-        write_phy_ofdm(dev, 0x1e, 0x95); mdelay(1);
-        write_phy_ofdm(dev, 0x1f, 0x75); mdelay(1);
-        write_phy_ofdm(dev, 0x20, 0x1f); mdelay(1);
-        write_phy_ofdm(dev, 0x21, 0x17); mdelay(1);
-        write_phy_ofdm(dev, 0x22, 0x16); mdelay(1);
-        write_phy_ofdm(dev, 0x23, 0x80); mdelay(1); /* FIXME maybe not needed */
-        write_phy_ofdm(dev, 0x24, 0x46); mdelay(1);
-        write_phy_ofdm(dev, 0x25, 0x00); mdelay(1);
-        write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);
-        write_phy_ofdm(dev, 0x27, 0x88); mdelay(1);
-        rtl8225z2_set_gain(dev, 4);
-        write_phy_cck(dev, 0x0, 0x98); mdelay(1);
-        write_phy_cck(dev, 0x3, 0x20); mdelay(1);
-        write_phy_cck(dev, 0x4, 0x7e); mdelay(1);
-        write_phy_cck(dev, 0x5, 0x12); mdelay(1);
-        write_phy_cck(dev, 0x6, 0xfc); mdelay(1);
-        write_phy_cck(dev, 0x7, 0x78); mdelay(1);
-        write_phy_cck(dev, 0x8, 0x2e); mdelay(1);
-        write_phy_cck(dev, 0x10, 0x93); mdelay(1);
-        write_phy_cck(dev, 0x11, 0x88); mdelay(1);
-        write_phy_cck(dev, 0x12, 0x47); mdelay(1);
-        write_phy_cck(dev, 0x13, 0xd0);
-        write_phy_cck(dev, 0x19, 0x00);
-        write_phy_cck(dev, 0x1a, 0xa0);
-        write_phy_cck(dev, 0x1b, 0x08);
-        write_phy_cck(dev, 0x40, 0x86); /* CCK Carrier Sense Threshold */
-        write_phy_cck(dev, 0x41, 0x8d); mdelay(1);
-        write_phy_cck(dev, 0x42, 0x15); mdelay(1);
-        write_phy_cck(dev, 0x43, 0x18); mdelay(1);
-        write_phy_cck(dev, 0x44, 0x36); mdelay(1);
-        write_phy_cck(dev, 0x45, 0x35); mdelay(1);
-        write_phy_cck(dev, 0x46, 0x2e); mdelay(1);
-        write_phy_cck(dev, 0x47, 0x25); mdelay(1);
-        write_phy_cck(dev, 0x48, 0x1c); mdelay(1);
-        write_phy_cck(dev, 0x49, 0x12); mdelay(1);
-        write_phy_cck(dev, 0x4a, 0x09); mdelay(1);
-        write_phy_cck(dev, 0x4b, 0x04); mdelay(1);
-        write_phy_cck(dev, 0x4c, 0x05); mdelay(1);
-        write_nic_byte(dev, 0x5b, 0x0d); mdelay(1);
-        rtl8225z2_SetTXPowerLevel(dev, channel);
-        /* RX antenna default to A */
-        write_phy_cck(dev, 0x11, 0x9b); mdelay(1);              /* B: 0xDB */
-        write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);             /* B: 0x10 */
-        rtl8185_tx_antenna(dev, 0x03);                          /* B: 0x00 */
-        /* switch to high-speed 3-wire
-         * last digit. 2 for both cck and ofdm
-         */
-        write_nic_dword(dev, 0x94, 0x15c00002);
-        rtl8185_rf_pins_enable(dev);
-        rtl8225z2_rf_set_chan(dev, priv->chan);
-}
-#define MAX_DOZE_WAITING_TIMES_85B              20
-#define MAX_POLLING_24F_TIMES_87SE              10
-#define LPS_MAX_SLEEP_WAITING_TIMES_87SE        5
-bool SetZebraRFPowerState8185(struct net_device *dev,
-                              enum rt_rf_power_state eRFPowerState)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8                      btCR9346, btConfig3;
-        bool bActionAllowed = true, bTurnOffBB = true;
-        u8                      u1bTmp;
-        int                     i;
-        bool            bResult = true;
-        u8                      QueueID;
-        if (priv->SetRFPowerStateInProgress == true)
-                return false;
-        priv->SetRFPowerStateInProgress = true;
-        btCR9346 = read_nic_byte(dev, CR9346);
-        write_nic_byte(dev, CR9346, (btCR9346 | 0xC0));
-        btConfig3 = read_nic_byte(dev, CONFIG3);
-        write_nic_byte(dev, CONFIG3, (btConfig3 | CONFIG3_PARM_En));
-        switch (eRFPowerState) {
-        case RF_ON:
-                write_nic_word(dev, 0x37C, 0x00EC);
-                /* turn on AFE */
-                write_nic_byte(dev, 0x54, 0x00);
-                write_nic_byte(dev, 0x62, 0x00);
-                /* turn on RF */
-                RF_WriteReg(dev, 0x0, 0x009f); udelay(500);
-                RF_WriteReg(dev, 0x4, 0x0972); udelay(500);
-                /* turn on RF again */
-                RF_WriteReg(dev, 0x0, 0x009f); udelay(500);
-                RF_WriteReg(dev, 0x4, 0x0972); udelay(500);
-                /* turn on BB */
-                write_phy_ofdm(dev, 0x10, 0x40);
-                write_phy_ofdm(dev, 0x12, 0x40);
-                /* Avoid power down at init time. */
-                write_nic_byte(dev, CONFIG4, priv->RFProgType);
-                u1bTmp = read_nic_byte(dev, 0x24E);
-                write_nic_byte(dev, 0x24E, (u1bTmp & (~(BIT5 | BIT6))));
-                break;
-        case RF_SLEEP:
-                for (QueueID = 0, i = 0; QueueID < 6;) {
-                        if (get_curr_tx_free_desc(dev, QueueID) ==
-                                                        priv->txringcount) {
-                                QueueID++;
-                                continue;
-                        } else {
-                                priv->TxPollingTimes++;
-                                if (priv->TxPollingTimes >=
-                                        LPS_MAX_SLEEP_WAITING_TIMES_87SE) {
-                                        bActionAllowed = false;
-                                        break;
-                                } else
-                                        udelay(10);
-                        }
-                }
-                if (bActionAllowed) {
-                        /* turn off BB RXIQ matrix to cut off rx signal */
-                        write_phy_ofdm(dev, 0x10, 0x00);
-                        write_phy_ofdm(dev, 0x12, 0x00);
-                        /* turn off RF */
-                        RF_WriteReg(dev, 0x4, 0x0000);
-                        RF_WriteReg(dev, 0x0, 0x0000);
-                        /* turn off AFE except PLL */
-                        write_nic_byte(dev, 0x62, 0xff);
-                        write_nic_byte(dev, 0x54, 0xec);
-                        mdelay(1);
-                        {
-                                int i = 0;
-                                while (true) {
-                                        u8 tmp24F = read_nic_byte(dev, 0x24f);
-                                        if ((tmp24F == 0x01) ||
-                                                        (tmp24F == 0x09)) {
-                                                bTurnOffBB = true;
-                                                break;
-                                        } else {
-                                                udelay(10);
-                                                i++;
-                                                priv->TxPollingTimes++;
-                                                if (priv->TxPollingTimes >= LPS_MAX_SLEEP_WAITING_TIMES_87SE) {
-                                                        bTurnOffBB = false;
-                                                        break;
-                                                } else
-                                                        udelay(10);
-                                        }
-                                }
-                        }
-                        if (bTurnOffBB) {
-                                /* turn off BB */
-                                u1bTmp = read_nic_byte(dev, 0x24E);
-                                write_nic_byte(dev, 0x24E,
-                                                (u1bTmp | BIT5 | BIT6));
-                                /* turn off AFE PLL */
-                                write_nic_byte(dev, 0x54, 0xFC);
-                                write_nic_word(dev, 0x37C, 0x00FC);
-                        }
-                }
-                break;
-        case RF_OFF:
-                for (QueueID = 0, i = 0; QueueID < 6;) {
-                        if (get_curr_tx_free_desc(dev, QueueID) ==
-                                        priv->txringcount) {
-                                QueueID++;
-                                continue;
-                        } else {
-                                udelay(10);
-                                i++;
-                        }
-                        if (i >= MAX_DOZE_WAITING_TIMES_85B)
-                                break;
-                }
-                /* turn off BB RXIQ matrix to cut off rx signal */
-                write_phy_ofdm(dev, 0x10, 0x00);
-                write_phy_ofdm(dev, 0x12, 0x00);
-                /* turn off RF */
-                RF_WriteReg(dev, 0x4, 0x0000);
-                RF_WriteReg(dev, 0x0, 0x0000);
-                /* turn off AFE except PLL */
-                write_nic_byte(dev, 0x62, 0xff);
-                write_nic_byte(dev, 0x54, 0xec);
-                mdelay(1);
-                {
-                        int i = 0;
-                        while (true) {
-                                u8 tmp24F = read_nic_byte(dev, 0x24f);
-                                if ((tmp24F == 0x01) || (tmp24F == 0x09)) {
-                                        bTurnOffBB = true;
-                                        break;
-                                } else {
-                                        bTurnOffBB = false;
-                                        udelay(10);
-                                        i++;
-                                }
-                                if (i > MAX_POLLING_24F_TIMES_87SE)
-                                        break;
-                        }
-                }
-                if (bTurnOffBB) {
-                        /* turn off BB */
-                        u1bTmp = read_nic_byte(dev, 0x24E);
-                        write_nic_byte(dev, 0x24E, (u1bTmp | BIT5 | BIT6));
-                        /* turn off AFE PLL (80M) */
-                        write_nic_byte(dev, 0x54, 0xFC);
-                        write_nic_word(dev, 0x37C, 0x00FC);
-                }
-                break;
-        }
-        btConfig3 &= ~(CONFIG3_PARM_En);
-        write_nic_byte(dev, CONFIG3, btConfig3);
-        btCR9346 &= ~(0xC0);
-        write_nic_byte(dev, CR9346, btCR9346);
-        if (bResult && bActionAllowed)
-                priv->eRFPowerState = eRFPowerState;
-        priv->SetRFPowerStateInProgress = false;
-        return bResult && bActionAllowed;
-}
-void rtl8225z4_rf_sleep(struct net_device *dev)
-{
-        MgntActSet_RF_State(dev, RF_SLEEP, RF_CHANGE_BY_PS);
-}
-void rtl8225z4_rf_wakeup(struct net_device *dev)
-{
-        MgntActSet_RF_State(dev, RF_ON, RF_CHANGE_BY_PS);
-}
diff --git a/drivers/staging/rtl8187se/r8180_wx.c b/drivers/staging/rtl8187se/r8180_wx.c
deleted file mode 100644
index b55249170f18..000000000000
--- a/drivers/staging/rtl8187se/r8180_wx.c
+++ /dev/null
@@ -1,1409 +0,0 @@
-/*
-        This file contains wireless extension handlers.
-        This is part of rtl8180 OpenSource driver.
-        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
-        Released under the terms of GPL (General Public Licence)
-        Parts of this driver are based on the GPL part
-        of the official realtek driver.
-        Parts of this driver are based on the rtl8180 driver skeleton
-        from Patric Schenke & Andres Salomon.
-        Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver.
-        We want to thanks the Authors of those projects and the Ndiswrapper
-        project Authors.
-*/
-#include "r8180.h"
-#include "r8180_hw.h"
-#include <net/iw_handler.h>
-#include "ieee80211/dot11d.h"
-static u32 rtl8180_rates[] = {1000000, 2000000, 5500000, 11000000,
-        6000000, 9000000, 12000000, 18000000, 24000000, 36000000, 48000000, 54000000};
-#define RATE_COUNT ARRAY_SIZE(rtl8180_rates)
-static struct rtl8187se_channel_list default_channel_plan[] = {
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 36, 40, 44, 48, 52, 56, 60, 64}, 19},              /* FCC */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                                              /* IC */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},      /* ETSI */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},      /* Spain. Change to ETSI. */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},      /* France. Change to ETSI. */
-        {{14, 36, 40, 44, 48, 52, 56, 60, 64}, 9},                                              /* MKK */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 36, 40, 44, 48, 52, 56, 60, 64}, 22},  /* MKK1 */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 36, 40, 44, 48, 52, 56, 60, 64}, 21},      /* Israel */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 34, 38, 42, 46}, 17},                      /* For 11a , TELEC */
-        {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14}                                   /* For Global Domain. 1-11:active scan, 12-14 passive scan.*/   /* +YJ, 080626 */
-};
-static int r8180_wx_get_freq(struct net_device *dev,
-                             struct iw_request_info *a,
-                             union iwreq_data *wrqu, char *b)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        return ieee80211_wx_get_freq(priv->ieee80211, a, wrqu, b);
-}
-static int r8180_wx_set_key(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *key)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct iw_point *erq = &(wrqu->encoding);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        if (erq->length > 0) {
-                u32 *tkey = (u32 *) key;
-                priv->key0[0] = tkey[0];
-                priv->key0[1] = tkey[1];
-                priv->key0[2] = tkey[2];
-                priv->key0[3] = tkey[3] & 0xff;
-                DMESG("Setting wep key to %x %x %x %x",
-                      tkey[0], tkey[1], tkey[2], tkey[3]);
-                rtl8180_set_hw_wep(dev);
-        }
-        return 0;
-}
-static int r8180_wx_set_beaconinterval(struct net_device *dev,
-                                       struct iw_request_info *aa,
-                                       union iwreq_data *wrqu, char *b)
-{
-        int *parms = (int *)b;
-        int bi = parms[0];
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        DMESG("setting beacon interval to %x", bi);
-        priv->ieee80211->current_network.beacon_interval = bi;
-        rtl8180_commit(dev);
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_get_mode(struct net_device *dev, struct iw_request_info *a,
-                             union iwreq_data *wrqu, char *b)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        return ieee80211_wx_get_mode(priv->ieee80211, a, wrqu, b);
-}
-static int r8180_wx_get_rate(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        return ieee80211_wx_get_rate(priv->ieee80211, info, wrqu, extra);
-}
-static int r8180_wx_set_rate(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        int ret;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_set_rate(priv->ieee80211, info, wrqu, extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_crcmon(struct net_device *dev,
-                               struct iw_request_info *info,
-                               union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int *parms = (int *)extra;
-        int enable = (parms[0] > 0);
-        short prev = priv->crcmon;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (enable)
-                priv->crcmon = 1;
-        else
-                priv->crcmon = 0;
-        DMESG("bad CRC in monitor mode are %s",
-              priv->crcmon ? "accepted" : "rejected");
-        if (prev != priv->crcmon && priv->up)   {
-                rtl8180_down(dev);
-                rtl8180_up(dev);
-        }
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_set_mode(struct net_device *dev, struct iw_request_info *a,
-                             union iwreq_data *wrqu, char *b)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (priv->bInactivePs)  {
-                if (wrqu->mode == IW_MODE_ADHOC)
-                        IPSLeave(dev);
-        }
-        ret = ieee80211_wx_set_mode(priv->ieee80211, a, wrqu, b);
-        up(&priv->wx_sem);
-        return ret;
-}
-/* YJ,add,080819,for hidden ap */
-struct  iw_range_with_scan_capa {
-                /* Informative stuff (to choose between different interface) */
-                __u32           throughput; /* To give an idea... */
-                /* In theory this value should be the maximum benchmarked
-                 * TCP/IP throughput, because with most of these devices the
-                 * bit rate is meaningless (overhead an co) to estimate how
-                 * fast the connection will go and pick the fastest one.
-                 * I suggest people to play with Netperf or any benchmark...
-                 */
-                /* NWID (or domain id)  */
-                __u32           min_nwid; /* Minimal NWID we are able to set */
-                __u32                   max_nwid; /* Maximal NWID we are able to set */
-                /* Old Frequency (backward compat - moved lower ) */
-                __u16                   old_num_channels;
-                __u8                    old_num_frequency;
-                /* Scan capabilities */
-                __u8                    scan_capa;
-};
-/* YJ,add,080819,for hidden ap */
-static int rtl8180_wx_get_range(struct net_device *dev,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu, char *extra)
-{
-        struct iw_range *range = (struct iw_range *)extra;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u16 val;
-        int i;
-        wrqu->data.length = sizeof(*range);
-        memset(range, 0, sizeof(*range));
-        /* Let's try to keep this struct in the same order as in
-         * linux/include/wireless.h
-         */
-        /* TODO: See what values we can set, and remove the ones we can't
-         * set, or fill them with some default data.
-         */
-        /* ~5 Mb/s real (802.11b) */
-        range->throughput = 5 * 1000 * 1000;
-        /* TODO: Not used in 802.11b?   */
-/*      range->min_nwid; */     /* Minimal NWID we are able to set */
-        /* TODO: Not used in 802.11b?   */
-/*      range->max_nwid; */     /* Maximal NWID we are able to set */
-                /* Old Frequency (backward compat - moved lower ) */
-/*      range->old_num_channels; */
-/*      range->old_num_frequency; */
-/*      range->old_freq[6]; */ /* Filler to keep "version" at the same offset */
-        if (priv->rf_set_sens != NULL)
-                range->sensitivity = priv->max_sens;    /* signal level threshold range */
-        range->max_qual.qual = 100;
-        /* TODO: Find real max RSSI and stick here */
-        range->max_qual.level = 0;
-        range->max_qual.noise = -98;
-        range->max_qual.updated = 7; /* Updated all three */
-        range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
-        /* TODO: Find real 'good' to 'bad' threshold value for RSSI */
-        range->avg_qual.level = 20 + -98;
-        range->avg_qual.noise = 0;
-        range->avg_qual.updated = 7; /* Updated all three */
-        range->num_bitrates = RATE_COUNT;
-        for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++)
-                range->bitrate[i] = rtl8180_rates[i];
-        range->min_frag = MIN_FRAG_THRESHOLD;
-        range->max_frag = MAX_FRAG_THRESHOLD;
-        range->pm_capa = 0;
-        range->we_version_compiled = WIRELESS_EXT;
-        range->we_version_source = 16;
-                range->num_channels = 14;
-        for (i = 0, val = 0; i < 14; i++) {
-                /* Include only legal frequencies for some countries */
-                if ((GET_DOT11D_INFO(priv->ieee80211)->channel_map)[i+1]) {
-                                range->freq[val].i = i + 1;
-                        range->freq[val].m = ieee80211_wlan_frequencies[i] * 100000;
-                        range->freq[val].e = 1;
-                        val++;
-                } else {
-                        /* FIXME: do we need to set anything for channels */
-                        /* we don't use ? */
-                }
-                if (val == IW_MAX_FREQUENCIES)
-                        break;
-        }
-        range->num_frequency = val;
-        range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-                                                IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
-        return 0;
-}
-static int r8180_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
-                             union iwreq_data *wrqu, char *b)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret;
-        struct ieee80211_device *ieee = priv->ieee80211;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        if (wrqu->data.flags & IW_SCAN_THIS_ESSID)      {
-                struct iw_scan_req *req = (struct iw_scan_req *)b;
-                if (req->essid_len)             {
-                        ieee->current_network.ssid_len = req->essid_len;
-                        memcpy(ieee->current_network.ssid, req->essid, req->essid_len);
-                }
-        }
-        down(&priv->wx_sem);
-        if (priv->up)   {
-                priv->ieee80211->actscanning = true;
-                if (priv->bInactivePs && (priv->ieee80211->state != IEEE80211_LINKED))  {
-                        IPSLeave(dev);
-                ieee80211_softmac_ips_scan_syncro(priv->ieee80211);
-                        ret = 0;
-                }       else    {
-                        /* prevent scan in BusyTraffic */
-                        /* FIXME: Need to consider last scan time */
-                        if ((priv->link_detect.b_busy_traffic) && (true)) {
-                                ret = 0;
-                                printk("Now traffic is busy, please try later!\n");
-                        }       else
-                                /* prevent scan in BusyTraffic,end */
-                                ret = ieee80211_wx_set_scan(priv->ieee80211, a, wrqu, b);
-                }
-        }       else
-                        ret = -1;
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_scan(struct net_device *dev, struct iw_request_info *a,
-                             union iwreq_data *wrqu, char *b)
-{
-        int ret;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        down(&priv->wx_sem);
-        if (priv->up)
-                ret = ieee80211_wx_get_scan(priv->ieee80211, a, wrqu, b);
-        else
-                ret = -1;
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_essid(struct net_device *dev,
-                              struct iw_request_info *a,
-                              union iwreq_data *wrqu, char *b)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (priv->bInactivePs)
-                IPSLeave(dev);
-        ret = ieee80211_wx_set_essid(priv->ieee80211, a, wrqu, b);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_essid(struct net_device *dev,
-                              struct iw_request_info *a,
-                              union iwreq_data *wrqu, char *b)
-{
-        int ret;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_get_essid(priv->ieee80211, a, wrqu, b);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_freq(struct net_device *dev, struct iw_request_info *a,
-                             union iwreq_data *wrqu, char *b)
-{
-        int ret;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_set_freq(priv->ieee80211, a, wrqu, b);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_name(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        return ieee80211_wx_get_name(priv->ieee80211, info, wrqu, extra);
-}
-static int r8180_wx_set_frag(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        if (wrqu->frag.disabled)
-                priv->ieee80211->fts = DEFAULT_FRAG_THRESHOLD;
-        else {
-                if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
-                    wrqu->frag.value > MAX_FRAG_THRESHOLD)
-                        return -EINVAL;
-                priv->ieee80211->fts = wrqu->frag.value & ~0x1;
-        }
-        return 0;
-}
-static int r8180_wx_get_frag(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        wrqu->frag.value = priv->ieee80211->fts;
-        wrqu->frag.fixed = 0;   /* no auto select */
-        wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FRAG_THRESHOLD);
-        return 0;
-}
-static int r8180_wx_set_wap(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *awrq, char *extra)
-{
-        int ret;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_set_wap(priv->ieee80211, info, awrq, extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_wap(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        return ieee80211_wx_get_wap(priv->ieee80211, info, wrqu, extra);
-}
-static int r8180_wx_set_enc(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *key)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (priv->hw_wep)
-                ret = r8180_wx_set_key(dev, info, wrqu, key);
-        else    {
-                DMESG("Setting SW wep key");
-                ret = ieee80211_wx_set_encode(priv->ieee80211, info, wrqu, key);
-        }
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_enc(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *key)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        return ieee80211_wx_get_encode(priv->ieee80211, info, wrqu, key);
-}
-static int r8180_wx_set_scan_type(struct net_device *dev,
-                                  struct iw_request_info *aa,
-                                  union iwreq_data *wrqu, char *p)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int *parms = (int *)p;
-        int mode = parms[0];
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        priv->ieee80211->active_scan = mode;
-        return 1;
-}
-static int r8180_wx_set_retry(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int err = 0;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (wrqu->retry.flags & IW_RETRY_LIFETIME ||
-            wrqu->retry.disabled)       {
-                err = -EINVAL;
-                goto exit;
-        }
-        if (!(wrqu->retry.flags & IW_RETRY_LIMIT))      {
-                err = -EINVAL;
-                goto exit;
-        }
-        if (wrqu->retry.value > R8180_MAX_RETRY)        {
-                err = -EINVAL;
-                goto exit;
-        }
-        if (wrqu->retry.flags & IW_RETRY_MAX) {
-                priv->retry_rts = wrqu->retry.value;
-                DMESG("Setting retry for RTS/CTS data to %d", wrqu->retry.value);
-        }       else {
-                priv->retry_data = wrqu->retry.value;
-                DMESG("Setting retry for non RTS/CTS data to %d", wrqu->retry.value);
-        }
-        /* FIXME !
-         * We might try to write directly the TX config register
-         * or to restart just the (R)TX process.
-         * I'm unsure if whole reset is really needed
-         */
-        rtl8180_commit(dev);
-exit:
-        up(&priv->wx_sem);
-        return err;
-}
-static int r8180_wx_get_retry(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        wrqu->retry.disabled = 0; /* can't be disabled */
-        if ((wrqu->retry.flags & IW_RETRY_TYPE) ==
-            IW_RETRY_LIFETIME)
-                return -EINVAL;
-        if (wrqu->retry.flags & IW_RETRY_MAX) {
-                wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
-                wrqu->retry.value = priv->retry_rts;
-        } else {
-                wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
-                wrqu->retry.value = priv->retry_data;
-        }
-        return 0;
-}
-static int r8180_wx_get_sens(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->rf_set_sens == NULL)
-                return -1; /* we have not this support for this radio */
-        wrqu->sens.value = priv->sens;
-        return 0;
-}
-static int r8180_wx_set_sens(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        short err = 0;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (priv->rf_set_sens == NULL) {
-                err = -1; /* we have not this support for this radio */
-                goto exit;
-        }
-        if (priv->rf_set_sens(dev, wrqu->sens.value) == 0)
-                priv->sens = wrqu->sens.value;
-        else
-                err = -EINVAL;
-exit:
-        up(&priv->wx_sem);
-        return err;
-}
-static int r8180_wx_set_rawtx(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_set_rawtx(priv->ieee80211, info, wrqu, extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_power(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu, char *extra)
-{
-        int ret;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_get_power(priv->ieee80211, info, wrqu, extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_power(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu, char *extra)
-{
-        int ret;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        printk("=>>>>>>>>>>=============================>set power:%d, %d!\n", wrqu->power.disabled, wrqu->power.flags);
-        if (wrqu->power.disabled == 0) {
-                wrqu->power.flags |= IW_POWER_ALL_R;
-                wrqu->power.flags |= IW_POWER_TIMEOUT;
-                wrqu->power.value = 1000;
-        }
-        ret = ieee80211_wx_set_power(priv->ieee80211, info, wrqu, extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_rts(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        if (wrqu->rts.disabled)
-                priv->rts = DEFAULT_RTS_THRESHOLD;
-        else {
-                if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
-                    wrqu->rts.value > MAX_RTS_THRESHOLD)
-                        return -EINVAL;
-                priv->rts = wrqu->rts.value;
-        }
-        return 0;
-}
-static int r8180_wx_get_rts(struct net_device *dev,
-                            struct iw_request_info *info,
-                            union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        wrqu->rts.value = priv->rts;
-        wrqu->rts.fixed = 0;    /* no auto select */
-        wrqu->rts.disabled = (wrqu->rts.value == 0);
-        return 0;
-}
-static int dummy(struct net_device *dev, struct iw_request_info *a,
-                 union iwreq_data *wrqu, char *b)
-{
-        return -1;
-}
-static int r8180_wx_get_iwmode(struct net_device *dev,
-                               struct iw_request_info *info,
-                               union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct ieee80211_device *ieee;
-        int ret = 0;
-        down(&priv->wx_sem);
-        ieee = priv->ieee80211;
-        strcpy(extra, "802.11");
-        if (ieee->modulation & IEEE80211_CCK_MODULATION) {
-                strcat(extra, "b");
-                if (ieee->modulation & IEEE80211_OFDM_MODULATION)
-                        strcat(extra, "/g");
-        } else if (ieee->modulation & IEEE80211_OFDM_MODULATION)
-                strcat(extra, "g");
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_iwmode(struct net_device *dev,
-                               struct iw_request_info *info,
-                               union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct ieee80211_device *ieee = priv->ieee80211;
-        int *param = (int *)extra;
-        int ret = 0;
-        int modulation = 0, mode = 0;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (*param == 1) {
-                modulation |= IEEE80211_CCK_MODULATION;
-                mode = IEEE_B;
-        printk(KERN_INFO "B mode!\n");
-        } else if (*param == 2) {
-                modulation |= IEEE80211_OFDM_MODULATION;
-                mode = IEEE_G;
-        printk(KERN_INFO "G mode!\n");
-        } else if (*param == 3) {
-                modulation |= IEEE80211_CCK_MODULATION;
-                modulation |= IEEE80211_OFDM_MODULATION;
-                mode = IEEE_B|IEEE_G;
-        printk(KERN_INFO "B/G mode!\n");
-        }
-        if (ieee->proto_started) {
-                ieee80211_stop_protocol(ieee);
-                ieee->mode = mode;
-                ieee->modulation = modulation;
-                ieee80211_start_protocol(ieee);
-        } else {
-                ieee->mode = mode;
-                ieee->modulation = modulation;
-        }
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_preamble(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        down(&priv->wx_sem);
-        *extra = (char) priv->plcp_preamble_mode;       /* 0:auto 1:short 2:long */
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_set_preamble(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret = 0;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        if (*extra < 0 || *extra > 2)
-                ret = -1;
-        else
-                priv->plcp_preamble_mode = *((short *)extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_siglevel(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret = 0;
-        down(&priv->wx_sem);
-        /* Modify by hikaru 6.5 */
-        *((int *)extra) = priv->wstats.qual.level;/*for interface test ,it should be the priv->wstats.qual.level; */
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_get_sigqual(struct net_device *dev,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret = 0;
-        down(&priv->wx_sem);
-        /* Modify by hikaru 6.5 */
-        *((int *)extra) = priv->wstats.qual.qual;/* for interface test ,it should be the priv->wstats.qual.qual; */
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_reset_stats(struct net_device *dev,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        down(&priv->wx_sem);
-        priv->stats.txrdu = 0;
-        priv->stats.rxrdu = 0;
-        priv->stats.rxnolast = 0;
-        priv->stats.rxnodata = 0;
-        priv->stats.rxnopointer = 0;
-        priv->stats.txnperr = 0;
-        priv->stats.txresumed = 0;
-        priv->stats.rxerr = 0;
-        priv->stats.rxoverflow = 0;
-        priv->stats.rxint = 0;
-        priv->stats.txnpokint = 0;
-        priv->stats.txhpokint = 0;
-        priv->stats.txhperr = 0;
-        priv->stats.ints = 0;
-        priv->stats.shints = 0;
-        priv->stats.txoverflow = 0;
-        priv->stats.rxdmafail = 0;
-        priv->stats.txbeacon = 0;
-        priv->stats.txbeaconerr = 0;
-        priv->stats.txlpokint = 0;
-        priv->stats.txlperr = 0;
-        priv->stats.txretry = 0;/* 20060601 */
-        priv->stats.rxcrcerrmin = 0 ;
-        priv->stats.rxcrcerrmid = 0;
-        priv->stats.rxcrcerrmax = 0;
-        priv->stats.rxicverr = 0;
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_radio_on(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        priv->rf_wakeup(dev);
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_radio_off(struct net_device *dev,
-                              struct iw_request_info *info,
-                              union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        priv->rf_sleep(dev);
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_get_channelplan(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        down(&priv->wx_sem);
-        *extra = priv->channel_plan;
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_set_channelplan(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int *val = (int *)extra;
-        int i;
-        printk("-----in fun %s\n", __func__);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        /* unsigned long flags; */
-        down(&priv->wx_sem);
-        if (default_channel_plan[*val].len != 0) {
-                priv->channel_plan = *val;
-                /* Clear old channel map 8 */
-                for (i = 1; i <= MAX_CHANNEL_NUMBER; i++)
-                        GET_DOT11D_INFO(priv->ieee80211)->channel_map[i] = 0;
-                /* Set new channel map */
-                for (i = 1; i <= default_channel_plan[*val].len; i++)
-                        GET_DOT11D_INFO(priv->ieee80211)->channel_map[default_channel_plan[*val].channel[i-1]] = 1;
-        }
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_get_version(struct net_device *dev,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        /* struct ieee80211_device *ieee; */
-        down(&priv->wx_sem);
-        strcpy(extra, "1020.0808");
-        up(&priv->wx_sem);
-        return 0;
-}
-/* added by amy 080818 */
-/*receive datarate from user typing valid rate is from 2 to 108 (1 - 54M), if input 0, return to normal rate adaptive. */
-static int r8180_wx_set_forcerate(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        u8 forcerate = *extra;
-        down(&priv->wx_sem);
-        printk("==============>%s(): forcerate is %d\n", __func__, forcerate);
-        if ((forcerate == 2) || (forcerate == 4) || (forcerate == 11) || (forcerate == 22) || (forcerate == 12) ||
-                (forcerate == 18) || (forcerate == 24) || (forcerate == 36) || (forcerate == 48) || (forcerate == 72) ||
-                (forcerate == 96) || (forcerate == 108)) {
-                priv->ForcedDataRate = 1;
-                priv->ieee80211->rate = forcerate * 5;
-        }       else if (forcerate == 0)        {
-                priv->ForcedDataRate = 0;
-                printk("OK! return rate adaptive\n");
-        }       else
-                        printk("ERR: wrong rate\n");
-        up(&priv->wx_sem);
-        return 0;
-}
-static int r8180_wx_set_enc_ext(struct net_device *dev,
-                                struct iw_request_info *info,
-                                union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret = 0;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_set_encode_ext(priv->ieee80211, info, wrqu, extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_auth(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        int ret = 0;
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-        ret = ieee80211_wx_set_auth(priv->ieee80211, info, &wrqu->param, extra);
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_mlme(struct net_device *dev,
-                             struct iw_request_info *info,
-                             union iwreq_data *wrqu, char *extra)
-{
-        int ret = 0;
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-#if 1
-        ret = ieee80211_wx_set_mlme(priv->ieee80211, info, wrqu, extra);
-#endif
-        up(&priv->wx_sem);
-        return ret;
-}
-static int r8180_wx_set_gen_ie(struct net_device *dev,
-                               struct iw_request_info *info,
-                               union iwreq_data *wrqu, char *extra)
-{
-        int ret = 0;
-                struct r8180_priv *priv = ieee80211_priv(dev);
-        if (priv->ieee80211->bHwRadioOff)
-                return 0;
-        down(&priv->wx_sem);
-#if 1
-        ret = ieee80211_wx_set_gen_ie(priv->ieee80211, extra, wrqu->data.length);
-#endif
-        up(&priv->wx_sem);
-        return ret;
-}
-static const iw_handler r8180_wx_handlers[] =   {
-        IW_HANDLER(SIOCGIWNAME,         r8180_wx_get_name),
-        IW_HANDLER(SIOCSIWNWID,         dummy),
-        IW_HANDLER(SIOCGIWNWID,         dummy),
-        IW_HANDLER(SIOCSIWFREQ,         r8180_wx_set_freq),
-        IW_HANDLER(SIOCGIWFREQ,         r8180_wx_get_freq),
-        IW_HANDLER(SIOCSIWMODE,         r8180_wx_set_mode),
-        IW_HANDLER(SIOCGIWMODE,         r8180_wx_get_mode),
-        IW_HANDLER(SIOCSIWSENS,         r8180_wx_set_sens),
-        IW_HANDLER(SIOCGIWSENS,         r8180_wx_get_sens),
-        IW_HANDLER(SIOCGIWRANGE,        rtl8180_wx_get_range),
-        IW_HANDLER(SIOCSIWSPY,          dummy),
-        IW_HANDLER(SIOCGIWSPY,          dummy),
-        IW_HANDLER(SIOCSIWAP,           r8180_wx_set_wap),
-        IW_HANDLER(SIOCGIWAP,           r8180_wx_get_wap),
-        IW_HANDLER(SIOCSIWMLME,         r8180_wx_set_mlme),
-        IW_HANDLER(SIOCGIWAPLIST,       dummy),         /* deprecated */
-        IW_HANDLER(SIOCSIWSCAN,         r8180_wx_set_scan),
-        IW_HANDLER(SIOCGIWSCAN,         r8180_wx_get_scan),
-        IW_HANDLER(SIOCSIWESSID,        r8180_wx_set_essid),
-        IW_HANDLER(SIOCGIWESSID,        r8180_wx_get_essid),
-        IW_HANDLER(SIOCSIWNICKN,        dummy),
-        IW_HANDLER(SIOCGIWNICKN,        dummy),
-        IW_HANDLER(SIOCSIWRATE,         r8180_wx_set_rate),
-        IW_HANDLER(SIOCGIWRATE,         r8180_wx_get_rate),
-        IW_HANDLER(SIOCSIWRTS,          r8180_wx_set_rts),
-        IW_HANDLER(SIOCGIWRTS,          r8180_wx_get_rts),
-        IW_HANDLER(SIOCSIWFRAG,         r8180_wx_set_frag),
-        IW_HANDLER(SIOCGIWFRAG,         r8180_wx_get_frag),
-        IW_HANDLER(SIOCSIWTXPOW,        dummy),
-        IW_HANDLER(SIOCGIWTXPOW,        dummy),
-        IW_HANDLER(SIOCSIWRETRY,        r8180_wx_set_retry),
-        IW_HANDLER(SIOCGIWRETRY,        r8180_wx_get_retry),
-        IW_HANDLER(SIOCSIWENCODE,       r8180_wx_set_enc),
-        IW_HANDLER(SIOCGIWENCODE,       r8180_wx_get_enc),
-        IW_HANDLER(SIOCSIWPOWER,        r8180_wx_set_power),
-        IW_HANDLER(SIOCGIWPOWER,        r8180_wx_get_power),
-        IW_HANDLER(SIOCSIWGENIE,        r8180_wx_set_gen_ie),
-        IW_HANDLER(SIOCSIWAUTH,         r8180_wx_set_auth),
-        IW_HANDLER(SIOCSIWENCODEEXT,    r8180_wx_set_enc_ext),
-};
-static const struct iw_priv_args r8180_private_args[] = {
-        {
-                SIOCIWFIRSTPRIV + 0x0,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "badcrc"
-        },
-        {       SIOCIWFIRSTPRIV + 0x1,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x2,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "beaconint"
-        },
-        {       SIOCIWFIRSTPRIV + 0x3,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x4,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "activescan"
-        },
-        {       SIOCIWFIRSTPRIV + 0x5,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x6,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "rawtx"
-        },
-        {       SIOCIWFIRSTPRIV + 0x7,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x8,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setiwmode"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x9,
-                0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 32, "getiwmode"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0xA,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setpreamble"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0xB,
-                0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getpreamble"
-        },
-        {       SIOCIWFIRSTPRIV + 0xC,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0xD,
-                0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getrssi"
-        },
-        {       SIOCIWFIRSTPRIV + 0xE,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0xF,
-                0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getlinkqual"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x10,
-                0, 0, "resetstats"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x11,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x12,
-                0, 0, "radioon"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x13,
-                0, 0, "radiooff"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x14,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setchannel"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x15,
-                0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getchannel"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x16,
-                0, 0, "dummy"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x17,
-                0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 32, "getversion"
-        },
-        {
-                SIOCIWFIRSTPRIV + 0x18,
-                IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "setrate"
-        },
-};
-static iw_handler r8180_private_handler[] = {
-        r8180_wx_set_crcmon, /*SIOCIWSECONDPRIV*/
-        dummy,
-        r8180_wx_set_beaconinterval,
-        dummy,
-        /* r8180_wx_set_monitor_type, */
-        r8180_wx_set_scan_type,
-        dummy,
-        r8180_wx_set_rawtx,
-        dummy,
-        r8180_wx_set_iwmode,
-        r8180_wx_get_iwmode,
-        r8180_wx_set_preamble,
-        r8180_wx_get_preamble,
-        dummy,
-        r8180_wx_get_siglevel,
-        dummy,
-        r8180_wx_get_sigqual,
-        r8180_wx_reset_stats,
-        dummy,/* r8180_wx_get_stats */
-        r8180_wx_radio_on,
-        r8180_wx_radio_off,
-        r8180_wx_set_channelplan,
-        r8180_wx_get_channelplan,
-        dummy,
-        r8180_wx_get_version,
-        r8180_wx_set_forcerate,
-};
-static inline int is_same_network(struct ieee80211_network *src,
-                                  struct ieee80211_network *dst,
-                                  struct ieee80211_device *ieee)
-{
-                /* A network is only a duplicate if the channel, BSSID, ESSID
-                 * and the capability field (in particular IBSS and BSS) all match.
-                 * We treat all <hidden> with the same BSSID and channel
-                 * as one network
-                 */
-                if (src->channel != dst->channel)
-                        return 0;
-                if (memcmp(src->bssid, dst->bssid, ETH_ALEN) != 0)
-                        return 0;
-                if (ieee->iw_mode != IW_MODE_INFRA) {
-                        if (src->ssid_len != dst->ssid_len)
-                                return 0;
-                        if (memcmp(src->ssid, dst->ssid, src->ssid_len) != 0)
-                                return 0;
-                }
-                if ((src->capability & WLAN_CAPABILITY_IBSS) !=
-                    (dst->capability & WLAN_CAPABILITY_IBSS))
-                        return 0;
-                if ((src->capability & WLAN_CAPABILITY_BSS) !=
-                    (dst->capability & WLAN_CAPABILITY_BSS))
-                        return 0;
-                return 1;
-}
-/* WB modified to show signal to GUI on 18-01-2008 */
-static struct iw_statistics *r8180_get_wireless_stats(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct ieee80211_device *ieee = priv->ieee80211;
-        struct iw_statistics *wstats = &priv->wstats;
-        int tmp_level = 0;
-        int tmp_qual = 0;
-        int tmp_noise = 0;
-        if (ieee->state < IEEE80211_LINKED)     {
-                wstats->qual.qual = 0;
-                wstats->qual.level = 0;
-                wstats->qual.noise = 0;
-                wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
-                return wstats;
-        }
-        tmp_level = (&ieee->current_network)->stats.signal;
-        tmp_qual = (&ieee->current_network)->stats.signalstrength;
-        tmp_noise = (&ieee->current_network)->stats.noise;
-        wstats->qual.level = tmp_level;
-        wstats->qual.qual = tmp_qual;
-        wstats->qual.noise = tmp_noise;
-        wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
-        return wstats;
-}
-struct iw_handler_def  r8180_wx_handlers_def = {
-        .standard = r8180_wx_handlers,
-        .num_standard = ARRAY_SIZE(r8180_wx_handlers),
-        .private = r8180_private_handler,
-        .num_private = ARRAY_SIZE(r8180_private_handler),
-        .num_private_args = sizeof(r8180_private_args) / sizeof(struct iw_priv_args),
-        .get_wireless_stats = r8180_get_wireless_stats,
-        .private_args = (struct iw_priv_args *)r8180_private_args,
-};
diff --git a/drivers/staging/rtl8187se/r8180_wx.h b/drivers/staging/rtl8187se/r8180_wx.h
deleted file mode 100644
index d471520ac772..000000000000
--- a/drivers/staging/rtl8187se/r8180_wx.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
-        This is part of rtl8180 OpenSource driver - v 0.3
-        Copyright (C) Andrea Merello 2004  <andrea.merello@gmail.com>
-        Released under the terms of GPL (General Public Licence)
-        Parts of this driver are based on the GPL part of the official realtek driver
-        Parts of this driver are based on the rtl8180 driver skeleton from Patric Schenke & Andres Salomon
-        Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
-        We want to thanks the Authors of such projects and the Ndiswrapper project Authors.
-*/
-/* this file (will) contains wireless extension handlers*/
-#ifndef R8180_WX_H
-#define R8180_WX_H
-#include <linux/wireless.h>
-#include "ieee80211/ieee80211.h"
-extern struct iw_handler_def r8180_wx_handlers_def;
-#endif
diff --git a/drivers/staging/rtl8187se/r8185b_init.c b/drivers/staging/rtl8187se/r8185b_init.c
deleted file mode 100644
index cc6f100814f3..000000000000
--- a/drivers/staging/rtl8187se/r8185b_init.c
+++ /dev/null
@@ -1,1464 +0,0 @@
-/*
- * Copyright (c) Realtek Semiconductor Corp. All rights reserved.
- *
- * Module Name:
- *      r8185b_init.c
- *
- * Abstract:
- *      Hardware Initialization and Hardware IO for RTL8185B
- *
- * Major Change History:
- *      When            Who                             What
- *      ----------      ---------------         -------------------------------
- *      2006-11-15      Xiong                   Created
- *
- * Notes:
- *      This file is ported from RTL8185B Windows driver.
- *
- *
- */
-/*--------------------------Include File------------------------------------*/
-#include <linux/spinlock.h>
-#include "r8180_hw.h"
-#include "r8180.h"
-#include "r8180_rtl8225.h" /* RTL8225 Radio frontend */
-#include "r8180_93cx6.h"   /* Card EEPROM */
-#include "r8180_wx.h"
-#include "ieee80211/dot11d.h"
-/* #define CONFIG_RTL8180_IO_MAP */
-#define TC_3W_POLL_MAX_TRY_CNT 5
-static u8 MAC_REG_TABLE[][2] =  {
-        /*
-         * PAGE 0:
-         * 0x34(BRSR), 0xBE(RATE_FALLBACK_CTL), 0x1E0(ARFR) would set in
-         * HwConfigureRTL8185()
-         * 0x272(RFSW_CTRL), 0x1CE(AESMSK_QC) set in InitializeAdapter8185().
-         * 0x1F0~0x1F8  set in MacConfig_85BASIC()
-         */
-        {0x08, 0xae}, {0x0a, 0x72}, {0x5b, 0x42},
-        {0x84, 0x88}, {0x85, 0x24}, {0x88, 0x54}, {0x8b, 0xb8}, {0x8c, 0x03},
-        {0x8d, 0x40}, {0x8e, 0x00}, {0x8f, 0x00}, {0x5b, 0x18}, {0x91, 0x03},
-        {0x94, 0x0F}, {0x95, 0x32},
-        {0x96, 0x00}, {0x97, 0x07}, {0xb4, 0x22}, {0xdb, 0x00},
-        {0xf0, 0x32}, {0xf1, 0x32}, {0xf2, 0x00}, {0xf3, 0x00}, {0xf4, 0x32},
-        {0xf5, 0x43}, {0xf6, 0x00}, {0xf7, 0x00}, {0xf8, 0x46}, {0xf9, 0xa4},
-        {0xfa, 0x00}, {0xfb, 0x00}, {0xfc, 0x96}, {0xfd, 0xa4}, {0xfe, 0x00},
-        {0xff, 0x00},
-        /*
-         * PAGE 1:
-         * For Flextronics system Logo PCIHCT failure:
-         * 0x1C4~0x1CD set no-zero value to avoid PCI configuration
-         * space 0x45[7]=1
-         */
-        {0x5e, 0x01},
-        {0x58, 0x00}, {0x59, 0x00}, {0x5a, 0x04}, {0x5b, 0x00}, {0x60, 0x24},
-        {0x61, 0x97}, {0x62, 0xF0}, {0x63, 0x09}, {0x80, 0x0F}, {0x81, 0xFF},
-        {0x82, 0xFF}, {0x83, 0x03},
-        /* lzm add 080826 */
-        {0xC4, 0x22}, {0xC5, 0x22}, {0xC6, 0x22}, {0xC7, 0x22}, {0xC8, 0x22},
-        /* lzm add 080826 */
-        {0xC9, 0x22}, {0xCA, 0x22}, {0xCB, 0x22}, {0xCC, 0x22}, {0xCD, 0x22},
-        {0xe2, 0x00},
-        /* PAGE 2: */
-        {0x5e, 0x02},
-        {0x0c, 0x04}, {0x4c, 0x30}, {0x4d, 0x08}, {0x50, 0x05}, {0x51, 0xf5},
-        {0x52, 0x04}, {0x53, 0xa0}, {0x54, 0xff}, {0x55, 0xff}, {0x56, 0xff},
-        {0x57, 0xff}, {0x58, 0x08}, {0x59, 0x08}, {0x5a, 0x08}, {0x5b, 0x08},
-        {0x60, 0x08}, {0x61, 0x08}, {0x62, 0x08}, {0x63, 0x08}, {0x64, 0x2f},
-        {0x8c, 0x3f}, {0x8d, 0x3f}, {0x8e, 0x3f},
-        {0x8f, 0x3f}, {0xc4, 0xff}, {0xc5, 0xff}, {0xc6, 0xff}, {0xc7, 0xff},
-        {0xc8, 0x00}, {0xc9, 0x00}, {0xca, 0x80}, {0xcb, 0x00},
-        /* PAGE 0: */
-        {0x5e, 0x00}, {0x9f, 0x03}
-        };
-static u8  ZEBRA_AGC[] = {
-        0,
-        0x7E, 0x7E, 0x7E, 0x7E, 0x7D, 0x7C, 0x7B, 0x7A, 0x79, 0x78, 0x77, 0x76,
-        0x75, 0x74, 0x73, 0x72, 0x71, 0x70, 0x6F, 0x6E, 0x6D, 0x6C, 0x6B, 0x6A,
-        0x69, 0x68, 0x67, 0x66, 0x65, 0x64, 0x63, 0x62, 0x48, 0x47, 0x46, 0x45,
-        0x44, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24, 0x23, 0x22, 0x21, 0x08, 0x07,
-        0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f,
-        0x0f, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x15, 0x16, 0x17, 0x17, 0x18, 0x18,
-        0x19, 0x1a, 0x1a, 0x1b, 0x1b, 0x1c, 0x1c, 0x1d, 0x1d, 0x1d, 0x1e, 0x1e,
-        0x1f, 0x1f, 0x1f, 0x20, 0x20, 0x20, 0x20, 0x21, 0x21, 0x21, 0x22, 0x22,
-        0x22, 0x23, 0x23, 0x24, 0x24, 0x25, 0x25, 0x25, 0x26, 0x26, 0x27, 0x27,
-        0x2F, 0x2F, 0x2F, 0x2F, 0x2F, 0x2F, 0x2F, 0x2F
-        };
-static u32 ZEBRA_RF_RX_GAIN_TABLE[] = {
-        0x0096, 0x0076, 0x0056, 0x0036, 0x0016, 0x01f6, 0x01d6, 0x01b6,
-        0x0196, 0x0176, 0x00F7, 0x00D7, 0x00B7, 0x0097, 0x0077, 0x0057,
-        0x0037, 0x00FB, 0x00DB, 0x00BB, 0x00FF, 0x00E3, 0x00C3, 0x00A3,
-        0x0083, 0x0063, 0x0043, 0x0023, 0x0003, 0x01E3, 0x01C3, 0x01A3,
-        0x0183, 0x0163, 0x0143, 0x0123, 0x0103
-        };
-static u8 OFDM_CONFIG[] = {
-        /* OFDM reg0x06[7:0]=0xFF: Enable power saving mode in RX */
-        /* OFDM reg0x3C[4]=1'b1: Enable RX power saving mode */
-        /* ofdm 0x3a = 0x7b ,(original : 0xfb) For ECS shielding room TP test */
-        /* 0x00 */
-        0x10, 0x0F, 0x0A, 0x0C, 0x14, 0xFA, 0xFF, 0x50,
-        0x00, 0x50, 0x00, 0x00, 0x00, 0x5C, 0x00, 0x00,
-        /* 0x10 */
-        0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xA8, 0x26,
-        0x32, 0x33, 0x06, 0xA5, 0x6F, 0x55, 0xC8, 0xBB,
-        /* 0x20 */
-        0x0A, 0xE1, 0x2C, 0x4A, 0x86, 0x83, 0x34, 0x00,
-        0x4F, 0x24, 0x6F, 0xC2, 0x03, 0x40, 0x80, 0x00,
-        /* 0x30 */
-        0xC0, 0xC1, 0x58, 0xF1, 0x00, 0xC4, 0x90, 0x3e,
-        0xD8, 0x3C, 0x7B, 0x10, 0x10
-        };
-        /*---------------------------------------------------------------
-         *      Hardware IO
-         *      the code is ported from Windows source code
-         *---------------------------------------------------------------
-         */
-static u8 PlatformIORead1Byte(struct net_device *dev, u32 offset)
-{
-        return read_nic_byte(dev, offset);
-}
-static void PlatformIOWrite1Byte(struct net_device *dev, u32 offset, u8 data)
-{
-        write_nic_byte(dev, offset, data);
-        /*
-         * To make sure write operation is completed,
-         * 2005.11.09, by rcnjko.
-         */
-        read_nic_byte(dev, offset);
-}
-static void PlatformIOWrite2Byte(struct net_device *dev, u32 offset, u16 data)
-{
-        write_nic_word(dev, offset, data);
-        /*
-         * To make sure write operation is completed,
-         *  2005.11.09, by rcnjko.
-         */
-        read_nic_word(dev, offset);
-}
-static void PlatformIOWrite4Byte(struct net_device *dev, u32 offset, u32 data)
-{
-        if (offset == PhyAddr) {
-                /* For Base Band configuration. */
-                unsigned char   cmdByte;
-                unsigned long   dataBytes;
-                unsigned char   idx;
-                u8              u1bTmp;
-                cmdByte = (u8)(data & 0x000000ff);
-                dataBytes = data>>8;
-                /*
-                 *      071010, rcnjko:
-                 *      The critical section is only BB read/write race
-                 *      condition. Assumption:
-                 *      1. We assume NO one will access BB at DIRQL, otherwise,
-                 *      system will crash for
-                 *      acquiring the spinlock in such context.
-                 *      2. PlatformIOWrite4Byte() MUST NOT be recursive.
-                 */
-                /* NdisAcquireSpinLock( &(pDevice->IoSpinLock) ); */
-                for (idx = 0; idx < 30; idx++) {
-                        /* Make sure command bit is clear before access it. */
-                        u1bTmp = PlatformIORead1Byte(dev, PhyAddr);
-                        if ((u1bTmp & BIT7) == 0)
-                                break;
-                        else
-                                mdelay(10);
-                }
-                for (idx = 0; idx < 3; idx++)
-                        PlatformIOWrite1Byte(dev, offset+1+idx,
-                                             ((u8 *)&dataBytes)[idx]);
-                write_nic_byte(dev, offset, cmdByte);
-                /* NdisReleaseSpinLock( &(pDevice->IoSpinLock) ); */
-        } else {
-                write_nic_dword(dev, offset, data);
-                /*
-                 * To make sure write operation is completed, 2005.11.09,
-                 *  by rcnjko.
-                 */
-                read_nic_dword(dev, offset);
-        }
-}
-static void SetOutputEnableOfRfPins(struct net_device *dev)
-{
-        write_nic_word(dev, RFPinsEnable, 0x1bff);
-}
-static bool HwHSSIThreeWire(struct net_device *dev,
-                            u8 *pDataBuf,
-                            bool write)
-{
-        u8      TryCnt;
-        u8      u1bTmp;
-        /* Check if WE and RE are cleared. */
-        for (TryCnt = 0; TryCnt < TC_3W_POLL_MAX_TRY_CNT; TryCnt++) {
-                u1bTmp = read_nic_byte(dev, SW_3W_CMD1);
-                if ((u1bTmp & (SW_3W_CMD1_RE|SW_3W_CMD1_WE)) == 0)
-                        break;
-                udelay(10);
-        }
-        if (TryCnt == TC_3W_POLL_MAX_TRY_CNT) {
-                netdev_err(dev,
-                           "HwThreeWire(): CmdReg: %#X RE|WE bits are not clear!!\n",
-                           u1bTmp);
-        return false;
-        }
-        /* RTL8187S HSSI Read/Write Function */
-        u1bTmp = read_nic_byte(dev, RF_SW_CONFIG);
-        u1bTmp |= RF_SW_CFG_SI; /* reg08[1]=1 Serial Interface(SI) */
-        write_nic_byte(dev, RF_SW_CONFIG, u1bTmp);
-        /* jong: HW SI read must set reg84[3]=0. */
-        u1bTmp = read_nic_byte(dev, RFPinsSelect);
-        u1bTmp &= ~BIT3;
-        write_nic_byte(dev, RFPinsSelect, u1bTmp);
-        /*  Fill up data buffer for write operation. */
-        /* SI - reg274[3:0] : RF register's Address */
-        if (write)
-                write_nic_word(dev, SW_3W_DB0, *((u16 *)pDataBuf));
-        else
-                write_nic_word(dev, SW_3W_DB0, *((u16 *)pDataBuf));
-        /* Set up command: WE or RE. */
-        if (write)
-                write_nic_byte(dev, SW_3W_CMD1, SW_3W_CMD1_WE);
-        else
-                write_nic_byte(dev, SW_3W_CMD1, SW_3W_CMD1_RE);
-        /* Check if DONE is set. */
-        for (TryCnt = 0; TryCnt < TC_3W_POLL_MAX_TRY_CNT; TryCnt++) {
-                u1bTmp = read_nic_byte(dev, SW_3W_CMD1);
-                if (u1bTmp & SW_3W_CMD1_DONE)
-                        break;
-                udelay(10);
-        }
-        write_nic_byte(dev, SW_3W_CMD1, 0);
-        /* Read back data for read operation. */
-        if (!write) {
-                /* Serial Interface : reg363_362[11:0] */
-                *((u16 *)pDataBuf) = read_nic_word(dev, SI_DATA_READ);
-                *((u16 *)pDataBuf) &= 0x0FFF;
-        }
-        return true;
-}
-void RF_WriteReg(struct net_device *dev, u8 offset, u16 data)
-{
-        u16 reg = (data << 4) | (offset & 0x0f);
-        HwHSSIThreeWire(dev, (u8 *)&reg, true);
-}
-u16 RF_ReadReg(struct net_device *dev, u8 offset)
-{
-        u16 reg = offset & 0x0f;
-        HwHSSIThreeWire(dev, (u8 *)&reg, false);
-        return reg;
-}
-static u8 ReadBBPortUchar(struct net_device *dev, u32 addr)
-{
-        PlatformIOWrite4Byte(dev, PhyAddr, addr & 0xffffff7f);
-        return PlatformIORead1Byte(dev, PhyDataR);
-}
-/* by Owen on 04/07/14 for writing BB register successfully */
-static void WriteBBPortUchar(struct net_device *dev, u32 Data)
-{
-        PlatformIOWrite4Byte(dev, PhyAddr, Data);
-        ReadBBPortUchar(dev, Data);
-}
-/*
- *      Description:
- *      Perform Antenna settings with antenna diversity on 87SE.
- *              Created by Roger, 2008.01.25.
- */
-bool SetAntennaConfig87SE(struct net_device *dev,
-                          u8   DefaultAnt, /* 0: Main, 1: Aux. */
-                          bool bAntDiversity) /* 1:Enable, 0: Disable. */
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        bool   bAntennaSwitched = true;
-        /* 0x00 = disabled, 0x80 = enabled */
-        u8      ant_diversity_offset = 0x00;
-        /*
-         * printk("SetAntennaConfig87SE(): DefaultAnt(%d), bAntDiversity(%d)\n",
-         * DefaultAnt, bAntDiversity);
-         */
-        /* Threshold for antenna diversity. */
-        write_phy_cck(dev, 0x0c, 0x09); /* Reg0c : 09 */
-        if (bAntDiversity)      /*      Enable Antenna Diversity. */
-                ant_diversity_offset = 0x80;
-        if (DefaultAnt == 1) { /* aux Antenna */
-                /* Mac register, aux antenna */
-                write_nic_byte(dev, ANTSEL, 0x00);
-                /* Config CCK RX antenna. */
-                write_phy_cck(dev, 0x11, 0xbb); /* Reg11 : bb */
-                /* Reg01 : 47 | ant_diversity_offset */
-                write_phy_cck(dev, 0x01, 0x47|ant_diversity_offset);
-                /* Config OFDM RX antenna. */
-                write_phy_ofdm(dev, 0x0D, 0x54);        /* Reg0d : 54 */
-                /* Reg18 : 32 */
-                write_phy_ofdm(dev, 0x18, 0x32|ant_diversity_offset);
-        } else { /* main Antenna */
-                /* Mac register, main antenna */
-                write_nic_byte(dev, ANTSEL, 0x03);
-                /* Config CCK RX antenna.       */
-                write_phy_cck(dev, 0x11, 0x9b); /* Reg11 : 9b */
-                /* Reg01 : 47 */
-                write_phy_cck(dev, 0x01, 0x47|ant_diversity_offset);
-                /* Config OFDM RX antenna. */
-                write_phy_ofdm(dev, 0x0D, 0x5c); /* Reg0d : 5c */
-                /*Reg18 : 32 */
-                write_phy_ofdm(dev, 0x18, 0x32|ant_diversity_offset);
-        }
-        priv->CurrAntennaIndex = DefaultAnt; /* Update default settings. */
-        return  bAntennaSwitched;
-}
-/*
- *--------------------------------------------------------------
- *              Hardware Initialization.
- *              the code is ported from Windows source code
- *--------------------------------------------------------------
- */
-static void ZEBRA_Config_85BASIC_HardCode(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        u32                     i;
-        u32     addr, data;
-        u32 u4bRegOffset, u4bRegValue;
-        u16 u4bRF23, u4bRF24;
-        u8                      u1b24E;
-        int d_cut = 0;
-/*
- *===========================================================================
- *      87S_PCIE :: RADIOCFG.TXT
- *===========================================================================
- */
-        /* Page1 : reg16-reg30 */
-        RF_WriteReg(dev, 0x00, 0x013f);         mdelay(1); /* switch to page1 */
-        u4bRF23 = RF_ReadReg(dev, 0x08);        mdelay(1);
-        u4bRF24 = RF_ReadReg(dev, 0x09);        mdelay(1);
-        if (u4bRF23 == 0x818 && u4bRF24 == 0x70C) {
-                d_cut = 1;
-                netdev_info(dev, "card type changed from C- to D-cut\n");
-        }
-        /* Page0 : reg0-reg15 */
-        RF_WriteReg(dev, 0x00, 0x009f);         mdelay(1);/* 1  */
-        RF_WriteReg(dev, 0x01, 0x06e0);         mdelay(1);
-        RF_WriteReg(dev, 0x02, 0x004d);         mdelay(1);/* 2  */
-        RF_WriteReg(dev, 0x03, 0x07f1);         mdelay(1);/* 3  */
-        RF_WriteReg(dev, 0x04, 0x0975);         mdelay(1);
-        RF_WriteReg(dev, 0x05, 0x0c72);         mdelay(1);
-        RF_WriteReg(dev, 0x06, 0x0ae6);         mdelay(1);
-        RF_WriteReg(dev, 0x07, 0x00ca);         mdelay(1);
-        RF_WriteReg(dev, 0x08, 0x0e1c);         mdelay(1);
-        RF_WriteReg(dev, 0x09, 0x02f0);         mdelay(1);
-        RF_WriteReg(dev, 0x0a, 0x09d0);         mdelay(1);
-        RF_WriteReg(dev, 0x0b, 0x01ba);         mdelay(1);
-        RF_WriteReg(dev, 0x0c, 0x0640);         mdelay(1);
-        RF_WriteReg(dev, 0x0d, 0x08df);         mdelay(1);
-        RF_WriteReg(dev, 0x0e, 0x0020);         mdelay(1);
-        RF_WriteReg(dev, 0x0f, 0x0990);         mdelay(1);
-        /*  Page1 : reg16-reg30 */
-        RF_WriteReg(dev, 0x00, 0x013f);         mdelay(1);
-        RF_WriteReg(dev, 0x03, 0x0806);         mdelay(1);
-        RF_WriteReg(dev, 0x04, 0x03a7);         mdelay(1);
-        RF_WriteReg(dev, 0x05, 0x059b);         mdelay(1);
-        RF_WriteReg(dev, 0x06, 0x0081);         mdelay(1);
-        RF_WriteReg(dev, 0x07, 0x01A0);         mdelay(1);
-/*
- * Don't write RF23/RF24 to make a difference between 87S C cut and D cut.
- * asked by SD3 stevenl.
- */
-        RF_WriteReg(dev, 0x0a, 0x0001);         mdelay(1);
-        RF_WriteReg(dev, 0x0b, 0x0418);         mdelay(1);
-        if (d_cut) {
-                RF_WriteReg(dev, 0x0c, 0x0fbe);         mdelay(1);
-                RF_WriteReg(dev, 0x0d, 0x0008);         mdelay(1);
-                /* RX LO buffer */
-                RF_WriteReg(dev, 0x0e, 0x0807);         mdelay(1);
-        } else {
-                RF_WriteReg(dev, 0x0c, 0x0fbe);         mdelay(1);
-                RF_WriteReg(dev, 0x0d, 0x0008);         mdelay(1);
-                /* RX LO buffer */
-                RF_WriteReg(dev, 0x0e, 0x0806);         mdelay(1);
-        }
-        RF_WriteReg(dev, 0x0f, 0x0acc);         mdelay(1);
-        RF_WriteReg(dev, 0x00, 0x01d7);         mdelay(1); /* 6 */
-        RF_WriteReg(dev, 0x03, 0x0e00);         mdelay(1);
-        RF_WriteReg(dev, 0x04, 0x0e50);         mdelay(1);
-        for (i = 0; i <= 36; i++) {
-                RF_WriteReg(dev, 0x01, i);              mdelay(1);
-                RF_WriteReg(dev, 0x02, ZEBRA_RF_RX_GAIN_TABLE[i]); mdelay(1);
-        }
-        RF_WriteReg(dev, 0x05, 0x0203);         mdelay(1); /* 203, 343 */
-        RF_WriteReg(dev, 0x06, 0x0200);         mdelay(1); /* 400 */
-        /* switch to reg16-reg30, and HSSI disable 137 */
-        RF_WriteReg(dev, 0x00, 0x0137);         mdelay(1);
-        mdelay(10); /* Deay 10 ms. */           /* 0xfd */
-        /* Z4 synthesizer loop filter setting, 392 */
-        RF_WriteReg(dev, 0x0d, 0x0008);         mdelay(1);
-        mdelay(10); /* Deay 10 ms. */           /* 0xfd */
-        /* switch to reg0-reg15, and HSSI disable */
-        RF_WriteReg(dev, 0x00, 0x0037);         mdelay(1);
-        mdelay(10); /* Deay 10 ms. */           /* 0xfd */
-        /* CBC on, Tx Rx disable, High gain */
-        RF_WriteReg(dev, 0x04, 0x0160);         mdelay(1);
-        mdelay(10); /* Deay 10 ms. */           /* 0xfd */
-        /* Z4 setted channel 1 */
-        RF_WriteReg(dev, 0x07, 0x0080);         mdelay(1);
-        mdelay(10); /* Deay 10 ms. */           /* 0xfd */
-        RF_WriteReg(dev, 0x02, 0x088D);         mdelay(1); /* LC calibration */
-        mdelay(200); /* Deay 200 ms. */         /* 0xfd */
-        mdelay(10);  /* Deay 10 ms. */          /* 0xfd */
-        mdelay(10);  /* Deay 10 ms. */          /* 0xfd */
-        /* switch to reg16-reg30 137, and HSSI disable 137 */
-        RF_WriteReg(dev, 0x00, 0x0137);         mdelay(1);
-        mdelay(10); /* Deay 10 ms. */           /* 0xfd */
-        RF_WriteReg(dev, 0x07, 0x0000);         mdelay(1);
-        RF_WriteReg(dev, 0x07, 0x0180);         mdelay(1);
-        RF_WriteReg(dev, 0x07, 0x0220);         mdelay(1);
-        RF_WriteReg(dev, 0x07, 0x03E0);         mdelay(1);
-        /* DAC calibration off 20070702 */
-        RF_WriteReg(dev, 0x06, 0x00c1);         mdelay(1);
-        RF_WriteReg(dev, 0x0a, 0x0001);         mdelay(1);
-        /* For crystal calibration, added by Roger, 2007.12.11. */
-        if (priv->bXtalCalibration) { /* reg 30.        */
-         /*
-          *     enable crystal calibration.
-          *     RF Reg[30], (1)Xin:[12:9], Xout:[8:5],  addr[4:0].
-          *     (2)PA Pwr delay timer[15:14], default: 2.4us,
-          *     set BIT15=0
-          *     (3)RF signal on/off when calibration[13], default: on,
-          *     set BIT13=0.
-          *     So we should minus 4 BITs offset.
-          */
-                RF_WriteReg(dev, 0x0f, (priv->XtalCal_Xin<<5) |
-                            (priv->XtalCal_Xout<<1) | BIT11 | BIT9); mdelay(1);
-                netdev_info(dev, "ZEBRA_Config_85BASIC_HardCode(): (%02x)\n",
-                      (priv->XtalCal_Xin<<5) | (priv->XtalCal_Xout<<1) |
-                       BIT11 | BIT9);
-        } else {
-                /* using default value. Xin=6, Xout=6.  */
-                RF_WriteReg(dev, 0x0f, 0x0acc);         mdelay(1);
-        }
-        /* switch to reg0-reg15, and HSSI enable */
-        RF_WriteReg(dev, 0x00, 0x00bf);         mdelay(1);
-        /* Rx BB start calibration, 00c//+edward */
-        RF_WriteReg(dev, 0x0d, 0x08df);         mdelay(1);
-        /* temperature meter off */
-        RF_WriteReg(dev, 0x02, 0x004d);         mdelay(1);
-        RF_WriteReg(dev, 0x04, 0x0975);         mdelay(1); /* Rx mode */
-        mdelay(10);     /* Deay 10 ms.*/        /* 0xfe */
-        mdelay(10);     /* Deay 10 ms.*/        /* 0xfe */
-        mdelay(10);     /* Deay 10 ms.*/        /* 0xfe */
-        /* Rx mode*/    /*+edward */
-        RF_WriteReg(dev, 0x00, 0x0197);         mdelay(1);
-        /* Rx mode*/    /*+edward */
-        RF_WriteReg(dev, 0x05, 0x05ab);         mdelay(1);
-        /* Rx mode*/    /*+edward */
-        RF_WriteReg(dev, 0x00, 0x009f);         mdelay(1);
-        /* Rx mode*/    /*+edward */
-        RF_WriteReg(dev, 0x01, 0x0000);         mdelay(1);
-        /* Rx mode*/    /*+edward */
-        RF_WriteReg(dev, 0x02, 0x0000);         mdelay(1);
-        /* power save parameters. */
-        u1b24E = read_nic_byte(dev, 0x24E);
-        write_nic_byte(dev, 0x24E, (u1b24E & (~(BIT5|BIT6))));
-        /*======================================================================
-         *
-         *======================================================================
-         * CCKCONF.TXT
-         *======================================================================
-         *
-         *      [POWER SAVE] Power Saving Parameters by jong. 2007-11-27
-         *      CCK reg0x00[7]=1'b1 :power saving for TX (default)
-         *      CCK reg0x00[6]=1'b1: power saving for RX (default)
-         *      CCK reg0x06[4]=1'b1: turn off channel estimation related
-         *      circuits if not doing channel estimation.
-         *      CCK reg0x06[3]=1'b1: turn off unused circuits before cca = 1
-         *      CCK reg0x06[2]=1'b1: turn off cck's circuit if macrst =0
-         */
-        write_phy_cck(dev, 0x00, 0xc8);
-        write_phy_cck(dev, 0x06, 0x1c);
-        write_phy_cck(dev, 0x10, 0x78);
-        write_phy_cck(dev, 0x2e, 0xd0);
-        write_phy_cck(dev, 0x2f, 0x06);
-        write_phy_cck(dev, 0x01, 0x46);
-        /* power control */
-        write_nic_byte(dev, CCK_TXAGC, 0x10);
-        write_nic_byte(dev, OFDM_TXAGC, 0x1B);
-        write_nic_byte(dev, ANTSEL, 0x03);
-        /*
-         *======================================================================
-         *      AGC.txt
-         *======================================================================
-         */
-        write_phy_ofdm(dev, 0x00, 0x12);
-        for (i = 0; i < 128; i++) {
-                data = ZEBRA_AGC[i+1];
-                data = data << 8;
-                data = data | 0x0000008F;
-                addr = i + 0x80; /* enable writing AGC table */
-                addr = addr << 8;
-                addr = addr | 0x0000008E;
-                WriteBBPortUchar(dev, data);
-                WriteBBPortUchar(dev, addr);
-                WriteBBPortUchar(dev, 0x0000008E);
-        }
-        PlatformIOWrite4Byte(dev, PhyAddr, 0x00001080); /* Annie, 2006-05-05 */
-        /*
-         *======================================================================
-         *
-         *======================================================================
-         * OFDMCONF.TXT
-         *======================================================================
-         */
-        for (i = 0; i < 60; i++) {
-                u4bRegOffset = i;
-                u4bRegValue = OFDM_CONFIG[i];
-                WriteBBPortUchar(dev,
-                                (0x00000080 |
-                                (u4bRegOffset & 0x7f) |
-                                ((u4bRegValue & 0xff) << 8)));
-        }
-        /*
-         *======================================================================
-         * by amy for antenna
-         *======================================================================
-         */
-        /*
-         * Config Sw/Hw  Combinational Antenna Diversity. Added by Roger,
-         * 2008.02.26.
-         */
-        SetAntennaConfig87SE(dev, priv->bDefaultAntenna1,
-                             priv->bSwAntennaDiverity);
-}
-void UpdateInitialGain(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        /* lzm add 080826 */
-        if (priv->eRFPowerState != RF_ON) {
-                /*      Don't access BB/RF under disable PLL situation.
-                 *      RT_TRACE(COMP_DIG, DBG_LOUD, ("UpdateInitialGain -
-                 *      pHalData->eRFPowerState!=RF_ON\n"));
-                 *      Back to the original state
-                 */
-                priv->InitialGain = priv->InitialGainBackUp;
-                return;
-        }
-        switch (priv->InitialGain) {
-        case 1: /* m861dBm */
-                write_phy_ofdm(dev, 0x17, 0x26);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0x86);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfa);        mdelay(1);
-                break;
-        case 2: /* m862dBm */
-                write_phy_ofdm(dev, 0x17, 0x36);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0x86);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfa);        mdelay(1);
-                break;
-        case 3: /* m863dBm */
-                write_phy_ofdm(dev, 0x17, 0x36);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0x86);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfb);        mdelay(1);
-                break;
-        case 4: /* m864dBm */
-                write_phy_ofdm(dev, 0x17, 0x46);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0x86);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfb);        mdelay(1);
-                break;
-        case 5: /* m82dBm */
-                write_phy_ofdm(dev, 0x17, 0x46);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0x96);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfb);        mdelay(1);
-                break;
-        case 6: /* m78dBm */
-                write_phy_ofdm(dev, 0x17, 0x56);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0x96);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfc);        mdelay(1);
-                break;
-        case 7: /* m74dBm */
-                write_phy_ofdm(dev, 0x17, 0x56);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0xa6);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfc);        mdelay(1);
-                break;
-        case 8:
-                write_phy_ofdm(dev, 0x17, 0x66);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0xb6);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfc);        mdelay(1);
-                break;
-        default: /* MP */
-                write_phy_ofdm(dev, 0x17, 0x26);        mdelay(1);
-                write_phy_ofdm(dev, 0x24, 0x86);        mdelay(1);
-                write_phy_ofdm(dev, 0x05, 0xfa);        mdelay(1);
-                break;
-        }
-}
-/*
- *      Description:
- *              Tx Power tracking mechanism routine on 87SE.
- *      Created by Roger, 2007.12.11.
- */
-static void InitTxPwrTracking87SE(struct net_device *dev)
-{
-        u32     u4bRfReg;
-        u4bRfReg = RF_ReadReg(dev, 0x02);
-        /* Enable Thermal meter indication.     */
-        RF_WriteReg(dev, 0x02, u4bRfReg|PWR_METER_EN);          mdelay(1);
-}
-static void PhyConfig8185(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-                write_nic_dword(dev, RCR, priv->ReceiveConfig);
-           priv->RFProgType = read_nic_byte(dev, CONFIG4) & 0x03;
-        /*  RF config */
-        ZEBRA_Config_85BASIC_HardCode(dev);
-        /* Set default initial gain state to 4, approved by SD3 DZ, by Bruce,
-         * 2007-06-06.
-         */
-        if (priv->bDigMechanism) {
-                if (priv->InitialGain == 0)
-                        priv->InitialGain = 4;
-        }
-        /*
-         *      Enable thermal meter indication to implement TxPower tracking
-         *      on 87SE. We initialize thermal meter here to avoid unsuccessful
-         *      configuration. Added by Roger, 2007.12.11.
-         */
-        if (priv->bTxPowerTrack)
-                InitTxPwrTracking87SE(dev);
-        priv->InitialGainBackUp = priv->InitialGain;
-        UpdateInitialGain(dev);
-        return;
-}
-static void HwConfigureRTL8185(struct net_device *dev)
-{
-        /*
-         * RTL8185_TODO: Determine Retrylimit, TxAGC,
-         * AutoRateFallback control.
-         */
-        u8 bUNIVERSAL_CONTROL_RL = 0;
-        u8 bUNIVERSAL_CONTROL_AGC = 1;
-        u8 bUNIVERSAL_CONTROL_ANT = 1;
-        u8 bAUTO_RATE_FALLBACK_CTL = 1;
-        u8 val8;
-        write_nic_word(dev, BRSR, 0x0fff);
-        /* Retry limit */
-        val8 = read_nic_byte(dev, CW_CONF);
-        if (bUNIVERSAL_CONTROL_RL)
-                val8 = val8 & 0xfd;
-        else
-                val8 = val8 | 0x02;
-        write_nic_byte(dev, CW_CONF, val8);
-        /* Tx AGC */
-        val8 = read_nic_byte(dev, TXAGC_CTL);
-        if (bUNIVERSAL_CONTROL_AGC) {
-                write_nic_byte(dev, CCK_TXAGC, 128);
-                write_nic_byte(dev, OFDM_TXAGC, 128);
-                val8 = val8 & 0xfe;
-        } else {
-                val8 = val8 | 0x01;
-        }
-        write_nic_byte(dev, TXAGC_CTL, val8);
-        /* Tx Antenna including Feedback control */
-        val8 = read_nic_byte(dev, TXAGC_CTL);
-        if (bUNIVERSAL_CONTROL_ANT) {
-                write_nic_byte(dev, ANTSEL, 0x00);
-                val8 = val8 & 0xfd;
-        } else {
-                val8 = val8 & (val8|0x02); /* xiong-2006-11-15 */
-        }
-        write_nic_byte(dev, TXAGC_CTL, val8);
-        /* Auto Rate fallback control   */
-        val8 = read_nic_byte(dev, RATE_FALLBACK);
-        val8 &= 0x7c;
-        if (bAUTO_RATE_FALLBACK_CTL) {
-                val8 |= RATE_FALLBACK_CTL_ENABLE | RATE_FALLBACK_CTL_AUTO_STEP1;
-                /* <RJ_TODO_8185B> We shall set up the ARFR according
-                 * to user's setting.
-                 */
-                PlatformIOWrite2Byte(dev, ARFR, 0x0fff); /* set 1M ~ 54Mbps. */
-        }
-        write_nic_byte(dev, RATE_FALLBACK, val8);
-}
-static void MacConfig_85BASIC_HardCode(struct net_device *dev)
-{
-        /*
-         *======================================================================
-         * MACREG.TXT
-         *======================================================================
-         */
-        int nLinesRead = 0;
-        u32 u4bRegOffset, u4bRegValue, u4bPageIndex = 0;
-        int i;
-        nLinesRead = sizeof(MAC_REG_TABLE)/2;
-        for (i = 0; i < nLinesRead; i++) { /* nLinesRead=101 */
-                u4bRegOffset = MAC_REG_TABLE[i][0];
-                u4bRegValue = MAC_REG_TABLE[i][1];
-                                if (u4bRegOffset == 0x5e)
-                                        u4bPageIndex = u4bRegValue;
-                                else
-                                        u4bRegOffset |= (u4bPageIndex << 8);
-                write_nic_byte(dev, u4bRegOffset, (u8)u4bRegValue);
-        }
-        /* ================================================================= */
-}
-static void MacConfig_85BASIC(struct net_device *dev)
-{
-        u8                      u1DA;
-        MacConfig_85BASIC_HardCode(dev);
-        /* ================================================================= */
-        /* Follow TID_AC_MAP of WMac. */
-        write_nic_word(dev, TID_AC_MAP, 0xfa50);
-        /* Interrupt Migration, Jong suggested we use set 0x0000 first,
-         * 2005.12.14, by rcnjko.
-         */
-        write_nic_word(dev, IntMig, 0x0000);
-        /* Prevent TPC to cause CRC error. Added by Annie, 2006-06-10. */
-        PlatformIOWrite4Byte(dev, 0x1F0, 0x00000000);
-        PlatformIOWrite4Byte(dev, 0x1F4, 0x00000000);
-        PlatformIOWrite1Byte(dev, 0x1F8, 0x00);
-        /* Asked for by SD3 CM Lin, 2006.06.27, by rcnjko. */
-        /*
-         *  power save parameter based on
-         * "87SE power save parameters 20071127.doc", as follow.
-         */
-        /* Enable DA10 TX power saving */
-        u1DA = read_nic_byte(dev, PHYPR);
-        write_nic_byte(dev, PHYPR, (u1DA | BIT2));
-        /* POWER: */
-        write_nic_word(dev, 0x360, 0x1000);
-        write_nic_word(dev, 0x362, 0x1000);
-        /* AFE. */
-        write_nic_word(dev, 0x370, 0x0560);
-        write_nic_word(dev, 0x372, 0x0560);
-        write_nic_word(dev, 0x374, 0x0DA4);
-        write_nic_word(dev, 0x376, 0x0DA4);
-        write_nic_word(dev, 0x378, 0x0560);
-        write_nic_word(dev, 0x37A, 0x0560);
-        write_nic_word(dev, 0x37C, 0x00EC);
-        write_nic_word(dev, 0x37E, 0x00EC); /* +edward */
-        write_nic_byte(dev, 0x24E, 0x01);
-}
-static u8 GetSupportedWirelessMode8185(struct net_device *dev)
-{
-        return WIRELESS_MODE_B | WIRELESS_MODE_G;
-}
-static void
-ActUpdateChannelAccessSetting(struct net_device *dev,
-                              enum wireless_mode mode,
-                              struct chnl_access_setting *chnl_access_setting)
-{
-        AC_CODING       eACI;
-        /*
-         *      <RJ_TODO_8185B>
-         *      TODO: We still don't know how to set up these registers,
-         *      just follow WMAC to verify 8185B FPAG.
-         *
-         *      <RJ_TODO_8185B>
-         *      Jong said CWmin/CWmax register are not functional in 8185B,
-         *      so we shall fill channel access realted register into AC
-         *      parameter registers,
-         *      even in nQBss.
-         */
-        /* Suggested by Jong, 2005.12.08. */
-        chnl_access_setting->sifs_timer = 0x22;
-        chnl_access_setting->difs_timer = 0x1C; /* 2006.06.02, by rcnjko. */
-        chnl_access_setting->slot_time_timer = 9; /* 2006.06.02, by rcnjko. */
-        /*
-         * Suggested by wcchu, it is the default value of EIFS register,
-         * 2005.12.08.
-         */
-        chnl_access_setting->eifs_timer = 0x5B;
-        chnl_access_setting->cwmin_index = 3; /* 2006.06.02, by rcnjko. */
-        chnl_access_setting->cwmax_index = 7; /* 2006.06.02, by rcnjko. */
-        write_nic_byte(dev, SIFS, chnl_access_setting->sifs_timer);
-        /*
-         * Rewrited from directly use PlatformEFIOWrite1Byte(),
-         * by Annie, 2006-03-29.
-         */
-        write_nic_byte(dev, SLOT, chnl_access_setting->slot_time_timer);
-        write_nic_byte(dev, EIFS, chnl_access_setting->eifs_timer);
-        /*
-         * <RJ_EXPR_QOS> Suggested by wcchu, it is the default value of EIFS
-         * register, 2005.12.08.
-         */
-        write_nic_byte(dev, AckTimeOutReg, 0x5B);
-        for (eACI = 0; eACI < AC_MAX; eACI++)
-                write_nic_byte(dev, ACM_CONTROL, 0);
-}
-static void ActSetWirelessMode8185(struct net_device *dev, u8 btWirelessMode)
-{
-        struct  r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        struct  ieee80211_device *ieee = priv->ieee80211;
-        u8      btSupportedWirelessMode = GetSupportedWirelessMode8185(dev);
-        if ((btWirelessMode & btSupportedWirelessMode) == 0)    {
-                /*
-                 * Don't switch to unsupported wireless mode, 2006.02.15,
-                 * by rcnjko.
-                 */
-                DMESGW("ActSetWirelessMode8185(): WirelessMode(%d) is not supported (%d)!\n",
-                        btWirelessMode, btSupportedWirelessMode);
-                return;
-        }
-        /* 1. Assign wireless mode to switch if necessary. */
-        if (btWirelessMode == WIRELESS_MODE_AUTO) {
-                if ((btSupportedWirelessMode & WIRELESS_MODE_A)) {
-                        btWirelessMode = WIRELESS_MODE_A;
-                } else if (btSupportedWirelessMode & WIRELESS_MODE_G) {
-                                btWirelessMode = WIRELESS_MODE_G;
-                } else if ((btSupportedWirelessMode & WIRELESS_MODE_B)) {
-                                btWirelessMode = WIRELESS_MODE_B;
-                } else {
-                        DMESGW("ActSetWirelessMode8185(): No valid wireless mode supported, btSupportedWirelessMode(%x)!!!\n",
-                               btSupportedWirelessMode);
-                        btWirelessMode = WIRELESS_MODE_B;
-                }
-        }
-        /*
-         * 2. Swtich band: RF or BB specific actions,
-         * for example, refresh tables in omc8255, or change initial gain if
-         * necessary. Nothing to do for Zebra to switch band. Update current
-         * wireless mode if we switch to specified band successfully.
-         */
-        ieee->mode = (enum wireless_mode)btWirelessMode;
-        /* 3. Change related setting. */
-        if (ieee->mode == WIRELESS_MODE_A)
-                DMESG("WIRELESS_MODE_A\n");
-        else if (ieee->mode == WIRELESS_MODE_B)
-                DMESG("WIRELESS_MODE_B\n");
-        else if (ieee->mode == WIRELESS_MODE_G)
-                DMESG("WIRELESS_MODE_G\n");
-        ActUpdateChannelAccessSetting(dev, ieee->mode,
-                                      &priv->ChannelAccessSetting);
-}
-void rtl8185b_irq_enable(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        priv->irq_enabled = 1;
-        write_nic_dword(dev, IMR, priv->IntrMask);
-}
-static void MgntDisconnectIBSS(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        u8 i;
-        for (i = 0; i < 6; i++)
-                priv->ieee80211->current_network.bssid[i] = 0x55;
-        priv->ieee80211->state = IEEE80211_NOLINK;
-        /*
-         *      Stop Beacon.
-         *
-         *      Vista add a Adhoc profile, HW radio off until
-         *      OID_DOT11_RESET_REQUEST Driver would set MSR=NO_LINK,
-         *      then HW Radio ON, MgntQueue Stuck. Because Bcn DMA isn't
-         *      complete, mgnt queue would stuck until Bcn packet send.
-         *
-         *      Disable Beacon Queue Own bit, suggested by jong
-         */
-        ieee80211_stop_send_beacons(priv->ieee80211);
-        priv->ieee80211->link_change(dev);
-        notify_wx_assoc_event(priv->ieee80211);
-}
-static void MlmeDisassociateRequest(struct net_device *dev, u8 *asSta, u8 asRsn)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        u8 i;
-        SendDisassociation(priv->ieee80211, asSta, asRsn);
-        if (memcmp(priv->ieee80211->current_network.bssid, asSta, 6) == 0) {
-                /* ShuChen TODO: change media status. */
-                for (i = 0; i < 6; i++)
-                        priv->ieee80211->current_network.bssid[i] = 0x22;
-                ieee80211_disassociate(priv->ieee80211);
-        }
-}
-static void MgntDisconnectAP(struct net_device *dev, u8 asRsn)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        /*
-         * Commented out by rcnjko, 2005.01.27:
-         * I move SecClearAllKeys() to MgntActSet_802_11_DISASSOCIATE().
-         *
-         *      2004/09/15, kcwu, the key should be cleared, or the new
-         *      handshaking will not success
-         *
-         *      In WPA WPA2 need to Clear all key ... because new key will set
-         *      after new handshaking. 2004.10.11, by rcnjko.
-         */
-        MlmeDisassociateRequest(dev, priv->ieee80211->current_network.bssid,
-                                asRsn);
-        priv->ieee80211->state = IEEE80211_NOLINK;
-}
-static bool MgntDisconnect(struct net_device *dev, u8 asRsn)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        /*
-         *      Schedule an workitem to wake up for ps mode, 070109, by rcnjko.
-         */
-        if (IS_DOT11D_ENABLE(priv->ieee80211))
-                Dot11d_Reset(priv->ieee80211);
-        /* In adhoc mode, update beacon frame. */
-        if (priv->ieee80211->state == IEEE80211_LINKED) {
-                if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
-                        MgntDisconnectIBSS(dev);
-                if (priv->ieee80211->iw_mode == IW_MODE_INFRA) {
-                        /*
-                         *      We clear key here instead of MgntDisconnectAP()
-                         *      because that MgntActSet_802_11_DISASSOCIATE()
-                         *      is an interface called by OS, e.g.
-                         *      OID_802_11_DISASSOCIATE in Windows while as
-                         *      MgntDisconnectAP() is used to handle
-                         *      disassociation related things to AP, e.g. send
-                         *      Disassoc frame to AP.  2005.01.27, by rcnjko.
-                         */
-                        MgntDisconnectAP(dev, asRsn);
-                }
-                /* Indicate Disconnect, 2005.02.23, by rcnjko.  */
-        }
-        return true;
-}
-/*
- *      Description:
- *              Chang RF Power State.
- *              Note that, only MgntActSet_RF_State() is allowed to set
- *              HW_VAR_RF_STATE.
- *
- *      Assumption:
- *              PASSIVE LEVEL.
- */
-static bool SetRFPowerState(struct net_device *dev,
-                            enum rt_rf_power_state eRFPowerState)
-{
-        struct  r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        bool    bResult = false;
-        if (eRFPowerState == priv->eRFPowerState)
-                return bResult;
-        bResult = SetZebraRFPowerState8185(dev, eRFPowerState);
-        return bResult;
-}
-bool MgntActSet_RF_State(struct net_device *dev, enum rt_rf_power_state StateToSet,
-                         u32 ChangeSource)
-{
-        struct  r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        bool    bActionAllowed = false;
-        bool    bConnectBySSID = false;
-        enum rt_rf_power_state rtState;
-        u16     RFWaitCounter = 0;
-        unsigned long flag;
-        /*
-         *      Prevent the race condition of RF state change. By Bruce,
-         *      2007-11-28. Only one thread can change the RF state at one time,
-         *      and others should wait to be executed.
-         */
-        while (true) {
-                spin_lock_irqsave(&priv->rf_ps_lock, flag);
-                if (priv->RFChangeInProgress) {
-                        spin_unlock_irqrestore(&priv->rf_ps_lock, flag);
-                        /*  Set RF after the previous action is done.   */
-                        while (priv->RFChangeInProgress) {
-                                RFWaitCounter++;
-                                udelay(1000); /* 1 ms   */
-                                /*
-                                 *      Wait too long, return FALSE to avoid
-                                 *      to be stuck here.
-                                 */
-                                if (RFWaitCounter > 1000) { /* 1sec */
-                                        netdev_info(dev, "MgntActSet_RF_State(): Wait too long to set RF\n");
-                                        /* TODO: Reset RF state? */
-                                        return false;
-                                }
-                        }
-                } else {
-                        priv->RFChangeInProgress = true;
-                        spin_unlock_irqrestore(&priv->rf_ps_lock, flag);
-                        break;
-                }
-        }
-        rtState = priv->eRFPowerState;
-        switch (StateToSet) {
-        case RF_ON:
-                /*
-                 *      Turn On RF no matter the IPS setting because we need to
-                 *      update the RF state to Ndis under Vista, or the Windows
-                 *      does not allow the driver to perform site survey any
-                 *      more. By Bruce, 2007-10-02.
-                 */
-                priv->RfOffReason &= (~ChangeSource);
-                if (!priv->RfOffReason) {
-                        priv->RfOffReason = 0;
-                        bActionAllowed = true;
-                        if (rtState == RF_OFF &&
-                            ChangeSource >= RF_CHANGE_BY_HW)
-                                bConnectBySSID = true;
-                }
-                break;
-        case RF_OFF:
-                 /* 070125, rcnjko: we always keep connected in AP mode. */
-                if (priv->RfOffReason > RF_CHANGE_BY_IPS) {
-                        /*
-                         *      060808, Annie:
-                         *      Disconnect to current BSS when radio off.
-                         *      Asked by QuanTa.
-                         *
-                         *      Calling MgntDisconnect() instead of
-                         *      MgntActSet_802_11_DISASSOCIATE(), because
-                         *      we do NOT need to set ssid to dummy ones.
-                         */
-                        MgntDisconnect(dev, disas_lv_ss);
-                        /*
-                         *      Clear content of bssDesc[] and bssDesc4Query[]
-                         *      to avoid reporting old bss to UI.
-                         */
-                }
-                priv->RfOffReason |= ChangeSource;
-                bActionAllowed = true;
-                break;
-        case RF_SLEEP:
-                priv->RfOffReason |= ChangeSource;
-                bActionAllowed = true;
-                break;
-        default:
-                break;
-        }
-        if (bActionAllowed) {
-                /* Config HW to the specified mode. */
-                SetRFPowerState(dev, StateToSet);
-        }
-        /* Release RF spinlock  */
-        spin_lock_irqsave(&priv->rf_ps_lock, flag);
-        priv->RFChangeInProgress = false;
-        spin_unlock_irqrestore(&priv->rf_ps_lock, flag);
-        return bActionAllowed;
-}
-static void InactivePowerSave(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        /*
-         *      This flag "bSwRfProcessing", indicates the status of IPS
-         *      procedure, should be set if the IPS workitem is really
-         *      scheduled. The old code, sets this flag before scheduling the
-         *      IPS workitem and however, at the same time the previous IPS
-         *      workitem did not end yet, fails to schedule the current
-         *      workitem. Thus, bSwRfProcessing blocks the IPS procedure of
-         *      switching RF.
-         */
-        priv->bSwRfProcessing = true;
-        MgntActSet_RF_State(dev, priv->eInactivePowerState, RF_CHANGE_BY_IPS);
-        /*
-         *      To solve CAM values miss in RF OFF, rewrite CAM values after
-         *      RF ON. By Bruce, 2007-09-20.
-         */
-        priv->bSwRfProcessing = false;
-}
-/*
- *      Description:
- *              Enter the inactive power save mode. RF will be off
- */
-void IPSEnter(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        enum rt_rf_power_state rtState;
-        if (priv->bInactivePs) {
-                rtState = priv->eRFPowerState;
-                /*
-                 *      Do not enter IPS in the following conditions:
-                 *      (1) RF is already OFF or
-                 *      Sleep (2) bSwRfProcessing (indicates the IPS is still
-                 *      under going) (3) Connected (only disconnected can
-                 *      trigger IPS)(4) IBSS (send Beacon)
-                 *      (5) AP mode (send Beacon)
-                 */
-                if (rtState == RF_ON && !priv->bSwRfProcessing
-                        && (priv->ieee80211->state != IEEE80211_LINKED)) {
-                        priv->eInactivePowerState = RF_OFF;
-                        InactivePowerSave(dev);
-                }
-        }
-}
-void IPSLeave(struct net_device *dev)
-{
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        enum rt_rf_power_state rtState;
-        if (priv->bInactivePs) {
-                rtState = priv->eRFPowerState;
-                if ((rtState == RF_OFF || rtState == RF_SLEEP) &&
-                    !priv->bSwRfProcessing
-                    && priv->RfOffReason <= RF_CHANGE_BY_IPS) {
-                        priv->eInactivePowerState = RF_ON;
-                        InactivePowerSave(dev);
-                }
-        }
-}
-void rtl8185b_adapter_start(struct net_device *dev)
-{
-        struct r8180_priv *priv = ieee80211_priv(dev);
-        struct ieee80211_device *ieee = priv->ieee80211;
-        u8 SupportedWirelessMode;
-        u8 InitWirelessMode;
-        u8 bInvalidWirelessMode = 0;
-        u8 tmpu8;
-        u8 btCR9346;
-        u8 TmpU1b;
-        u8 btPSR;
-        write_nic_byte(dev, 0x24e, (BIT5|BIT6|BIT0));
-        rtl8180_reset(dev);
-        priv->dma_poll_mask = 0;
-        priv->dma_poll_stop_mask = 0;
-        HwConfigureRTL8185(dev);
-        write_nic_dword(dev, MAC0, ((u32 *)dev->dev_addr)[0]);
-        write_nic_word(dev, MAC4, ((u32 *)dev->dev_addr)[1] & 0xffff);
-        /* default network type to 'No Link' */
-        write_nic_byte(dev, MSR, read_nic_byte(dev, MSR) & 0xf3);
-        write_nic_word(dev, BcnItv, 100);
-        write_nic_word(dev, AtimWnd, 2);
-        PlatformIOWrite2Byte(dev, FEMR, 0xFFFF);
-        write_nic_byte(dev, WPA_CONFIG, 0);
-        MacConfig_85BASIC(dev);
-        /* Override the RFSW_CTRL (MAC offset 0x272-0x273), 2006.06.07,
-         * by rcnjko.
-         */
-        /* BT_DEMO_BOARD type */
-        PlatformIOWrite2Byte(dev, RFSW_CTRL, 0x569a);
-        /*
-         *---------------------------------------------------------------------
-         *      Set up PHY related.
-         *---------------------------------------------------------------------
-         */
-        /* Enable Config3.PARAM_En to revise AnaaParm. */
-        write_nic_byte(dev, CR9346, 0xc0); /* enable config register write */
-        tmpu8 = read_nic_byte(dev, CONFIG3);
-        write_nic_byte(dev, CONFIG3, (tmpu8 | CONFIG3_PARM_En));
-        /* Turn on Analog power. */
-        /* Asked for by William, otherwise, MAC 3-wire can't work,
-         * 2006.06.27, by rcnjko.
-         */
-        write_nic_dword(dev, ANAPARAM2, ANAPARM2_ASIC_ON);
-        write_nic_dword(dev, ANAPARAM, ANAPARM_ASIC_ON);
-        write_nic_word(dev, ANAPARAM3, 0x0010);
-        write_nic_byte(dev, CONFIG3, tmpu8);
-        write_nic_byte(dev, CR9346, 0x00);
-        /* enable EEM0 and EEM1 in 9346CR */
-        btCR9346 = read_nic_byte(dev, CR9346);
-        write_nic_byte(dev, CR9346, (btCR9346 | 0xC0));
-        /* B cut use LED1 to control HW RF on/off */
-        TmpU1b = read_nic_byte(dev, CONFIG5);
-        TmpU1b = TmpU1b & ~BIT3;
-        write_nic_byte(dev, CONFIG5, TmpU1b);
-        /* disable EEM0 and EEM1 in 9346CR */
-        btCR9346 &= ~(0xC0);
-        write_nic_byte(dev, CR9346, btCR9346);
-        /* Enable Led (suggested by Jong) */
-        /* B-cut RF Radio on/off  5e[3]=0 */
-        btPSR = read_nic_byte(dev, PSR);
-        write_nic_byte(dev, PSR, (btPSR | BIT3));
-        /* setup initial timing for RFE. */
-        write_nic_word(dev, RFPinsOutput, 0x0480);
-        SetOutputEnableOfRfPins(dev);
-        write_nic_word(dev, RFPinsSelect, 0x2488);
-        /* PHY config. */
-        PhyConfig8185(dev);
-        /*
-         *      We assume RegWirelessMode has already been initialized before,
-         *      however, we has to validate the wireless mode here and provide a
-         *      reasonable initialized value if necessary. 2005.01.13,
-         *      by rcnjko.
-         */
-        SupportedWirelessMode = GetSupportedWirelessMode8185(dev);
-        if ((ieee->mode != WIRELESS_MODE_B) &&
-                (ieee->mode != WIRELESS_MODE_G) &&
-                (ieee->mode != WIRELESS_MODE_A) &&
-                (ieee->mode != WIRELESS_MODE_AUTO)) {
-                /* It should be one of B, G, A, or AUTO. */
-                bInvalidWirelessMode = 1;
-        } else {
-        /* One of B, G, A, or AUTO. */
-                /* Check if the wireless mode is supported by RF. */
-                if      ((ieee->mode != WIRELESS_MODE_AUTO) &&
-                        (ieee->mode & SupportedWirelessMode) == 0) {
-                        bInvalidWirelessMode = 1;
-                }
-        }
-        if (bInvalidWirelessMode || ieee->mode == WIRELESS_MODE_AUTO) {
-                /* Auto or other invalid value. */
-                /* Assigne a wireless mode to initialize. */
-                if ((SupportedWirelessMode & WIRELESS_MODE_A)) {
-                        InitWirelessMode = WIRELESS_MODE_A;
-                } else if ((SupportedWirelessMode & WIRELESS_MODE_G)) {
-                        InitWirelessMode = WIRELESS_MODE_G;
-                } else if ((SupportedWirelessMode & WIRELESS_MODE_B)) {
-                        InitWirelessMode = WIRELESS_MODE_B;
-                } else {
-                        DMESGW("InitializeAdapter8185(): No valid wireless mode supported, SupportedWirelessMode(%x)!!!\n",
-                                 SupportedWirelessMode);
-                        InitWirelessMode = WIRELESS_MODE_B;
-                }
-                /* Initialize RegWirelessMode if it is not a valid one. */
-                if (bInvalidWirelessMode)
-                        ieee->mode = (enum wireless_mode)InitWirelessMode;
-        } else {
-        /* One of B, G, A. */
-                InitWirelessMode = ieee->mode;
-        }
-        priv->eRFPowerState = RF_OFF;
-        priv->RfOffReason = 0;
-        {
-                MgntActSet_RF_State(dev, RF_ON, 0);
-        }
-                /*
-                 * If inactive power mode is enabled, disable rf while in
-                 * disconnected state.
-                 */
-        if (priv->bInactivePs)
-                MgntActSet_RF_State(dev , RF_OFF, RF_CHANGE_BY_IPS);
-        ActSetWirelessMode8185(dev, (u8)(InitWirelessMode));
-        /* ----------------------------------------------------------------- */
-        rtl8185b_irq_enable(dev);
-        netif_start_queue(dev);
-}
-void rtl8185b_rx_enable(struct net_device *dev)
-{
-        u8 cmd;
-        /* for now we accept data, management & ctl frame*/
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        if (dev->flags & IFF_PROMISC)
-                DMESG("NIC in promisc mode");
-        if (priv->ieee80211->iw_mode == IW_MODE_MONITOR || dev->flags &
-            IFF_PROMISC) {
-                priv->ReceiveConfig = priv->ReceiveConfig & (~RCR_APM);
-                priv->ReceiveConfig = priv->ReceiveConfig | RCR_AAP;
-        }
-        if (priv->ieee80211->iw_mode == IW_MODE_MONITOR)
-                priv->ReceiveConfig = priv->ReceiveConfig | RCR_ACF |
-                                      RCR_APWRMGT | RCR_AICV;
-        if (priv->crcmon == 1 && priv->ieee80211->iw_mode == IW_MODE_MONITOR)
-                priv->ReceiveConfig = priv->ReceiveConfig | RCR_ACRC32;
-        write_nic_dword(dev, RCR, priv->ReceiveConfig);
-        fix_rx_fifo(dev);
-        cmd = read_nic_byte(dev, CMD);
-        write_nic_byte(dev, CMD, cmd | (1<<CMD_RX_ENABLE_SHIFT));
-}
-void rtl8185b_tx_enable(struct net_device *dev)
-{
-        u8 cmd;
-        u8 byte;
-        struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        write_nic_dword(dev, TCR, priv->TransmitConfig);
-        byte = read_nic_byte(dev, MSR);
-        byte |= MSR_LINK_ENEDCA;
-        write_nic_byte(dev, MSR, byte);
-        fix_tx_fifo(dev);
-        cmd = read_nic_byte(dev, CMD);
-        write_nic_byte(dev, CMD, cmd | (1<<CMD_TX_ENABLE_SHIFT));
-}
diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
index 636ec553ae83..e305d43ebd06 100644
--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
@@ -545,20 +545,18 @@ static struct recv_frame *decryptor(struct adapter *padapter,
 static struct recv_frame *portctrl(struct adapter *adapter,
                                   struct recv_frame *precv_frame)
 {
-        u8   *psta_addr = NULL, *ptr;
+        u8   *psta_addr, *ptr;
        uint  auth_alg;
        struct recv_frame *pfhdr;
        struct sta_info *psta;
        struct sta_priv *pstapriv;
        struct recv_frame *prtnframe;
-        u16     ether_type = 0;
+        u16     ether_type;
        u16  eapol_type = 0x888e;/* for Funia BD's WPA issue */
        struct rx_pkt_attrib *pattrib;
-        __be16 be_tmp;
        pstapriv = &adapter->stapriv;
-        psta = rtw_get_stainfo(pstapriv, psta_addr);
        auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
@@ -566,24 +564,23 @@ static struct recv_frame *portctrl(struct adapter *adapter,
        pfhdr = precv_frame;
        pattrib = &pfhdr->attrib;
        psta_addr = pattrib->ta;
+        psta = rtw_get_stainfo(pstapriv, psta_addr);
        prtnframe = NULL;
        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########portctrl:adapter->securitypriv.dot11AuthAlgrthm=%d\n", adapter->securitypriv.dot11AuthAlgrthm));
        if (auth_alg == 2) {
+                /* get ether_type */
+                ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
+                memcpy(&ether_type, ptr, 2);
+                ether_type = ntohs((unsigned short)ether_type);
                if ((psta != NULL) && (psta->ieee8021x_blocked)) {
                        /* blocked */
                        /* only accept EAPOL frame */
                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########portctrl:psta->ieee8021x_blocked==1\n"));
-                        prtnframe = precv_frame;
-                        /* get ether_type */
-                        ptr = ptr+pfhdr->attrib.hdrlen+pfhdr->attrib.iv_len+LLC_HEADER_SIZE;
-                        memcpy(&be_tmp, ptr, 2);
-                        ether_type = ntohs(be_tmp);
                        if (ether_type == eapol_type) {
                                prtnframe = precv_frame;
                        } else {
diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index 2636e7f3dbb8..cf30a08912d1 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -359,7 +359,7 @@ static char *translate_scan(struct adapter *padapter,
                if (wpa_len > 0) {
                        p = buf;
                        _rtw_memset(buf, 0, MAX_WPA_IE_LEN);
-                        p += sprintf(p, "wpa_ie =");
+                        p += sprintf(p, "wpa_ie=");
                        for (i = 0; i < wpa_len; i++)
                                p += sprintf(p, "%02x", wpa_ie[i]);
@@ -376,7 +376,7 @@ static char *translate_scan(struct adapter *padapter,
                if (rsn_len > 0) {
                        p = buf;
                        _rtw_memset(buf, 0, MAX_WPA_IE_LEN);
-                        p += sprintf(p, "rsn_ie =");
+                        p += sprintf(p, "rsn_ie=");
                        for (i = 0; i < rsn_len; i++)
                                p += sprintf(p, "%02x", rsn_ie[i]);
                        _rtw_memset(&iwe, 0, sizeof(iwe));
@@ -2899,7 +2899,7 @@ static int rtw_p2p_get_status(struct net_device *dev,
        /*      Commented by Albert 2010/10/12 */
        /*      Because of the output size limitation, I had removed the "Role" information. */
        /*      About the "Role" information, we will use the new private IOCTL to get the "Role" information. */
-        sprintf(extra, "\n\nStatus =%.2d\n", rtw_p2p_state(pwdinfo));
+        sprintf(extra, "\n\nStatus=%.2d\n", rtw_p2p_state(pwdinfo));
        wrqu->data.length = strlen(extra);
        return ret;
@@ -2918,7 +2918,7 @@ static int rtw_p2p_get_req_cm(struct net_device *dev,
        struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
        struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
-        sprintf(extra, "\n\nCM =%s\n", pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req);
+        sprintf(extra, "\n\nCM=%s\n", pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req);
        wrqu->data.length = strlen(extra);
        return ret;
 }
@@ -2935,7 +2935,7 @@ static int rtw_p2p_get_role(struct net_device *dev,
                        pwdinfo->p2p_peer_interface_addr[0], pwdinfo->p2p_peer_interface_addr[1], pwdinfo->p2p_peer_interface_addr[2],
                        pwdinfo->p2p_peer_interface_addr[3], pwdinfo->p2p_peer_interface_addr[4], pwdinfo->p2p_peer_interface_addr[5]);
-        sprintf(extra, "\n\nRole =%.2d\n", rtw_p2p_role(pwdinfo));
+        sprintf(extra, "\n\nRole=%.2d\n", rtw_p2p_role(pwdinfo));
        wrqu->data.length = strlen(extra);
        return ret;
 }
@@ -3022,7 +3022,7 @@ static int rtw_p2p_get_op_ch(struct net_device *dev,
        DBG_88E("[%s] Op_ch = %02x\n", __func__, pwdinfo->operating_channel);
-        sprintf(extra, "\n\nOp_ch =%.2d\n", pwdinfo->operating_channel);
+        sprintf(extra, "\n\nOp_ch=%.2d\n", pwdinfo->operating_channel);
        wrqu->data.length = strlen(extra);
        return ret;
 }
@@ -3043,7 +3043,7 @@ static int rtw_p2p_get_wps_configmethod(struct net_device *dev,
        u8 blnMatch = 0;
        u16     attr_content = 0;
        uint attr_contentlen = 0;
-        /* 6 is the string "wpsCM =", 17 is the MAC addr, we have to clear it at wrqu->data.pointer */
+        /* 6 is the string "wpsCM=", 17 is the MAC addr, we have to clear it at wrqu->data.pointer */
        u8 attr_content_str[6 + 17] = {0x00};
        /*      Commented by Albert 20110727 */
@@ -3079,7 +3079,7 @@ static int rtw_p2p_get_wps_configmethod(struct net_device *dev,
                                rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_CONF_METHOD, (u8 *) &be_tmp, &attr_contentlen);
                                if (attr_contentlen) {
                                        attr_content = be16_to_cpu(be_tmp);
-                                        sprintf(attr_content_str, "\n\nM =%.4d", attr_content);
+                                        sprintf(attr_content_str, "\n\nM=%.4d", attr_content);
                                        blnMatch = 1;
                                }
                        }
@@ -3091,7 +3091,7 @@ static int rtw_p2p_get_wps_configmethod(struct net_device *dev,
        spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
        if (!blnMatch)
-                sprintf(attr_content_str, "\n\nM = 0000");
+                sprintf(attr_content_str, "\n\nM=0000");
        if (copy_to_user(wrqu->data.pointer, attr_content_str, 6 + 17))
                return -EFAULT;
@@ -3172,9 +3172,9 @@ static int rtw_p2p_get_go_device_address(struct net_device *dev,
        spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
        if (!blnMatch)
-                snprintf(go_devadd_str, sizeof(go_devadd_str), "\n\ndev_add = NULL");
+                snprintf(go_devadd_str, sizeof(go_devadd_str), "\n\ndev_add=NULL");
        else
-                snprintf(go_devadd_str, sizeof(go_devadd_str), "\n\ndev_add =%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+                snprintf(go_devadd_str, sizeof(go_devadd_str), "\n\ndev_add=%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
                        attr_content[0], attr_content[1], attr_content[2], attr_content[3], attr_content[4], attr_content[5]);
        if (copy_to_user(wrqu->data.pointer, go_devadd_str, sizeof(go_devadd_str)))
@@ -3198,7 +3198,7 @@ static int rtw_p2p_get_device_type(struct net_device *dev,
        u8 blnMatch = 0;
        u8 dev_type[8] = {0x00};
        uint dev_type_len = 0;
-        u8 dev_type_str[17 + 9] = {0x00};       /*  +9 is for the str "dev_type =", we have to clear it at wrqu->data.pointer */
+        u8 dev_type_str[17 + 9] = {0x00};       /*  +9 is for the str "dev_type=", we have to clear it at wrqu->data.pointer */
        /*      Commented by Albert 20121209 */
        /*      The input data is the MAC address which the application wants to know its device type. */
@@ -3239,7 +3239,7 @@ static int rtw_p2p_get_device_type(struct net_device *dev,
                                        memcpy(&be_tmp, dev_type, 2);
                                        type = be16_to_cpu(be_tmp);
-                                        sprintf(dev_type_str, "\n\nN =%.2d", type);
+                                        sprintf(dev_type_str, "\n\nN=%.2d", type);
                                        blnMatch = 1;
                                }
                        }
@@ -3252,7 +3252,7 @@ static int rtw_p2p_get_device_type(struct net_device *dev,
        spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
        if (!blnMatch)
-                sprintf(dev_type_str, "\n\nN = 00");
+                sprintf(dev_type_str, "\n\nN=00");
        if (copy_to_user(wrqu->data.pointer, dev_type_str, 9 + 17)) {
                return -EFAULT;
@@ -3277,7 +3277,7 @@ static int rtw_p2p_get_device_name(struct net_device *dev,
        u8 blnMatch = 0;
        u8 dev_name[WPS_MAX_DEVICE_NAME_LEN] = {0x00};
        uint dev_len = 0;
-        u8 dev_name_str[WPS_MAX_DEVICE_NAME_LEN + 5] = {0x00};  /*  +5 is for the str "devN =", we have to clear it at wrqu->data.pointer */
+        u8 dev_name_str[WPS_MAX_DEVICE_NAME_LEN + 5] = {0x00};  /*  +5 is for the str "devN=", we have to clear it at wrqu->data.pointer */
        /*      Commented by Albert 20121225 */
        /*      The input data is the MAC address which the application wants to know its device name. */
@@ -3310,7 +3310,7 @@ static int rtw_p2p_get_device_name(struct net_device *dev,
                        if (wpsie) {
                                rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_DEVICE_NAME, dev_name, &dev_len);
                                if (dev_len) {
-                                        sprintf(dev_name_str, "\n\nN =%s", dev_name);
+                                        sprintf(dev_name_str, "\n\nN=%s", dev_name);
                                        blnMatch = 1;
                                }
                        }
@@ -3323,7 +3323,7 @@ static int rtw_p2p_get_device_name(struct net_device *dev,
        spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
        if (!blnMatch)
-                sprintf(dev_name_str, "\n\nN = 0000");
+                sprintf(dev_name_str, "\n\nN=0000");
        if (copy_to_user(wrqu->data.pointer, dev_name_str, 5 + ((dev_len > 17) ? dev_len : 17)))
                return -EFAULT;
@@ -3349,7 +3349,7 @@ static int rtw_p2p_get_invitation_procedure(struct net_device *dev,
        u8 attr_content[2] = {0x00};
        u8 inv_proc_str[17 + 8] = {0x00};
-        /*  +8 is for the str "InvProc =", we have to clear it at wrqu->data.pointer */
+        /*  +8 is for the str "InvProc=", we have to clear it at wrqu->data.pointer */
        /*      Commented by Ouden 20121226 */
        /*      The application wants to know P2P initiation procedure is supported or not. */
@@ -3397,12 +3397,12 @@ static int rtw_p2p_get_invitation_procedure(struct net_device *dev,
        spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
        if (!blnMatch) {
-                sprintf(inv_proc_str, "\nIP =-1");
+                sprintf(inv_proc_str, "\nIP=-1");
        } else {
                if (attr_content[0] & 0x20)
-                        sprintf(inv_proc_str, "\nIP = 1");
+                        sprintf(inv_proc_str, "\nIP=1");
                else
-                        sprintf(inv_proc_str, "\nIP = 0");
+                        sprintf(inv_proc_str, "\nIP=0");
        }
        if (copy_to_user(wrqu->data.pointer, inv_proc_str, 8 + 17))
                return -EFAULT;
@@ -3512,7 +3512,7 @@ static int rtw_p2p_invite_req(struct net_device *dev,
        /*      The input data contains two informations. */
        /*      1. First information is the P2P device address which you want to send to. */
        /*      2. Second information is the group id which combines with GO's mac address, space and GO's ssid. */
-        /*      Command line sample: iwpriv wlan0 p2p_set invite ="00:11:22:33:44:55 00:E0:4C:00:00:05 DIRECT-xy" */
+        /*      Command line sample: iwpriv wlan0 p2p_set invite="00:11:22:33:44:55 00:E0:4C:00:00:05 DIRECT-xy" */
        /*      Format: 00:11:22:33:44:55 00:E0:4C:00:00:05 DIRECT-xy */
        DBG_88E("[%s] data = %s\n", __func__, extra);
@@ -3805,48 +3805,48 @@ static int rtw_p2p_set(struct net_device *dev,
 #ifdef CONFIG_88EU_P2P
        DBG_88E("[%s] extra = %s\n", __func__, extra);
-        if (!memcmp(extra, "enable =", 7)) {
+        if (!memcmp(extra, "enable=", 7)) {
                rtw_wext_p2p_enable(dev, info, wrqu, &extra[7]);
-        } else if (!memcmp(extra, "setDN =", 6)) {
+        } else if (!memcmp(extra, "setDN=", 6)) {
                wrqu->data.length -= 6;
                rtw_p2p_setDN(dev, info, wrqu, &extra[6]);
-        } else if (!memcmp(extra, "profilefound =", 13)) {
+        } else if (!memcmp(extra, "profilefound=", 13)) {
                wrqu->data.length -= 13;
                rtw_p2p_profilefound(dev, info, wrqu, &extra[13]);
-        } else if (!memcmp(extra, "prov_disc =", 10)) {
+        } else if (!memcmp(extra, "prov_disc=", 10)) {
                wrqu->data.length -= 10;
                rtw_p2p_prov_disc(dev, info, wrqu, &extra[10]);
-        } else if (!memcmp(extra, "nego =", 5)) {
+        } else if (!memcmp(extra, "nego=", 5)) {
                wrqu->data.length -= 5;
                rtw_p2p_connect(dev, info, wrqu, &extra[5]);
-        } else if (!memcmp(extra, "intent =", 7)) {
+        } else if (!memcmp(extra, "intent=", 7)) {
                /*      Commented by Albert 2011/03/23 */
                /*      The wrqu->data.length will include the null character */
                /*      So, we will decrease 7 + 1 */
                wrqu->data.length -= 8;
                rtw_p2p_set_intent(dev, info, wrqu, &extra[7]);
-        } else if (!memcmp(extra, "ssid =", 5)) {
+        } else if (!memcmp(extra, "ssid=", 5)) {
                wrqu->data.length -= 5;
                rtw_p2p_set_go_nego_ssid(dev, info, wrqu, &extra[5]);
-        } else if (!memcmp(extra, "got_wpsinfo =", 12)) {
+        } else if (!memcmp(extra, "got_wpsinfo=", 12)) {
                wrqu->data.length -= 12;
                rtw_p2p_got_wpsinfo(dev, info, wrqu, &extra[12]);
-        } else if (!memcmp(extra, "listen_ch =", 10)) {
+        } else if (!memcmp(extra, "listen_ch=", 10)) {
                /*      Commented by Albert 2011/05/24 */
                /*      The wrqu->data.length will include the null character */
                /*      So, we will decrease (10 + 1) */
                wrqu->data.length -= 11;
                rtw_p2p_set_listen_ch(dev, info, wrqu, &extra[10]);
-        } else if (!memcmp(extra, "op_ch =", 6)) {
+        } else if (!memcmp(extra, "op_ch=", 6)) {
                /*      Commented by Albert 2011/05/24 */
                /*      The wrqu->data.length will include the null character */
                /*      So, we will decrease (6 + 1) */
                wrqu->data.length -= 7;
                rtw_p2p_set_op_ch(dev, info, wrqu, &extra[6]);
-        } else if (!memcmp(extra, "invite =", 7)) {
+        } else if (!memcmp(extra, "invite=", 7)) {
                wrqu->data.length -= 8;
                rtw_p2p_invite_req(dev, info, wrqu, &extra[7]);
-        } else if (!memcmp(extra, "persistent =", 11)) {
+        } else if (!memcmp(extra, "persistent=", 11)) {
                wrqu->data.length -= 11;
                rtw_p2p_set_persistent(dev, info, wrqu, &extra[11]);
        }
@@ -3887,7 +3887,7 @@ static int rtw_p2p_get(struct net_device *dev,
                        "group_id", 8)) {
                rtw_p2p_get_groupid(dev, info, wrqu, extra);
        } else if (!memcmp((__force const char *)wrqu->data.pointer,
-                        "peer_deva_inv", 9)) {
+                        "peer_deva_inv", 13)) {
                /*      Get the P2P device address when receiving the P2P Invitation request frame. */
                rtw_p2p_get_peer_devaddr_by_invitation(dev, info, wrqu, extra);
        } else if (!memcmp((__force const char *)wrqu->data.pointer,
@@ -6920,7 +6920,7 @@ static int rtw_mp_ctx(struct net_device *dev,
        DBG_88E("%s: in =%s\n", __func__, extra);
-        countPkTx = strncmp(extra, "count =", 5); /*  strncmp true is 0 */
+        countPkTx = strncmp(extra, "count=", 6); /*  strncmp true is 0 */
        cotuTx = strncmp(extra, "background", 20);
        CarrSprTx = strncmp(extra, "background, cs", 20);
        scTx = strncmp(extra, "background, sc", 20);
@@ -7044,7 +7044,7 @@ static int rtw_mp_arx(struct net_device *dev,
        DBG_88E("%s: %s\n", __func__, input);
        bStartRx = (strncmp(input, "start", 5) == 0) ? 1 : 0; /*  strncmp true is 0 */
-        bStopRx = (strncmp(input, "stop", 5) == 0) ? 1 : 0; /*  strncmp true is 0 */
+        bStopRx = (strncmp(input, "stop", 4) == 0) ? 1 : 0; /*  strncmp true is 0 */
        bQueryPhy = (strncmp(input, "phy", 3) == 0) ? 1 : 0; /*  strncmp true is 0 */
        if (bStartRx) {
diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
index 23ec684b60e1..274c359279ef 100644
--- a/drivers/staging/rtl8712/rtl871x_recv.c
+++ b/drivers/staging/rtl8712/rtl871x_recv.c
@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
        struct sta_info *psta;
        struct  sta_priv *pstapriv;
        union recv_frame *prtnframe;
-        u16 ether_type = 0;
+        u16 ether_type;
        pstapriv = &adapter->stapriv;
        ptr = get_recvframe_data(precv_frame);
@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
        psta = r8712_get_stainfo(pstapriv, psta_addr);
        auth_alg = adapter->securitypriv.AuthAlgrthm;
        if (auth_alg == 2) {
+                /* get ether_type */
+                ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
+                memcpy(&ether_type, ptr, 2);
+                ether_type = ntohs((unsigned short)ether_type);
                if ((psta != NULL) && (psta->ieee8021x_blocked)) {
                        /* blocked
                         * only accept EAPOL frame */
-                        prtnframe = precv_frame;
-                        /*get ether_type */
-                        ptr = ptr + pfhdr->attrib.hdrlen +
-                              pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
-                        memcpy(&ether_type, ptr, 2);
-                        ether_type = ntohs((unsigned short)ether_type);
                        if (ether_type == 0x888e)
                                prtnframe = precv_frame;
                        else {
diff --git a/drivers/staging/rtl8723au/core/rtw_ieee80211.c b/drivers/staging/rtl8723au/core/rtw_ieee80211.c
index 780631fd3b6d..a48ab25a7d8a 100644
--- a/drivers/staging/rtl8723au/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723au/core/rtw_ieee80211.c
@@ -1496,45 +1496,23 @@ void rtw_wlan_bssid_ex_remove_p2p_attr23a(struct wlan_bssid_ex *bss_ex, u8 attr_
 int rtw_get_wfd_ie(u8 *in_ie, int in_len, u8 *wfd_ie, uint *wfd_ielen)
 {
        int match;
-        uint cnt = 0;
+        const u8 *ie;
-        u8 eid, wfd_oui[4] = {0x50, 0x6F, 0x9A, 0x0A};
-        match = false;
+        match = 0;
-        if (in_len < 0) {
+        if (in_len < 0)
                return match;
-        }
-        while (cnt < in_len)
-        {
-                eid = in_ie[cnt];
-                if ((eid == _VENDOR_SPECIFIC_IE_) &&
+        ie = cfg80211_find_vendor_ie(0x506F9A, 0x0A, in_ie, in_len);
-                    !memcmp(&in_ie[cnt+2], wfd_oui, 4)) {
+        if (ie && (ie[1] <= (MAX_WFD_IE_LEN - 2))) {
-                        if (wfd_ie != NULL) {
+                if (wfd_ie) {
-                                memcpy(wfd_ie, &in_ie[cnt], in_ie[cnt + 1] + 2);
+                        *wfd_ielen = ie[1] + 2;
+                        memcpy(wfd_ie, ie, ie[1] + 2);
-                        } else {
+                } else
-                                if (wfd_ielen != NULL) {
+                        if (wfd_ielen)
-                                        *wfd_ielen = 0;
+                                *wfd_ielen = 0;
-                                }
-                        }
-                        if (wfd_ielen != NULL) {
-                                *wfd_ielen = in_ie[cnt + 1] + 2;
-                        }
-                        cnt += in_ie[cnt + 1] + 2;
-                        match = true;
-                        break;
-                } else {
-                        cnt += in_ie[cnt + 1] +2; /* goto next */
-                }
-        }
-        if (match == true) {
+                match = 1;
-                match = cnt;
        }
        return match;
diff --git a/drivers/staging/rtl8723au/core/rtw_mlme_ext.c b/drivers/staging/rtl8723au/core/rtw_mlme_ext.c
index 4c753639ea5a..1f3e8a0aece4 100644
--- a/drivers/staging/rtl8723au/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723au/core/rtw_mlme_ext.c
@@ -1281,7 +1281,7 @@ unsigned int OnAssocReq23a(struct rtw_adapter *padapter, struct recv_frame *prec
        u8 p2p_status_code = P2P_STATUS_SUCCESS;
        u8 *p2pie;
        u32 p2pielen = 0;
-        u8      wfd_ie[ 128 ] = { 0x00 };
+        u8      wfd_ie[MAX_WFD_IE_LEN] = { 0x00 };
        u32     wfd_ielen = 0;
 #endif /* CONFIG_8723AU_P2P */
diff --git a/drivers/staging/rtl8723au/core/rtw_p2p.c b/drivers/staging/rtl8723au/core/rtw_p2p.c
index 27a6cc76973d..1a961e3f3a55 100644
--- a/drivers/staging/rtl8723au/core/rtw_p2p.c
+++ b/drivers/staging/rtl8723au/core/rtw_p2p.c
@@ -2535,7 +2535,7 @@ u8 process_p2p_group_negotation_req23a(struct wifidirect_info *pwdinfo, u8 *pfra
        u16             wps_devicepassword_id = 0x0000;
        uint    wps_devicepassword_id_len = 0;
 #ifdef CONFIG_8723AU_P2P
-        u8      wfd_ie[ 128 ] = { 0x00 };
+        u8      wfd_ie[MAX_WFD_IE_LEN] = { 0x00 };
        u32     wfd_ielen = 0;
 #endif /*  CONFIG_8723AU_P2P */
@@ -2741,7 +2741,7 @@ u8 process_p2p_group_negotation_resp23a(struct wifidirect_info *pwdinfo, u8 *pfr
        u32 ies_len;
        u8 * p2p_ie;
 #ifdef CONFIG_8723AU_P2P
-        u8      wfd_ie[ 128 ] = { 0x00 };
+        u8      wfd_ie[MAX_WFD_IE_LEN] = { 0x00 };
        u32     wfd_ielen = 0;
 #endif /*  CONFIG_8723AU_P2P */
diff --git a/drivers/staging/rtl8723au/core/rtw_wlan_util.c b/drivers/staging/rtl8723au/core/rtw_wlan_util.c
index 0dfcfbce3b52..99d81e612e7b 100644
--- a/drivers/staging/rtl8723au/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723au/core/rtw_wlan_util.c
@@ -570,7 +570,7 @@ void flush_all_cam_entry23a(struct rtw_adapter *padapter)
 int WFD_info_handler(struct rtw_adapter *padapter, struct ndis_802_11_var_ies * pIE)
 {
        struct wifidirect_info  *pwdinfo;
-        u8      wfd_ie[128] = {0x00};
+        u8      wfd_ie[MAX_WFD_IE_LEN] = {0x00};
        u32     wfd_ielen = 0;
        pwdinfo = &padapter->wdinfo;
@@ -681,7 +681,7 @@ void WMMOnAssocRsp23a(struct rtw_adapter *padapter)
        inx[0] = 0; inx[1] = 1; inx[2] = 2; inx[3] = 3;
        if (pregpriv->wifi_spec == 1) {
-                u32     j, tmp, change_inx;
+                u32     j, tmp, change_inx = false;
                /* entry indx: 0->vo, 1->vi, 2->be, 3->bk. */
                for (i = 0; i < 4; i++) {
diff --git a/drivers/staging/rtl8723au/os_dep/os_intfs.c b/drivers/staging/rtl8723au/os_dep/os_intfs.c
index 57eca7a45672..4fe751f7c2bf 100644
--- a/drivers/staging/rtl8723au/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723au/os_dep/os_intfs.c
@@ -953,8 +953,6 @@ static int netdev_close(struct net_device *pnetdev)
 #endif /* CONFIG_8723AU_P2P */
        rtw_scan_abort23a(padapter);
-         /* set this at the end */
-        padapter->rtw_wdev->iftype = NL80211_IFTYPE_MONITOR;
        RT_TRACE(_module_os_intfs_c_, _drv_info_, ("-871x_drv - drv_close\n"));
        DBG_8723A("-871x_drv - drv_close, bup =%d\n", padapter->bup);
diff --git a/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c b/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c
index c49160e477d8..07e542e5d156 100644
--- a/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c
+++ b/drivers/staging/rtl8723au/os_dep/usb_ops_linux.c
@@ -26,7 +26,7 @@ unsigned int ffaddr2pipehdl23a(struct dvobj_priv *pdvobj, u32 addr)
        if (addr == RECV_BULK_IN_ADDR) {
                pipe = usb_rcvbulkpipe(pusbd, pdvobj->RtInPipe[0]);
        } else if (addr == RECV_INT_IN_ADDR) {
-                pipe = usb_rcvbulkpipe(pusbd, pdvobj->RtInPipe[1]);
+                pipe = usb_rcvintpipe(pusbd, pdvobj->RtInPipe[1]);
        } else if (addr < HW_QUEUE_ENTRY) {
                ep_num = pdvobj->Queue2Pipe[addr];
                pipe = usb_sndbulkpipe(pusbd, ep_num);
diff --git a/drivers/staging/rtl8821ae/base.c b/drivers/staging/rtl8821ae/base.c
index e5073fe24770..a4c9cc437bc6 100644
--- a/drivers/staging/rtl8821ae/base.c
+++ b/drivers/staging/rtl8821ae/base.c
@@ -388,7 +388,7 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw)
 }
-static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
+static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -410,6 +410,9 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
        rtlpriv->works.rtl_wq = create_workqueue(rtlpriv->cfg->name);
 #endif
 /*<delete in kernel end>*/
+        if (!rtlpriv->works.rtl_wq)
+                return -ENOMEM;
        INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
                          (void *)rtl_watchdog_wq_callback);
        INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
@@ -421,6 +424,8 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
        INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq,
                          (void *)rtl_fwevt_wq_callback);
+        return 0;
 }
 void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
@@ -519,7 +524,8 @@ int rtl_init_core(struct ieee80211_hw *hw)
        INIT_LIST_HEAD(&rtlpriv->entry_list);
        /* <6> init deferred work */
-        _rtl_init_deferred_work(hw);
+        if (_rtl_init_deferred_work(hw))
+                return 1;
        /* <7> */
 #ifdef VIF_TODO
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index ef5933b93590..3b6e5358c723 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -1855,8 +1855,9 @@ static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key)
 {
        static u_char goto_buf[8];
        static int num;
-        int maxlen, go_pos;
+        int maxlen;
        char *cp;
        if (type == KT_SPKUP && ch == SPEAKUP_GOTO)
                goto do_goto;
        if (type == KT_LATIN && ch == '\n')
@@ -1891,25 +1892,24 @@ oops:
                spk_special_handler = NULL;
                return 1;
        }
-        go_pos = kstrtol(goto_buf, 10, (long *)&cp);
-        goto_pos = (u_long) go_pos;
+        goto_pos = simple_strtoul(goto_buf, &cp, 10);
        if (*cp == 'x') {
                if (*goto_buf < '0')
                        goto_pos += spk_x;
-                else
+                else if (goto_pos > 0)
                        goto_pos--;
-                if (goto_pos < 0)
-                        goto_pos = 0;
                if (goto_pos >= vc->vc_cols)
                        goto_pos = vc->vc_cols - 1;
                goto_x = 1;
        } else {
                if (*goto_buf < '0')
                        goto_pos += spk_y;
-                else
+                else if (goto_pos > 0)
                        goto_pos--;
-                if (goto_pos < 0)
-                        goto_pos = 0;
                if (goto_pos >= vc->vc_rows)
                        goto_pos = vc->vc_rows - 1;
                goto_x = 0;
diff --git a/drivers/staging/unisys/uislib/uislib.c b/drivers/staging/unisys/uislib/uislib.c
index 8ea9c46e56ae..3152a2180c45 100644
--- a/drivers/staging/unisys/uislib/uislib.c
+++ b/drivers/staging/unisys/uislib/uislib.c
@@ -381,17 +381,17 @@ create_bus(CONTROLVM_MESSAGE *msg, char *buf)
                cmd.add_vbus.busTypeGuid = msg->cmd.createBus.busDataTypeGuid;
                cmd.add_vbus.busInstGuid = msg->cmd.createBus.busInstGuid;
                if (!VirtControlChanFunc) {
-                        kfree(bus);
                        LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci callback not registered.");
                        POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo,
                                         POSTCODE_SEVERITY_ERR);
+                        kfree(bus);
                        return CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_FAILURE;
                }
                if (!VirtControlChanFunc(&cmd)) {
-                        kfree(bus);
                        LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci GUEST_ADD_VBUS returned error.");
                        POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo,
                                         POSTCODE_SEVERITY_ERR);
+                        kfree(bus);
                        return
                            CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_CALLBACK_ERROR;
                }
diff --git a/drivers/staging/unisys/visorchipset/visorchipset.h b/drivers/staging/unisys/visorchipset/visorchipset.h
index d4bf203cdfdf..d95825dc5414 100644
--- a/drivers/staging/unisys/visorchipset/visorchipset.h
+++ b/drivers/staging/unisys/visorchipset/visorchipset.h
@@ -104,9 +104,9 @@ finddevice(struct list_head *list, U32 busNo, U32 devNo)
 static inline void delbusdevices(struct list_head *list, U32 busNo)
 {
-        VISORCHIPSET_DEVICE_INFO *p;
+        VISORCHIPSET_DEVICE_INFO *p, *tmp;
-        list_for_each_entry(p, list, entry) {
+        list_for_each_entry_safe(p, tmp, list, entry) {
                if (p->busNo == busNo) {
                        list_del(&p->entry);
                        kfree(p);
diff --git a/drivers/staging/unisys/visorchipset/visorchipset_main.c b/drivers/staging/unisys/visorchipset/visorchipset_main.c
index 257c6e59b460..c475e256e34b 100644
--- a/drivers/staging/unisys/visorchipset/visorchipset_main.c
+++ b/drivers/staging/unisys/visorchipset/visorchipset_main.c
@@ -605,16 +605,16 @@ EXPORT_SYMBOL_GPL(visorchipset_register_busdev_client);
 static void
 cleanup_controlvm_structures(void)
 {
-        VISORCHIPSET_BUS_INFO *bi;
+        VISORCHIPSET_BUS_INFO *bi, *tmp_bi;
-        VISORCHIPSET_DEVICE_INFO *di;
+        VISORCHIPSET_DEVICE_INFO *di, *tmp_di;
-        list_for_each_entry(bi, &BusInfoList, entry) {
+        list_for_each_entry_safe(bi, tmp_bi, &BusInfoList, entry) {
                busInfo_clear(bi);
                list_del(&bi->entry);
                kfree(bi);
        }
-        list_for_each_entry(di, &DevInfoList, entry) {
+        list_for_each_entry_safe(di, tmp_di, &DevInfoList, entry) {
                devInfo_clear(di);
                list_del(&di->entry);
                kfree(di);
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c b/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
index c5bf60b135b9..92caef7474c7 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
+++ b/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
@@ -118,6 +118,7 @@ static int refresh_exported_devices(void)
        struct udev_list_entry *devices, *dev_list_entry;
        struct udev_device *dev;
        const char *path;
+        const char *driver;
        enumerate = udev_enumerate_new(udev_context);
        udev_enumerate_add_match_subsystem(enumerate, "usb");
@@ -128,10 +129,12 @@ static int refresh_exported_devices(void)
        udev_list_entry_foreach(dev_list_entry, devices) {
                path = udev_list_entry_get_name(dev_list_entry);
                dev = udev_device_new_from_syspath(udev_context, path);
+                if (dev == NULL)
+                        continue;
                /* Check whether device uses usbip-host driver. */
-                if (!strcmp(udev_device_get_driver(dev),
+                driver = udev_device_get_driver(dev);
-                            USBIP_HOST_DRV_NAME)) {
+                if (driver != NULL && !strcmp(driver, USBIP_HOST_DRV_NAME)) {
                        edev = usbip_exported_device_new(path);
                        if (!edev) {
                                dbg("usbip_exported_device_new failed");
diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/staging/usbip/vhci_sysfs.c
index 47bddcdde0a6..211f43f67ea2 100644
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/staging/usbip/vhci_sysfs.c
@@ -184,7 +184,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
         * @devid: unique device identifier in a remote host
         * @speed: usb device speed in a remote host
         */
-        if (sscanf(buf, "%u %u %u %u", &rhport, &sockfd, &devid, &speed) != 1)
+        if (sscanf(buf, "%u %u %u %u", &rhport, &sockfd, &devid, &speed) != 4)
                return -EINVAL;
        usbip_dbg_vhci_sysfs("rhport(%u) sockfd(%u) devid(%u) speed(%u)\n",
diff --git a/drivers/staging/vme/devices/vme_user.c b/drivers/staging/vme/devices/vme_user.c
index 792792715673..ffb4eeefdddb 100644
--- a/drivers/staging/vme/devices/vme_user.c
+++ b/drivers/staging/vme/devices/vme_user.c
@@ -776,7 +776,8 @@ static int vme_user_probe(struct vme_dev *vdev)
                image[i].kern_buf = kmalloc(image[i].size_buf, GFP_KERNEL);
                if (image[i].kern_buf == NULL) {
                        err = -ENOMEM;
-                        goto err_master_buf;
+                        vme_master_free(image[i].resource);
+                        goto err_master;
                }
        }
@@ -819,8 +820,6 @@ static int vme_user_probe(struct vme_dev *vdev)
        return 0;
-        /* Ensure counter set correcty to destroy all sysfs devices */
-        i = VME_DEVS;
 err_sysfs:
        while (i > 0) {
                i--;
@@ -830,12 +829,10 @@ err_sysfs:
        /* Ensure counter set correcty to unalloc all master windows */
        i = MASTER_MAX + 1;
-err_master_buf:
-        for (i = MASTER_MINOR; i < (MASTER_MAX + 1); i++)
-                kfree(image[i].kern_buf);
 err_master:
        while (i > MASTER_MINOR) {
                i--;
+                kfree(image[i].kern_buf);
                vme_master_free(image[i].resource);
        }
diff --git a/drivers/staging/xgifb/vb_def.h b/drivers/staging/xgifb/vb_def.h
index 5c739bebd8a5..949f0e5eed8d 100644
--- a/drivers/staging/xgifb/vb_def.h
+++ b/drivers/staging/xgifb/vb_def.h
@@ -1,6 +1,6 @@
 #ifndef _VB_DEF_
 #define _VB_DEF_
-#include "../../video/sis/initdef.h"
+#include "../../video/fbdev/sis/initdef.h"
 #define VB_XGI301C      0x0020 /* for 301C */
diff --git a/drivers/staging/xgifb/vb_struct.h b/drivers/staging/xgifb/vb_struct.h
index c08ff5b2d6ee..0d27594554ca 100644
--- a/drivers/staging/xgifb/vb_struct.h
+++ b/drivers/staging/xgifb/vb_struct.h
@@ -1,6 +1,6 @@
 #ifndef _VB_STRUCT_
 #define _VB_STRUCT_
-#include "../../video/sis/vstruct.h"
+#include "../../video/fbdev/sis/vstruct.h"
 struct XGI_LVDSCRT1HDataStruct {
        unsigned char Reg[8];
diff --git a/drivers/staging/xgifb/vgatypes.h b/drivers/staging/xgifb/vgatypes.h
index ddf7776c295b..264351441f99 100644
--- a/drivers/staging/xgifb/vgatypes.h
+++ b/drivers/staging/xgifb/vgatypes.h
@@ -2,8 +2,8 @@
 #define _VGATYPES_
 #include <linux/fb.h>   /* for struct fb_var_screeninfo for sis.h */
-#include "../../video/sis/vgatypes.h"
+#include "../../video/fbdev/sis/vgatypes.h"
-#include "../../video/sis/sis.h"                /* for LCD_TYPE */
+#include "../../video/fbdev/sis/sis.h"          /* for LCD_TYPE */
 #ifndef XGI_VB_CHIP_TYPE
 enum XGI_VB_CHIP_TYPE {
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 78cab13bbb1b..46588c85d39b 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1593,7 +1593,9 @@ int iscsit_process_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         * Initiator is expecting a NopIN ping reply..
         */
        if (hdr->itt != RESERVED_ITT) {
-                BUG_ON(!cmd);
+                if (!cmd)
+                        return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
+                                                (unsigned char *)hdr);
                spin_lock_bh(&conn->cmd_lock);
                list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
index 6960f22909ae..302eb3b78715 100644
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -775,6 +775,7 @@ struct iscsi_np {
        int                     np_ip_proto;
        int                     np_sock_type;
        enum np_thread_state_table np_thread_state;
+        bool                    enabled;
        enum iscsi_timer_flags_table np_login_timer_flags;
        u32                     np_exports;
        enum np_flags_table     np_flags;
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 8739b98f6f93..ca31fa1b8a4b 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -436,7 +436,7 @@ static int iscsi_login_zero_tsih_s2(
                }
                off = mrdsl % PAGE_SIZE;
                if (!off)
-                        return 0;
+                        goto check_prot;
                if (mrdsl < PAGE_SIZE)
                        mrdsl = PAGE_SIZE;
@@ -452,6 +452,31 @@ static int iscsi_login_zero_tsih_s2(
                                ISCSI_LOGIN_STATUS_NO_RESOURCES);
                        return -1;
                }
+                /*
+                 * ISER currently requires that ImmediateData + Unsolicited
+                 * Data be disabled when protection / signature MRs are enabled.
+                 */
+check_prot:
+                if (sess->se_sess->sup_prot_ops &
+                   (TARGET_PROT_DOUT_STRIP | TARGET_PROT_DOUT_PASS |
+                    TARGET_PROT_DOUT_INSERT)) {
+                        sprintf(buf, "ImmediateData=No");
+                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                                return -1;
+                        }
+                        sprintf(buf, "InitialR2T=Yes");
+                        if (iscsi_change_param_value(buf, conn->param_list, 0) < 0) {
+                                iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                                    ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                                return -1;
+                        }
+                        pr_debug("Forcing ImmediateData=No + InitialR2T=Yes for"
+                                 " T10-PI enabled ISER session\n");
+                }
        }
        return 0;
@@ -984,6 +1009,7 @@ int iscsi_target_setup_login_socket(
        }
        np->np_transport = t;
+        np->enabled = true;
        return 0;
 }
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index eb96b20dc09e..ca1811858afd 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -184,6 +184,7 @@ static void iscsit_clear_tpg_np_login_thread(
                return;
        }
+        tpg_np->tpg_np->enabled = false;
        iscsit_reset_np_thread(tpg_np->tpg_np, tpg_np, tpg, shutdown);
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 65001e133670..26416c15d65c 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -798,10 +798,10 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
                pr_err("emulate_write_cache not supported for pSCSI\n");
                return -EINVAL;
        }
-        if (dev->transport->get_write_cache) {
+        if (flag &&
-                pr_warn("emulate_write_cache cannot be changed when underlying"
+            dev->transport->get_write_cache) {
-                        " HW reports WriteCacheEnabled, ignoring request\n");
+                pr_err("emulate_write_cache not supported for this device\n");
-                return 0;
+                return -EINVAL;
        }
        dev->dev_attrib.emulate_write_cache = flag;
@@ -936,6 +936,10 @@ int se_dev_set_pi_prot_type(struct se_device *dev, int flag)
                return 0;
        }
        if (!dev->transport->init_prot || !dev->transport->free_prot) {
+                /* 0 is only allowed value for non-supporting backends */
+                if (flag == 0)
+                        return 0;
                pr_err("DIF protection not supported by backend: %s\n",
                       dev->transport->name);
                return -ENOSYS;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index d4b98690a736..789aa9eb0a1e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1113,6 +1113,7 @@ void transport_init_se_cmd(
        init_completion(&cmd->cmd_wait_comp);
        init_completion(&cmd->task_stop_comp);
        spin_lock_init(&cmd->t_state_lock);
+        kref_init(&cmd->cmd_kref);
        cmd->transport_state = CMD_T_DEV_ACTIVE;
        cmd->se_tfo = tfo;
@@ -2357,7 +2358,6 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
        unsigned long flags;
        int ret = 0;
-        kref_init(&se_cmd->cmd_kref);
        /*
         * Add a second kref if the fabric caller is expecting to handle
         * fabric acknowledgement that requires two target_put_sess_cmd()
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 01cf37f212c3..f5fd515b2bee 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -90,18 +90,18 @@ static void ft_free_cmd(struct ft_cmd *cmd)
 {
        struct fc_frame *fp;
        struct fc_lport *lport;
-        struct se_session *se_sess;
+        struct ft_sess *sess;
        if (!cmd)
                return;
-        se_sess = cmd->sess->se_sess;
+        sess = cmd->sess;
        fp = cmd->req_frame;
        lport = fr_dev(fp);
        if (fr_seq(fp))
                lport->tt.seq_release(fr_seq(fp));
        fc_frame_free(fp);
-        percpu_ida_free(&se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
+        percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
-        ft_sess_put(cmd->sess); /* undo get from lookup at recv */
+        ft_sess_put(sess);      /* undo get from lookup at recv */
 }
 void ft_release_cmd(struct se_cmd *se_cmd)
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index 94f9e3a38412..0ff7fda0742f 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -190,7 +190,7 @@ static struct tty_driver *hvc_console_device(struct console *c, int *index)
        return hvc_driver;
 }
-static int __init hvc_console_setup(struct console *co, char *options)
+static int hvc_console_setup(struct console *co, char *options)
 {       
        if (co->index < 0 || co->index >= MAX_NR_HVC_CONSOLES)
                return -ENODEV;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 41fe8a047d37..fe9d129c8735 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
                        if (tty->ops->flush_chars)
                                tty->ops->flush_chars(tty);
                } else {
+                        struct n_tty_data *ldata = tty->disc_data;
                        while (nr > 0) {
+                                mutex_lock(&ldata->output_lock);
                                c = tty->ops->write(tty, b, nr);
+                                mutex_unlock(&ldata->output_lock);
                                if (c < 0) {
                                        retval = c;
                                        goto break_out;
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 81f909c2101f..2d4bd3929e50 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -555,7 +555,7 @@ static void serial8250_set_sleep(struct uart_8250_port *p, int sleep)
         */
        if ((p->port.type == PORT_XR17V35X) ||
           (p->port.type == PORT_XR17D15X)) {
-                serial_out(p, UART_EXAR_SLEEP, 0xff);
+                serial_out(p, UART_EXAR_SLEEP, sleep ? 0xff : 0);
                return;
        }
@@ -1520,7 +1520,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
                        status = serial8250_rx_chars(up, status);
        }
        serial8250_modem_status(up);
-        if (status & UART_LSR_THRE)
+        if (!up->dma && (status & UART_LSR_THRE))
                serial8250_tx_chars(up);
        spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c
index 7046769608d4..ab9096dc3849 100644
--- a/drivers/tty/serial/8250/8250_dma.c
+++ b/drivers/tty/serial/8250/8250_dma.c
@@ -20,12 +20,15 @@ static void __dma_tx_complete(void *param)
        struct uart_8250_port   *p = param;
        struct uart_8250_dma    *dma = p->dma;
        struct circ_buf         *xmit = &p->port.state->xmit;
+        unsigned long   flags;
-        dma->tx_running = 0;
        dma_sync_single_for_cpu(dma->txchan->device->dev, dma->tx_addr,
                                UART_XMIT_SIZE, DMA_TO_DEVICE);
+        spin_lock_irqsave(&p->port.lock, flags);
+        dma->tx_running = 0;
        xmit->tail += dma->tx_size;
        xmit->tail &= UART_XMIT_SIZE - 1;
        p->port.icount.tx += dma->tx_size;
@@ -35,6 +38,8 @@ static void __dma_tx_complete(void *param)
        if (!uart_circ_empty(xmit) && !uart_tx_stopped(&p->port))
                serial8250_tx_dma(p);
+        spin_unlock_irqrestore(&p->port.lock, flags);
 }
 static void __dma_rx_complete(void *param)
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 2e6d8ddc4425..5d9b01aa54f4 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1226,6 +1226,7 @@ config SERIAL_BFIN_SPORT3_UART_CTSRTS
 config SERIAL_TIMBERDALE
        tristate "Support for timberdale UART"
        select SERIAL_CORE
+        depends on X86_32 || COMPILE_TEST
        ---help---
        Add support for UART controller on timberdale.
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index d4eda24aa68b..dacf0a09ab24 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -318,7 +318,7 @@ static void pl011_dma_probe_initcall(struct device *dev, struct uart_amba_port *
                        .src_addr = uap->port.mapbase + UART01x_DR,
                        .src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE,
                        .direction = DMA_DEV_TO_MEM,
-                        .src_maxburst = uap->fifosize >> 1,
+                        .src_maxburst = uap->fifosize >> 2,
                        .device_fc = false,
                };
@@ -2176,6 +2176,7 @@ static int pl011_probe(struct amba_device *dev, const struct amba_id *id)
 static int pl011_remove(struct amba_device *dev)
 {
        struct uart_amba_port *uap = amba_get_drvdata(dev);
+        bool busy = false;
        int i;
        uart_remove_one_port(&amba_reg, &uap->port);
@@ -2183,9 +2184,12 @@ static int pl011_remove(struct amba_device *dev)
        for (i = 0; i < ARRAY_SIZE(amba_ports); i++)
                if (amba_ports[i] == uap)
                        amba_ports[i] = NULL;
+                else if (amba_ports[i])
+                        busy = true;
        pl011_dma_remove(uap);
-        uart_unregister_driver(&amba_reg);
+        if (!busy)
+                uart_unregister_driver(&amba_reg);
        return 0;
 }
diff --git a/drivers/tty/serial/clps711x.c b/drivers/tty/serial/clps711x.c
index 5e6fdb1ea73b..14aaea0d4131 100644
--- a/drivers/tty/serial/clps711x.c
+++ b/drivers/tty/serial/clps711x.c
@@ -368,16 +368,12 @@ static const struct uart_ops uart_clps711x_ops = {
 static void uart_clps711x_console_putchar(struct uart_port *port, int ch)
 {
        struct clps711x_port *s = dev_get_drvdata(port->dev);
+        u32 sysflg = 0;
        /* Wait for FIFO is not full */
-        while (1) {
+        do {
-                u32 sysflg = 0;
                regmap_read(s->syscon, SYSFLG_OFFSET, &sysflg);
-                if (!(sysflg & SYSFLG_UTXFF))
+        } while (sysflg & SYSFLG_UTXFF);
-                        break;
-                cond_resched();
-        }
        writew(ch, port->membase + UARTDR_OFFSET);
 }
@@ -387,18 +383,14 @@ static void uart_clps711x_console_write(struct console *co, const char *c,
 {
        struct uart_port *port = clps711x_uart.state[co->index].uart_port;
        struct clps711x_port *s = dev_get_drvdata(port->dev);
+        u32 sysflg = 0;
        uart_console_write(port, c, n, uart_clps711x_console_putchar);
        /* Wait for transmitter to become empty */
-        while (1) {
+        do {
-                u32 sysflg = 0;
                regmap_read(s->syscon, SYSFLG_OFFSET, &sysflg);
-                if (!(sysflg & SYSFLG_UBUSY))
+        } while (sysflg & SYSFLG_UBUSY);
-                        break;
-                cond_resched();
-        }
 }
 static int uart_clps711x_console_setup(struct console *co, char *options)
diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
index 028582e924a5..c167a710dc39 100644
--- a/drivers/tty/serial/efm32-uart.c
+++ b/drivers/tty/serial/efm32-uart.c
@@ -798,6 +798,9 @@ static int efm32_uart_remove(struct platform_device *pdev)
 static const struct of_device_id efm32_uart_dt_ids[] = {
        {
+                .compatible = "energymicro,efm32-uart",
+        }, {
+                /* doesn't follow the "vendor,device" scheme, don't use */
                .compatible = "efm32,uart",
        }, {
                /* sentinel */
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index dd8b1a5458ff..08b6b9419f0d 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -225,14 +225,19 @@ static inline void serial_omap_enable_wakeirq(struct uart_omap_port *up,
        if (enable)
                enable_irq(up->wakeirq);
        else
-                disable_irq(up->wakeirq);
+                disable_irq_nosync(up->wakeirq);
 }
 static void serial_omap_enable_wakeup(struct uart_omap_port *up, bool enable)
 {
        struct omap_uart_port_info *pdata = dev_get_platdata(up->dev);
+        if (enable == up->wakeups_enabled)
+                return;
        serial_omap_enable_wakeirq(up, enable);
+        up->wakeups_enabled = enable;
        if (!pdata || !pdata->enable_wakeup)
                return;
@@ -1495,6 +1500,11 @@ static int serial_omap_suspend(struct device *dev)
        uart_suspend_port(&serial_omap_reg, &up->port);
        flush_work(&up->qos_work);
+        if (device_may_wakeup(dev))
+                serial_omap_enable_wakeup(up, true);
+        else
+                serial_omap_enable_wakeup(up, false);
        return 0;
 }
@@ -1502,6 +1512,9 @@ static int serial_omap_resume(struct device *dev)
 {
        struct uart_omap_port *up = dev_get_drvdata(dev);
+        if (device_may_wakeup(dev))
+                serial_omap_enable_wakeup(up, false);
        uart_resume_port(&serial_omap_reg, &up->port);
        return 0;
@@ -1789,6 +1802,7 @@ static int serial_omap_remove(struct platform_device *dev)
        pm_runtime_disable(up->dev);
        uart_remove_one_port(&serial_omap_reg, &up->port);
        pm_qos_remove_request(&up->pm_qos_request);
+        device_init_wakeup(&dev->dev, false);
        return 0;
 }
@@ -1877,17 +1891,7 @@ static int serial_omap_runtime_suspend(struct device *dev)
        up->context_loss_cnt = serial_omap_get_context_loss_count(up);
-        if (device_may_wakeup(dev)) {
+        serial_omap_enable_wakeup(up, true);
-                if (!up->wakeups_enabled) {
-                        serial_omap_enable_wakeup(up, true);
-                        up->wakeups_enabled = true;
-                }
-        } else {
-                if (up->wakeups_enabled) {
-                        serial_omap_enable_wakeup(up, false);
-                        up->wakeups_enabled = false;
-                }
-        }
        up->latency = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE;
        schedule_work(&up->qos_work);
@@ -1901,6 +1905,8 @@ static int serial_omap_runtime_resume(struct device *dev)
        int loss_cnt = serial_omap_get_context_loss_count(up);
+        serial_omap_enable_wakeup(up, false);
        if (loss_cnt < 0) {
                dev_dbg(dev, "serial_omap_get_context_loss_count failed : %d\n",
                        loss_cnt);
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 23f459600738..1f5505e7f90d 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1446,8 +1446,8 @@ static int s3c24xx_serial_get_poll_char(struct uart_port *port)
 static void s3c24xx_serial_put_poll_char(struct uart_port *port,
                unsigned char c)
 {
-        unsigned int ufcon = rd_regl(cons_uart, S3C2410_UFCON);
+        unsigned int ufcon = rd_regl(port, S3C2410_UFCON);
-        unsigned int ucon = rd_regl(cons_uart, S3C2410_UCON);
+        unsigned int ucon = rd_regl(port, S3C2410_UCON);
        /* not possible to xmit on unconfigured port */
        if (!s3c24xx_port_configured(ucon))
@@ -1455,7 +1455,7 @@ static void s3c24xx_serial_put_poll_char(struct uart_port *port,
        while (!s3c24xx_serial_console_txrdy(port, ufcon))
                cpu_relax();
-        wr_regb(cons_uart, S3C2410_UTXH, c);
+        wr_regb(port, S3C2410_UTXH, c);
 }
 #endif /* CONFIG_CONSOLE_POLL */
@@ -1463,22 +1463,23 @@ static void s3c24xx_serial_put_poll_char(struct uart_port *port,
 static void
 s3c24xx_serial_console_putchar(struct uart_port *port, int ch)
 {
-        unsigned int ufcon = rd_regl(cons_uart, S3C2410_UFCON);
+        unsigned int ufcon = rd_regl(port, S3C2410_UFCON);
-        unsigned int ucon = rd_regl(cons_uart, S3C2410_UCON);
-        /* not possible to xmit on unconfigured port */
-        if (!s3c24xx_port_configured(ucon))
-                return;
        while (!s3c24xx_serial_console_txrdy(port, ufcon))
-                barrier();
+                cpu_relax();
-        wr_regb(cons_uart, S3C2410_UTXH, ch);
+        wr_regb(port, S3C2410_UTXH, ch);
 }
 static void
 s3c24xx_serial_console_write(struct console *co, const char *s,
                             unsigned int count)
 {
+        unsigned int ucon = rd_regl(cons_uart, S3C2410_UCON);
+        /* not possible to xmit on unconfigured port */
+        if (!s3c24xx_port_configured(ucon))
+                return;
        uart_console_write(cons_uart, s, count, s3c24xx_serial_console_putchar);
 }
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 2cf5649a6dc0..b68550d95a40 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -89,8 +89,7 @@ static void __uart_start(struct tty_struct *tty)
        struct uart_state *state = tty->driver_data;
        struct uart_port *port = state->uart_port;
-        if (!uart_circ_empty(&state->xmit) && state->xmit.buf &&
+        if (!tty->stopped && !tty->hw_stopped)
-            !tty->stopped && !tty->hw_stopped)
                port->ops->start_tx(port);
 }
@@ -138,6 +137,11 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
                return 1;
        /*
+         * Make sure the device is in D0 state.
+         */
+        uart_change_pm(state, UART_PM_STATE_ON);
+        /*
         * Initialise and allocate the transmit and temporary
         * buffer.
         */
@@ -826,25 +830,29 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
                 * If we fail to request resources for the
                 * new port, try to restore the old settings.
                 */
-                if (retval && old_type != PORT_UNKNOWN) {
+                if (retval) {
                        uport->iobase = old_iobase;
                        uport->type = old_type;
                        uport->hub6 = old_hub6;
                        uport->iotype = old_iotype;
                        uport->regshift = old_shift;
                        uport->mapbase = old_mapbase;
-                        retval = uport->ops->request_port(uport);
-                        /*
-                         * If we failed to restore the old settings,
-                         * we fail like this.
-                         */
-                        if (retval)
-                                uport->type = PORT_UNKNOWN;
-                        /*
+                        if (old_type != PORT_UNKNOWN) {
-                         * We failed anyway.
+                                retval = uport->ops->request_port(uport);
-                         */
+                                /*
-                        retval = -EBUSY;
+                                 * If we failed to restore the old settings,
+                                 * we fail like this.
+                                 */
+                                if (retval)
+                                        uport->type = PORT_UNKNOWN;
+                                /*
+                                 * We failed anyway.
+                                 */
+                                retval = -EBUSY;
+                        }
                        /* Added to return the correct error -Ram Gupta */
                        goto exit;
                }
@@ -1452,6 +1460,8 @@ static void uart_hangup(struct tty_struct *tty)
                clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
                spin_unlock_irqrestore(&port->lock, flags);
                tty_port_tty_set(port, NULL);
+                if (!uart_console(state->uart_port))
+                        uart_change_pm(state, UART_PM_STATE_OFF);
                wake_up_interruptible(&port->open_wait);
                wake_up_interruptible(&port->delta_msr_wait);
        }
@@ -1570,12 +1580,6 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
        }
        /*
-         * Make sure the device is in D0 state.
-         */
-        if (port->count == 1)
-                uart_change_pm(state, UART_PM_STATE_ON);
-        /*
         * Start up the serial port.
         */
        retval = uart_startup(tty, state, 0);
diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
index 21e6e84c0df8..dd3a96e07026 100644
--- a/drivers/tty/serial/st-asc.c
+++ b/drivers/tty/serial/st-asc.c
@@ -295,7 +295,7 @@ static void asc_receive_chars(struct uart_port *port)
                        status & ASC_STA_OE) {
                        if (c & ASC_RXBUF_FE) {
-                                if (c == ASC_RXBUF_FE) {
+                                if (c == (ASC_RXBUF_FE | ASC_RXBUF_DUMMY_RX)) {
                                        port->icount.brk++;
                                        if (uart_handle_break(port))
                                                continue;
@@ -325,7 +325,7 @@ static void asc_receive_chars(struct uart_port *port)
                                flag = TTY_FRAME;
                }
-                if (uart_handle_sysrq_char(port, c))
+                if (uart_handle_sysrq_char(port, c & 0xff))
                        continue;
                uart_insert_char(port, c, ASC_RXBUF_DUMMY_OE, c & 0xff, flag);
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 8ebd9f88a6f6..cf78d1985cd8 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -258,7 +258,11 @@ static int __tty_buffer_request_room(struct tty_port *port, size_t size,
                        n->flags = flags;
                        buf->tail = n;
                        b->commit = b->used;
-                        smp_mb();
+                        /* paired w/ barrier in flush_to_ldisc(); ensures the
+                         * latest commit value can be read before the head is
+                         * advanced to the next buffer
+                         */
+                        smp_wmb();
                        b->next = n;
                } else if (change)
                        size = 0;
@@ -444,17 +448,24 @@ static void flush_to_ldisc(struct work_struct *work)
        while (1) {
                struct tty_buffer *head = buf->head;
+                struct tty_buffer *next;
                int count;
                /* Ldisc or user is trying to gain exclusive access */
                if (atomic_read(&buf->priority))
                        break;
+                next = head->next;
+                /* paired w/ barrier in __tty_buffer_request_room();
+                 * ensures commit value read is not stale if the head
+                 * is advancing to the next buffer
+                 */
+                smp_rmb();
                count = head->commit - head->read;
                if (!count) {
-                        if (head->next == NULL)
+                        if (next == NULL)
                                break;
-                        buf->head = head->next;
+                        buf->head = next;
                        tty_buffer_free(port, head);
                        continue;
                }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index d3448a90f0f9..34110719fe03 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -878,9 +878,8 @@ void disassociate_ctty(int on_exit)
        spin_lock_irq(&current->sighand->siglock);
        put_pid(current->signal->tty_old_pgrp);
        current->signal->tty_old_pgrp = NULL;
-        spin_unlock_irq(&current->sighand->siglock);
-        tty = get_current_tty();
+        tty = tty_kref_get(current->signal->tty);
        if (tty) {
                unsigned long flags;
                spin_lock_irqsave(&tty->ctrl_lock, flags);
@@ -897,6 +896,7 @@ void disassociate_ctty(int on_exit)
 #endif
        }
+        spin_unlock_irq(&current->sighand->siglock);
        /* Now clear signal->tty under the lock */
        read_lock(&tasklist_lock);
        session_clear_tty(task_session(current));
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index ca6831c5b763..1cd5d0ba587c 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -277,6 +277,39 @@ static void hw_phymode_configure(struct ci_hdrc *ci)
 }
 /**
+ * ci_usb_phy_init: initialize phy according to different phy type
+ * @ci: the controller
+  *
+ * This function returns an error code if usb_phy_init has failed
+ */
+static int ci_usb_phy_init(struct ci_hdrc *ci)
+{
+        int ret;
+        switch (ci->platdata->phy_mode) {
+        case USBPHY_INTERFACE_MODE_UTMI:
+        case USBPHY_INTERFACE_MODE_UTMIW:
+        case USBPHY_INTERFACE_MODE_HSIC:
+                ret = usb_phy_init(ci->transceiver);
+                if (ret)
+                        return ret;
+                hw_phymode_configure(ci);
+                break;
+        case USBPHY_INTERFACE_MODE_ULPI:
+        case USBPHY_INTERFACE_MODE_SERIAL:
+                hw_phymode_configure(ci);
+                ret = usb_phy_init(ci->transceiver);
+                if (ret)
+                        return ret;
+                break;
+        default:
+                ret = usb_phy_init(ci->transceiver);
+        }
+        return ret;
+}
+/**
 * hw_device_reset: resets chip (execute without interruption)
 * @ci: the controller
  *
@@ -543,8 +576,6 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        hw_phymode_configure(ci);
        if (ci->platdata->phy)
                ci->transceiver = ci->platdata->phy;
        else
@@ -564,7 +595,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                return -EPROBE_DEFER;
        }
-        ret = usb_phy_init(ci->transceiver);
+        ret = ci_usb_phy_init(ci);
        if (ret) {
                dev_err(dev, "unable to init phy: %d\n", ret);
                return ret;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 900f7ff805ee..904efb6035b0 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -518,13 +518,16 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
        if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
                dev_err(&acm->control->dev,
                        "%s - usb_submit_urb(ctrl irq) failed\n", __func__);
+                usb_autopm_put_interface(acm->control);
                goto error_submit_urb;
        }
        acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS;
        if (acm_set_control(acm, acm->ctrlout) < 0 &&
-            (acm->ctrl_caps & USB_CDC_CAP_LINE))
+            (acm->ctrl_caps & USB_CDC_CAP_LINE)) {
+                usb_autopm_put_interface(acm->control);
                goto error_set_control;
+        }
        usb_autopm_put_interface(acm->control);
@@ -549,7 +552,6 @@ error_submit_read_urbs:
 error_set_control:
        usb_kill_urb(acm->ctrlurb);
 error_submit_urb:
-        usb_autopm_put_interface(acm->control);
 error_get_interface:
 disconnected:
        mutex_unlock(&acm->mutex);
@@ -1652,13 +1654,27 @@ static const struct usb_device_id acm_ids[] = {
        },
        /* Motorola H24 HSPA module: */
        { USB_DEVICE(0x22b8, 0x2d91) }, /* modem                                */
-        { USB_DEVICE(0x22b8, 0x2d92) }, /* modem           + diagnostics        */
+        { USB_DEVICE(0x22b8, 0x2d92),   /* modem           + diagnostics        */
-        { USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port                      */
+        .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
-        { USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics        */
+        },
-        { USB_DEVICE(0x22b8, 0x2d96) }, /* modem                         + NMEA */
+        { USB_DEVICE(0x22b8, 0x2d93),   /* modem + AT port                      */
-        { USB_DEVICE(0x22b8, 0x2d97) }, /* modem           + diagnostics + NMEA */
+        .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
-        { USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port               + NMEA */
+        },
-        { USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
+        { USB_DEVICE(0x22b8, 0x2d95),   /* modem + AT port + diagnostics        */
+        .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+        },
+        { USB_DEVICE(0x22b8, 0x2d96),   /* modem                         + NMEA */
+        .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+        },
+        { USB_DEVICE(0x22b8, 0x2d97),   /* modem           + diagnostics + NMEA */
+        .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+        },
+        { USB_DEVICE(0x22b8, 0x2d99),   /* modem + AT port               + NMEA */
+        .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+        },
+        { USB_DEVICE(0x22b8, 0x2d9a),   /* modem + AT port + diagnostics + NMEA */
+        .driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
+        },
        { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
        .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index d59d99347d54..1f02e65fe305 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -75,7 +75,7 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd,
                                PCI_SLOT(companion->devfn) != slot)
                        continue;
                companion_hcd = pci_get_drvdata(companion);
-                if (!companion_hcd)
+                if (!companion_hcd || !companion_hcd->self.root_hub)
                        continue;
                fn(pdev, hcd, companion, companion_hcd);
        }
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index d001417e8e37..10aaaae9af25 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -821,6 +821,7 @@ static void dwc3_complete(struct device *dev)
        spin_lock_irqsave(&dwc->lock, flags);
+        dwc3_event_buffers_setup(dwc);
        switch (dwc->dr_mode) {
        case USB_DR_MODE_PERIPHERAL:
        case USB_DR_MODE_OTG:
@@ -828,7 +829,6 @@ static void dwc3_complete(struct device *dev)
                /* FALLTHROUGH */
        case USB_DR_MODE_HOST:
        default:
-                dwc3_event_buffers_setup(dwc);
                break;
        }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index a740eac74d56..70715eeededd 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -187,15 +187,12 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
         * improve this algorithm so that we better use the internal
         * FIFO space
         */
-        for (num = 0; num < DWC3_ENDPOINTS_NUM; num++) {
+        for (num = 0; num < dwc->num_in_eps; num++) {
-                struct dwc3_ep  *dep = dwc->eps[num];
+                /* bit0 indicates direction; 1 means IN ep */
-                int             fifo_number = dep->number >> 1;
+                struct dwc3_ep  *dep = dwc->eps[(num << 1) | 1];
                int             mult = 1;
                int             tmp;
-                if (!(dep->number & 1))
-                        continue;
                if (!(dep->flags & DWC3_EP_ENABLED))
                        continue;
@@ -224,8 +221,7 @@ int dwc3_gadget_resize_tx_fifos(struct dwc3 *dwc)
                dev_vdbg(dwc->dev, "%s: Fifo Addr %04x Size %d\n",
                                dep->name, last_fifo_depth, fifo_size & 0xffff);
-                dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(fifo_number),
+                dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(num), fifo_size);
-                                fifo_size);
                last_fifo_depth += (fifo_size & 0xffff);
        }
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index f605ad8c1902..cfd18bcca723 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1709,16 +1709,6 @@ static int at91udc_probe(struct platform_device *pdev)
                return -ENODEV;
        }
-        if (pdev->num_resources != 2) {
-                DBG("invalid num_resources\n");
-                return -ENODEV;
-        }
-        if ((pdev->resource[0].flags != IORESOURCE_MEM)
-                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
-                DBG("invalid resource type\n");
-                return -ENODEV;
-        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res)
                return -ENXIO;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 2e164dca08e8..1e12b3ee56fd 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -745,6 +745,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 */
                struct usb_gadget *gadget = epfile->ffs->gadget;
+                spin_lock_irq(&epfile->ffs->eps_lock);
+                /* In the meantime, endpoint got disabled or changed. */
+                if (epfile->ep != ep) {
+                        spin_unlock_irq(&epfile->ffs->eps_lock);
+                        return -ESHUTDOWN;
+                }
                /*
                 * Controller may require buffer size to be aligned to
                 * maxpacketsize of an out endpoint.
@@ -752,6 +758,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                data_len = io_data->read ?
                           usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
                           io_data->len;
+                spin_unlock_irq(&epfile->ffs->eps_lock);
                data = kmalloc(data_len, GFP_KERNEL);
                if (unlikely(!data))
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index c11761ce5113..9a4f49dc6ac4 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -377,7 +377,7 @@ static struct sk_buff *rndis_add_header(struct gether *port,
        if (skb2)
                rndis_add_hdr(skb2);
-        dev_kfree_skb_any(skb);
+        dev_kfree_skb(skb);
        return skb2;
 }
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index 15960af0f67e..a2f26cdb56fe 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -1219,6 +1219,10 @@ static int fsl_pullup(struct usb_gadget *gadget, int is_on)
        struct fsl_udc *udc;
        udc = container_of(gadget, struct fsl_udc, gadget);
+        if (!udc->vbus_active)
+                return -EOPNOTSUPP;
        udc->softconnect = (is_on != 0);
        if (can_pullup(udc))
                fsl_writel((fsl_readl(&dr_regs->usbcmd) | USB_CMD_RUN_STOP),
@@ -2532,8 +2536,8 @@ static int __exit fsl_udc_remove(struct platform_device *pdev)
        if (!udc_controller)
                return -ENODEV;
-        usb_del_gadget_udc(&udc_controller->gadget);
        udc_controller->done = &done;
+        usb_del_gadget_udc(&udc_controller->gadget);
        fsl_udc_clk_release();
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index b5be6f0308c2..a925d0cbcd41 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -2043,6 +2043,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                return -ESRCH;
        /* fake probe to determine $CHIP */
+        CHIP = NULL;
        usb_gadget_probe_driver(&probe_driver);
        if (!CHIP)
                return -ENODEV;
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index d822d822efb3..7ed452d90f4d 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -35,6 +35,7 @@
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
+#include "u_rndis.h"
 #undef  VERBOSE_DEBUG
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 50d09c289137..b7d4f82872b7 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -48,8 +48,6 @@
 #define UETH__VERSION   "29-May-2008"
-#define GETHER_NAPI_WEIGHT      32
 struct eth_dev {
        /* lock is held while accessing port_usb
         */
@@ -74,7 +72,6 @@ struct eth_dev {
                                                struct sk_buff_head *list);
        struct work_struct      work;
-        struct napi_struct      rx_napi;
        unsigned long           todo;
 #define WORK_RX_MEMORY          0
@@ -256,16 +253,18 @@ enomem:
                DBG(dev, "rx submit --> %d\n", retval);
                if (skb)
                        dev_kfree_skb_any(skb);
+                spin_lock_irqsave(&dev->req_lock, flags);
+                list_add(&req->list, &dev->rx_reqs);
+                spin_unlock_irqrestore(&dev->req_lock, flags);
        }
        return retval;
 }
 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
 {
-        struct sk_buff  *skb = req->context;
+        struct sk_buff  *skb = req->context, *skb2;
        struct eth_dev  *dev = ep->driver_data;
        int             status = req->status;
-        bool            rx_queue = 0;
        switch (status) {
@@ -289,8 +288,30 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req)
                } else {
                        skb_queue_tail(&dev->rx_frames, skb);
                }
-                if (!status)
+                skb = NULL;
-                        rx_queue = 1;
+                skb2 = skb_dequeue(&dev->rx_frames);
+                while (skb2) {
+                        if (status < 0
+                                        || ETH_HLEN > skb2->len
+                                        || skb2->len > VLAN_ETH_FRAME_LEN) {
+                                dev->net->stats.rx_errors++;
+                                dev->net->stats.rx_length_errors++;
+                                DBG(dev, "rx length %d\n", skb2->len);
+                                dev_kfree_skb_any(skb2);
+                                goto next_frame;
+                        }
+                        skb2->protocol = eth_type_trans(skb2, dev->net);
+                        dev->net->stats.rx_packets++;
+                        dev->net->stats.rx_bytes += skb2->len;
+                        /* no buffer copies needed, unless hardware can't
+                         * use skb buffers.
+                         */
+                        status = netif_rx(skb2);
+next_frame:
+                        skb2 = skb_dequeue(&dev->rx_frames);
+                }
                break;
        /* software-driven interface shutdown */
@@ -313,20 +334,22 @@ quiesce:
                /* FALLTHROUGH */
        default:
-                rx_queue = 1;
-                dev_kfree_skb_any(skb);
                dev->net->stats.rx_errors++;
                DBG(dev, "rx status %d\n", status);
                break;
        }
+        if (skb)
+                dev_kfree_skb_any(skb);
+        if (!netif_running(dev->net)) {
 clean:
                spin_lock(&dev->req_lock);
                list_add(&req->list, &dev->rx_reqs);
                spin_unlock(&dev->req_lock);
+                req = NULL;
-        if (rx_queue && likely(napi_schedule_prep(&dev->rx_napi)))
+        }
-                __napi_schedule(&dev->rx_napi);
+        if (req)
+                rx_submit(dev, req, GFP_ATOMIC);
 }
 static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
@@ -391,24 +414,16 @@ static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
 {
        struct usb_request      *req;
        unsigned long           flags;
-        int                     rx_counts = 0;
        /* fill unused rxq slots with some skb */
        spin_lock_irqsave(&dev->req_lock, flags);
        while (!list_empty(&dev->rx_reqs)) {
-                if (++rx_counts > qlen(dev->gadget, dev->qmult))
-                        break;
                req = container_of(dev->rx_reqs.next,
                                struct usb_request, list);
                list_del_init(&req->list);
                spin_unlock_irqrestore(&dev->req_lock, flags);
                if (rx_submit(dev, req, gfp_flags) < 0) {
-                        spin_lock_irqsave(&dev->req_lock, flags);
-                        list_add(&req->list, &dev->rx_reqs);
-                        spin_unlock_irqrestore(&dev->req_lock, flags);
                        defer_kevent(dev, WORK_RX_MEMORY);
                        return;
                }
@@ -418,41 +433,6 @@ static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
        spin_unlock_irqrestore(&dev->req_lock, flags);
 }
-static int gether_poll(struct napi_struct *napi, int budget)
-{
-        struct eth_dev  *dev = container_of(napi, struct eth_dev, rx_napi);
-        struct sk_buff  *skb;
-        unsigned int    work_done = 0;
-        int             status = 0;
-        while ((skb = skb_dequeue(&dev->rx_frames))) {
-                if (status < 0
-                                || ETH_HLEN > skb->len
-                                || skb->len > VLAN_ETH_FRAME_LEN) {
-                        dev->net->stats.rx_errors++;
-                        dev->net->stats.rx_length_errors++;
-                        DBG(dev, "rx length %d\n", skb->len);
-                        dev_kfree_skb_any(skb);
-                        continue;
-                }
-                skb->protocol = eth_type_trans(skb, dev->net);
-                dev->net->stats.rx_packets++;
-                dev->net->stats.rx_bytes += skb->len;
-                status = netif_rx_ni(skb);
-        }
-        if (netif_running(dev->net)) {
-                rx_fill(dev, GFP_KERNEL);
-                work_done++;
-        }
-        if (work_done < budget)
-                napi_complete(&dev->rx_napi);
-        return work_done;
-}
 static void eth_work(struct work_struct *work)
 {
        struct eth_dev  *dev = container_of(work, struct eth_dev, work);
@@ -645,7 +625,6 @@ static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
        /* and open the tx floodgates */
        atomic_set(&dev->tx_qlen, 0);
        netif_wake_queue(dev->net);
-        napi_enable(&dev->rx_napi);
 }
 static int eth_open(struct net_device *net)
@@ -672,7 +651,6 @@ static int eth_stop(struct net_device *net)
        unsigned long   flags;
        VDBG(dev, "%s\n", __func__);
-        napi_disable(&dev->rx_napi);
        netif_stop_queue(net);
        DBG(dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
@@ -790,7 +768,6 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
                return ERR_PTR(-ENOMEM);
        dev = netdev_priv(net);
-        netif_napi_add(net, &dev->rx_napi, gether_poll, GETHER_NAPI_WEIGHT);
        spin_lock_init(&dev->lock);
        spin_lock_init(&dev->req_lock);
        INIT_WORK(&dev->work, eth_work);
@@ -853,7 +830,6 @@ struct net_device *gether_setup_name_default(const char *netname)
                return ERR_PTR(-ENOMEM);
        dev = netdev_priv(net);
-        netif_napi_add(net, &dev->rx_napi, gether_poll, GETHER_NAPI_WEIGHT);
        spin_lock_init(&dev->lock);
        spin_lock_init(&dev->req_lock);
        INIT_WORK(&dev->work, eth_work);
@@ -1137,7 +1113,6 @@ void gether_disconnect(struct gether *link)
 {
        struct eth_dev          *dev = link->ioport;
        struct usb_request      *req;
-        struct sk_buff          *skb;
        WARN_ON(!dev);
        if (!dev)
@@ -1164,12 +1139,6 @@ void gether_disconnect(struct gether *link)
                spin_lock(&dev->req_lock);
        }
        spin_unlock(&dev->req_lock);
-        spin_lock(&dev->rx_frames.lock);
-        while ((skb = __skb_dequeue(&dev->rx_frames)))
-                dev_kfree_skb_any(skb);
-        spin_unlock(&dev->rx_frames.lock);
        link->in_ep->driver_data = NULL;
        link->in_ep->desc = NULL;
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 9f170c53e3d9..134f354ede62 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -300,7 +300,7 @@ static int __init zero_bind(struct usb_composite_dev *cdev)
        ss_opts->isoc_interval = gzero_options.isoc_interval;
        ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket;
        ss_opts->isoc_mult = gzero_options.isoc_mult;
-        ss_opts->isoc_maxburst = gzero_options.isoc_maxpacket;
+        ss_opts->isoc_maxburst = gzero_options.isoc_maxburst;
        ss_opts->bulk_buflen = gzero_options.bulk_buflen;
        func_ss = usb_get_function(func_inst_ss);
diff --git a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c
index d1d8c47777c5..7f425acd9be5 100644
--- a/drivers/usb/host/ehci-exynos.c
+++ b/drivers/usb/host/ehci-exynos.c
@@ -212,6 +212,8 @@ static int exynos_ehci_suspend(struct device *dev)
        int rc;
        rc = ehci_suspend(hcd, do_wakeup);
+        if (rc)
+                return rc;
        if (exynos_ehci->otg)
                exynos_ehci->otg->set_host(exynos_ehci->otg, &hcd->self);
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 6f2c8d3899d2..cf2734b532a7 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -248,7 +248,8 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
                break;
        }
-        if (pdata->have_sysif_regs && pdata->controller_ver &&
+        if (pdata->have_sysif_regs &&
+            pdata->controller_ver > FSL_USB_VER_1_6 &&
            (phy_mode == FSL_USB2_PHY_ULPI)) {
                /* check PHY_CLK_VALID to get phy clk valid */
                if (!(spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index b3a0e11073aa..c7dd93aad20c 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -303,6 +303,8 @@ static int ehci_platform_suspend(struct device *dev)
        int ret;
        ret = ehci_suspend(hcd, do_wakeup);
+        if (ret)
+                return ret;
        if (pdata->power_suspend)
                pdata->power_suspend(pdev);
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 27ac6ad53c3d..7ef00ecb0da1 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -509,8 +509,31 @@ static struct platform_driver tegra_ehci_driver = {
        }
 };
+static int tegra_ehci_reset(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int retval;
+        int txfifothresh;
+        retval = ehci_setup(hcd);
+        if (retval)
+                return retval;
+        /*
+         * We should really pull this value out of tegra_ehci_soc_config, but
+         * to avoid needing access to it, make use of the fact that Tegra20 is
+         * the only one so far that needs a value of 10, and Tegra20 is the
+         * only one which doesn't set has_hostpc.
+         */
+        txfifothresh = ehci->has_hostpc ? 0x10 : 10;
+        ehci_writel(ehci, txfifothresh << 16, &ehci->regs->txfill_tuning);
+        return 0;
+}
 static const struct ehci_driver_overrides tegra_overrides __initconst = {
        .extra_priv_size        = sizeof(struct tegra_ehci_hcd),
+        .reset                  = tegra_ehci_reset,
 };
 static int __init ehci_tegra_init(void)
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index c81c8721cc5a..cd871b895013 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -90,6 +90,24 @@ __acquires(ohci->lock)
        dl_done_list (ohci);
        finish_unlinks (ohci, ohci_frame_no(ohci));
+        /*
+         * Some controllers don't handle "global" suspend properly if
+         * there are unsuspended ports.  For these controllers, put all
+         * the enabled ports into suspend before suspending the root hub.
+         */
+        if (ohci->flags & OHCI_QUIRK_GLOBAL_SUSPEND) {
+                __hc32 __iomem  *portstat = ohci->regs->roothub.portstatus;
+                int             i;
+                unsigned        temp;
+                for (i = 0; i < ohci->num_ports; (++i, ++portstat)) {
+                        temp = ohci_readl(ohci, portstat);
+                        if ((temp & (RH_PS_PES | RH_PS_PSS)) ==
+                                        RH_PS_PES)
+                                ohci_writel(ohci, RH_PS_PSS, portstat);
+                }
+        }
        /* maybe resume can wake root hub */
        if (ohci_to_hcd(ohci)->self.root_hub->do_remote_wakeup || autostop) {
                ohci->hc_control |= OHCI_CTRL_RWE;
diff --git a/drivers/usb/host/ohci-jz4740.c b/drivers/usb/host/ohci-jz4740.c
index af8dc1b92d75..c2c221a332eb 100644
--- a/drivers/usb/host/ohci-jz4740.c
+++ b/drivers/usb/host/ohci-jz4740.c
@@ -82,14 +82,14 @@ static int ohci_jz4740_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
        u16 wIndex, char *buf, u16 wLength)
 {
        struct jz4740_ohci_hcd *jz4740_ohci = hcd_to_jz4740_hcd(hcd);
-        int ret;
+        int ret = 0;
        switch (typeReq) {
-        case SetHubFeature:
+        case SetPortFeature:
                if (wValue == USB_PORT_FEAT_POWER)
                        ret = ohci_jz4740_set_vbus_power(jz4740_ohci, true);
                break;
-        case ClearHubFeature:
+        case ClearPortFeature:
                if (wValue == USB_PORT_FEAT_POWER)
                        ret = ohci_jz4740_set_vbus_power(jz4740_ohci, false);
                break;
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 90879e9ccbec..bb1509675727 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -160,6 +160,7 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd)
                ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
        }
+        ohci->flags |= OHCI_QUIRK_GLOBAL_SUSPEND;
        return 0;
 }
diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
index 9250cada13f0..4550ce05af7f 100644
--- a/drivers/usb/host/ohci.h
+++ b/drivers/usb/host/ohci.h
@@ -405,6 +405,8 @@ struct ohci_hcd {
 #define OHCI_QUIRK_HUB_POWER    0x100                   /* distrust firmware power/oc setup */
 #define OHCI_QUIRK_AMD_PLL      0x200                   /* AMD PLL quirk*/
 #define OHCI_QUIRK_AMD_PREFETCH 0x400                   /* pre-fetch for ISO transfer */
+#define OHCI_QUIRK_GLOBAL_SUSPEND       0x800           /* must suspend ports */
        // there are also chip quirks/bugs in init logic
        struct work_struct      nec_work;       /* Worker for NEC quirk */
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 47390e369cd4..35d447780707 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -134,6 +134,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 */
                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+                xhci->quirks |= XHCI_SPURIOUS_REBOOT;
        }
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
@@ -143,9 +145,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
        }
        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
-                        pdev->device == 0x0015 &&
+                        pdev->device == 0x0015)
-                        pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG &&
-                        pdev->subsystem_device == 0xc0cd)
                xhci->quirks |= XHCI_RESET_ON_RESUME;
        if (pdev->vendor == PCI_VENDOR_ID_VIA)
                xhci->quirks |= XHCI_RESET_ON_RESUME;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5f926bea5ab1..7a0e3c720c00 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -550,6 +550,7 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
        struct xhci_ring *ep_ring;
        struct xhci_generic_trb *trb;
        dma_addr_t addr;
+        u64 hw_dequeue;
        ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
                        ep_index, stream_id);
@@ -559,16 +560,6 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                                stream_id);
                return;
        }
-        state->new_cycle_state = 0;
-        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
-                        "Finding segment containing stopped TRB.");
-        state->new_deq_seg = find_trb_seg(cur_td->start_seg,
-                        dev->eps[ep_index].stopped_trb,
-                        &state->new_cycle_state);
-        if (!state->new_deq_seg) {
-                WARN_ON(1);
-                return;
-        }
        /* Dig out the cycle state saved by the xHC during the stop ep cmd */
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
@@ -577,46 +568,57 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
        if (ep->ep_state & EP_HAS_STREAMS) {
                struct xhci_stream_ctx *ctx =
                        &ep->stream_info->stream_ctx_array[stream_id];
-                state->new_cycle_state = 0x1 & le64_to_cpu(ctx->stream_ring);
+                hw_dequeue = le64_to_cpu(ctx->stream_ring);
        } else {
                struct xhci_ep_ctx *ep_ctx
                        = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
-                state->new_cycle_state = 0x1 & le64_to_cpu(ep_ctx->deq);
+                hw_dequeue = le64_to_cpu(ep_ctx->deq);
        }
+        /* Find virtual address and segment of hardware dequeue pointer */
+        state->new_deq_seg = ep_ring->deq_seg;
+        state->new_deq_ptr = ep_ring->dequeue;
+        while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
+                        != (dma_addr_t)(hw_dequeue & ~0xf)) {
+                next_trb(xhci, ep_ring, &state->new_deq_seg,
+                                        &state->new_deq_ptr);
+                if (state->new_deq_ptr == ep_ring->dequeue) {
+                        WARN_ON(1);
+                        return;
+                }
+        }
+        /*
+         * Find cycle state for last_trb, starting at old cycle state of
+         * hw_dequeue. If there is only one segment ring, find_trb_seg() will
+         * return immediately and cannot toggle the cycle state if this search
+         * wraps around, so add one more toggle manually in that case.
+         */
+        state->new_cycle_state = hw_dequeue & 0x1;
+        if (ep_ring->first_seg == ep_ring->first_seg->next &&
+                        cur_td->last_trb < state->new_deq_ptr)
+                state->new_cycle_state ^= 0x1;
        state->new_deq_ptr = cur_td->last_trb;
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                        "Finding segment containing last TRB in TD.");
        state->new_deq_seg = find_trb_seg(state->new_deq_seg,
-                        state->new_deq_ptr,
+                        state->new_deq_ptr, &state->new_cycle_state);
-                        &state->new_cycle_state);
        if (!state->new_deq_seg) {
                WARN_ON(1);
                return;
        }
+        /* Increment to find next TRB after last_trb. Cycle if appropriate. */
        trb = &state->new_deq_ptr->generic;
        if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
            (trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
                state->new_cycle_state ^= 0x1;
        next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
-        /*
+        /* Don't update the ring cycle state for the producer (us). */
-         * If there is only one segment in a ring, find_trb_seg()'s while loop
-         * will not run, and it will return before it has a chance to see if it
-         * needs to toggle the cycle bit.  It can't tell if the stalled transfer
-         * ended just before the link TRB on a one-segment ring, or if the TD
-         * wrapped around the top of the ring, because it doesn't have the TD in
-         * question.  Look for the one-segment case where stalled TRB's address
-         * is greater than the new dequeue pointer address.
-         */
-        if (ep_ring->first_seg == ep_ring->first_seg->next &&
-                        state->new_deq_ptr < dev->eps[ep_index].stopped_trb)
-                state->new_cycle_state ^= 0x1;
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                        "Cycle state = 0x%x", state->new_cycle_state);
-        /* Don't update the ring cycle state for the producer (us). */
        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                        "New dequeue segment = %p (virtual)",
                        state->new_deq_seg);
@@ -799,7 +801,6 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
        if (list_empty(&ep->cancelled_td_list)) {
                xhci_stop_watchdog_timer_in_irq(xhci, ep);
                ep->stopped_td = NULL;
-                ep->stopped_trb = NULL;
                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
                return;
        }
@@ -867,11 +868,9 @@ remove_finished_td:
                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
        }
-        /* Clear stopped_td and stopped_trb if endpoint is not halted */
+        /* Clear stopped_td if endpoint is not halted */
-        if (!(ep->ep_state & EP_HALTED)) {
+        if (!(ep->ep_state & EP_HALTED))
                ep->stopped_td = NULL;
-                ep->stopped_trb = NULL;
-        }
        /*
         * Drop the lock and complete the URBs in the cancelled TD list.
@@ -1941,14 +1940,12 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
        struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
        ep->ep_state |= EP_HALTED;
        ep->stopped_td = td;
-        ep->stopped_trb = event_trb;
        ep->stopped_stream = stream_id;
        xhci_queue_reset_ep(xhci, slot_id, ep_index);
        xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
        ep->stopped_td = NULL;
-        ep->stopped_trb = NULL;
        ep->stopped_stream = 0;
        xhci_ring_cmd_db(xhci);
@@ -2030,7 +2027,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 * the ring dequeue pointer or take this TD off any lists yet.
                 */
                ep->stopped_td = td;
-                ep->stopped_trb = event_trb;
                return 0;
        } else {
                if (trb_comp_code == COMP_STALL) {
@@ -2042,7 +2038,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
                         * USB class driver clear the stall later.
                         */
                        ep->stopped_td = td;
-                        ep->stopped_trb = event_trb;
                        ep->stopped_stream = ep_ring->stream_id;
                } else if (xhci_requires_manual_halt_cleanup(xhci,
                                        ep_ctx, trb_comp_code)) {
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 8fe4e124ddd4..300836972faa 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -408,16 +408,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
 #else
-static int xhci_try_enable_msi(struct usb_hcd *hcd)
+static inline int xhci_try_enable_msi(struct usb_hcd *hcd)
 {
        return 0;
 }
-static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+static inline void xhci_cleanup_msix(struct xhci_hcd *xhci)
 {
 }
-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
 {
 }
@@ -2954,7 +2954,6 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
                xhci_ring_cmd_db(xhci);
        }
        virt_ep->stopped_td = NULL;
-        virt_ep->stopped_trb = NULL;
        virt_ep->stopped_stream = 0;
        spin_unlock_irqrestore(&xhci->lock, flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index d280e9213d08..4746816aed3e 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -865,8 +865,6 @@ struct xhci_virt_ep {
 #define EP_GETTING_NO_STREAMS   (1 << 5)
        /* ----  Related to URB cancellation ---- */
        struct list_head        cancelled_td_list;
-        /* The TRB that was last reported in a stopped endpoint ring */
-        union xhci_trb          *stopped_trb;
        struct xhci_td          *stopped_td;
        unsigned int            stopped_stream;
        /* Watchdog timer for stop endpoint command to cancel URBs */
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 3372ded5def7..e2fd263585de 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -470,8 +470,9 @@ static int dsps_musb_exit(struct musb *musb)
        struct dsps_glue *glue = dev_get_drvdata(dev->parent);
        del_timer_sync(&glue->timer);
        usb_phy_shutdown(musb->xceiv);
+        debugfs_remove_recursive(glue->dbgfs_root);
        return 0;
 }
@@ -708,8 +709,6 @@ static int dsps_remove(struct platform_device *pdev)
        pm_runtime_put(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
-        debugfs_remove_recursive(glue->dbgfs_root);
        return 0;
 }
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index d341c149a2f9..d369bf1f3936 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -316,7 +316,13 @@ static void omap_musb_mailbox_work(struct work_struct *mailbox_work)
 {
        struct omap2430_glue *glue = container_of(mailbox_work,
                                struct omap2430_glue, omap_musb_mailbox_work);
+        struct musb *musb = glue_to_musb(glue);
+        struct device *dev = musb->controller;
+        pm_runtime_get_sync(dev);
        omap_musb_set_mailbox(glue);
+        pm_runtime_mark_last_busy(dev);
+        pm_runtime_put_autosuspend(dev);
 }
 static irqreturn_t omap2430_musb_interrupt(int irq, void *__hci)
@@ -416,6 +422,7 @@ static int omap2430_musb_init(struct musb *musb)
                omap_musb_set_mailbox(glue);
        phy_init(musb->phy);
+        phy_power_on(musb->phy);
        pm_runtime_put_noidle(musb->controller);
        return 0;
@@ -478,6 +485,7 @@ static int omap2430_musb_exit(struct musb *musb)
        del_timer_sync(&musb_idle_timer);
        omap2430_low_level_exit(musb);
+        phy_power_off(musb->phy);
        phy_exit(musb->phy);
        return 0;
diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
index d75196ad5f2f..35b6083b7999 100644
--- a/drivers/usb/phy/phy-am335x-control.c
+++ b/drivers/usb/phy/phy-am335x-control.c
@@ -3,6 +3,7 @@
 #include <linux/err.h>
 #include <linux/of.h>
 #include <linux/io.h>
+#include <linux/delay.h>
 #include "am35x-phy-control.h"
 struct am335x_control_usb {
@@ -86,6 +87,14 @@ static void am335x_phy_power(struct phy_control *phy_ctrl, u32 id, bool on)
        }
        writel(val, usb_ctrl->phy_reg + reg);
+        /*
+         * Give the PHY ~1ms to complete the power up operation.
+         * Tests have shown unstable behaviour if other USB PHY related
+         * registers are written too shortly after such a transition.
+         */
+        if (on)
+                mdelay(1);
 }
 static const struct phy_control ctrl_am335x = {
diff --git a/drivers/usb/phy/phy-fsm-usb.c b/drivers/usb/phy/phy-fsm-usb.c
index c47e5a6edde2..d03fadd2629f 100644
--- a/drivers/usb/phy/phy-fsm-usb.c
+++ b/drivers/usb/phy/phy-fsm-usb.c
@@ -303,17 +303,18 @@ int otg_statemachine(struct otg_fsm *fsm)
                        otg_set_state(fsm, OTG_STATE_A_WAIT_VRISE);
                break;
        case OTG_STATE_A_WAIT_VRISE:
-                if (fsm->id || fsm->a_bus_drop || fsm->a_vbus_vld ||
+                if (fsm->a_vbus_vld)
-                                fsm->a_wait_vrise_tmout) {
                        otg_set_state(fsm, OTG_STATE_A_WAIT_BCON);
-                }
+                else if (fsm->id || fsm->a_bus_drop ||
+                                fsm->a_wait_vrise_tmout)
+                        otg_set_state(fsm, OTG_STATE_A_WAIT_VFALL);
                break;
        case OTG_STATE_A_WAIT_BCON:
                if (!fsm->a_vbus_vld)
                        otg_set_state(fsm, OTG_STATE_A_VBUS_ERR);
                else if (fsm->b_conn)
                        otg_set_state(fsm, OTG_STATE_A_HOST);
-                else if (fsm->id | fsm->a_bus_drop | fsm->a_wait_bcon_tmout)
+                else if (fsm->id || fsm->a_bus_drop || fsm->a_wait_bcon_tmout)
                        otg_set_state(fsm, OTG_STATE_A_WAIT_VFALL);
                break;
        case OTG_STATE_A_HOST:
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index 8afa813d690b..36b6bce33b20 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -132,6 +132,9 @@ struct usb_phy *usb_get_phy(enum usb_phy_type type)
        if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
                pr_debug("PHY: unable to find transceiver of type %s\n",
                        usb_phy_type_string(type));
+                if (!IS_ERR(phy))
+                        phy = ERR_PTR(-ENODEV);
                goto err0;
        }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 95fa1217afdd..762e4a5f5ae9 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -104,6 +104,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
        { USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
        { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
+        { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
        { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
        { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
        { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 44ab12986805..7c6e1dedeb06 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -909,6 +909,39 @@ static const struct usb_device_id id_table_combined[] = {
        { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
        /* Cressi Devices */
        { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
+        /* Brainboxes Devices */
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
+        { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index e599fbfcde5f..993c93df6874 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1326,3 +1326,40 @@
 * Manufacturer: Cressi
 */
 #define FTDI_CRESSI_PID         0x87d0
+/*
+ * Brainboxes devices
+ */
+#define BRAINBOXES_VID                  0x05d1
+#define BRAINBOXES_VX_001_PID           0x1001 /* VX-001 ExpressCard 1 Port RS232 */
+#define BRAINBOXES_VX_012_PID           0x1002 /* VX-012 ExpressCard 2 Port RS232 */
+#define BRAINBOXES_VX_023_PID           0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
+#define BRAINBOXES_VX_034_PID           0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
+#define BRAINBOXES_US_101_PID           0x1011 /* US-101 1xRS232 */
+#define BRAINBOXES_US_324_PID           0x1013 /* US-324 1xRS422/485 1Mbaud */
+#define BRAINBOXES_US_606_1_PID         0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
+#define BRAINBOXES_US_606_2_PID         0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
+#define BRAINBOXES_US_606_3_PID         0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
+#define BRAINBOXES_US_701_1_PID         0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_701_2_PID         0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_279_1_PID         0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_279_2_PID         0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_279_3_PID         0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_279_4_PID         0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_346_1_PID         0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_346_2_PID         0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_257_PID           0x5001 /* US-257 2xRS232 1Mbaud */
+#define BRAINBOXES_US_313_PID           0x6001 /* US-313 2xRS422/485 1Mbaud */
+#define BRAINBOXES_US_357_PID           0x7001 /* US_357 1xRS232/422/485 */
+#define BRAINBOXES_US_842_1_PID         0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_842_2_PID         0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_842_3_PID         0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_842_4_PID         0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_160_1_PID         0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
+#define BRAINBOXES_US_160_2_PID         0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
+#define BRAINBOXES_US_160_3_PID         0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
+#define BRAINBOXES_US_160_4_PID         0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
+#define BRAINBOXES_US_160_5_PID         0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
+#define BRAINBOXES_US_160_6_PID         0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
+#define BRAINBOXES_US_160_7_PID         0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
+#define BRAINBOXES_US_160_8_PID         0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index a2db5be9c305..df90dae53eb9 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -28,6 +28,7 @@
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 #include <linux/serial.h>
+#include <linux/swab.h>
 #include <linux/kfifo.h>
 #include <linux/ioctl.h>
 #include <linux/firmware.h>
@@ -280,7 +281,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
 {
        int status = 0;
        __u8 read_length;
-        __be16 be_start_address;
+        u16 be_start_address;
        dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, length);
@@ -296,10 +297,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
                if (read_length > 1) {
                        dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, read_length);
                }
-                be_start_address = cpu_to_be16(start_address);
+                /*
+                 * NOTE: Must use swab as wIndex is sent in little-endian
+                 *       byte order regardless of host byte order.
+                 */
+                be_start_address = swab16((u16)start_address);
                status = ti_vread_sync(dev, UMPC_MEMORY_READ,
                                        (__u16)address_type,
-                                        (__force __u16)be_start_address,
+                                        be_start_address,
                                        buffer, read_length);
                if (status) {
@@ -394,7 +399,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
        struct device *dev = &serial->serial->dev->dev;
        int status = 0;
        int write_length;
-        __be16 be_start_address;
+        u16 be_start_address;
        /* We can only send a maximum of 1 aligned byte page at a time */
@@ -409,11 +414,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
                __func__, start_address, write_length);
        usb_serial_debug_data(dev, __func__, write_length, buffer);
-        /* Write first page */
+        /*
-        be_start_address = cpu_to_be16(start_address);
+         * Write first page.
+         *
+         * NOTE: Must use swab as wIndex is sent in little-endian byte order
+         *       regardless of host byte order.
+         */
+        be_start_address = swab16((u16)start_address);
        status = ti_vsend_sync(serial->serial->dev,
                                UMPC_MEMORY_WRITE, (__u16)address_type,
-                                (__force __u16)be_start_address,
+                                be_start_address,
                                buffer, write_length);
        if (status) {
                dev_dbg(dev, "%s - ERROR %d\n", __func__, status);
@@ -436,11 +446,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
                        __func__, start_address, write_length);
                usb_serial_debug_data(dev, __func__, write_length, buffer);
-                /* Write next page */
+                /*
-                be_start_address = cpu_to_be16(start_address);
+                 * Write next page.
+                 *
+                 * NOTE: Must use swab as wIndex is sent in little-endian byte
+                 *       order regardless of host byte order.
+                 */
+                be_start_address = swab16((u16)start_address);
                status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
                                (__u16)address_type,
-                                (__force __u16)be_start_address,
+                                be_start_address,
                                buffer, write_length);
                if (status) {
                        dev_err(dev, "%s - ERROR %d\n", __func__, status);
@@ -585,8 +600,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
                if (rom_desc->Type == desc_type)
                        return start_address;
-                start_address = start_address + sizeof(struct ti_i2c_desc)
+                start_address = start_address + sizeof(struct ti_i2c_desc) +
-                                                        + rom_desc->Size;
+                                                le16_to_cpu(rom_desc->Size);
        } while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
@@ -599,7 +614,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
        __u16 i;
        __u8 cs = 0;
-        for (i = 0; i < rom_desc->Size; i++)
+        for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
                cs = (__u8)(cs + buffer[i]);
        if (cs != rom_desc->CheckSum) {
@@ -650,7 +665,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
                        break;
                if ((start_address + sizeof(struct ti_i2c_desc) +
-                                        rom_desc->Size) > TI_MAX_I2C_SIZE) {
+                        le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
                        status = -ENODEV;
                        dev_dbg(dev, "%s - structure too big, erroring out.\n", __func__);
                        break;
@@ -665,7 +680,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
                        /* Read the descriptor data */
                        status = read_rom(serial, start_address +
                                                sizeof(struct ti_i2c_desc),
-                                                rom_desc->Size, buffer);
+                                                le16_to_cpu(rom_desc->Size),
+                                                buffer);
                        if (status)
                                break;
@@ -674,7 +690,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
                                break;
                }
                start_address = start_address + sizeof(struct ti_i2c_desc) +
-                                                                rom_desc->Size;
+                                                le16_to_cpu(rom_desc->Size);
        } while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
                                (start_address < TI_MAX_I2C_SIZE));
@@ -712,7 +728,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
        /* Read the descriptor data */
        status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
-                                                rom_desc->Size, buffer);
+                                        le16_to_cpu(rom_desc->Size), buffer);
        if (status)
                goto exit;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 68fc9fe65936..f213ee978516 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb);
 #define QUALCOMM_VENDOR_ID                      0x05C6
 #define CMOTECH_VENDOR_ID                       0x16d8
-#define CMOTECH_PRODUCT_6008                    0x6008
+#define CMOTECH_PRODUCT_6001                    0x6001
-#define CMOTECH_PRODUCT_6280                    0x6280
+#define CMOTECH_PRODUCT_CMU_300                 0x6002
+#define CMOTECH_PRODUCT_6003                    0x6003
+#define CMOTECH_PRODUCT_6004                    0x6004
+#define CMOTECH_PRODUCT_6005                    0x6005
+#define CMOTECH_PRODUCT_CGU_628A                0x6006
+#define CMOTECH_PRODUCT_CHE_628S                0x6007
+#define CMOTECH_PRODUCT_CMU_301                 0x6008
+#define CMOTECH_PRODUCT_CHU_628                 0x6280
+#define CMOTECH_PRODUCT_CHU_628S                0x6281
+#define CMOTECH_PRODUCT_CDU_680                 0x6803
+#define CMOTECH_PRODUCT_CDU_685A                0x6804
+#define CMOTECH_PRODUCT_CHU_720S                0x7001
+#define CMOTECH_PRODUCT_7002                    0x7002
+#define CMOTECH_PRODUCT_CHU_629K                0x7003
+#define CMOTECH_PRODUCT_7004                    0x7004
+#define CMOTECH_PRODUCT_7005                    0x7005
+#define CMOTECH_PRODUCT_CGU_629                 0x7006
+#define CMOTECH_PRODUCT_CHU_629S                0x700a
+#define CMOTECH_PRODUCT_CHU_720I                0x7211
+#define CMOTECH_PRODUCT_7212                    0x7212
+#define CMOTECH_PRODUCT_7213                    0x7213
+#define CMOTECH_PRODUCT_7251                    0x7251
+#define CMOTECH_PRODUCT_7252                    0x7252
+#define CMOTECH_PRODUCT_7253                    0x7253
 #define TELIT_VENDOR_ID                         0x1bc7
 #define TELIT_PRODUCT_UC864E                    0x1003
@@ -243,6 +266,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_CC864_DUAL                0x1005
 #define TELIT_PRODUCT_CC864_SINGLE              0x1006
 #define TELIT_PRODUCT_DE910_DUAL                0x1010
+#define TELIT_PRODUCT_UE910_V2                  0x1012
 #define TELIT_PRODUCT_LE920                     0x1200
 /* ZTE PRODUCTS */
@@ -286,6 +310,7 @@ static void option_instat_callback(struct urb *urb);
 #define ALCATEL_PRODUCT_X060S_X200              0x0000
 #define ALCATEL_PRODUCT_X220_X500D              0x0017
 #define ALCATEL_PRODUCT_L100V                   0x011e
+#define ALCATEL_PRODUCT_L800MA                  0x0203
 #define PIRELLI_VENDOR_ID                       0x1266
 #define PIRELLI_PRODUCT_C100_1                  0x1002
@@ -348,6 +373,7 @@ static void option_instat_callback(struct urb *urb);
 #define OLIVETTI_PRODUCT_OLICARD100             0xc000
 #define OLIVETTI_PRODUCT_OLICARD145             0xc003
 #define OLIVETTI_PRODUCT_OLICARD200             0xc005
+#define OLIVETTI_PRODUCT_OLICARD500             0xc00b
 /* Celot products */
 #define CELOT_VENDOR_ID                         0x211f
@@ -501,6 +527,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = {
        .reserved = BIT(1) | BIT(2),
 };
+static const struct option_blacklist_info net_intf0_blacklist = {
+        .reserved = BIT(0),
+};
 static const struct option_blacklist_info net_intf1_blacklist = {
        .reserved = BIT(1),
 };
@@ -1034,13 +1064,53 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
-        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
-        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
+          .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
+          .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
+          .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
+          .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
+          .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
+          .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
                .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
@@ -1498,6 +1568,8 @@ static const struct usb_device_id option_ids[] = {
          .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
+          .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
        { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
        { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
        { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
@@ -1543,6 +1615,9 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
                .driver_info = (kernel_ulong_t)&net_intf6_blacklist
        },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
+                .driver_info = (kernel_ulong_t)&net_intf4_blacklist
+        },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 2e22fc22c382..b3d5a35c0d4b 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -83,6 +83,9 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
        { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
        { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+        { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+        { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+        { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
        { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
        { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
        { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index c38b8c00c06f..42bc082896ac 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -121,8 +121,11 @@
 #define SUPERIAL_VENDOR_ID      0x5372
 #define SUPERIAL_PRODUCT_ID     0x2303
-/* Hewlett-Packard LD220-HP POS Pole Display */
+/* Hewlett-Packard POS Pole Displays */
 #define HP_VENDOR_ID            0x03f0
+#define HP_LD960_PRODUCT_ID     0x0b39
+#define HP_LCM220_PRODUCT_ID    0x3139
+#define HP_LCM960_PRODUCT_ID    0x3239
 #define HP_LD220_PRODUCT_ID     0x3524
 /* Cressi Edy (diving computer) PC interface */
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 968a40201e5f..6c0a542e8ec1 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -136,12 +136,36 @@ static const struct usb_device_id id_table[] = {
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 0)},       /* Sierra Wireless MC7710 Device Management */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 2)},       /* Sierra Wireless MC7710 NMEA */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 3)},       /* Sierra Wireless MC7710 Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 0)},       /* Sierra Wireless MC73xx Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 2)},       /* Sierra Wireless MC73xx NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 3)},       /* Sierra Wireless MC73xx Modem */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)},       /* Sierra Wireless EM7700 Device Management */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)},       /* Sierra Wireless EM7700 NMEA */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)},       /* Sierra Wireless EM7700 Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 0)},       /* Sierra Wireless EM7355 Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 2)},       /* Sierra Wireless EM7355 NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 3)},       /* Sierra Wireless EM7355 Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 0)},       /* Sierra Wireless MC7305/MC7355 Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 2)},       /* Sierra Wireless MC7305/MC7355 NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 3)},       /* Sierra Wireless MC7305/MC7355 Modem */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)},       /* Netgear AirCard 340U Device Management */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)},       /* Netgear AirCard 340U NMEA */
        {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)},       /* Netgear AirCard 340U Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 0)},       /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 2)},       /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a2, 3)},       /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 0)},       /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 2)},       /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a3, 3)},       /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 0)},       /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 2)},       /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a4, 3)},       /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 0)},       /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 2)},       /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a8, 3)},       /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card Modem */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 0)},       /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Device Management */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 2)},       /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card NMEA */
+        {USB_DEVICE_INTERFACE_NUMBER(0x413c, 0x81a9, 3)},       /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card Modem */
        { }                             /* Terminating entry */
 };
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index a9eb6221a815..6b192e602ce0 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -291,7 +291,6 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x0f3d, 0x68A3),   /* Airprime/Sierra Wireless Direct IP modems */
          .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
        },
-       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
        { }
 };
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 81fc0dfcfdcf..6d40d56378d7 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1347,10 +1347,12 @@ static int usb_serial_register(struct usb_serial_driver *driver)
 static void usb_serial_deregister(struct usb_serial_driver *device)
 {
        pr_info("USB Serial deregistering driver %s\n", device->description);
        mutex_lock(&table_lock);
        list_del(&device->driver_list);
-        usb_serial_bus_deregister(device);
        mutex_unlock(&table_lock);
+        usb_serial_bus_deregister(device);
 }
 /**
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 640fe0173236..b078440e822f 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -466,6 +466,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
        int err;
        int i;
+        if (!port->bulk_in_size || !port->bulk_out_size)
+                return -ENODEV;
        portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
        if (!portdata)
                return -ENOMEM;
@@ -473,9 +476,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
        init_usb_anchor(&portdata->delayed);
        for (i = 0; i < N_IN_URB; i++) {
-                if (!port->bulk_in_size)
-                        break;
                buffer = (u8 *)__get_free_page(GFP_KERNEL);
                if (!buffer)
                        goto bail_out_error;
@@ -489,9 +489,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
        }
        for (i = 0; i < N_OUT_URB; i++) {
-                if (!port->bulk_out_size)
-                        break;
                buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
                if (!buffer)
                        goto bail_out_error2;
diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index 4ef2a80728f7..008d805c3d21 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -1851,7 +1851,7 @@ static int usbat_probe(struct usb_interface *intf,
        us->transport_name = "Shuttle USBAT";
        us->transport = usbat_flash_transport;
        us->transport_reset = usb_stor_CB_reset;
-        us->max_lun = 1;
+        us->max_lun = 0;
        result = usb_stor_probe2(us);
        return result;
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index a7ac97cc5949..511b22953167 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -137,7 +137,7 @@ static void uas_do_work(struct work_struct *work)
                if (!(cmdinfo->state & IS_IN_WORK_LIST))
                        continue;
-                err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_NOIO);
+                err = uas_submit_urbs(cmnd, cmnd->device->hostdata, GFP_ATOMIC);
                if (!err)
                        cmdinfo->state &= ~IS_IN_WORK_LIST;
                else
@@ -803,7 +803,7 @@ static int uas_eh_task_mgmt(struct scsi_cmnd *cmnd,
        devinfo->running_task = 1;
        memset(&devinfo->response, 0, sizeof(devinfo->response));
-        sense_urb = uas_submit_sense_urb(cmnd, GFP_NOIO,
+        sense_urb = uas_submit_sense_urb(cmnd, GFP_ATOMIC,
                                         devinfo->use_streams ? tag : 0);
        if (!sense_urb) {
                shost_printk(KERN_INFO, shost,
@@ -813,7 +813,7 @@ static int uas_eh_task_mgmt(struct scsi_cmnd *cmnd,
                spin_unlock_irqrestore(&devinfo->lock, flags);
                return FAILED;
        }
-        if (uas_submit_task_urb(cmnd, GFP_NOIO, function, tag)) {
+        if (uas_submit_task_urb(cmnd, GFP_ATOMIC, function, tag)) {
                shost_printk(KERN_INFO, shost,
                             "%s: %s: submit task mgmt urb failed\n",
                             __func__, fname);
@@ -1030,7 +1030,7 @@ static int uas_configure_endpoints(struct uas_dev_info *devinfo)
                devinfo->use_streams = 0;
        } else {
                devinfo->qdepth = usb_alloc_streams(devinfo->intf, eps + 1,
-                                                    3, 256, GFP_KERNEL);
+                                                    3, 256, GFP_NOIO);
                if (devinfo->qdepth < 0)
                        return devinfo->qdepth;
                devinfo->use_streams = 1;
@@ -1047,7 +1047,7 @@ static void uas_free_streams(struct uas_dev_info *devinfo)
        eps[0] = usb_pipe_endpoint(udev, devinfo->status_pipe);
        eps[1] = usb_pipe_endpoint(udev, devinfo->data_in_pipe);
        eps[2] = usb_pipe_endpoint(udev, devinfo->data_out_pipe);
-        usb_free_streams(devinfo->intf, eps, 3, GFP_KERNEL);
+        usb_free_streams(devinfo->intf, eps, 3, GFP_NOIO);
 }
 static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
@@ -1096,16 +1096,17 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
        if (result)
                goto free_streams;
+        usb_set_intfdata(intf, shost);
        result = scsi_add_host(shost, &intf->dev);
        if (result)
                goto free_streams;
        scsi_scan_host(shost);
-        usb_set_intfdata(intf, shost);
        return result;
 free_streams:
        uas_free_streams(devinfo);
+        usb_set_intfdata(intf, NULL);
 set_alt0:
        usb_set_interface(udev, intf->altsetting[0].desc.bInterfaceNumber, 0);
        if (shost)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index f4a82291894a..174a447868cd 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -234,6 +234,20 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_MAX_SECTORS_64 ),
+/* Reported by Daniele Forsi <dforsi@gmail.com> */
+UNUSUAL_DEV(  0x0421, 0x04b9, 0x0350, 0x0350,
+                "Nokia",
+                "5300",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64 ),
+/* Patch submitted by Victor A. Santos <victoraur.santos@gmail.com> */
+UNUSUAL_DEV(  0x0421, 0x05af, 0x0742, 0x0742,
+                "Nokia",
+                "305",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64),
 /* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
 UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
                "Nokia",
diff --git a/drivers/usb/usb-common.c b/drivers/usb/usb-common.c
index d771870a819e..6dfd30a863c7 100644
--- a/drivers/usb/usb-common.c
+++ b/drivers/usb/usb-common.c
@@ -69,7 +69,7 @@ const char *usb_state_string(enum usb_device_state state)
                [USB_STATE_RECONNECTING] = "reconnecting",
                [USB_STATE_UNAUTHENTICATED] = "unauthenticated",
                [USB_STATE_DEFAULT] = "default",
-                [USB_STATE_ADDRESS] = "addresssed",
+                [USB_STATE_ADDRESS] = "addressed",
                [USB_STATE_CONFIGURED] = "configured",
                [USB_STATE_SUSPENDED] = "suspended",
        };
diff --git a/drivers/usb/wusbcore/mmc.c b/drivers/usb/wusbcore/mmc.c
index 44741267c917..3f485df96226 100644
--- a/drivers/usb/wusbcore/mmc.c
+++ b/drivers/usb/wusbcore/mmc.c
@@ -301,7 +301,7 @@ int wusbhc_chid_set(struct wusbhc *wusbhc, const struct wusb_ckhdid *chid)
        if (chid)
                result = uwb_radio_start(&wusbhc->pal);
-        else
+        else if (wusbhc->uwb_rc)
                uwb_radio_stop(&wusbhc->pal);
        return result;
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index c8e2a47d62a7..3e2e4ed20157 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -2390,10 +2390,10 @@ error_complete:
                done) {
                dev_info(dev, "Control EP stall.  Queue delayed work.\n");
-                spin_lock_irq(&wa->xfer_list_lock);
+                spin_lock(&wa->xfer_list_lock);
                /* move xfer from xfer_list to xfer_errored_list. */
                list_move_tail(&xfer->list_node, &wa->xfer_errored_list);
-                spin_unlock_irq(&wa->xfer_list_lock);
+                spin_unlock(&wa->xfer_list_lock);
                spin_unlock_irqrestore(&xfer->lock, flags);
                queue_work(wusbd, &wa->xfer_error_work);
        } else {
diff --git a/drivers/uwb/drp.c b/drivers/uwb/drp.c
index 16ada8341c46..468c89fb6a16 100644
--- a/drivers/uwb/drp.c
+++ b/drivers/uwb/drp.c
@@ -59,6 +59,7 @@ static void uwb_rc_set_drp_cmd_done(struct uwb_rc *rc, void *arg,
                                    struct uwb_rceb *reply, ssize_t reply_size)
 {
        struct uwb_rc_evt_set_drp_ie *r = (struct uwb_rc_evt_set_drp_ie *)reply;
+        unsigned long flags;
        if (r != NULL) {
                if (r->bResultCode != UWB_RC_RES_SUCCESS)
@@ -67,14 +68,14 @@ static void uwb_rc_set_drp_cmd_done(struct uwb_rc *rc, void *arg,
        } else
                dev_err(&rc->uwb_dev.dev, "SET-DRP-IE: timeout\n");
-        spin_lock_irq(&rc->rsvs_lock);
+        spin_lock_irqsave(&rc->rsvs_lock, flags);
        if (rc->set_drp_ie_pending > 1) {
                rc->set_drp_ie_pending = 0;
-                uwb_rsv_queue_update(rc);       
+                uwb_rsv_queue_update(rc);
        } else {
-                rc->set_drp_ie_pending = 0;     
+                rc->set_drp_ie_pending = 0;
        }
-        spin_unlock_irq(&rc->rsvs_lock);
+        spin_unlock_irqrestore(&rc->rsvs_lock, flags);
 }
 /**
@@ -599,8 +600,11 @@ static void uwb_drp_handle_alien_drp(struct uwb_rc *rc, struct uwb_ie_drp *drp_i
        /* alloc and initialize new uwb_cnflt_alien */
        cnflt = kzalloc(sizeof(struct uwb_cnflt_alien), GFP_KERNEL);
-        if (!cnflt)
+        if (!cnflt) {
                dev_err(dev, "failed to alloc uwb_cnflt_alien struct\n");
+                return;
+        }
        INIT_LIST_HEAD(&cnflt->rc_node);
        init_timer(&cnflt->timer);
        cnflt->timer.function = uwb_cnflt_timer;
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 6c793bc683d9..c7b4f0f927b1 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -21,7 +21,15 @@ source "drivers/gpu/vga/Kconfig"
 source "drivers/gpu/host1x/Kconfig"
+menu "Direct Rendering Manager"
 source "drivers/gpu/drm/Kconfig"
+endmenu
+menu "Frame buffer Devices"
+source "drivers/video/fbdev/Kconfig"
+endmenu
+source "drivers/video/backlight/Kconfig"
 config VGASTATE
       tristate
@@ -33,2482 +41,14 @@ config VIDEOMODE_HELPERS
 config HDMI
        bool
-menuconfig FB
-        tristate "Support for frame buffer devices"
-        ---help---
-          The frame buffer device provides an abstraction for the graphics
-          hardware. It represents the frame buffer of some video hardware and
-          allows application software to access the graphics hardware through
-          a well-defined interface, so the software doesn't need to know
-          anything about the low-level (hardware register) stuff.
-          Frame buffer devices work identically across the different
-          architectures supported by Linux and make the implementation of
-          application programs easier and more portable; at this point, an X
-          server exists which uses the frame buffer device exclusively.
-          On several non-X86 architectures, the frame buffer device is the
-          only way to use the graphics hardware.
-          The device is accessed through special device nodes, usually located
-          in the /dev directory, i.e. /dev/fb*.
-          You need an utility program called fbset to make full use of frame
-          buffer devices. Please read <file:Documentation/fb/framebuffer.txt>
-          and the Framebuffer-HOWTO at
-          <http://www.munted.org.uk/programming/Framebuffer-HOWTO-1.3.html> for more
-          information.
-          Say Y here and to the driver for your graphics board below if you
-          are compiling a kernel for a non-x86 architecture.
-          If you are compiling for the x86 architecture, you can say Y if you
-          want to play with it, but it is not essential. Please note that
-          running graphical applications that directly touch the hardware
-          (e.g. an accelerated X server) and that are not frame buffer
-          device-aware may cause unexpected results. If unsure, say N.
-config FIRMWARE_EDID
-       bool "Enable firmware EDID"
-       depends on FB
-       default n
-       ---help---
-         This enables access to the EDID transferred from the firmware.
-         On the i386, this is from the Video BIOS. Enable this if DDC/I2C
-         transfers do not work for your driver and if you are using
-         nvidiafb, i810fb or savagefb.
-         In general, choosing Y for this option is safe.  If you
-         experience extremely long delays while booting before you get
-         something on your display, try setting this to N.  Matrox cards in
-         combination with certain motherboards and monitors are known to
-         suffer from this problem.
-config FB_DDC
-       tristate
-       depends on FB
-       select I2C_ALGOBIT
-       select I2C
-       default n
-config FB_BOOT_VESA_SUPPORT
-        bool
-        depends on FB
-        default n
-        ---help---
-          If true, at least one selected framebuffer driver can take advantage
-          of VESA video modes set at an early boot stage via the vga= parameter.
-config FB_CFB_FILLRECT
-        tristate
-        depends on FB
-        default n
-        ---help---
-          Include the cfb_fillrect function for generic software rectangle
-          filling. This is used by drivers that don't provide their own
-          (accelerated) version.
-config FB_CFB_COPYAREA
-        tristate
-        depends on FB
-        default n
-        ---help---
-          Include the cfb_copyarea function for generic software area copying.
-          This is used by drivers that don't provide their own (accelerated)
-          version.
-config FB_CFB_IMAGEBLIT
-        tristate
-        depends on FB
-        default n
-        ---help---
-          Include the cfb_imageblit function for generic software image
-          blitting. This is used by drivers that don't provide their own
-          (accelerated) version.
-config FB_CFB_REV_PIXELS_IN_BYTE
-        bool
-        depends on FB
-        default n
-        ---help---
-          Allow generic frame-buffer functions to work on displays with 1, 2
-          and 4 bits per pixel depths which has opposite order of pixels in
-          byte order to bytes in long order.
-config FB_SYS_FILLRECT
-        tristate
-        depends on FB
-        default n
-        ---help---
-          Include the sys_fillrect function for generic software rectangle
-          filling. This is used by drivers that don't provide their own
-          (accelerated) version and the framebuffer is in system RAM.
-config FB_SYS_COPYAREA
-        tristate
-        depends on FB
-        default n
-        ---help---
-          Include the sys_copyarea function for generic software area copying.
-          This is used by drivers that don't provide their own (accelerated)
-          version and the framebuffer is in system RAM.
-config FB_SYS_IMAGEBLIT
-        tristate
-        depends on FB
-        default n
-        ---help---
-          Include the sys_imageblit function for generic software image
-          blitting. This is used by drivers that don't provide their own
-          (accelerated) version and the framebuffer is in system RAM.
-menuconfig FB_FOREIGN_ENDIAN
-        bool "Framebuffer foreign endianness support"
-        depends on FB
-        ---help---
-          This menu will let you enable support for the framebuffers with
-          non-native endianness (e.g. Little-Endian framebuffer on a
-          Big-Endian machine). Most probably you don't have such hardware,
-          so it's safe to say "n" here.
-choice
-        prompt "Choice endianness support"
-        depends on FB_FOREIGN_ENDIAN
-config FB_BOTH_ENDIAN
-        bool "Support for Big- and Little-Endian framebuffers"
-config FB_BIG_ENDIAN
-        bool "Support for Big-Endian framebuffers only"
-config FB_LITTLE_ENDIAN
-        bool "Support for Little-Endian framebuffers only"
-endchoice
-config FB_SYS_FOPS
-       tristate
-       depends on FB
-       default n
-config FB_DEFERRED_IO
-        bool
-        depends on FB
-config FB_HECUBA
-        tristate
-        depends on FB
-        depends on FB_DEFERRED_IO
-config FB_SVGALIB
-        tristate
-        depends on FB
-        default n
-        ---help---
-          Common utility functions useful to fbdev drivers of VGA-based
-          cards.
-config FB_MACMODES
-       tristate
-       depends on FB
-       default n
-config FB_BACKLIGHT
-        bool
-        depends on FB
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
-        default n
-config FB_MODE_HELPERS
-        bool "Enable Video Mode Handling Helpers"
-        depends on FB
-        default n
-        ---help---
-          This enables functions for handling video modes using the
-          Generalized Timing Formula and the EDID parser. A few drivers rely
-          on this feature such as the radeonfb, rivafb, and the i810fb. If
-          your driver does not take advantage of this feature, choosing Y will
-          just increase the kernel size by about 5K.
-config FB_TILEBLITTING
-       bool "Enable Tile Blitting Support"
-       depends on FB
-       default n
-       ---help---
-         This enables tile blitting.  Tile blitting is a drawing technique
-         where the screen is divided into rectangular sections (tiles), whereas
-         the standard blitting divides the screen into pixels. Because the
-         default drawing element is a tile, drawing functions will be passed
-         parameters in terms of number of tiles instead of number of pixels.
-         For example, to draw a single character, instead of using bitmaps,
-         an index to an array of bitmaps will be used.  To clear or move a
-         rectangular section of a screen, the rectangle will be described in
-         terms of number of tiles in the x- and y-axis.
-         This is particularly important to one driver, matroxfb.  If
-         unsure, say N.
-comment "Frame buffer hardware drivers"
-        depends on FB
-config FB_GRVGA
-        tristate "Aeroflex Gaisler framebuffer support"
-        depends on FB && SPARC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-        This enables support for the SVGACTRL framebuffer in the GRLIB IP library from Aeroflex Gaisler.
-config FB_CIRRUS
-        tristate "Cirrus Logic support"
-        depends on FB && (ZORRO || PCI)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          This enables support for Cirrus Logic GD542x/543x based boards on
-          Amiga: SD64, Piccolo, Picasso II/II+, Picasso IV, or EGS Spectrum.
-          If you have a PCI-based system, this enables support for these
-          chips: GD-543x, GD-544x, GD-5480.
-          Please read the file <file:Documentation/fb/cirrusfb.txt>.
-          Say N unless you have such a graphics board or plan to get one
-          before you next recompile the kernel.
-config FB_PM2
-        tristate "Permedia2 support"
-        depends on FB && ((AMIGA && BROKEN) || PCI)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for cards based on
-          the 3D Labs Permedia, Permedia 2 and Permedia 2V chips.
-          The driver was tested on the following cards:
-                Diamond FireGL 1000 PRO AGP
-                ELSA Gloria Synergy PCI
-                Appian Jeronimo PRO (both heads) PCI
-                3DLabs Oxygen ACX aka EONtronics Picasso P2 PCI
-                Techsource Raptor GFX-8P (aka Sun PGX-32) on SPARC
-                ASK Graphic Blaster Exxtreme AGP
-          To compile this driver as a module, choose M here: the
-          module will be called pm2fb.
-config FB_PM2_FIFO_DISCONNECT
-        bool "enable FIFO disconnect feature"
-        depends on FB_PM2 && PCI
-        help
-          Support the Permedia2 FIFO disconnect feature.
-config FB_ARMCLCD
-        tristate "ARM PrimeCell PL110 support"
-        depends on ARM || ARM64 || COMPILE_TEST
-        depends on FB && ARM_AMBA
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This framebuffer device driver is for the ARM PrimeCell PL110
-          Colour LCD controller.  ARM PrimeCells provide the building
-          blocks for System on a Chip devices.
-          If you want to compile this as a module (=code which can be
-          inserted into and removed from the running kernel), say M
-          here and read <file:Documentation/kbuild/modules.txt>.  The module
-          will be called amba-clcd.
-config FB_ACORN
-        bool "Acorn VIDC support"
-        depends on (FB = y) && ARM && ARCH_ACORN
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the Acorn VIDC graphics
-          hardware found in Acorn RISC PCs and other ARM-based machines.  If
-          unsure, say N.
-config FB_CLPS711X
-        bool "CLPS711X LCD support"
-        depends on (FB = y) && ARM && ARCH_CLPS711X
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Say Y to enable the Framebuffer driver for the CLPS7111 and
-          EP7212 processors.
-config FB_SA1100
-        bool "SA-1100 LCD support"
-        depends on (FB = y) && ARM && ARCH_SA1100
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is a framebuffer device for the SA-1100 LCD Controller.
-          See <http://www.linux-fbdev.org/> for information on framebuffer
-          devices.
-          If you plan to use the LCD display with your SA-1100 system, say
-          Y here.
-config FB_IMX
-        tristate "Freescale i.MX1/21/25/27 LCD support"
-        depends on FB && ARCH_MXC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MODE_HELPERS
-        select VIDEOMODE_HELPERS
-config FB_CYBER2000
-        tristate "CyberPro 2000/2010/5000 support"
-        depends on FB && PCI && (BROKEN || !SPARC64)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This enables support for the Integraphics CyberPro 20x0 and 5000
-          VGA chips used in the Rebel.com Netwinder and other machines.
-          Say Y if you have a NetWinder or a graphics card containing this
-          device, otherwise say N.
-config FB_CYBER2000_DDC
-        bool "DDC for CyberPro support"
-        depends on FB_CYBER2000
-        select FB_DDC
-        default y
-        help
-          Say Y here if you want DDC support for your CyberPro graphics
-          card. This is only I2C bus support, driver does not use EDID.
-config FB_CYBER2000_I2C
-        bool "CyberPro 2000/2010/5000 I2C support"
-        depends on FB_CYBER2000 && I2C && ARCH_NETWINDER
-        select I2C_ALGOBIT
-        help
-          Enable support for the I2C video decoder interface on the
-          Integraphics CyberPro 20x0 and 5000 VGA chips.  This is used
-          on the Netwinder machines for the SAA7111 video capture.
-config FB_APOLLO
-        bool
-        depends on (FB = y) && APOLLO
-        default y
-        select FB_CFB_FILLRECT
-        select FB_CFB_IMAGEBLIT
-config FB_Q40
-        bool
-        depends on (FB = y) && Q40
-        default y
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-config FB_AMIGA
-        tristate "Amiga native chipset support"
-        depends on FB && AMIGA
-        help
-          This is the frame buffer device driver for the builtin graphics
-          chipset found in Amigas.
-          To compile this driver as a module, choose M here: the
-          module will be called amifb.
-config FB_AMIGA_OCS
-        bool "Amiga OCS chipset support"
-        depends on FB_AMIGA
-        help
-          This enables support for the original Agnus and Denise video chips,
-          found in the Amiga 1000 and most A500's and A2000's. If you intend
-          to run Linux on any of these systems, say Y; otherwise say N.
-config FB_AMIGA_ECS
-        bool "Amiga ECS chipset support"
-        depends on FB_AMIGA
-        help
-          This enables support for the Enhanced Chip Set, found in later
-          A500's, later A2000's, the A600, the A3000, the A3000T and CDTV. If
-          you intend to run Linux on any of these systems, say Y; otherwise
-          say N.
-config FB_AMIGA_AGA
-        bool "Amiga AGA chipset support"
-        depends on FB_AMIGA
-        help
-          This enables support for the Advanced Graphics Architecture (also
-          known as the AGA or AA) Chip Set, found in the A1200, A4000, A4000T
-          and CD32. If you intend to run Linux on any of these systems, say Y;
-          otherwise say N.
-config FB_FM2
-        bool "Amiga FrameMaster II/Rainbow II support"
-        depends on (FB = y) && ZORRO
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the Amiga FrameMaster
-          card from BSC (exhibited 1992 but not shipped as a CBM product).
-config FB_ARC
-        tristate "Arc Monochrome LCD board support"
-        depends on FB && X86
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        help
-          This enables support for the Arc Monochrome LCD board. The board
-          is based on the KS-108 lcd controller and is typically a matrix
-          of 2*n chips. This driver was tested with a 128x64 panel. This
-          driver supports it for use with x86 SBCs through a 16 bit GPIO
-          interface (8 bit data, 8 bit control). If you anticipate using
-          this driver, say Y or M; otherwise say N. You must specify the
-          GPIO IO address to be used for setting control and data.
-config FB_ATARI
-        bool "Atari native chipset support"
-        depends on (FB = y) && ATARI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the builtin graphics
-          chipset found in Ataris.
-config FB_OF
-        bool "Open Firmware frame buffer device support"
-        depends on (FB = y) && (PPC64 || PPC_OF) && (!PPC_PSERIES || PCI)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES
-        help
-          Say Y if you want support with Open Firmware for your graphics
-          board.
-config FB_CONTROL
-        bool "Apple \"control\" display support"
-        depends on (FB = y) && PPC_PMAC && PPC32
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES
-        help
-          This driver supports a frame buffer for the graphics adapter in the
-          Power Macintosh 7300 and others.
-config FB_PLATINUM
-        bool "Apple \"platinum\" display support"
-        depends on (FB = y) && PPC_PMAC && PPC32
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES
-        help
-          This driver supports a frame buffer for the "platinum" graphics
-          adapter in some Power Macintoshes.
-config FB_VALKYRIE
-        bool "Apple \"valkyrie\" display support"
-        depends on (FB = y) && (MAC || (PPC_PMAC && PPC32))
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES
-        help
-          This driver supports a frame buffer for the "valkyrie" graphics
-          adapter in some Power Macintoshes.
-config FB_CT65550
-        bool "Chips 65550 display support"
-        depends on (FB = y) && PPC32 && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the Chips & Technologies
-          65550 graphics chip in PowerBooks.
-config FB_ASILIANT
-        bool "Asiliant (Chips) 69000 display support"
-        depends on (FB = y) && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the Asiliant 69030 chipset
-config FB_IMSTT
-        bool "IMS Twin Turbo display support"
-        depends on (FB = y) && PCI
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES if PPC
-        help
-          The IMS Twin Turbo is a PCI-based frame buffer card bundled with
-          many Macintosh and compatible computers.
-config FB_VGA16
-        tristate "VGA 16-color graphics support"
-        depends on FB && (X86 || PPC)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select VGASTATE
-        select FONT_8x16 if FRAMEBUFFER_CONSOLE
-        help
-          This is the frame buffer device driver for VGA 16 color graphic
-          cards. Say Y if you have such a card.
-          To compile this driver as a module, choose M here: the
-          module will be called vga16fb.
-config FB_BF54X_LQ043
-        tristate "SHARP LQ043 TFT LCD (BF548 EZKIT)"
-        depends on FB && (BF54x) && !BF542
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-         This is the framebuffer device driver for a SHARP LQ043T1DG01 TFT LCD
-config FB_BFIN_T350MCQB
-        tristate "Varitronix COG-T350MCQB TFT LCD display (BF527 EZKIT)"
-        depends on FB && BLACKFIN
-        select BFIN_GPTIMERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-         This is the framebuffer device driver for a Varitronix VL-PS-COG-T350MCQB-01 display TFT LCD
-         This display is a QVGA 320x240 24-bit RGB display interfaced by an 8-bit wide PPI
-         It uses PPI[0..7] PPI_FS1, PPI_FS2 and PPI_CLK.
-config FB_BFIN_LQ035Q1
-        tristate "SHARP LQ035Q1DH02 TFT LCD"
-        depends on FB && BLACKFIN && SPI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select BFIN_GPTIMERS
-        help
-          This is the framebuffer device driver for a SHARP LQ035Q1DH02 TFT display found on
-          the Blackfin Landscape LCD EZ-Extender Card.
-          This display is a QVGA 320x240 18-bit RGB display interfaced by an 16-bit wide PPI
-          It uses PPI[0..15] PPI_FS1, PPI_FS2 and PPI_CLK.
-          To compile this driver as a module, choose M here: the
-          module will be called bfin-lq035q1-fb.
-config FB_BF537_LQ035
-        tristate "SHARP LQ035 TFT LCD (BF537 STAMP)"
-        depends on FB && (BF534 || BF536 || BF537) && I2C_BLACKFIN_TWI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select BFIN_GPTIMERS
-        help
-          This is the framebuffer device for a SHARP LQ035Q7DB03 TFT LCD
-          attached to a BF537.
-          To compile this driver as a module, choose M here: the
-          module will be called bf537-lq035.
-config FB_BFIN_7393
-        tristate "Blackfin ADV7393 Video encoder"
-        depends on FB && BLACKFIN
-        select I2C
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the framebuffer device for a ADV7393 video encoder
-          attached to a Blackfin on the PPI port.
-          If your Blackfin board has a ADV7393 select Y.
-          To compile this driver as a module, choose M here: the
-          module will be called bfin_adv7393fb.
-choice
-        prompt  "Video mode support"
-        depends on FB_BFIN_7393
-        default NTSC
-config NTSC
-        bool 'NTSC 720x480'
-config PAL
-        bool 'PAL 720x576'
-config NTSC_640x480
-        bool 'NTSC 640x480 (Experimental)'
-config PAL_640x480
-        bool 'PAL 640x480 (Experimental)'
-config NTSC_YCBCR
-        bool 'NTSC 720x480 YCbCR input'
-config PAL_YCBCR
-        bool 'PAL 720x576 YCbCR input'
-endchoice
-choice
-        prompt  "Size of ADV7393 frame buffer memory Single/Double Size"
-        depends on (FB_BFIN_7393)
-        default ADV7393_1XMEM
-config ADV7393_1XMEM
-        bool 'Single'
-config ADV7393_2XMEM
-        bool 'Double'
-endchoice
-config FB_STI
-        tristate "HP STI frame buffer device support"
-        depends on FB && PARISC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select STI_CONSOLE
-        select VT
-        default y
-        ---help---
-          STI refers to the HP "Standard Text Interface" which is a set of
-          BIOS routines contained in a ROM chip in HP PA-RISC based machines.
-          Enabling this option will implement the linux framebuffer device
-          using calls to the STI BIOS routines for initialisation.
-        
-          If you enable this option, you will get a planar framebuffer device
-          /dev/fb which will work on the most common HP graphic cards of the
-          NGLE family, including the artist chips (in the 7xx and Bxxx series),
-          HCRX, HCRX24, CRX, CRX24 and VisEG series.
-          It is safe to enable this option, so you should probably say "Y".
-config FB_MAC
-        bool "Generic Macintosh display support"
-        depends on (FB = y) && MAC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES
-config FB_HP300
-        bool
-        depends on (FB = y) && DIO
-        select FB_CFB_IMAGEBLIT
-        default y
-config FB_TGA
-        tristate "TGA/SFB+ framebuffer support"
-        depends on FB && (ALPHA || TC)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select BITREVERSE
-        ---help---
-          This is the frame buffer device driver for generic TGA and SFB+
-          graphic cards.  These include DEC ZLXp-E1, -E2 and -E3 PCI cards,
-          also known as PBXGA-A, -B and -C, and DEC ZLX-E1, -E2 and -E3
-          TURBOchannel cards, also known as PMAGD-A, -B and -C.
-          Due to hardware limitations ZLX-E2 and E3 cards are not supported
-          for DECstation 5000/200 systems.  Additionally due to firmware
-          limitations these cards may cause troubles with booting DECstation
-          5000/240 and /260 systems, but are fully supported under Linux if
-          you manage to get it going. ;-)
-          Say Y if you have one of those.
-config FB_UVESA
-        tristate "Userspace VESA VGA graphics support"
-        depends on FB && CONNECTOR
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MODE_HELPERS
-        help
-          This is the frame buffer driver for generic VBE 2.0 compliant
-          graphic cards. It can also take advantage of VBE 3.0 features,
-          such as refresh rate adjustment.
-          This driver generally provides more features than vesafb but
-          requires a userspace helper application called 'v86d'. See
-          <file:Documentation/fb/uvesafb.txt> for more information.
-          If unsure, say N.
-config FB_VESA
-        bool "VESA VGA graphics support"
-        depends on (FB = y) && X86
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_BOOT_VESA_SUPPORT
-        help
-          This is the frame buffer device driver for generic VESA 2.0
-          compliant graphic cards. The older VESA 1.2 cards are not supported.
-          You will get a boot time penguin logo at no additional cost. Please
-          read <file:Documentation/fb/vesafb.txt>. If unsure, say Y.
-config FB_EFI
-        bool "EFI-based Framebuffer Support"
-        depends on (FB = y) && X86 && EFI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the EFI frame buffer device driver. If the firmware on
-          your platform is EFI 1.10 or UEFI 2.0, select Y to add support for
-          using the EFI framebuffer as your console.
-config FB_N411
-       tristate "N411 Apollo/Hecuba devkit support"
-       depends on FB && X86 && MMU
-       select FB_SYS_FILLRECT
-       select FB_SYS_COPYAREA
-       select FB_SYS_IMAGEBLIT
-       select FB_SYS_FOPS
-       select FB_DEFERRED_IO
-       select FB_HECUBA
-       help
-         This enables support for the Apollo display controller in its
-         Hecuba form using the n411 devkit.
-config FB_HGA
-        tristate "Hercules mono graphics support"
-        depends on FB && X86
-        help
-          Say Y here if you have a Hercules mono graphics card.
-          To compile this driver as a module, choose M here: the
-          module will be called hgafb.
-          As this card technology is at least 25 years old,
-          most people will answer N here.
-config FB_GBE
-        bool "SGI Graphics Backend frame buffer support"
-        depends on (FB = y) && SGI_IP32
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for SGI Graphics Backend.
-          This chip is used in SGI O2 and Visual Workstation 320/540.
-config FB_GBE_MEM
-        int "Video memory size in MB"
-        depends on FB_GBE
-        default 4
-        help
-          This is the amount of memory reserved for the framebuffer,
-          which can be any value between 1MB and 8MB.
-config FB_SBUS
-        bool "SBUS and UPA framebuffers"
-        depends on (FB = y) && SPARC
-        help
-          Say Y if you want support for SBUS or UPA based frame buffer device.
-config FB_BW2
-        bool "BWtwo support"
-        depends on (FB = y) && (SPARC && FB_SBUS)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the BWtwo frame buffer.
-config FB_CG3
-        bool "CGthree support"
-        depends on (FB = y) && (SPARC && FB_SBUS)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the CGthree frame buffer.
-config FB_CG6
-        bool "CGsix (GX,TurboGX) support"
-        depends on (FB = y) && (SPARC && FB_SBUS)
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the CGsix (GX, TurboGX)
-          frame buffer.
-config FB_FFB
-        bool "Creator/Creator3D/Elite3D support"
-        depends on FB_SBUS && SPARC64
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the Creator, Creator3D,
-          and Elite3D graphics boards.
-config FB_TCX
-        bool "TCX (SS4/SS5 only) support"
-        depends on FB_SBUS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the TCX 24/8bit frame
-          buffer.
-config FB_CG14
-        bool "CGfourteen (SX) support"
-        depends on FB_SBUS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the CGfourteen frame
-          buffer on Desktop SPARCsystems with the SX graphics option.
-config FB_P9100
-        bool "P9100 (Sparcbook 3 only) support"
-        depends on FB_SBUS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the P9100 card
-          supported on Sparcbook 3 machines.
-config FB_LEO
-        bool "Leo (ZX) support"
-        depends on FB_SBUS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the SBUS-based Sun ZX
-          (leo) frame buffer cards.
-config FB_IGA
-        bool "IGA 168x display support"
-        depends on (FB = y) && SPARC32
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the framebuffer device for the INTERGRAPHICS 1680 and
-          successor frame buffer cards.
-config FB_XVR500
-        bool "Sun XVR-500 3DLABS Wildcat support"
-        depends on (FB = y) && PCI && SPARC64
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the framebuffer device for the Sun XVR-500 and similar
-          graphics cards based upon the 3DLABS Wildcat chipset.  The driver
-          only works on sparc64 systems where the system firmware has
-          mostly initialized the card already.  It is treated as a
-          completely dumb framebuffer device.
-config FB_XVR2500
-        bool "Sun XVR-2500 3DLABS Wildcat support"
-        depends on (FB = y) && PCI && SPARC64
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the framebuffer device for the Sun XVR-2500 and similar
-          graphics cards based upon the 3DLABS Wildcat chipset.  The driver
-          only works on sparc64 systems where the system firmware has
-          mostly initialized the card already.  It is treated as a
-          completely dumb framebuffer device.
-config FB_XVR1000
-        bool "Sun XVR-1000 support"
-        depends on (FB = y) && SPARC64
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the framebuffer device for the Sun XVR-1000 and similar
-          graphics cards.  The driver only works on sparc64 systems where
-          the system firmware has mostly initialized the card already.  It
-          is treated as a completely dumb framebuffer device.
-config FB_PVR2
-        tristate "NEC PowerVR 2 display support"
-        depends on FB && SH_DREAMCAST
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Say Y here if you have a PowerVR 2 card in your box.  If you plan to
-          run linux on your Dreamcast, you will have to say Y here.
-          This driver may or may not work on other PowerVR 2 cards, but is
-          totally untested.  Use at your own risk.  If unsure, say N.
-          To compile this driver as a module, choose M here: the
-          module will be called pvr2fb.
-          You can pass several parameters to the driver at boot time or at
-          module load time.  The parameters look like "video=pvr2:XXX", where
-          the meaning of XXX can be found at the end of the main source file
-          (<file:drivers/video/pvr2fb.c>). Please see the file
-          <file:Documentation/fb/pvr2fb.txt>.
-config FB_OPENCORES
-        tristate "OpenCores VGA/LCD core 2.0 framebuffer support"
-        depends on FB && HAS_DMA
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This enables support for the OpenCores VGA/LCD core.
-          The OpenCores VGA/LCD core is typically used together with
-          softcore CPUs (e.g. OpenRISC or Microblaze) or hard processor
-          systems (e.g. Altera socfpga or Xilinx Zynq) on FPGAs.
-          The source code and specification for the core is available at
-          <http://opencores.org/project,vga_lcd>
-config FB_S1D13XXX
-        tristate "Epson S1D13XXX framebuffer support"
-        depends on FB
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Support for S1D13XXX framebuffer device family (currently only
-          working with S1D13806). Product specs at
-          <http://vdc.epson.com/>
-config FB_ATMEL
-        tristate "AT91/AT32 LCD Controller support"
-        depends on FB && HAVE_FB_ATMEL
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MODE_HELPERS
-        select VIDEOMODE_HELPERS
-        help
-          This enables support for the AT91/AT32 LCD Controller.
-config FB_INTSRAM
-        bool "Frame Buffer in internal SRAM"
-        depends on FB_ATMEL && ARCH_AT91SAM9261
-        help
-          Say Y if you want to map Frame Buffer in internal SRAM. Say N if you want
-          to let frame buffer in external SDRAM.
-config FB_ATMEL_STN
-        bool "Use a STN display with AT91/AT32 LCD Controller"
-        depends on FB_ATMEL && (MACH_AT91SAM9261EK || MACH_AT91SAM9G10EK)
-        default n
-        help
-          Say Y if you want to connect a STN LCD display to the AT91/AT32 LCD
-          Controller. Say N if you want to connect a TFT.
-          If unsure, say N.
-config FB_NVIDIA
-        tristate "nVidia Framebuffer Support"
-        depends on FB && PCI
-        select FB_BACKLIGHT if FB_NVIDIA_BACKLIGHT
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select BITREVERSE
-        select VGASTATE
-        help
-          This driver supports graphics boards with the nVidia chips, TNT
-          and newer. For very old chipsets, such as the RIVA128, then use
-          the rivafb.
-          Say Y if you have such a graphics board.
-          To compile this driver as a module, choose M here: the
-          module will be called nvidiafb.
-config FB_NVIDIA_I2C
-       bool "Enable DDC Support"
-       depends on FB_NVIDIA
-       select FB_DDC
-       help
-          This enables I2C support for nVidia Chipsets.  This is used
-          only for getting EDID information from the attached display
-          allowing for robust video mode handling and switching.
-          Because fbdev-2.6 requires that drivers must be able to
-          independently validate video mode parameters, you should say Y
-          here.
-config FB_NVIDIA_DEBUG
-        bool "Lots of debug output"
-        depends on FB_NVIDIA
-        default n
-        help
-          Say Y here if you want the nVidia driver to output all sorts
-          of debugging information to provide to the maintainer when
-          something goes wrong.
-config FB_NVIDIA_BACKLIGHT
-        bool "Support for backlight control"
-        depends on FB_NVIDIA
-        default y
-        help
-          Say Y here if you want to control the backlight of your display.
-config FB_RIVA
-        tristate "nVidia Riva support"
-        depends on FB && PCI
-        select FB_BACKLIGHT if FB_RIVA_BACKLIGHT
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select BITREVERSE
-        select VGASTATE
-        help
-          This driver supports graphics boards with the nVidia Riva/Geforce
-          chips.
-          Say Y if you have such a graphics board.
-          To compile this driver as a module, choose M here: the
-          module will be called rivafb.
-config FB_RIVA_I2C
-       bool "Enable DDC Support"
-       depends on FB_RIVA
-       select FB_DDC
-       help
-          This enables I2C support for nVidia Chipsets.  This is used
-          only for getting EDID information from the attached display
-          allowing for robust video mode handling and switching.
-          Because fbdev-2.6 requires that drivers must be able to
-          independently validate video mode parameters, you should say Y
-          here.
-config FB_RIVA_DEBUG
-        bool "Lots of debug output"
-        depends on FB_RIVA
-        default n
-        help
-          Say Y here if you want the Riva driver to output all sorts
-          of debugging information to provide to the maintainer when
-          something goes wrong.
-config FB_RIVA_BACKLIGHT
-        bool "Support for backlight control"
-        depends on FB_RIVA
-        default y
-        help
-          Say Y here if you want to control the backlight of your display.
-config FB_I740
-        tristate "Intel740 support"
-        depends on FB && PCI
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select VGASTATE
-        select FB_DDC
-        help
-          This driver supports graphics cards based on Intel740 chip.
-config FB_I810
-        tristate "Intel 810/815 support"
-        depends on FB && PCI && X86_32 && AGP_INTEL
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select VGASTATE
-        help
-          This driver supports the on-board graphics built in to the Intel 810 
-          and 815 chipsets.  Say Y if you have and plan to use such a board.
-          To compile this driver as a module, choose M here: the
-          module will be called i810fb.
-          For more information, please read 
-          <file:Documentation/fb/intel810.txt>
-config FB_I810_GTF
-        bool "use VESA Generalized Timing Formula"
-        depends on FB_I810
-        help
-          If you say Y, then the VESA standard, Generalized Timing Formula 
-          or GTF, will be used to calculate the required video timing values
-          per video mode.  Since the GTF allows nondiscrete timings 
-          (nondiscrete being a range of values as opposed to discrete being a
-          set of values), you'll be able to use any combination of horizontal 
-          and vertical resolutions, and vertical refresh rates without having
-          to specify your own timing parameters.  This is especially useful
-          to maximize the performance of an aging display, or if you just 
-          have a display with nonstandard dimensions. A VESA compliant 
-          monitor is recommended, but can still work with non-compliant ones.
-          If you need or want this, then select this option. The timings may 
-          not be compliant with Intel's recommended values. Use at your own 
-          risk.
-          If you say N, the driver will revert to discrete video timings 
-          using a set recommended by Intel in their documentation.
-  
-          If unsure, say N.
-config FB_I810_I2C
-        bool "Enable DDC Support"
-        depends on FB_I810 && FB_I810_GTF
-        select FB_DDC
-        help
-config FB_LE80578
-        tristate "Intel LE80578 (Vermilion) support"
-        depends on FB && PCI && X86
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This driver supports the LE80578 (Vermilion Range) chipset
-config FB_CARILLO_RANCH
-        tristate "Intel Carillo Ranch support"
-        depends on FB_LE80578 && FB && PCI && X86
-        help
-          This driver supports the LE80578 (Carillo Ranch) board
-config FB_INTEL
-        tristate "Intel 830M/845G/852GM/855GM/865G/915G/945G/945GM/965G/965GM support"
-        depends on FB && PCI && X86 && AGP_INTEL && EXPERT
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_BOOT_VESA_SUPPORT if FB_INTEL = y
-        depends on !DRM_I915
-        help
-          This driver supports the on-board graphics built in to the Intel
-          830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
-          Say Y if you have and plan to use such a board.
-          To make FB_INTELFB=Y work you need to say AGP_INTEL=y too.
-          To compile this driver as a module, choose M here: the
-          module will be called intelfb.
-          For more information, please read <file:Documentation/fb/intelfb.txt>
-config FB_INTEL_DEBUG
-        bool "Intel driver Debug Messages"
-        depends on FB_INTEL
-        ---help---
-          Say Y here if you want the Intel driver to output all sorts
-          of debugging information to provide to the maintainer when
-          something goes wrong.
-config FB_INTEL_I2C
-        bool "DDC/I2C for Intel framebuffer support"
-        depends on FB_INTEL
-        select FB_DDC
-        default y
-        help
-          Say Y here if you want DDC/I2C support for your on-board Intel graphics.
-config FB_MATROX
-        tristate "Matrox acceleration"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_TILEBLITTING
-        select FB_MACMODES if PPC_PMAC
-        ---help---
-          Say Y here if you have a Matrox Millennium, Matrox Millennium II,
-          Matrox Mystique, Matrox Mystique 220, Matrox Productiva G100, Matrox
-          Mystique G200, Matrox Millennium G200, Matrox Marvel G200 video,
-          Matrox G400, G450 or G550 card in your box.
-          To compile this driver as a module, choose M here: the
-          module will be called matroxfb.
-          You can pass several parameters to the driver at boot time or at
-          module load time. The parameters look like "video=matroxfb:XXX", and
-          are described in <file:Documentation/fb/matroxfb.txt>.
-config FB_MATROX_MILLENIUM
-        bool "Millennium I/II support"
-        depends on FB_MATROX
-        help
-          Say Y here if you have a Matrox Millennium or Matrox Millennium II
-          video card. If you select "Advanced lowlevel driver options" below,
-          you should check 4 bpp packed pixel, 8 bpp packed pixel, 16 bpp
-          packed pixel, 24 bpp packed pixel and 32 bpp packed pixel. You can
-          also use font widths different from 8.
-config FB_MATROX_MYSTIQUE
-        bool "Mystique support"
-        depends on FB_MATROX
-        help
-          Say Y here if you have a Matrox Mystique or Matrox Mystique 220
-          video card. If you select "Advanced lowlevel driver options" below,
-          you should check 8 bpp packed pixel, 16 bpp packed pixel, 24 bpp
-          packed pixel and 32 bpp packed pixel. You can also use font widths
-          different from 8.
-config FB_MATROX_G
-        bool "G100/G200/G400/G450/G550 support"
-        depends on FB_MATROX
-        ---help---
-          Say Y here if you have a Matrox G100, G200, G400, G450 or G550 based
-          video card. If you select "Advanced lowlevel driver options", you
-          should check 8 bpp packed pixel, 16 bpp packed pixel, 24 bpp packed
-          pixel and 32 bpp packed pixel. You can also use font widths
-          different from 8.
-          If you need support for G400 secondary head, you must say Y to
-          "Matrox I2C support" and "G400 second head support" right below.
-          G450/G550 secondary head and digital output are supported without
-          additional modules.
-          The driver starts in monitor mode. You must use the matroxset tool 
-          (available at <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to 
-          swap primary and secondary head outputs, or to change output mode.  
-          Secondary head driver always start in 640x480 resolution and you 
-          must use fbset to change it.
-          Do not forget that second head supports only 16 and 32 bpp
-          packed pixels, so it is a good idea to compile them into the kernel
-          too. You can use only some font widths, as the driver uses generic
-          painting procedures (the secondary head does not use acceleration
-          engine).
-          G450/G550 hardware can display TV picture only from secondary CRTC,
-          and it performs no scaling, so picture must have 525 or 625 lines.
-config FB_MATROX_I2C
-        tristate "Matrox I2C support"
-        depends on FB_MATROX
-        select FB_DDC
-        ---help---
-          This drivers creates I2C buses which are needed for accessing the
-          DDC (I2C) bus present on all Matroxes, an I2C bus which
-          interconnects Matrox optional devices, like MGA-TVO on G200 and
-          G400, and the secondary head DDC bus, present on G400 only.
-          You can say Y or M here if you want to experiment with monitor
-          detection code. You must say Y or M here if you want to use either
-          second head of G400 or MGA-TVO on G200 or G400.
-          If you compile it as module, it will create a module named
-          i2c-matroxfb.
-config FB_MATROX_MAVEN
-        tristate "G400 second head support"
-        depends on FB_MATROX_G && FB_MATROX_I2C
-        ---help---
-          WARNING !!! This support does not work with G450 !!!
-          Say Y or M here if you want to use a secondary head (meaning two
-          monitors in parallel) on G400 or MGA-TVO add-on on G200. Secondary
-          head is not compatible with accelerated XFree 3.3.x SVGA servers -
-          secondary head output is blanked while you are in X. With XFree
-          3.9.17 preview you can use both heads if you use SVGA over fbdev or
-          the fbdev driver on first head and the fbdev driver on second head.
-          If you compile it as module, two modules are created,
-          matroxfb_crtc2 and matroxfb_maven. Matroxfb_maven is needed for
-          both G200 and G400, matroxfb_crtc2 is needed only by G400. You must
-          also load i2c-matroxfb to get it to run.
-          The driver starts in monitor mode and you must use the matroxset
-          tool (available at
-          <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to switch it to
-          PAL or NTSC or to swap primary and secondary head outputs.
-          Secondary head driver also always start in 640x480 resolution, you
-          must use fbset to change it.
-          Also do not forget that second head supports only 16 and 32 bpp
-          packed pixels, so it is a good idea to compile them into the kernel
-          too.  You can use only some font widths, as the driver uses generic
-          painting procedures (the secondary head does not use acceleration
-          engine).
-config FB_RADEON
-        tristate "ATI Radeon display support"
-        depends on FB && PCI
-        select FB_BACKLIGHT if FB_RADEON_BACKLIGHT
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES if PPC_OF
-        help
-          Choose this option if you want to use an ATI Radeon graphics card as
-          a framebuffer device.  There are both PCI and AGP versions.  You
-          don't need to choose this to run the Radeon in plain VGA mode.
-          There is a product page at
-          http://products.amd.com/en-us/GraphicCardResult.aspx
-config FB_RADEON_I2C
-        bool "DDC/I2C for ATI Radeon support"
-        depends on FB_RADEON
-        select FB_DDC
-        default y
-        help
-          Say Y here if you want DDC/I2C support for your Radeon board. 
-config FB_RADEON_BACKLIGHT
-        bool "Support for backlight control"
-        depends on FB_RADEON
-        default y
-        help
-          Say Y here if you want to control the backlight of your display.
-config FB_RADEON_DEBUG
-        bool "Lots of debug output from Radeon driver"
-        depends on FB_RADEON
-        default n
-        help
-          Say Y here if you want the Radeon driver to output all sorts
-          of debugging information to provide to the maintainer when
-          something goes wrong.
-config FB_ATY128
-        tristate "ATI Rage128 display support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_BACKLIGHT if FB_ATY128_BACKLIGHT
-        select FB_MACMODES if PPC_PMAC
-        help
-          This driver supports graphics boards with the ATI Rage128 chips.
-          Say Y if you have such a graphics board and read
-          <file:Documentation/fb/aty128fb.txt>.
-          To compile this driver as a module, choose M here: the
-          module will be called aty128fb.
-config FB_ATY128_BACKLIGHT
-        bool "Support for backlight control"
-        depends on FB_ATY128
-        default y
-        help
-          Say Y here if you want to control the backlight of your display.
-config FB_ATY
-        tristate "ATI Mach64 display support" if PCI || ATARI
-        depends on FB && !SPARC32
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_BACKLIGHT if FB_ATY_BACKLIGHT
-        select FB_MACMODES if PPC
-        help
-          This driver supports graphics boards with the ATI Mach64 chips.
-          Say Y if you have such a graphics board.
-          To compile this driver as a module, choose M here: the
-          module will be called atyfb.
-config FB_ATY_CT
-        bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
-        depends on PCI && FB_ATY
-        default y if SPARC64 && PCI
-        help
-          Say Y here to support use of ATI's 64-bit Rage boards (or other
-          boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
-          framebuffer device.  The ATI product support page for these boards
-          is at <http://support.ati.com/products/pc/mach64/mach64.html>.
-config FB_ATY_GENERIC_LCD
-        bool "Mach64 generic LCD support"
-        depends on FB_ATY_CT
-        help
-          Say Y if you have a laptop with an ATI Rage LT PRO, Rage Mobility,
-          Rage XC, or Rage XL chipset.
-config FB_ATY_GX
-        bool "Mach64 GX support" if PCI
-        depends on FB_ATY
-        default y if ATARI
-        help
-          Say Y here to support use of the ATI Mach64 Graphics Expression
-          board (or other boards based on the Mach64 GX chipset) as a
-          framebuffer device.  The ATI product support page for these boards
-          is at
-          <http://support.ati.com/products/pc/mach64/graphics_xpression.html>.
-config FB_ATY_BACKLIGHT
-        bool "Support for backlight control"
-        depends on FB_ATY
-        default y
-        help
-          Say Y here if you want to control the backlight of your display.
-config FB_S3
-        tristate "S3 Trio/Virge support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_TILEBLITTING
-        select FB_SVGALIB
-        select VGASTATE
-        select FONT_8x16 if FRAMEBUFFER_CONSOLE
-        ---help---
-          Driver for graphics boards with S3 Trio / S3 Virge chip.
-config FB_S3_DDC
-        bool "DDC for S3 support"
-        depends on FB_S3
-        select FB_DDC
-        default y
-        help
-          Say Y here if you want DDC support for your S3 graphics card.
-config FB_SAVAGE
-        tristate "S3 Savage support"
-        depends on FB && PCI
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select VGASTATE
-        help
-          This driver supports notebooks and computers with S3 Savage PCI/AGP
-          chips.
-          Say Y if you have such a graphics card.
-          To compile this driver as a module, choose M here; the module
-          will be called savagefb.
-config FB_SAVAGE_I2C
-       bool "Enable DDC2 Support"
-       depends on FB_SAVAGE
-       select FB_DDC
-       help
-          This enables I2C support for S3 Savage Chipsets.  This is used
-          only for getting EDID information from the attached display
-          allowing for robust video mode handling and switching.
-          Because fbdev-2.6 requires that drivers must be able to
-          independently validate video mode parameters, you should say Y
-          here.
-config FB_SAVAGE_ACCEL
-       bool "Enable Console Acceleration"
-       depends on FB_SAVAGE
-       default n
-       help
-          This option will compile in console acceleration support. If
-          the resulting framebuffer console has bothersome glitches, then
-          choose N here.
-config FB_SIS
-        tristate "SiS/XGI display support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_BOOT_VESA_SUPPORT if FB_SIS = y
-        help
-          This is the frame buffer device driver for the SiS 300, 315, 330
-          and 340 series as well as XGI V3XT, V5, V8, Z7 graphics chipsets.
-          Specs available at <http://www.sis.com> and <http://www.xgitech.com>.
-          To compile this driver as a module, choose M here; the module
-          will be called sisfb.
-config FB_SIS_300
-        bool "SiS 300 series support"
-        depends on FB_SIS
-        help
-          Say Y here to support use of the SiS 300/305, 540, 630 and 730.
-config FB_SIS_315
-        bool "SiS 315/330/340 series and XGI support"
-        depends on FB_SIS
-        help
-          Say Y here to support use of the SiS 315, 330 and 340 series
-          (315/H/PRO, 55x, 650, 651, 740, 330, 661, 741, 760, 761) as well
-          as XGI V3XT, V5, V8 and Z7.
-config FB_VIA
-       tristate "VIA UniChrome (Pro) and Chrome9 display support"
-       depends on FB && PCI && X86
-       select FB_CFB_FILLRECT
-       select FB_CFB_COPYAREA
-       select FB_CFB_IMAGEBLIT
-       select I2C_ALGOBIT
-       select I2C
-       select GPIOLIB
-       help
-          This is the frame buffer device driver for Graphics chips of VIA
-          UniChrome (Pro) Family (CLE266,PM800/CN400,P4M800CE/P4M800Pro/
-          CN700/VN800,CX700/VX700,P4M890) and Chrome9 Family (K8M890,CN896
-          /P4M900,VX800)
-          Say Y if you have a VIA UniChrome graphics board.
-          To compile this driver as a module, choose M here: the
-          module will be called viafb.
-if FB_VIA
-config FB_VIA_DIRECT_PROCFS
-        bool "direct hardware access via procfs (DEPRECATED)(DANGEROUS)"
-        depends on FB_VIA
-        default n
-        help
-          Allow direct hardware access to some output registers via procfs.
-          This is dangerous but may provide the only chance to get the
-          correct output device configuration.
-          Its use is strongly discouraged.
-config FB_VIA_X_COMPATIBILITY
-        bool "X server compatibility"
-        depends on FB_VIA
-        default n
-        help
-          This option reduces the functionality (power saving, ...) of the
-          framebuffer to avoid negative impact on the OpenChrome X server.
-          If you use any X server other than fbdev you should enable this
-          otherwise it should be safe to disable it and allow using all
-          features.
-endif
-config FB_NEOMAGIC
-        tristate "NeoMagic display support"
-        depends on FB && PCI
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select VGASTATE
-        help
-          This driver supports notebooks with NeoMagic PCI chips.
-          Say Y if you have such a graphics card. 
-          To compile this driver as a module, choose M here: the
-          module will be called neofb.
-config FB_KYRO
-        tristate "IMG Kyro support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Say Y here if you have a STG4000 / Kyro / PowerVR 3 based
-          graphics board.
-          To compile this driver as a module, choose M here: the
-          module will be called kyrofb.
-config FB_3DFX
-        tristate "3Dfx Banshee/Voodoo3/Voodoo5 display support"
-        depends on FB && PCI
-        select FB_CFB_IMAGEBLIT
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_MODE_HELPERS
-        help
-          This driver supports graphics boards with the 3Dfx Banshee,
-          Voodoo3 or VSA-100 (aka Voodoo4/5) chips. Say Y if you have
-          such a graphics board.
-          To compile this driver as a module, choose M here: the
-          module will be called tdfxfb.
-config FB_3DFX_ACCEL
-        bool "3Dfx Acceleration functions"
-        depends on FB_3DFX
-        ---help---
-        This will compile the 3Dfx Banshee/Voodoo3/VSA-100 frame buffer
-        device driver with acceleration functions.
-config FB_3DFX_I2C
-        bool "Enable DDC/I2C support"
-        depends on FB_3DFX
-        select FB_DDC
-        default y
-        help
-          Say Y here if you want DDC/I2C support for your 3dfx Voodoo3.
-config FB_VOODOO1
-        tristate "3Dfx Voodoo Graphics (sst1) support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Say Y here if you have a 3Dfx Voodoo Graphics (Voodoo1/sst1) or 
-          Voodoo2 (cvg) based graphics card.
-          To compile this driver as a module, choose M here: the
-          module will be called sstfb.
-          WARNING: Do not use any application that uses the 3D engine
-          (namely glide) while using this driver.
-          Please read the <file:Documentation/fb/sstfb.txt> for supported
-          options and other important info  support.
-config FB_VT8623
-        tristate "VIA VT8623 support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_TILEBLITTING
-        select FB_SVGALIB
-        select VGASTATE
-        select FONT_8x16 if FRAMEBUFFER_CONSOLE
-        ---help---
-          Driver for CastleRock integrated graphics core in the
-          VIA VT8623 [Apollo CLE266] chipset.
-config FB_TRIDENT
-        tristate "Trident/CyberXXX/CyberBlade support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          This is the frame buffer device driver for Trident PCI/AGP chipsets.
-          Supported chipset families are TGUI 9440/96XX, 3DImage, Blade3D
-          and Blade XP.
-          There are also integrated versions of these chips called CyberXXXX,
-          CyberImage or CyberBlade. These chips are mostly found in laptops
-          but also on some motherboards including early VIA EPIA motherboards.
-          For more information, read <file:Documentation/fb/tridentfb.txt>
-          Say Y if you have such a graphics board.
-          To compile this driver as a module, choose M here: the
-          module will be called tridentfb.
-config FB_ARK
-        tristate "ARK 2000PV support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_TILEBLITTING
-        select FB_SVGALIB
-        select VGASTATE
-        select FONT_8x16 if FRAMEBUFFER_CONSOLE
-        ---help---
-          Driver for PCI graphics boards with ARK 2000PV chip
-          and ICS 5342 RAMDAC.
-config FB_PM3
-        tristate "Permedia3 support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the 3DLabs Permedia3
-          chipset, used in Formac ProFormance III, 3DLabs Oxygen VX1 &
-          similar boards, 3DLabs Permedia3 Create!, Appian Jeronimo 2000
-          and maybe other boards.
-config FB_CARMINE
-        tristate "Fujitsu carmine frame buffer support"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the Fujitsu Carmine chip.
-          The driver provides two independent frame buffer devices.
-choice
-        depends on FB_CARMINE
-        prompt "DRAM timing"
-        default FB_CARMINE_DRAM_EVAL
-config FB_CARMINE_DRAM_EVAL
-        bool "Eval board timings"
-        help
-          Use timings which work on the eval card.
-config CARMINE_DRAM_CUSTOM
-        bool "Custom board timings"
-        help
-          Use custom board timings.
-endchoice
-config FB_AU1100
-        bool "Au1100 LCD Driver"
-        depends on (FB = y) && MIPS_ALCHEMY
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the framebuffer driver for the AMD Au1100 SOC.  It can drive
-          various panels and CRTs by passing in kernel cmd line option
-          au1100fb:panel=<name>.
-config FB_AU1200
-        bool "Au1200/Au1300 LCD Driver"
-        depends on (FB = y) && MIPS_ALCHEMY
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        help
-          This is the framebuffer driver for the Au1200/Au1300 SOCs.
-          It can drive various panels and CRTs by passing in kernel cmd line
-          option au1200fb:panel=<name>.
-config FB_VT8500
-        bool "VIA VT8500 framebuffer support"
-        depends on (FB = y) && ARM && ARCH_VT8500
-        select FB_SYS_FILLRECT if (!FB_WMT_GE_ROPS)
-        select FB_SYS_COPYAREA if (!FB_WMT_GE_ROPS)
-        select FB_SYS_IMAGEBLIT
-        select FB_MODE_HELPERS
-        select VIDEOMODE_HELPERS
-        help
-          This is the framebuffer driver for VIA VT8500 integrated LCD
-          controller.
-config FB_WM8505
-        bool "Wondermedia WM8xxx-series frame buffer support"
-        depends on (FB = y) && ARM && ARCH_VT8500
-        select FB_SYS_FILLRECT if (!FB_WMT_GE_ROPS)
-        select FB_SYS_COPYAREA if (!FB_WMT_GE_ROPS)
-        select FB_SYS_IMAGEBLIT
-        select FB_MODE_HELPERS
-        select VIDEOMODE_HELPERS
-        help
-          This is the framebuffer driver for WonderMedia WM8xxx-series
-          integrated LCD controller. This driver covers the WM8505, WM8650
-          and WM8850 SoCs.
-config FB_WMT_GE_ROPS
-        bool "VT8500/WM8xxx accelerated raster ops support"
-        depends on (FB = y) && (FB_VT8500 || FB_WM8505)
-        default n
-        help
-          This adds support for accelerated raster operations on the
-          VIA VT8500 and Wondermedia 85xx series SoCs.
-source "drivers/video/geode/Kconfig"
-config FB_HIT
-        tristate "HD64461 Frame Buffer support"
-        depends on FB && HD64461
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This is the frame buffer device driver for the Hitachi HD64461 LCD
-          frame buffer card.
-config FB_PMAG_AA
-        bool "PMAG-AA TURBOchannel framebuffer support"
-        depends on (FB = y) && TC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Support for the PMAG-AA TURBOchannel framebuffer card (1280x1024x1)
-          used mainly in the MIPS-based DECstation series.
-config FB_PMAG_BA
-        tristate "PMAG-BA TURBOchannel framebuffer support"
-        depends on FB && TC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Support for the PMAG-BA TURBOchannel framebuffer card (1024x864x8)
-          used mainly in the MIPS-based DECstation series.
-config FB_PMAGB_B
-        tristate "PMAGB-B TURBOchannel framebuffer support"
-        depends on FB && TC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Support for the PMAGB-B TURBOchannel framebuffer card used mainly
-          in the MIPS-based DECstation series. The card is currently only
-          supported in 1280x1024x8 mode.
-config FB_MAXINE
-        bool "Maxine (Personal DECstation) onboard framebuffer support"
-        depends on (FB = y) && MACH_DECSTATION
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Support for the onboard framebuffer (1024x768x8) in the Personal
-          DECstation series (Personal DECstation 5000/20, /25, /33, /50,
-          Codename "Maxine").
-config FB_G364
-        bool "G364 frame buffer support"
-        depends on (FB = y) && (MIPS_MAGNUM_4000 || OLIVETTI_M700)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          The G364 driver is the framebuffer used in MIPS Magnum 4000 and
-          Olivetti M700-10 systems.
-config FB_68328
-        bool "Motorola 68328 native frame buffer support"
-        depends on (FB = y) && (M68328 || M68EZ328 || M68VZ328)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Say Y here if you want to support the built-in frame buffer of
-          the Motorola 68328 CPU family.
-config FB_PXA168
-        tristate "PXA168/910 LCD framebuffer support"
-        depends on FB && (CPU_PXA168 || CPU_PXA910)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the built-in LCD controller in the Marvell
-          MMP processor.
-config FB_PXA
-        tristate "PXA LCD framebuffer support"
-        depends on FB && ARCH_PXA
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the built-in LCD controller in the Intel
-          PXA2x0 processor.
-          This driver is also available as a module ( = code which can be
-          inserted and removed from the running kernel whenever you want). The
-          module will be called pxafb. If you want to compile it as a module,
-          say M here and read <file:Documentation/kbuild/modules.txt>.
-          If unsure, say N.
-config FB_PXA_OVERLAY
-        bool "Support PXA27x/PXA3xx Overlay(s) as framebuffer"
-        default n
-        depends on FB_PXA && (PXA27x || PXA3xx)
-config FB_PXA_SMARTPANEL
-        bool "PXA Smartpanel LCD support"
-        default n
-        depends on FB_PXA
-config FB_PXA_PARAMETERS
-        bool "PXA LCD command line parameters"
-        default n
-        depends on FB_PXA
-        ---help---
-          Enable the use of kernel command line or module parameters
-          to configure the physical properties of the LCD panel when
-          using the PXA LCD driver.
-          This option allows you to override the panel parameters
-          supplied by the platform in order to support multiple
-          different models of flatpanel. If you will only be using a
-          single model of flatpanel then you can safely leave this
-          option disabled.
-          <file:Documentation/fb/pxafb.txt> describes the available parameters.
-config PXA3XX_GCU
-        tristate "PXA3xx 2D graphics accelerator driver"
-        depends on FB_PXA
-        help
-          Kernelspace driver for the 2D graphics controller unit (GCU)
-          found on PXA3xx processors. There is a counterpart driver in the
-          DirectFB suite, see http://www.directfb.org/
-          If you compile this as a module, it will be called pxa3xx_gcu.
-config FB_MBX
-        tristate "2700G LCD framebuffer support"
-        depends on FB && ARCH_PXA
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Framebuffer driver for the Intel 2700G (Marathon) Graphics
-          Accelerator
-config FB_MBX_DEBUG
-       bool "Enable debugging info via debugfs"
-       depends on FB_MBX && DEBUG_FS
-       default n
-       ---help---
-         Enable this if you want debugging information using the debug
-         filesystem (debugfs)
-         If unsure, say N.
-config FB_FSL_DIU
-        tristate "Freescale DIU framebuffer support"
-        depends on FB && FSL_SOC
-        select FB_MODE_HELPERS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select PPC_LIB_RHEAP
-        ---help---
-          Framebuffer driver for the Freescale SoC DIU
-config FB_W100
-        tristate "W100 frame buffer support"
-        depends on FB && ARCH_PXA
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the w100 as found on the Sharp SL-Cxx series.
-          It can also drive the w3220 chip found on iPAQ hx4700.
-          This driver is also available as a module ( = code which can be
-          inserted and removed from the running kernel whenever you want). The
-          module will be called w100fb. If you want to compile it as a module,
-          say M here and read <file:Documentation/kbuild/modules.txt>.
-          If unsure, say N.
-config FB_SH_MOBILE_LCDC
-        tristate "SuperH Mobile LCDC framebuffer support"
-        depends on FB && (SUPERH || ARCH_SHMOBILE) && HAVE_CLK
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select FB_DEFERRED_IO
-        select FB_BACKLIGHT
-        select SH_MIPI_DSI if SH_LCD_MIPI_DSI
-        ---help---
-          Frame buffer driver for the on-chip SH-Mobile LCD controller.
-config FB_SH_MOBILE_HDMI
-        tristate "SuperH Mobile HDMI controller support"
-        depends on FB_SH_MOBILE_LCDC
-        select FB_MODE_HELPERS
-        select SOUND
-        select SND
-        select SND_SOC
-        ---help---
-          Driver for the on-chip SH-Mobile HDMI controller.
-config FB_TMIO
-        tristate "Toshiba Mobile IO FrameBuffer support"
-        depends on FB && MFD_CORE
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the Toshiba Mobile IO integrated as found
-          on the Sharp SL-6000 series
-          This driver is also available as a module ( = code which can be
-          inserted and removed from the running kernel whenever you want). The
-          module will be called tmiofb. If you want to compile it as a module,
-          say M here and read <file:Documentation/kbuild/modules.txt>.
-          If unsure, say N.
-config FB_TMIO_ACCELL
-        bool "tmiofb acceleration"
-        depends on FB_TMIO
-        default y
-config FB_S3C
-        tristate "Samsung S3C framebuffer support"
-        depends on FB && (CPU_S3C2416 || ARCH_S3C64XX || ARCH_S5P64X0 || \
-                ARCH_S5PC100 || ARCH_S5PV210 || ARCH_EXYNOS)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the built-in FB controller in the Samsung
-          SoC line from the S3C2443 onwards, including the S3C2416, S3C2450,
-          and the S3C64XX series such as the S3C6400 and S3C6410.
-          These chips all have the same basic framebuffer design with the
-          actual capabilities depending on the chip. For instance the S3C6400
-          and S3C6410 support 4 hardware windows whereas the S3C24XX series
-          currently only have two.
-          Currently the support is only for the S3C6400 and S3C6410 SoCs.
-config FB_S3C_DEBUG_REGWRITE
-       bool "Debug register writes"
-       depends on FB_S3C
-       ---help---
-         Show all register writes via pr_debug()
-config FB_S3C2410
-        tristate "S3C2410 LCD framebuffer support"
-        depends on FB && ARCH_S3C24XX
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the built-in LCD controller in the Samsung
-          S3C2410 processor.
-          This driver is also available as a module ( = code which can be
-          inserted and removed from the running kernel whenever you want). The
-          module will be called s3c2410fb. If you want to compile it as a module,
-          say M here and read <file:Documentation/kbuild/modules.txt>.
-          If unsure, say N.
-config FB_S3C2410_DEBUG
-        bool "S3C2410 lcd debug messages"
-        depends on FB_S3C2410
-        help
-          Turn on debugging messages. Note that you can set/unset at run time
-          through sysfs
-config FB_NUC900
-        bool "NUC900 LCD framebuffer support"
-        depends on FB && ARCH_W90X900
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the built-in LCD controller in the Nuvoton
-          NUC900 processor
-config GPM1040A0_320X240
-        bool "Giantplus Technology GPM1040A0 320x240 Color TFT LCD"
-        depends on FB_NUC900
-config FB_SM501
-        tristate "Silicon Motion SM501 framebuffer support"
-        depends on FB && MFD_SM501
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for the CRT and LCD controllers in the Silicon
-          Motion SM501.
-          This driver is also available as a module ( = code which can be
-          inserted and removed from the running kernel whenever you want). The
-          module will be called sm501fb. If you want to compile it as a module,
-          say M here and read <file:Documentation/kbuild/modules.txt>.
-          If unsure, say N.
-config FB_SMSCUFX
-        tristate "SMSC UFX6000/7000 USB Framebuffer support"
-        depends on FB && USB
-        select FB_MODE_HELPERS
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select FB_DEFERRED_IO
-        ---help---
-          This is a kernel framebuffer driver for SMSC UFX USB devices.
-          Supports fbdev clients like xf86-video-fbdev, kdrive, fbi, and
-          mplayer -vo fbdev. Supports both UFX6000 (USB 2.0) and UFX7000
-          (USB 3.0) devices.
-          To compile as a module, choose M here: the module name is smscufx.
-config FB_UDL
-        tristate "Displaylink USB Framebuffer support"
-        depends on FB && USB
-        select FB_MODE_HELPERS
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select FB_DEFERRED_IO
-        ---help---
-          This is a kernel framebuffer driver for DisplayLink USB devices.
-          Supports fbdev clients like xf86-video-fbdev, kdrive, fbi, and
-          mplayer -vo fbdev. Supports all USB 2.0 era DisplayLink devices.
-          To compile as a module, choose M here: the module name is udlfb.
-config FB_IBM_GXT4500
-        tristate "Framebuffer support for IBM GXT4000P/4500P/6000P/6500P adaptors"
-        depends on FB && PPC
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Say Y here to enable support for the IBM GXT4000P/6000P and
-          GXT4500P/6500P display adaptor based on Raster Engine RC1000,
-          found on some IBM System P (pSeries) machines. This driver
-          doesn't use Geometry Engine GT1000.
-config FB_PS3
-        tristate "PS3 GPU framebuffer driver"
-        depends on FB && PS3_PS3AV
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select VT_HW_CONSOLE_BINDING if FRAMEBUFFER_CONSOLE
-        ---help---
-          Include support for the virtual frame buffer in the PS3 platform.
-config FB_PS3_DEFAULT_SIZE_M
-        int "PS3 default frame buffer size (in MiB)"
-        depends on FB_PS3
-        default 9
-        ---help---
-          This is the default size (in MiB) of the virtual frame buffer in
-          the PS3.
-          The default value can be overridden on the kernel command line
-          using the "ps3fb" option (e.g. "ps3fb=9M");
-config FB_XILINX
-        tristate "Xilinx frame buffer support"
-        depends on FB && (XILINX_VIRTEX || MICROBLAZE || ARCH_ZYNQ)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Include support for the Xilinx ML300/ML403 reference design
-          framebuffer. ML300 carries a 640*480 LCD display on the board,
-          ML403 uses a standard DB15 VGA connector.
-config FB_GOLDFISH
-        tristate "Goldfish Framebuffer"
-        depends on FB && HAS_DMA
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Framebuffer driver for Goldfish Virtual Platform
-config FB_COBALT
-        tristate "Cobalt server LCD frame buffer support"
-        depends on FB && (MIPS_COBALT || MIPS_SEAD3)
-config FB_SH7760
-        bool "SH7760/SH7763/SH7720/SH7721 LCDC support"
-        depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
-                || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Support for the SH7760/SH7763/SH7720/SH7721 integrated
-          (D)STN/TFT LCD Controller.
-          Supports display resolutions up to 1024x1024 pixel, grayscale and
-          color operation, with depths ranging from 1 bpp to 8 bpp monochrome
-          and 8, 15 or 16 bpp color; 90 degrees clockwise display rotation for
-          panels <= 320 pixel horizontal resolution.
-config FB_DA8XX
-        tristate "DA8xx/OMAP-L1xx/AM335x Framebuffer support"
-        depends on FB && (ARCH_DAVINCI_DA8XX || SOC_AM33XX)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_CFB_REV_PIXELS_IN_BYTE
-        select FB_MODE_HELPERS
-        select VIDEOMODE_HELPERS
-        ---help---
-          This is the frame buffer device driver for the TI LCD controller
-          found on DA8xx/OMAP-L1xx/AM335x SoCs.
-          If unsure, say N.
-config FB_VIRTUAL
-        tristate "Virtual Frame Buffer support (ONLY FOR TESTING!)"
-        depends on FB
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        ---help---
-          This is a `virtual' frame buffer device. It operates on a chunk of
-          unswappable kernel memory instead of on the memory of a graphics
-          board. This means you cannot see any output sent to this frame
-          buffer device, while it does consume precious memory. The main use
-          of this frame buffer device is testing and debugging the frame
-          buffer subsystem. Do NOT enable it for normal systems! To protect
-          the innocent, it has to be enabled explicitly at boot time using the
-          kernel option `video=vfb:'.
-          To compile this driver as a module, choose M here: the
-          module will be called vfb. In order to load it, you must use
-          the vfb_enable=1 option.
-          If unsure, say N.
-config XEN_FBDEV_FRONTEND
-        tristate "Xen virtual frame buffer support"
-        depends on FB && XEN
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select FB_DEFERRED_IO
-        select INPUT_XEN_KBDDEV_FRONTEND if INPUT_MISC
-        select XEN_XENBUS_FRONTEND
-        default y
-        help
-          This driver implements the front-end of the Xen virtual
-          frame buffer driver.  It communicates with a back-end
-          in another domain.
-config FB_METRONOME
-        tristate "E-Ink Metronome/8track controller support"
-        depends on FB
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select FB_DEFERRED_IO
-        help
-          This driver implements support for the E-Ink Metronome
-          controller. The pre-release name for this device was 8track
-          and could also have been called by some vendors as PVI-nnnn.
-config FB_MB862XX
-        tristate "Fujitsu MB862xx GDC support"
-        depends on FB
-        depends on PCI || (OF && PPC)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Frame buffer driver for Fujitsu Carmine/Coral-P(A)/Lime controllers.
-choice
-        prompt "GDC variant"
-        depends on FB_MB862XX
-config FB_MB862XX_PCI_GDC
-        bool "Carmine/Coral-P(A) GDC"
-        depends on PCI
-        ---help---
-          This enables framebuffer support for Fujitsu Carmine/Coral-P(A)
-          PCI graphics controller devices.
-config FB_MB862XX_LIME
-        bool "Lime GDC"
-        depends on OF && PPC
-        select FB_FOREIGN_ENDIAN
-        select FB_LITTLE_ENDIAN
-        ---help---
-          Framebuffer support for Fujitsu Lime GDC on host CPU bus.
-endchoice
-config FB_MB862XX_I2C
-        bool "Support I2C bus on MB862XX GDC"
-        depends on FB_MB862XX && I2C
-        default y
-        help
-          Selecting this option adds Coral-P(A)/Lime GDC I2C bus adapter
-          driver to support accessing I2C devices on controller's I2C bus.
-          These are usually some video decoder chips.
-config FB_EP93XX
-        tristate "EP93XX frame buffer support"
-        depends on FB && ARCH_EP93XX
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        ---help---
-          Framebuffer driver for the Cirrus Logic EP93XX series of processors.
-          This driver is also available as a module. The module will be called
-          ep93xx-fb.
-config FB_PRE_INIT_FB
-        bool "Don't reinitialize, use bootloader's GDC/Display configuration"
-        depends on FB && FB_MB862XX_LIME
-        ---help---
-          Select this option if display contents should be inherited as set by
-          the bootloader.
-config FB_MSM
-        tristate "MSM Framebuffer support"
-        depends on FB && ARCH_MSM
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-config FB_MX3
-        tristate "MX3 Framebuffer support"
-        depends on FB && MX3_IPU
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        default y
-        help
-          This is a framebuffer device for the i.MX31 LCD Controller. So
-          far only synchronous displays are supported. If you plan to use
-          an LCD display with your i.MX31 system, say Y here.
-config FB_BROADSHEET
-        tristate "E-Ink Broadsheet/Epson S1D13521 controller support"
-        depends on FB
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select FB_DEFERRED_IO
-        help
-          This driver implements support for the E-Ink Broadsheet
-          controller. The release name for this device was Epson S1D13521
-          and could also have been called by other names when coupled with
-          a bridge adapter.
-config FB_AUO_K190X
-        tristate "AUO-K190X EPD controller support"
-        depends on FB
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        select FB_DEFERRED_IO
-        help
-          Provides support for epaper controllers from the K190X series
-          of AUO. These controllers can be used to drive epaper displays
-          from Sipix.
-          This option enables the common support, shared by the individual
-          controller drivers. You will also have to enable the driver
-          for the controller type used in your device.
-config FB_AUO_K1900
-        tristate "AUO-K1900 EPD controller support"
-        depends on FB && FB_AUO_K190X
-        help
-          This driver implements support for the AUO K1900 epd-controller.
-          This controller can drive Sipix epaper displays but can only do
-          serial updates, reducing the number of possible frames per second.
-config FB_AUO_K1901
-        tristate "AUO-K1901 EPD controller support"
-        depends on FB && FB_AUO_K190X
-        help
-          This driver implements support for the AUO K1901 epd-controller.
-          This controller can drive Sipix epaper displays and supports
-          concurrent updates, making higher frames per second possible.
-config FB_JZ4740
-        tristate "JZ4740 LCD framebuffer support"
-        depends on FB && MACH_JZ4740
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        help
-          Framebuffer support for the JZ4740 SoC.
-config FB_MXS
-        tristate "MXS LCD framebuffer support"
-        depends on FB && ARCH_MXS
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MODE_HELPERS
-        select VIDEOMODE_HELPERS
-        help
-          Framebuffer support for the MXS SoC.
-config FB_PUV3_UNIGFX
-        tristate "PKUnity v3 Unigfx framebuffer support"
-        depends on FB && UNICORE32 && ARCH_PUV3
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_SYS_FOPS
-        help
-          Choose this option if you want to use the Unigfx device as a
-          framebuffer device. Without the support of PCI & AGP.
-config FB_HYPERV
-        tristate "Microsoft Hyper-V Synthetic Video support"
-        depends on FB && HYPERV
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          This framebuffer driver supports Microsoft Hyper-V Synthetic Video.
-config FB_SIMPLE
-        bool "Simple framebuffer support"
-        depends on (FB = y)
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        help
-          Say Y if you want support for a simple frame-buffer.
-          This driver assumes that the display hardware has been initialized
-          before the kernel boots, and the kernel will simply render to the
-          pre-allocated frame buffer surface.
-          Configuration re: surface address, size, and format must be provided
-          through device tree, or plain old platform data.
-source "drivers/video/omap/Kconfig"
-source "drivers/video/omap2/Kconfig"
-source "drivers/video/exynos/Kconfig"
-source "drivers/video/mmp/Kconfig"
-source "drivers/video/backlight/Kconfig"
 if VT
        source "drivers/video/console/Kconfig"
 endif
 if FB || SGI_NEWPORT_CONSOLE
        source "drivers/video/logo/Kconfig"
-endif
-config FB_SH_MOBILE_MERAM
+endif
-        tristate "SuperH Mobile MERAM read ahead support"
-        depends on (SUPERH || ARCH_SHMOBILE)
-        select GENERIC_ALLOCATOR
-        ---help---
-          Enable MERAM support for the SuperH controller.
-          This will allow for caching of the framebuffer to provide more
-          reliable access under heavy main memory bus traffic situations.
-          Up to 4 memory channels can be configured, allowing 4 RGB or
-          2 YCbCr framebuffers to be configured.
-config FB_SSD1307
-        tristate "Solomon SSD1307 framebuffer support"
-        depends on FB && I2C
-        depends on OF
-        depends on GPIOLIB
-        select FB_SYS_FOPS
-        select FB_SYS_FILLRECT
-        select FB_SYS_COPYAREA
-        select FB_SYS_IMAGEBLIT
-        select FB_DEFERRED_IO
-        select PWM
-        help
-          This driver implements support for the Solomon SSD1307
-          OLED controller over I2C.
 endmenu
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 1be26fe10592..9ad3c17d6456 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -1,175 +1,11 @@
-# Makefile for the Linux video drivers.
-# 5 Aug 1999, James Simmons, <mailto:jsimmons@users.sf.net>
-# Rewritten to use lists instead of if-statements.
-# Each configuration option enables a list of files.
 obj-$(CONFIG_VGASTATE)            += vgastate.o
 obj-$(CONFIG_HDMI)                += hdmi.o
-obj-y                             += fb_notify.o
-obj-$(CONFIG_FB)                  += fb.o
-fb-y                              := fbmem.o fbmon.o fbcmap.o fbsysfs.o \
-                                     modedb.o fbcvt.o
-fb-objs                           := $(fb-y)
 obj-$(CONFIG_VT)                  += console/
 obj-$(CONFIG_LOGO)                += logo/
 obj-y                             += backlight/
-obj-$(CONFIG_EXYNOS_VIDEO)     += exynos/
+obj-y                             += fbdev/
-obj-$(CONFIG_FB_CFB_FILLRECT)  += cfbfillrect.o
-obj-$(CONFIG_FB_CFB_COPYAREA)  += cfbcopyarea.o
-obj-$(CONFIG_FB_CFB_IMAGEBLIT) += cfbimgblt.o
-obj-$(CONFIG_FB_SYS_FILLRECT)  += sysfillrect.o
-obj-$(CONFIG_FB_SYS_COPYAREA)  += syscopyarea.o
-obj-$(CONFIG_FB_SYS_IMAGEBLIT) += sysimgblt.o
-obj-$(CONFIG_FB_SYS_FOPS)      += fb_sys_fops.o
-obj-$(CONFIG_FB_SVGALIB)       += svgalib.o
-obj-$(CONFIG_FB_MACMODES)      += macmodes.o
-obj-$(CONFIG_FB_DDC)           += fb_ddc.o
-obj-$(CONFIG_FB_DEFERRED_IO)   += fb_defio.o
-obj-$(CONFIG_FB_WMT_GE_ROPS)   += wmt_ge_rops.o
-# Hardware specific drivers go first
-obj-$(CONFIG_FB_AMIGA)            += amifb.o c2p_planar.o
-obj-$(CONFIG_FB_ARC)              += arcfb.o
-obj-$(CONFIG_FB_CLPS711X)         += clps711xfb.o
-obj-$(CONFIG_FB_CYBER2000)        += cyber2000fb.o
-obj-$(CONFIG_FB_GRVGA)            += grvga.o
-obj-$(CONFIG_FB_PM2)              += pm2fb.o
-obj-$(CONFIG_FB_PM3)              += pm3fb.o
-obj-$(CONFIG_FB_I740)             += i740fb.o
-obj-$(CONFIG_FB_MATROX)           += matrox/
-obj-$(CONFIG_FB_RIVA)             += riva/
-obj-$(CONFIG_FB_NVIDIA)           += nvidia/
-obj-$(CONFIG_FB_ATY)              += aty/ macmodes.o
-obj-$(CONFIG_FB_ATY128)           += aty/ macmodes.o
-obj-$(CONFIG_FB_RADEON)           += aty/
-obj-$(CONFIG_FB_SIS)              += sis/
-obj-$(CONFIG_FB_VIA)              += via/
-obj-$(CONFIG_FB_KYRO)             += kyro/
-obj-$(CONFIG_FB_SAVAGE)           += savage/
-obj-$(CONFIG_FB_GEODE)            += geode/
-obj-$(CONFIG_FB_MBX)              += mbx/
-obj-$(CONFIG_FB_NEOMAGIC)         += neofb.o
-obj-$(CONFIG_FB_3DFX)             += tdfxfb.o
-obj-$(CONFIG_FB_CONTROL)          += controlfb.o
-obj-$(CONFIG_FB_PLATINUM)         += platinumfb.o
-obj-$(CONFIG_FB_VALKYRIE)         += valkyriefb.o
-obj-$(CONFIG_FB_CT65550)          += chipsfb.o
-obj-$(CONFIG_FB_IMSTT)            += imsttfb.o
-obj-$(CONFIG_FB_FM2)              += fm2fb.o
-obj-$(CONFIG_FB_VT8623)           += vt8623fb.o
-obj-$(CONFIG_FB_TRIDENT)          += tridentfb.o
-obj-$(CONFIG_FB_LE80578)          += vermilion/
-obj-$(CONFIG_FB_S3)               += s3fb.o
-obj-$(CONFIG_FB_ARK)              += arkfb.o
-obj-$(CONFIG_FB_STI)              += stifb.o
-obj-$(CONFIG_FB_FFB)              += ffb.o sbuslib.o
-obj-$(CONFIG_FB_CG6)              += cg6.o sbuslib.o
-obj-$(CONFIG_FB_CG3)              += cg3.o sbuslib.o
-obj-$(CONFIG_FB_BW2)              += bw2.o sbuslib.o
-obj-$(CONFIG_FB_CG14)             += cg14.o sbuslib.o
-obj-$(CONFIG_FB_P9100)            += p9100.o sbuslib.o
-obj-$(CONFIG_FB_TCX)              += tcx.o sbuslib.o
-obj-$(CONFIG_FB_LEO)              += leo.o sbuslib.o
-obj-$(CONFIG_FB_ACORN)            += acornfb.o
-obj-$(CONFIG_FB_ATARI)            += atafb.o c2p_iplan2.o atafb_mfb.o \
-                                     atafb_iplan2p2.o atafb_iplan2p4.o atafb_iplan2p8.o
-obj-$(CONFIG_FB_MAC)              += macfb.o
-obj-$(CONFIG_FB_HECUBA)           += hecubafb.o
-obj-$(CONFIG_FB_N411)             += n411.o
-obj-$(CONFIG_FB_HGA)              += hgafb.o
-obj-$(CONFIG_FB_XVR500)           += sunxvr500.o
-obj-$(CONFIG_FB_XVR2500)          += sunxvr2500.o
-obj-$(CONFIG_FB_XVR1000)          += sunxvr1000.o
-obj-$(CONFIG_FB_IGA)              += igafb.o
-obj-$(CONFIG_FB_APOLLO)           += dnfb.o
-obj-$(CONFIG_FB_Q40)              += q40fb.o
-obj-$(CONFIG_FB_TGA)              += tgafb.o
-obj-$(CONFIG_FB_HP300)            += hpfb.o
-obj-$(CONFIG_FB_G364)             += g364fb.o
-obj-$(CONFIG_FB_EP93XX)           += ep93xx-fb.o
-obj-$(CONFIG_FB_SA1100)           += sa1100fb.o
-obj-$(CONFIG_FB_HIT)              += hitfb.o
-obj-$(CONFIG_FB_ATMEL)            += atmel_lcdfb.o
-obj-$(CONFIG_FB_PVR2)             += pvr2fb.o
-obj-$(CONFIG_FB_VOODOO1)          += sstfb.o
-obj-$(CONFIG_FB_ARMCLCD)          += amba-clcd.o
-obj-$(CONFIG_FB_GOLDFISH)         += goldfishfb.o
-obj-$(CONFIG_FB_68328)            += 68328fb.o
-obj-$(CONFIG_FB_GBE)              += gbefb.o
-obj-$(CONFIG_FB_CIRRUS)           += cirrusfb.o
-obj-$(CONFIG_FB_ASILIANT)         += asiliantfb.o
-obj-$(CONFIG_FB_PXA)              += pxafb.o
-obj-$(CONFIG_FB_PXA168)           += pxa168fb.o
-obj-$(CONFIG_PXA3XX_GCU)          += pxa3xx-gcu.o
-obj-$(CONFIG_MMP_DISP)           += mmp/
-obj-$(CONFIG_FB_W100)             += w100fb.o
-obj-$(CONFIG_FB_TMIO)             += tmiofb.o
-obj-$(CONFIG_FB_AU1100)           += au1100fb.o
-obj-$(CONFIG_FB_AU1200)           += au1200fb.o
-obj-$(CONFIG_FB_VT8500)           += vt8500lcdfb.o
-obj-$(CONFIG_FB_WM8505)           += wm8505fb.o
-obj-$(CONFIG_FB_PMAG_AA)          += pmag-aa-fb.o
-obj-$(CONFIG_FB_PMAG_BA)          += pmag-ba-fb.o
-obj-$(CONFIG_FB_PMAGB_B)          += pmagb-b-fb.o
-obj-$(CONFIG_FB_MAXINE)           += maxinefb.o
-obj-$(CONFIG_FB_METRONOME)        += metronomefb.o
-obj-$(CONFIG_FB_BROADSHEET)       += broadsheetfb.o
-obj-$(CONFIG_FB_AUO_K190X)        += auo_k190x.o
-obj-$(CONFIG_FB_AUO_K1900)        += auo_k1900fb.o
-obj-$(CONFIG_FB_AUO_K1901)        += auo_k1901fb.o
-obj-$(CONFIG_FB_S1D13XXX)         += s1d13xxxfb.o
-obj-$(CONFIG_FB_SH7760)           += sh7760fb.o
-obj-$(CONFIG_FB_IMX)              += imxfb.o
-obj-$(CONFIG_FB_S3C)              += s3c-fb.o
-obj-$(CONFIG_FB_S3C2410)          += s3c2410fb.o
-obj-$(CONFIG_FB_FSL_DIU)          += fsl-diu-fb.o
-obj-$(CONFIG_FB_COBALT)           += cobalt_lcdfb.o
-obj-$(CONFIG_FB_IBM_GXT4500)      += gxt4500.o
-obj-$(CONFIG_FB_PS3)              += ps3fb.o
-obj-$(CONFIG_FB_SM501)            += sm501fb.o
-obj-$(CONFIG_FB_UDL)              += udlfb.o
-obj-$(CONFIG_FB_SMSCUFX)          += smscufx.o
-obj-$(CONFIG_FB_XILINX)           += xilinxfb.o
-obj-$(CONFIG_SH_MIPI_DSI)         += sh_mipi_dsi.o
-obj-$(CONFIG_FB_SH_MOBILE_HDMI)   += sh_mobile_hdmi.o
-obj-$(CONFIG_FB_SH_MOBILE_MERAM)  += sh_mobile_meram.o
-obj-$(CONFIG_FB_SH_MOBILE_LCDC)   += sh_mobile_lcdcfb.o
-obj-$(CONFIG_FB_OMAP)             += omap/
-obj-y                             += omap2/
-obj-$(CONFIG_XEN_FBDEV_FRONTEND)  += xen-fbfront.o
-obj-$(CONFIG_FB_CARMINE)          += carminefb.o
-obj-$(CONFIG_FB_MB862XX)          += mb862xx/
-obj-$(CONFIG_FB_MSM)              += msm/
-obj-$(CONFIG_FB_NUC900)           += nuc900fb.o
-obj-$(CONFIG_FB_JZ4740)           += jz4740_fb.o
-obj-$(CONFIG_FB_PUV3_UNIGFX)      += fb-puv3.o
-obj-$(CONFIG_FB_HYPERV)           += hyperv_fb.o
-obj-$(CONFIG_FB_OPENCORES)        += ocfb.o
-# Platform or fallback drivers go here
-obj-$(CONFIG_FB_UVESA)            += uvesafb.o
-obj-$(CONFIG_FB_VESA)             += vesafb.o
-obj-$(CONFIG_FB_EFI)              += efifb.o
-obj-$(CONFIG_FB_VGA16)            += vga16fb.o
-obj-$(CONFIG_FB_OF)               += offb.o
-obj-$(CONFIG_FB_BF537_LQ035)      += bf537-lq035.o
-obj-$(CONFIG_FB_BF54X_LQ043)      += bf54x-lq043fb.o
-obj-$(CONFIG_FB_BFIN_LQ035Q1)     += bfin-lq035q1-fb.o
-obj-$(CONFIG_FB_BFIN_T350MCQB)    += bfin-t350mcqb-fb.o
-obj-$(CONFIG_FB_BFIN_7393)        += bfin_adv7393fb.o
-obj-$(CONFIG_FB_MX3)              += mx3fb.o
-obj-$(CONFIG_FB_DA8XX)            += da8xx-fb.o
-obj-$(CONFIG_FB_MXS)              += mxsfb.o
-obj-$(CONFIG_FB_SSD1307)          += ssd1307fb.o
-obj-$(CONFIG_FB_SIMPLE)           += simplefb.o
-# the test framebuffer is last
-obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
 obj-$(CONFIG_VIDEOMODE_HELPERS) += display_timing.o videomode.o
 ifeq ($(CONFIG_OF),y)
diff --git a/drivers/video/console/sticon.c b/drivers/video/console/sticon.c
index 5f65ca3d8564..026fd1215933 100644
--- a/drivers/video/console/sticon.c
+++ b/drivers/video/console/sticon.c
@@ -46,7 +46,7 @@
 #include <asm/io.h>
-#include "../sticore.h"
+#include "../fbdev/sticore.h"
 /* switching to graphics mode */
 #define BLANK 0
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index cecd3de01c24..7da1ad03acb5 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -28,7 +28,7 @@
 #include <asm/cacheflush.h>
 #include <asm/grfioctl.h>
-#include "../sticore.h"
+#include "../fbdev/sticore.h"
 #define STI_DRIVERVERSION "Version 0.9b"
diff --git a/drivers/video/68328fb.c b/drivers/video/fbdev/68328fb.c
index 552258c8f99d..552258c8f99d 100644
--- a/drivers/video/68328fb.c
+++ b/drivers/video/fbdev/68328fb.c
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
new file mode 100644
index 000000000000..e1f47272fdea
--- /dev/null
+++ b/drivers/video/fbdev/Kconfig
@@ -0,0 +1,2474 @@
+#
+# fbdev configuration
+#
+menuconfig FB
+        tristate "Support for frame buffer devices"
+        ---help---
+          The frame buffer device provides an abstraction for the graphics
+          hardware. It represents the frame buffer of some video hardware and
+          allows application software to access the graphics hardware through
+          a well-defined interface, so the software doesn't need to know
+          anything about the low-level (hardware register) stuff.
+          Frame buffer devices work identically across the different
+          architectures supported by Linux and make the implementation of
+          application programs easier and more portable; at this point, an X
+          server exists which uses the frame buffer device exclusively.
+          On several non-X86 architectures, the frame buffer device is the
+          only way to use the graphics hardware.
+          The device is accessed through special device nodes, usually located
+          in the /dev directory, i.e. /dev/fb*.
+          You need an utility program called fbset to make full use of frame
+          buffer devices. Please read <file:Documentation/fb/framebuffer.txt>
+          and the Framebuffer-HOWTO at
+          <http://www.munted.org.uk/programming/Framebuffer-HOWTO-1.3.html> for more
+          information.
+          Say Y here and to the driver for your graphics board below if you
+          are compiling a kernel for a non-x86 architecture.
+          If you are compiling for the x86 architecture, you can say Y if you
+          want to play with it, but it is not essential. Please note that
+          running graphical applications that directly touch the hardware
+          (e.g. an accelerated X server) and that are not frame buffer
+          device-aware may cause unexpected results. If unsure, say N.
+config FIRMWARE_EDID
+       bool "Enable firmware EDID"
+       depends on FB
+       default n
+       ---help---
+         This enables access to the EDID transferred from the firmware.
+         On the i386, this is from the Video BIOS. Enable this if DDC/I2C
+         transfers do not work for your driver and if you are using
+         nvidiafb, i810fb or savagefb.
+         In general, choosing Y for this option is safe.  If you
+         experience extremely long delays while booting before you get
+         something on your display, try setting this to N.  Matrox cards in
+         combination with certain motherboards and monitors are known to
+         suffer from this problem.
+config FB_DDC
+       tristate
+       depends on FB
+       select I2C_ALGOBIT
+       select I2C
+       default n
+config FB_BOOT_VESA_SUPPORT
+        bool
+        depends on FB
+        default n
+        ---help---
+          If true, at least one selected framebuffer driver can take advantage
+          of VESA video modes set at an early boot stage via the vga= parameter.
+config FB_CFB_FILLRECT
+        tristate
+        depends on FB
+        default n
+        ---help---
+          Include the cfb_fillrect function for generic software rectangle
+          filling. This is used by drivers that don't provide their own
+          (accelerated) version.
+config FB_CFB_COPYAREA
+        tristate
+        depends on FB
+        default n
+        ---help---
+          Include the cfb_copyarea function for generic software area copying.
+          This is used by drivers that don't provide their own (accelerated)
+          version.
+config FB_CFB_IMAGEBLIT
+        tristate
+        depends on FB
+        default n
+        ---help---
+          Include the cfb_imageblit function for generic software image
+          blitting. This is used by drivers that don't provide their own
+          (accelerated) version.
+config FB_CFB_REV_PIXELS_IN_BYTE
+        bool
+        depends on FB
+        default n
+        ---help---
+          Allow generic frame-buffer functions to work on displays with 1, 2
+          and 4 bits per pixel depths which has opposite order of pixels in
+          byte order to bytes in long order.
+config FB_SYS_FILLRECT
+        tristate
+        depends on FB
+        default n
+        ---help---
+          Include the sys_fillrect function for generic software rectangle
+          filling. This is used by drivers that don't provide their own
+          (accelerated) version and the framebuffer is in system RAM.
+config FB_SYS_COPYAREA
+        tristate
+        depends on FB
+        default n
+        ---help---
+          Include the sys_copyarea function for generic software area copying.
+          This is used by drivers that don't provide their own (accelerated)
+          version and the framebuffer is in system RAM.
+config FB_SYS_IMAGEBLIT
+        tristate
+        depends on FB
+        default n
+        ---help---
+          Include the sys_imageblit function for generic software image
+          blitting. This is used by drivers that don't provide their own
+          (accelerated) version and the framebuffer is in system RAM.
+menuconfig FB_FOREIGN_ENDIAN
+        bool "Framebuffer foreign endianness support"
+        depends on FB
+        ---help---
+          This menu will let you enable support for the framebuffers with
+          non-native endianness (e.g. Little-Endian framebuffer on a
+          Big-Endian machine). Most probably you don't have such hardware,
+          so it's safe to say "n" here.
+choice
+        prompt "Choice endianness support"
+        depends on FB_FOREIGN_ENDIAN
+config FB_BOTH_ENDIAN
+        bool "Support for Big- and Little-Endian framebuffers"
+config FB_BIG_ENDIAN
+        bool "Support for Big-Endian framebuffers only"
+config FB_LITTLE_ENDIAN
+        bool "Support for Little-Endian framebuffers only"
+endchoice
+config FB_SYS_FOPS
+       tristate
+       depends on FB
+       default n
+config FB_DEFERRED_IO
+        bool
+        depends on FB
+config FB_HECUBA
+        tristate
+        depends on FB
+        depends on FB_DEFERRED_IO
+config FB_SVGALIB
+        tristate
+        depends on FB
+        default n
+        ---help---
+          Common utility functions useful to fbdev drivers of VGA-based
+          cards.
+config FB_MACMODES
+       tristate
+       depends on FB
+       default n
+config FB_BACKLIGHT
+        bool
+        depends on FB
+        select BACKLIGHT_LCD_SUPPORT
+        select BACKLIGHT_CLASS_DEVICE
+        default n
+config FB_MODE_HELPERS
+        bool "Enable Video Mode Handling Helpers"
+        depends on FB
+        default n
+        ---help---
+          This enables functions for handling video modes using the
+          Generalized Timing Formula and the EDID parser. A few drivers rely
+          on this feature such as the radeonfb, rivafb, and the i810fb. If
+          your driver does not take advantage of this feature, choosing Y will
+          just increase the kernel size by about 5K.
+config FB_TILEBLITTING
+       bool "Enable Tile Blitting Support"
+       depends on FB
+       default n
+       ---help---
+         This enables tile blitting.  Tile blitting is a drawing technique
+         where the screen is divided into rectangular sections (tiles), whereas
+         the standard blitting divides the screen into pixels. Because the
+         default drawing element is a tile, drawing functions will be passed
+         parameters in terms of number of tiles instead of number of pixels.
+         For example, to draw a single character, instead of using bitmaps,
+         an index to an array of bitmaps will be used.  To clear or move a
+         rectangular section of a screen, the rectangle will be described in
+         terms of number of tiles in the x- and y-axis.
+         This is particularly important to one driver, matroxfb.  If
+         unsure, say N.
+comment "Frame buffer hardware drivers"
+        depends on FB
+config FB_GRVGA
+        tristate "Aeroflex Gaisler framebuffer support"
+        depends on FB && SPARC
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+        This enables support for the SVGACTRL framebuffer in the GRLIB IP library from Aeroflex Gaisler.
+config FB_CIRRUS
+        tristate "Cirrus Logic support"
+        depends on FB && (ZORRO || PCI)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          This enables support for Cirrus Logic GD542x/543x based boards on
+          Amiga: SD64, Piccolo, Picasso II/II+, Picasso IV, or EGS Spectrum.
+          If you have a PCI-based system, this enables support for these
+          chips: GD-543x, GD-544x, GD-5480.
+          Please read the file <file:Documentation/fb/cirrusfb.txt>.
+          Say N unless you have such a graphics board or plan to get one
+          before you next recompile the kernel.
+config FB_PM2
+        tristate "Permedia2 support"
+        depends on FB && ((AMIGA && BROKEN) || PCI)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for cards based on
+          the 3D Labs Permedia, Permedia 2 and Permedia 2V chips.
+          The driver was tested on the following cards:
+                Diamond FireGL 1000 PRO AGP
+                ELSA Gloria Synergy PCI
+                Appian Jeronimo PRO (both heads) PCI
+                3DLabs Oxygen ACX aka EONtronics Picasso P2 PCI
+                Techsource Raptor GFX-8P (aka Sun PGX-32) on SPARC
+                ASK Graphic Blaster Exxtreme AGP
+          To compile this driver as a module, choose M here: the
+          module will be called pm2fb.
+config FB_PM2_FIFO_DISCONNECT
+        bool "enable FIFO disconnect feature"
+        depends on FB_PM2 && PCI
+        help
+          Support the Permedia2 FIFO disconnect feature.
+config FB_ARMCLCD
+        tristate "ARM PrimeCell PL110 support"
+        depends on ARM || ARM64 || COMPILE_TEST
+        depends on FB && ARM_AMBA
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This framebuffer device driver is for the ARM PrimeCell PL110
+          Colour LCD controller.  ARM PrimeCells provide the building
+          blocks for System on a Chip devices.
+          If you want to compile this as a module (=code which can be
+          inserted into and removed from the running kernel), say M
+          here and read <file:Documentation/kbuild/modules.txt>.  The module
+          will be called amba-clcd.
+config FB_ACORN
+        bool "Acorn VIDC support"
+        depends on (FB = y) && ARM && ARCH_ACORN
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Acorn VIDC graphics
+          hardware found in Acorn RISC PCs and other ARM-based machines.  If
+          unsure, say N.
+config FB_CLPS711X
+        bool "CLPS711X LCD support"
+        depends on (FB = y) && ARM && ARCH_CLPS711X
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Say Y to enable the Framebuffer driver for the CLPS7111 and
+          EP7212 processors.
+config FB_SA1100
+        bool "SA-1100 LCD support"
+        depends on (FB = y) && ARM && ARCH_SA1100
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is a framebuffer device for the SA-1100 LCD Controller.
+          See <http://www.linux-fbdev.org/> for information on framebuffer
+          devices.
+          If you plan to use the LCD display with your SA-1100 system, say
+          Y here.
+config FB_IMX
+        tristate "Freescale i.MX1/21/25/27 LCD support"
+        depends on FB && ARCH_MXC
+        select BACKLIGHT_LCD_SUPPORT
+        select LCD_CLASS_DEVICE
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MODE_HELPERS
+        select VIDEOMODE_HELPERS
+config FB_CYBER2000
+        tristate "CyberPro 2000/2010/5000 support"
+        depends on FB && PCI && (BROKEN || !SPARC64)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This enables support for the Integraphics CyberPro 20x0 and 5000
+          VGA chips used in the Rebel.com Netwinder and other machines.
+          Say Y if you have a NetWinder or a graphics card containing this
+          device, otherwise say N.
+config FB_CYBER2000_DDC
+        bool "DDC for CyberPro support"
+        depends on FB_CYBER2000
+        select FB_DDC
+        default y
+        help
+          Say Y here if you want DDC support for your CyberPro graphics
+          card. This is only I2C bus support, driver does not use EDID.
+config FB_CYBER2000_I2C
+        bool "CyberPro 2000/2010/5000 I2C support"
+        depends on FB_CYBER2000 && I2C && ARCH_NETWINDER
+        select I2C_ALGOBIT
+        help
+          Enable support for the I2C video decoder interface on the
+          Integraphics CyberPro 20x0 and 5000 VGA chips.  This is used
+          on the Netwinder machines for the SAA7111 video capture.
+config FB_APOLLO
+        bool
+        depends on (FB = y) && APOLLO
+        default y
+        select FB_CFB_FILLRECT
+        select FB_CFB_IMAGEBLIT
+config FB_Q40
+        bool
+        depends on (FB = y) && Q40
+        default y
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+config FB_AMIGA
+        tristate "Amiga native chipset support"
+        depends on FB && AMIGA
+        help
+          This is the frame buffer device driver for the builtin graphics
+          chipset found in Amigas.
+          To compile this driver as a module, choose M here: the
+          module will be called amifb.
+config FB_AMIGA_OCS
+        bool "Amiga OCS chipset support"
+        depends on FB_AMIGA
+        help
+          This enables support for the original Agnus and Denise video chips,
+          found in the Amiga 1000 and most A500's and A2000's. If you intend
+          to run Linux on any of these systems, say Y; otherwise say N.
+config FB_AMIGA_ECS
+        bool "Amiga ECS chipset support"
+        depends on FB_AMIGA
+        help
+          This enables support for the Enhanced Chip Set, found in later
+          A500's, later A2000's, the A600, the A3000, the A3000T and CDTV. If
+          you intend to run Linux on any of these systems, say Y; otherwise
+          say N.
+config FB_AMIGA_AGA
+        bool "Amiga AGA chipset support"
+        depends on FB_AMIGA
+        help
+          This enables support for the Advanced Graphics Architecture (also
+          known as the AGA or AA) Chip Set, found in the A1200, A4000, A4000T
+          and CD32. If you intend to run Linux on any of these systems, say Y;
+          otherwise say N.
+config FB_FM2
+        bool "Amiga FrameMaster II/Rainbow II support"
+        depends on (FB = y) && ZORRO
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Amiga FrameMaster
+          card from BSC (exhibited 1992 but not shipped as a CBM product).
+config FB_ARC
+        tristate "Arc Monochrome LCD board support"
+        depends on FB && X86
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        help
+          This enables support for the Arc Monochrome LCD board. The board
+          is based on the KS-108 lcd controller and is typically a matrix
+          of 2*n chips. This driver was tested with a 128x64 panel. This
+          driver supports it for use with x86 SBCs through a 16 bit GPIO
+          interface (8 bit data, 8 bit control). If you anticipate using
+          this driver, say Y or M; otherwise say N. You must specify the
+          GPIO IO address to be used for setting control and data.
+config FB_ATARI
+        bool "Atari native chipset support"
+        depends on (FB = y) && ATARI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the builtin graphics
+          chipset found in Ataris.
+config FB_OF
+        bool "Open Firmware frame buffer device support"
+        depends on (FB = y) && (PPC64 || PPC_OF) && (!PPC_PSERIES || PCI)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MACMODES
+        help
+          Say Y if you want support with Open Firmware for your graphics
+          board.
+config FB_CONTROL
+        bool "Apple \"control\" display support"
+        depends on (FB = y) && PPC_PMAC && PPC32
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MACMODES
+        help
+          This driver supports a frame buffer for the graphics adapter in the
+          Power Macintosh 7300 and others.
+config FB_PLATINUM
+        bool "Apple \"platinum\" display support"
+        depends on (FB = y) && PPC_PMAC && PPC32
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MACMODES
+        help
+          This driver supports a frame buffer for the "platinum" graphics
+          adapter in some Power Macintoshes.
+config FB_VALKYRIE
+        bool "Apple \"valkyrie\" display support"
+        depends on (FB = y) && (MAC || (PPC_PMAC && PPC32))
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MACMODES
+        help
+          This driver supports a frame buffer for the "valkyrie" graphics
+          adapter in some Power Macintoshes.
+config FB_CT65550
+        bool "Chips 65550 display support"
+        depends on (FB = y) && PPC32 && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Chips & Technologies
+          65550 graphics chip in PowerBooks.
+config FB_ASILIANT
+        bool "Asiliant (Chips) 69000 display support"
+        depends on (FB = y) && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Asiliant 69030 chipset
+config FB_IMSTT
+        bool "IMS Twin Turbo display support"
+        depends on (FB = y) && PCI
+        select FB_CFB_IMAGEBLIT
+        select FB_MACMODES if PPC
+        help
+          The IMS Twin Turbo is a PCI-based frame buffer card bundled with
+          many Macintosh and compatible computers.
+config FB_VGA16
+        tristate "VGA 16-color graphics support"
+        depends on FB && (X86 || PPC)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select VGASTATE
+        select FONT_8x16 if FRAMEBUFFER_CONSOLE
+        help
+          This is the frame buffer device driver for VGA 16 color graphic
+          cards. Say Y if you have such a card.
+          To compile this driver as a module, choose M here: the
+          module will be called vga16fb.
+config FB_BF54X_LQ043
+        tristate "SHARP LQ043 TFT LCD (BF548 EZKIT)"
+        depends on FB && (BF54x) && !BF542
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+         This is the framebuffer device driver for a SHARP LQ043T1DG01 TFT LCD
+config FB_BFIN_T350MCQB
+        tristate "Varitronix COG-T350MCQB TFT LCD display (BF527 EZKIT)"
+        depends on FB && BLACKFIN
+        select BFIN_GPTIMERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+         This is the framebuffer device driver for a Varitronix VL-PS-COG-T350MCQB-01 display TFT LCD
+         This display is a QVGA 320x240 24-bit RGB display interfaced by an 8-bit wide PPI
+         It uses PPI[0..7] PPI_FS1, PPI_FS2 and PPI_CLK.
+config FB_BFIN_LQ035Q1
+        tristate "SHARP LQ035Q1DH02 TFT LCD"
+        depends on FB && BLACKFIN && SPI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select BFIN_GPTIMERS
+        help
+          This is the framebuffer device driver for a SHARP LQ035Q1DH02 TFT display found on
+          the Blackfin Landscape LCD EZ-Extender Card.
+          This display is a QVGA 320x240 18-bit RGB display interfaced by an 16-bit wide PPI
+          It uses PPI[0..15] PPI_FS1, PPI_FS2 and PPI_CLK.
+          To compile this driver as a module, choose M here: the
+          module will be called bfin-lq035q1-fb.
+config FB_BF537_LQ035
+        tristate "SHARP LQ035 TFT LCD (BF537 STAMP)"
+        depends on FB && (BF534 || BF536 || BF537) && I2C_BLACKFIN_TWI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select BFIN_GPTIMERS
+        help
+          This is the framebuffer device for a SHARP LQ035Q7DB03 TFT LCD
+          attached to a BF537.
+          To compile this driver as a module, choose M here: the
+          module will be called bf537-lq035.
+config FB_BFIN_7393
+        tristate "Blackfin ADV7393 Video encoder"
+        depends on FB && BLACKFIN
+        select I2C
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the framebuffer device for a ADV7393 video encoder
+          attached to a Blackfin on the PPI port.
+          If your Blackfin board has a ADV7393 select Y.
+          To compile this driver as a module, choose M here: the
+          module will be called bfin_adv7393fb.
+choice
+        prompt  "Video mode support"
+        depends on FB_BFIN_7393
+        default NTSC
+config NTSC
+        bool 'NTSC 720x480'
+config PAL
+        bool 'PAL 720x576'
+config NTSC_640x480
+        bool 'NTSC 640x480 (Experimental)'
+config PAL_640x480
+        bool 'PAL 640x480 (Experimental)'
+config NTSC_YCBCR
+        bool 'NTSC 720x480 YCbCR input'
+config PAL_YCBCR
+        bool 'PAL 720x576 YCbCR input'
+endchoice
+choice
+        prompt  "Size of ADV7393 frame buffer memory Single/Double Size"
+        depends on (FB_BFIN_7393)
+        default ADV7393_1XMEM
+config ADV7393_1XMEM
+        bool 'Single'
+config ADV7393_2XMEM
+        bool 'Double'
+endchoice
+config FB_STI
+        tristate "HP STI frame buffer device support"
+        depends on FB && PARISC
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select STI_CONSOLE
+        select VT
+        default y
+        ---help---
+          STI refers to the HP "Standard Text Interface" which is a set of
+          BIOS routines contained in a ROM chip in HP PA-RISC based machines.
+          Enabling this option will implement the linux framebuffer device
+          using calls to the STI BIOS routines for initialisation.
+        
+          If you enable this option, you will get a planar framebuffer device
+          /dev/fb which will work on the most common HP graphic cards of the
+          NGLE family, including the artist chips (in the 7xx and Bxxx series),
+          HCRX, HCRX24, CRX, CRX24 and VisEG series.
+          It is safe to enable this option, so you should probably say "Y".
+config FB_MAC
+        bool "Generic Macintosh display support"
+        depends on (FB = y) && MAC
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MACMODES
+config FB_HP300
+        bool
+        depends on (FB = y) && DIO
+        select FB_CFB_IMAGEBLIT
+        default y
+config FB_TGA
+        tristate "TGA/SFB+ framebuffer support"
+        depends on FB && (ALPHA || TC)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select BITREVERSE
+        ---help---
+          This is the frame buffer device driver for generic TGA and SFB+
+          graphic cards.  These include DEC ZLXp-E1, -E2 and -E3 PCI cards,
+          also known as PBXGA-A, -B and -C, and DEC ZLX-E1, -E2 and -E3
+          TURBOchannel cards, also known as PMAGD-A, -B and -C.
+          Due to hardware limitations ZLX-E2 and E3 cards are not supported
+          for DECstation 5000/200 systems.  Additionally due to firmware
+          limitations these cards may cause troubles with booting DECstation
+          5000/240 and /260 systems, but are fully supported under Linux if
+          you manage to get it going. ;-)
+          Say Y if you have one of those.
+config FB_UVESA
+        tristate "Userspace VESA VGA graphics support"
+        depends on FB && CONNECTOR
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MODE_HELPERS
+        help
+          This is the frame buffer driver for generic VBE 2.0 compliant
+          graphic cards. It can also take advantage of VBE 3.0 features,
+          such as refresh rate adjustment.
+          This driver generally provides more features than vesafb but
+          requires a userspace helper application called 'v86d'. See
+          <file:Documentation/fb/uvesafb.txt> for more information.
+          If unsure, say N.
+config FB_VESA
+        bool "VESA VGA graphics support"
+        depends on (FB = y) && X86
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_BOOT_VESA_SUPPORT
+        help
+          This is the frame buffer device driver for generic VESA 2.0
+          compliant graphic cards. The older VESA 1.2 cards are not supported.
+          You will get a boot time penguin logo at no additional cost. Please
+          read <file:Documentation/fb/vesafb.txt>. If unsure, say Y.
+config FB_EFI
+        bool "EFI-based Framebuffer Support"
+        depends on (FB = y) && X86 && EFI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the EFI frame buffer device driver. If the firmware on
+          your platform is EFI 1.10 or UEFI 2.0, select Y to add support for
+          using the EFI framebuffer as your console.
+config FB_N411
+       tristate "N411 Apollo/Hecuba devkit support"
+       depends on FB && X86 && MMU
+       select FB_SYS_FILLRECT
+       select FB_SYS_COPYAREA
+       select FB_SYS_IMAGEBLIT
+       select FB_SYS_FOPS
+       select FB_DEFERRED_IO
+       select FB_HECUBA
+       help
+         This enables support for the Apollo display controller in its
+         Hecuba form using the n411 devkit.
+config FB_HGA
+        tristate "Hercules mono graphics support"
+        depends on FB && X86
+        help
+          Say Y here if you have a Hercules mono graphics card.
+          To compile this driver as a module, choose M here: the
+          module will be called hgafb.
+          As this card technology is at least 25 years old,
+          most people will answer N here.
+config FB_GBE
+        bool "SGI Graphics Backend frame buffer support"
+        depends on (FB = y) && SGI_IP32
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for SGI Graphics Backend.
+          This chip is used in SGI O2 and Visual Workstation 320/540.
+config FB_GBE_MEM
+        int "Video memory size in MB"
+        depends on FB_GBE
+        default 4
+        help
+          This is the amount of memory reserved for the framebuffer,
+          which can be any value between 1MB and 8MB.
+config FB_SBUS
+        bool "SBUS and UPA framebuffers"
+        depends on (FB = y) && SPARC
+        help
+          Say Y if you want support for SBUS or UPA based frame buffer device.
+config FB_BW2
+        bool "BWtwo support"
+        depends on (FB = y) && (SPARC && FB_SBUS)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the BWtwo frame buffer.
+config FB_CG3
+        bool "CGthree support"
+        depends on (FB = y) && (SPARC && FB_SBUS)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the CGthree frame buffer.
+config FB_CG6
+        bool "CGsix (GX,TurboGX) support"
+        depends on (FB = y) && (SPARC && FB_SBUS)
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the CGsix (GX, TurboGX)
+          frame buffer.
+config FB_FFB
+        bool "Creator/Creator3D/Elite3D support"
+        depends on FB_SBUS && SPARC64
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Creator, Creator3D,
+          and Elite3D graphics boards.
+config FB_TCX
+        bool "TCX (SS4/SS5 only) support"
+        depends on FB_SBUS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the TCX 24/8bit frame
+          buffer.
+config FB_CG14
+        bool "CGfourteen (SX) support"
+        depends on FB_SBUS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the CGfourteen frame
+          buffer on Desktop SPARCsystems with the SX graphics option.
+config FB_P9100
+        bool "P9100 (Sparcbook 3 only) support"
+        depends on FB_SBUS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the P9100 card
+          supported on Sparcbook 3 machines.
+config FB_LEO
+        bool "Leo (ZX) support"
+        depends on FB_SBUS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the SBUS-based Sun ZX
+          (leo) frame buffer cards.
+config FB_IGA
+        bool "IGA 168x display support"
+        depends on (FB = y) && SPARC32
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the framebuffer device for the INTERGRAPHICS 1680 and
+          successor frame buffer cards.
+config FB_XVR500
+        bool "Sun XVR-500 3DLABS Wildcat support"
+        depends on (FB = y) && PCI && SPARC64
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the framebuffer device for the Sun XVR-500 and similar
+          graphics cards based upon the 3DLABS Wildcat chipset.  The driver
+          only works on sparc64 systems where the system firmware has
+          mostly initialized the card already.  It is treated as a
+          completely dumb framebuffer device.
+config FB_XVR2500
+        bool "Sun XVR-2500 3DLABS Wildcat support"
+        depends on (FB = y) && PCI && SPARC64
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the framebuffer device for the Sun XVR-2500 and similar
+          graphics cards based upon the 3DLABS Wildcat chipset.  The driver
+          only works on sparc64 systems where the system firmware has
+          mostly initialized the card already.  It is treated as a
+          completely dumb framebuffer device.
+config FB_XVR1000
+        bool "Sun XVR-1000 support"
+        depends on (FB = y) && SPARC64
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the framebuffer device for the Sun XVR-1000 and similar
+          graphics cards.  The driver only works on sparc64 systems where
+          the system firmware has mostly initialized the card already.  It
+          is treated as a completely dumb framebuffer device.
+config FB_PVR2
+        tristate "NEC PowerVR 2 display support"
+        depends on FB && SH_DREAMCAST
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Say Y here if you have a PowerVR 2 card in your box.  If you plan to
+          run linux on your Dreamcast, you will have to say Y here.
+          This driver may or may not work on other PowerVR 2 cards, but is
+          totally untested.  Use at your own risk.  If unsure, say N.
+          To compile this driver as a module, choose M here: the
+          module will be called pvr2fb.
+          You can pass several parameters to the driver at boot time or at
+          module load time.  The parameters look like "video=pvr2:XXX", where
+          the meaning of XXX can be found at the end of the main source file
+          (<file:drivers/video/pvr2fb.c>). Please see the file
+          <file:Documentation/fb/pvr2fb.txt>.
+config FB_OPENCORES
+        tristate "OpenCores VGA/LCD core 2.0 framebuffer support"
+        depends on FB && HAS_DMA
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This enables support for the OpenCores VGA/LCD core.
+          The OpenCores VGA/LCD core is typically used together with
+          softcore CPUs (e.g. OpenRISC or Microblaze) or hard processor
+          systems (e.g. Altera socfpga or Xilinx Zynq) on FPGAs.
+          The source code and specification for the core is available at
+          <http://opencores.org/project,vga_lcd>
+config FB_S1D13XXX
+        tristate "Epson S1D13XXX framebuffer support"
+        depends on FB
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Support for S1D13XXX framebuffer device family (currently only
+          working with S1D13806). Product specs at
+          <http://vdc.epson.com/>
+config FB_ATMEL
+        tristate "AT91/AT32 LCD Controller support"
+        depends on FB && HAVE_FB_ATMEL
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MODE_HELPERS
+        select VIDEOMODE_HELPERS
+        help
+          This enables support for the AT91/AT32 LCD Controller.
+config FB_INTSRAM
+        bool "Frame Buffer in internal SRAM"
+        depends on FB_ATMEL && ARCH_AT91SAM9261
+        help
+          Say Y if you want to map Frame Buffer in internal SRAM. Say N if you want
+          to let frame buffer in external SDRAM.
+config FB_ATMEL_STN
+        bool "Use a STN display with AT91/AT32 LCD Controller"
+        depends on FB_ATMEL && (MACH_AT91SAM9261EK || MACH_AT91SAM9G10EK)
+        default n
+        help
+          Say Y if you want to connect a STN LCD display to the AT91/AT32 LCD
+          Controller. Say N if you want to connect a TFT.
+          If unsure, say N.
+config FB_NVIDIA
+        tristate "nVidia Framebuffer Support"
+        depends on FB && PCI
+        select FB_BACKLIGHT if FB_NVIDIA_BACKLIGHT
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select BITREVERSE
+        select VGASTATE
+        help
+          This driver supports graphics boards with the nVidia chips, TNT
+          and newer. For very old chipsets, such as the RIVA128, then use
+          the rivafb.
+          Say Y if you have such a graphics board.
+          To compile this driver as a module, choose M here: the
+          module will be called nvidiafb.
+config FB_NVIDIA_I2C
+       bool "Enable DDC Support"
+       depends on FB_NVIDIA
+       select FB_DDC
+       help
+          This enables I2C support for nVidia Chipsets.  This is used
+          only for getting EDID information from the attached display
+          allowing for robust video mode handling and switching.
+          Because fbdev-2.6 requires that drivers must be able to
+          independently validate video mode parameters, you should say Y
+          here.
+config FB_NVIDIA_DEBUG
+        bool "Lots of debug output"
+        depends on FB_NVIDIA
+        default n
+        help
+          Say Y here if you want the nVidia driver to output all sorts
+          of debugging information to provide to the maintainer when
+          something goes wrong.
+config FB_NVIDIA_BACKLIGHT
+        bool "Support for backlight control"
+        depends on FB_NVIDIA
+        default y
+        help
+          Say Y here if you want to control the backlight of your display.
+config FB_RIVA
+        tristate "nVidia Riva support"
+        depends on FB && PCI
+        select FB_BACKLIGHT if FB_RIVA_BACKLIGHT
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select BITREVERSE
+        select VGASTATE
+        help
+          This driver supports graphics boards with the nVidia Riva/Geforce
+          chips.
+          Say Y if you have such a graphics board.
+          To compile this driver as a module, choose M here: the
+          module will be called rivafb.
+config FB_RIVA_I2C
+       bool "Enable DDC Support"
+       depends on FB_RIVA
+       select FB_DDC
+       help
+          This enables I2C support for nVidia Chipsets.  This is used
+          only for getting EDID information from the attached display
+          allowing for robust video mode handling and switching.
+          Because fbdev-2.6 requires that drivers must be able to
+          independently validate video mode parameters, you should say Y
+          here.
+config FB_RIVA_DEBUG
+        bool "Lots of debug output"
+        depends on FB_RIVA
+        default n
+        help
+          Say Y here if you want the Riva driver to output all sorts
+          of debugging information to provide to the maintainer when
+          something goes wrong.
+config FB_RIVA_BACKLIGHT
+        bool "Support for backlight control"
+        depends on FB_RIVA
+        default y
+        help
+          Say Y here if you want to control the backlight of your display.
+config FB_I740
+        tristate "Intel740 support"
+        depends on FB && PCI
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select VGASTATE
+        select FB_DDC
+        help
+          This driver supports graphics cards based on Intel740 chip.
+config FB_I810
+        tristate "Intel 810/815 support"
+        depends on FB && PCI && X86_32 && AGP_INTEL
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select VGASTATE
+        help
+          This driver supports the on-board graphics built in to the Intel 810 
+          and 815 chipsets.  Say Y if you have and plan to use such a board.
+          To compile this driver as a module, choose M here: the
+          module will be called i810fb.
+          For more information, please read 
+          <file:Documentation/fb/intel810.txt>
+config FB_I810_GTF
+        bool "use VESA Generalized Timing Formula"
+        depends on FB_I810
+        help
+          If you say Y, then the VESA standard, Generalized Timing Formula 
+          or GTF, will be used to calculate the required video timing values
+          per video mode.  Since the GTF allows nondiscrete timings 
+          (nondiscrete being a range of values as opposed to discrete being a
+          set of values), you'll be able to use any combination of horizontal 
+          and vertical resolutions, and vertical refresh rates without having
+          to specify your own timing parameters.  This is especially useful
+          to maximize the performance of an aging display, or if you just 
+          have a display with nonstandard dimensions. A VESA compliant 
+          monitor is recommended, but can still work with non-compliant ones.
+          If you need or want this, then select this option. The timings may 
+          not be compliant with Intel's recommended values. Use at your own 
+          risk.
+          If you say N, the driver will revert to discrete video timings 
+          using a set recommended by Intel in their documentation.
+  
+          If unsure, say N.
+config FB_I810_I2C
+        bool "Enable DDC Support"
+        depends on FB_I810 && FB_I810_GTF
+        select FB_DDC
+        help
+config FB_LE80578
+        tristate "Intel LE80578 (Vermilion) support"
+        depends on FB && PCI && X86
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This driver supports the LE80578 (Vermilion Range) chipset
+config FB_CARILLO_RANCH
+        tristate "Intel Carillo Ranch support"
+        depends on FB_LE80578 && FB && PCI && X86
+        help
+          This driver supports the LE80578 (Carillo Ranch) board
+config FB_INTEL
+        tristate "Intel 830M/845G/852GM/855GM/865G/915G/945G/945GM/965G/965GM support"
+        depends on FB && PCI && X86 && AGP_INTEL && EXPERT
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_BOOT_VESA_SUPPORT if FB_INTEL = y
+        depends on !DRM_I915
+        help
+          This driver supports the on-board graphics built in to the Intel
+          830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
+          Say Y if you have and plan to use such a board.
+          To make FB_INTELFB=Y work you need to say AGP_INTEL=y too.
+          To compile this driver as a module, choose M here: the
+          module will be called intelfb.
+          For more information, please read <file:Documentation/fb/intelfb.txt>
+config FB_INTEL_DEBUG
+        bool "Intel driver Debug Messages"
+        depends on FB_INTEL
+        ---help---
+          Say Y here if you want the Intel driver to output all sorts
+          of debugging information to provide to the maintainer when
+          something goes wrong.
+config FB_INTEL_I2C
+        bool "DDC/I2C for Intel framebuffer support"
+        depends on FB_INTEL
+        select FB_DDC
+        default y
+        help
+          Say Y here if you want DDC/I2C support for your on-board Intel graphics.
+config FB_MATROX
+        tristate "Matrox acceleration"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_TILEBLITTING
+        select FB_MACMODES if PPC_PMAC
+        ---help---
+          Say Y here if you have a Matrox Millennium, Matrox Millennium II,
+          Matrox Mystique, Matrox Mystique 220, Matrox Productiva G100, Matrox
+          Mystique G200, Matrox Millennium G200, Matrox Marvel G200 video,
+          Matrox G400, G450 or G550 card in your box.
+          To compile this driver as a module, choose M here: the
+          module will be called matroxfb.
+          You can pass several parameters to the driver at boot time or at
+          module load time. The parameters look like "video=matroxfb:XXX", and
+          are described in <file:Documentation/fb/matroxfb.txt>.
+config FB_MATROX_MILLENIUM
+        bool "Millennium I/II support"
+        depends on FB_MATROX
+        help
+          Say Y here if you have a Matrox Millennium or Matrox Millennium II
+          video card. If you select "Advanced lowlevel driver options" below,
+          you should check 4 bpp packed pixel, 8 bpp packed pixel, 16 bpp
+          packed pixel, 24 bpp packed pixel and 32 bpp packed pixel. You can
+          also use font widths different from 8.
+config FB_MATROX_MYSTIQUE
+        bool "Mystique support"
+        depends on FB_MATROX
+        help
+          Say Y here if you have a Matrox Mystique or Matrox Mystique 220
+          video card. If you select "Advanced lowlevel driver options" below,
+          you should check 8 bpp packed pixel, 16 bpp packed pixel, 24 bpp
+          packed pixel and 32 bpp packed pixel. You can also use font widths
+          different from 8.
+config FB_MATROX_G
+        bool "G100/G200/G400/G450/G550 support"
+        depends on FB_MATROX
+        ---help---
+          Say Y here if you have a Matrox G100, G200, G400, G450 or G550 based
+          video card. If you select "Advanced lowlevel driver options", you
+          should check 8 bpp packed pixel, 16 bpp packed pixel, 24 bpp packed
+          pixel and 32 bpp packed pixel. You can also use font widths
+          different from 8.
+          If you need support for G400 secondary head, you must say Y to
+          "Matrox I2C support" and "G400 second head support" right below.
+          G450/G550 secondary head and digital output are supported without
+          additional modules.
+          The driver starts in monitor mode. You must use the matroxset tool 
+          (available at <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to 
+          swap primary and secondary head outputs, or to change output mode.  
+          Secondary head driver always start in 640x480 resolution and you 
+          must use fbset to change it.
+          Do not forget that second head supports only 16 and 32 bpp
+          packed pixels, so it is a good idea to compile them into the kernel
+          too. You can use only some font widths, as the driver uses generic
+          painting procedures (the secondary head does not use acceleration
+          engine).
+          G450/G550 hardware can display TV picture only from secondary CRTC,
+          and it performs no scaling, so picture must have 525 or 625 lines.
+config FB_MATROX_I2C
+        tristate "Matrox I2C support"
+        depends on FB_MATROX
+        select FB_DDC
+        ---help---
+          This drivers creates I2C buses which are needed for accessing the
+          DDC (I2C) bus present on all Matroxes, an I2C bus which
+          interconnects Matrox optional devices, like MGA-TVO on G200 and
+          G400, and the secondary head DDC bus, present on G400 only.
+          You can say Y or M here if you want to experiment with monitor
+          detection code. You must say Y or M here if you want to use either
+          second head of G400 or MGA-TVO on G200 or G400.
+          If you compile it as module, it will create a module named
+          i2c-matroxfb.
+config FB_MATROX_MAVEN
+        tristate "G400 second head support"
+        depends on FB_MATROX_G && FB_MATROX_I2C
+        ---help---
+          WARNING !!! This support does not work with G450 !!!
+          Say Y or M here if you want to use a secondary head (meaning two
+          monitors in parallel) on G400 or MGA-TVO add-on on G200. Secondary
+          head is not compatible with accelerated XFree 3.3.x SVGA servers -
+          secondary head output is blanked while you are in X. With XFree
+          3.9.17 preview you can use both heads if you use SVGA over fbdev or
+          the fbdev driver on first head and the fbdev driver on second head.
+          If you compile it as module, two modules are created,
+          matroxfb_crtc2 and matroxfb_maven. Matroxfb_maven is needed for
+          both G200 and G400, matroxfb_crtc2 is needed only by G400. You must
+          also load i2c-matroxfb to get it to run.
+          The driver starts in monitor mode and you must use the matroxset
+          tool (available at
+          <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to switch it to
+          PAL or NTSC or to swap primary and secondary head outputs.
+          Secondary head driver also always start in 640x480 resolution, you
+          must use fbset to change it.
+          Also do not forget that second head supports only 16 and 32 bpp
+          packed pixels, so it is a good idea to compile them into the kernel
+          too.  You can use only some font widths, as the driver uses generic
+          painting procedures (the secondary head does not use acceleration
+          engine).
+config FB_RADEON
+        tristate "ATI Radeon display support"
+        depends on FB && PCI
+        select FB_BACKLIGHT if FB_RADEON_BACKLIGHT
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MACMODES if PPC_OF
+        help
+          Choose this option if you want to use an ATI Radeon graphics card as
+          a framebuffer device.  There are both PCI and AGP versions.  You
+          don't need to choose this to run the Radeon in plain VGA mode.
+          There is a product page at
+          http://products.amd.com/en-us/GraphicCardResult.aspx
+config FB_RADEON_I2C
+        bool "DDC/I2C for ATI Radeon support"
+        depends on FB_RADEON
+        select FB_DDC
+        default y
+        help
+          Say Y here if you want DDC/I2C support for your Radeon board. 
+config FB_RADEON_BACKLIGHT
+        bool "Support for backlight control"
+        depends on FB_RADEON
+        default y
+        help
+          Say Y here if you want to control the backlight of your display.
+config FB_RADEON_DEBUG
+        bool "Lots of debug output from Radeon driver"
+        depends on FB_RADEON
+        default n
+        help
+          Say Y here if you want the Radeon driver to output all sorts
+          of debugging information to provide to the maintainer when
+          something goes wrong.
+config FB_ATY128
+        tristate "ATI Rage128 display support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_BACKLIGHT if FB_ATY128_BACKLIGHT
+        select FB_MACMODES if PPC_PMAC
+        help
+          This driver supports graphics boards with the ATI Rage128 chips.
+          Say Y if you have such a graphics board and read
+          <file:Documentation/fb/aty128fb.txt>.
+          To compile this driver as a module, choose M here: the
+          module will be called aty128fb.
+config FB_ATY128_BACKLIGHT
+        bool "Support for backlight control"
+        depends on FB_ATY128
+        default y
+        help
+          Say Y here if you want to control the backlight of your display.
+config FB_ATY
+        tristate "ATI Mach64 display support" if PCI || ATARI
+        depends on FB && !SPARC32
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_BACKLIGHT if FB_ATY_BACKLIGHT
+        select FB_MACMODES if PPC
+        help
+          This driver supports graphics boards with the ATI Mach64 chips.
+          Say Y if you have such a graphics board.
+          To compile this driver as a module, choose M here: the
+          module will be called atyfb.
+config FB_ATY_CT
+        bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
+        depends on PCI && FB_ATY
+        default y if SPARC64 && PCI
+        help
+          Say Y here to support use of ATI's 64-bit Rage boards (or other
+          boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
+          framebuffer device.  The ATI product support page for these boards
+          is at <http://support.ati.com/products/pc/mach64/mach64.html>.
+config FB_ATY_GENERIC_LCD
+        bool "Mach64 generic LCD support"
+        depends on FB_ATY_CT
+        help
+          Say Y if you have a laptop with an ATI Rage LT PRO, Rage Mobility,
+          Rage XC, or Rage XL chipset.
+config FB_ATY_GX
+        bool "Mach64 GX support" if PCI
+        depends on FB_ATY
+        default y if ATARI
+        help
+          Say Y here to support use of the ATI Mach64 Graphics Expression
+          board (or other boards based on the Mach64 GX chipset) as a
+          framebuffer device.  The ATI product support page for these boards
+          is at
+          <http://support.ati.com/products/pc/mach64/graphics_xpression.html>.
+config FB_ATY_BACKLIGHT
+        bool "Support for backlight control"
+        depends on FB_ATY
+        default y
+        help
+          Say Y here if you want to control the backlight of your display.
+config FB_S3
+        tristate "S3 Trio/Virge support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_TILEBLITTING
+        select FB_SVGALIB
+        select VGASTATE
+        select FONT_8x16 if FRAMEBUFFER_CONSOLE
+        ---help---
+          Driver for graphics boards with S3 Trio / S3 Virge chip.
+config FB_S3_DDC
+        bool "DDC for S3 support"
+        depends on FB_S3
+        select FB_DDC
+        default y
+        help
+          Say Y here if you want DDC support for your S3 graphics card.
+config FB_SAVAGE
+        tristate "S3 Savage support"
+        depends on FB && PCI
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select VGASTATE
+        help
+          This driver supports notebooks and computers with S3 Savage PCI/AGP
+          chips.
+          Say Y if you have such a graphics card.
+          To compile this driver as a module, choose M here; the module
+          will be called savagefb.
+config FB_SAVAGE_I2C
+       bool "Enable DDC2 Support"
+       depends on FB_SAVAGE
+       select FB_DDC
+       help
+          This enables I2C support for S3 Savage Chipsets.  This is used
+          only for getting EDID information from the attached display
+          allowing for robust video mode handling and switching.
+          Because fbdev-2.6 requires that drivers must be able to
+          independently validate video mode parameters, you should say Y
+          here.
+config FB_SAVAGE_ACCEL
+       bool "Enable Console Acceleration"
+       depends on FB_SAVAGE
+       default n
+       help
+          This option will compile in console acceleration support. If
+          the resulting framebuffer console has bothersome glitches, then
+          choose N here.
+config FB_SIS
+        tristate "SiS/XGI display support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_BOOT_VESA_SUPPORT if FB_SIS = y
+        help
+          This is the frame buffer device driver for the SiS 300, 315, 330
+          and 340 series as well as XGI V3XT, V5, V8, Z7 graphics chipsets.
+          Specs available at <http://www.sis.com> and <http://www.xgitech.com>.
+          To compile this driver as a module, choose M here; the module
+          will be called sisfb.
+config FB_SIS_300
+        bool "SiS 300 series support"
+        depends on FB_SIS
+        help
+          Say Y here to support use of the SiS 300/305, 540, 630 and 730.
+config FB_SIS_315
+        bool "SiS 315/330/340 series and XGI support"
+        depends on FB_SIS
+        help
+          Say Y here to support use of the SiS 315, 330 and 340 series
+          (315/H/PRO, 55x, 650, 651, 740, 330, 661, 741, 760, 761) as well
+          as XGI V3XT, V5, V8 and Z7.
+config FB_VIA
+       tristate "VIA UniChrome (Pro) and Chrome9 display support"
+       depends on FB && PCI && X86
+       select FB_CFB_FILLRECT
+       select FB_CFB_COPYAREA
+       select FB_CFB_IMAGEBLIT
+       select I2C_ALGOBIT
+       select I2C
+       select GPIOLIB
+       help
+          This is the frame buffer device driver for Graphics chips of VIA
+          UniChrome (Pro) Family (CLE266,PM800/CN400,P4M800CE/P4M800Pro/
+          CN700/VN800,CX700/VX700,P4M890) and Chrome9 Family (K8M890,CN896
+          /P4M900,VX800)
+          Say Y if you have a VIA UniChrome graphics board.
+          To compile this driver as a module, choose M here: the
+          module will be called viafb.
+if FB_VIA
+config FB_VIA_DIRECT_PROCFS
+        bool "direct hardware access via procfs (DEPRECATED)(DANGEROUS)"
+        depends on FB_VIA
+        default n
+        help
+          Allow direct hardware access to some output registers via procfs.
+          This is dangerous but may provide the only chance to get the
+          correct output device configuration.
+          Its use is strongly discouraged.
+config FB_VIA_X_COMPATIBILITY
+        bool "X server compatibility"
+        depends on FB_VIA
+        default n
+        help
+          This option reduces the functionality (power saving, ...) of the
+          framebuffer to avoid negative impact on the OpenChrome X server.
+          If you use any X server other than fbdev you should enable this
+          otherwise it should be safe to disable it and allow using all
+          features.
+endif
+config FB_NEOMAGIC
+        tristate "NeoMagic display support"
+        depends on FB && PCI
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select VGASTATE
+        help
+          This driver supports notebooks with NeoMagic PCI chips.
+          Say Y if you have such a graphics card. 
+          To compile this driver as a module, choose M here: the
+          module will be called neofb.
+config FB_KYRO
+        tristate "IMG Kyro support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Say Y here if you have a STG4000 / Kyro / PowerVR 3 based
+          graphics board.
+          To compile this driver as a module, choose M here: the
+          module will be called kyrofb.
+config FB_3DFX
+        tristate "3Dfx Banshee/Voodoo3/Voodoo5 display support"
+        depends on FB && PCI
+        select FB_CFB_IMAGEBLIT
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_MODE_HELPERS
+        help
+          This driver supports graphics boards with the 3Dfx Banshee,
+          Voodoo3 or VSA-100 (aka Voodoo4/5) chips. Say Y if you have
+          such a graphics board.
+          To compile this driver as a module, choose M here: the
+          module will be called tdfxfb.
+config FB_3DFX_ACCEL
+        bool "3Dfx Acceleration functions"
+        depends on FB_3DFX
+        ---help---
+        This will compile the 3Dfx Banshee/Voodoo3/VSA-100 frame buffer
+        device driver with acceleration functions.
+config FB_3DFX_I2C
+        bool "Enable DDC/I2C support"
+        depends on FB_3DFX
+        select FB_DDC
+        default y
+        help
+          Say Y here if you want DDC/I2C support for your 3dfx Voodoo3.
+config FB_VOODOO1
+        tristate "3Dfx Voodoo Graphics (sst1) support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Say Y here if you have a 3Dfx Voodoo Graphics (Voodoo1/sst1) or 
+          Voodoo2 (cvg) based graphics card.
+          To compile this driver as a module, choose M here: the
+          module will be called sstfb.
+          WARNING: Do not use any application that uses the 3D engine
+          (namely glide) while using this driver.
+          Please read the <file:Documentation/fb/sstfb.txt> for supported
+          options and other important info  support.
+config FB_VT8623
+        tristate "VIA VT8623 support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_TILEBLITTING
+        select FB_SVGALIB
+        select VGASTATE
+        select FONT_8x16 if FRAMEBUFFER_CONSOLE
+        ---help---
+          Driver for CastleRock integrated graphics core in the
+          VIA VT8623 [Apollo CLE266] chipset.
+config FB_TRIDENT
+        tristate "Trident/CyberXXX/CyberBlade support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          This is the frame buffer device driver for Trident PCI/AGP chipsets.
+          Supported chipset families are TGUI 9440/96XX, 3DImage, Blade3D
+          and Blade XP.
+          There are also integrated versions of these chips called CyberXXXX,
+          CyberImage or CyberBlade. These chips are mostly found in laptops
+          but also on some motherboards including early VIA EPIA motherboards.
+          For more information, read <file:Documentation/fb/tridentfb.txt>
+          Say Y if you have such a graphics board.
+          To compile this driver as a module, choose M here: the
+          module will be called tridentfb.
+config FB_ARK
+        tristate "ARK 2000PV support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_TILEBLITTING
+        select FB_SVGALIB
+        select VGASTATE
+        select FONT_8x16 if FRAMEBUFFER_CONSOLE
+        ---help---
+          Driver for PCI graphics boards with ARK 2000PV chip
+          and ICS 5342 RAMDAC.
+config FB_PM3
+        tristate "Permedia3 support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the 3DLabs Permedia3
+          chipset, used in Formac ProFormance III, 3DLabs Oxygen VX1 &
+          similar boards, 3DLabs Permedia3 Create!, Appian Jeronimo 2000
+          and maybe other boards.
+config FB_CARMINE
+        tristate "Fujitsu carmine frame buffer support"
+        depends on FB && PCI
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Fujitsu Carmine chip.
+          The driver provides two independent frame buffer devices.
+choice
+        depends on FB_CARMINE
+        prompt "DRAM timing"
+        default FB_CARMINE_DRAM_EVAL
+config FB_CARMINE_DRAM_EVAL
+        bool "Eval board timings"
+        help
+          Use timings which work on the eval card.
+config CARMINE_DRAM_CUSTOM
+        bool "Custom board timings"
+        help
+          Use custom board timings.
+endchoice
+config FB_AU1100
+        bool "Au1100 LCD Driver"
+        depends on (FB = y) && MIPS_ALCHEMY
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the framebuffer driver for the AMD Au1100 SOC.  It can drive
+          various panels and CRTs by passing in kernel cmd line option
+          au1100fb:panel=<name>.
+config FB_AU1200
+        bool "Au1200/Au1300 LCD Driver"
+        depends on (FB = y) && MIPS_ALCHEMY
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        help
+          This is the framebuffer driver for the Au1200/Au1300 SOCs.
+          It can drive various panels and CRTs by passing in kernel cmd line
+          option au1200fb:panel=<name>.
+config FB_VT8500
+        bool "VIA VT8500 framebuffer support"
+        depends on (FB = y) && ARM && ARCH_VT8500
+        select FB_SYS_FILLRECT if (!FB_WMT_GE_ROPS)
+        select FB_SYS_COPYAREA if (!FB_WMT_GE_ROPS)
+        select FB_SYS_IMAGEBLIT
+        select FB_MODE_HELPERS
+        select VIDEOMODE_HELPERS
+        help
+          This is the framebuffer driver for VIA VT8500 integrated LCD
+          controller.
+config FB_WM8505
+        bool "Wondermedia WM8xxx-series frame buffer support"
+        depends on (FB = y) && ARM && ARCH_VT8500
+        select FB_SYS_FILLRECT if (!FB_WMT_GE_ROPS)
+        select FB_SYS_COPYAREA if (!FB_WMT_GE_ROPS)
+        select FB_SYS_IMAGEBLIT
+        select FB_MODE_HELPERS
+        select VIDEOMODE_HELPERS
+        help
+          This is the framebuffer driver for WonderMedia WM8xxx-series
+          integrated LCD controller. This driver covers the WM8505, WM8650
+          and WM8850 SoCs.
+config FB_WMT_GE_ROPS
+        bool "VT8500/WM8xxx accelerated raster ops support"
+        depends on (FB = y) && (FB_VT8500 || FB_WM8505)
+        default n
+        help
+          This adds support for accelerated raster operations on the
+          VIA VT8500 and Wondermedia 85xx series SoCs.
+source "drivers/video/fbdev/geode/Kconfig"
+config FB_HIT
+        tristate "HD64461 Frame Buffer support"
+        depends on FB && HD64461
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Hitachi HD64461 LCD
+          frame buffer card.
+config FB_PMAG_AA
+        bool "PMAG-AA TURBOchannel framebuffer support"
+        depends on (FB = y) && TC
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Support for the PMAG-AA TURBOchannel framebuffer card (1280x1024x1)
+          used mainly in the MIPS-based DECstation series.
+config FB_PMAG_BA
+        tristate "PMAG-BA TURBOchannel framebuffer support"
+        depends on FB && TC
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Support for the PMAG-BA TURBOchannel framebuffer card (1024x864x8)
+          used mainly in the MIPS-based DECstation series.
+config FB_PMAGB_B
+        tristate "PMAGB-B TURBOchannel framebuffer support"
+        depends on FB && TC
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Support for the PMAGB-B TURBOchannel framebuffer card used mainly
+          in the MIPS-based DECstation series. The card is currently only
+          supported in 1280x1024x8 mode.
+config FB_MAXINE
+        bool "Maxine (Personal DECstation) onboard framebuffer support"
+        depends on (FB = y) && MACH_DECSTATION
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Support for the onboard framebuffer (1024x768x8) in the Personal
+          DECstation series (Personal DECstation 5000/20, /25, /33, /50,
+          Codename "Maxine").
+config FB_G364
+        bool "G364 frame buffer support"
+        depends on (FB = y) && (MIPS_MAGNUM_4000 || OLIVETTI_M700)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          The G364 driver is the framebuffer used in MIPS Magnum 4000 and
+          Olivetti M700-10 systems.
+config FB_68328
+        bool "Motorola 68328 native frame buffer support"
+        depends on (FB = y) && (M68328 || M68EZ328 || M68VZ328)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Say Y here if you want to support the built-in frame buffer of
+          the Motorola 68328 CPU family.
+config FB_PXA168
+        tristate "PXA168/910 LCD framebuffer support"
+        depends on FB && (CPU_PXA168 || CPU_PXA910)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the built-in LCD controller in the Marvell
+          MMP processor.
+config FB_PXA
+        tristate "PXA LCD framebuffer support"
+        depends on FB && ARCH_PXA
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the built-in LCD controller in the Intel
+          PXA2x0 processor.
+          This driver is also available as a module ( = code which can be
+          inserted and removed from the running kernel whenever you want). The
+          module will be called pxafb. If you want to compile it as a module,
+          say M here and read <file:Documentation/kbuild/modules.txt>.
+          If unsure, say N.
+config FB_PXA_OVERLAY
+        bool "Support PXA27x/PXA3xx Overlay(s) as framebuffer"
+        default n
+        depends on FB_PXA && (PXA27x || PXA3xx)
+config FB_PXA_SMARTPANEL
+        bool "PXA Smartpanel LCD support"
+        default n
+        depends on FB_PXA
+config FB_PXA_PARAMETERS
+        bool "PXA LCD command line parameters"
+        default n
+        depends on FB_PXA
+        ---help---
+          Enable the use of kernel command line or module parameters
+          to configure the physical properties of the LCD panel when
+          using the PXA LCD driver.
+          This option allows you to override the panel parameters
+          supplied by the platform in order to support multiple
+          different models of flatpanel. If you will only be using a
+          single model of flatpanel then you can safely leave this
+          option disabled.
+          <file:Documentation/fb/pxafb.txt> describes the available parameters.
+config PXA3XX_GCU
+        tristate "PXA3xx 2D graphics accelerator driver"
+        depends on FB_PXA
+        help
+          Kernelspace driver for the 2D graphics controller unit (GCU)
+          found on PXA3xx processors. There is a counterpart driver in the
+          DirectFB suite, see http://www.directfb.org/
+          If you compile this as a module, it will be called pxa3xx_gcu.
+config FB_MBX
+        tristate "2700G LCD framebuffer support"
+        depends on FB && ARCH_PXA
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Framebuffer driver for the Intel 2700G (Marathon) Graphics
+          Accelerator
+config FB_MBX_DEBUG
+       bool "Enable debugging info via debugfs"
+       depends on FB_MBX && DEBUG_FS
+       default n
+       ---help---
+         Enable this if you want debugging information using the debug
+         filesystem (debugfs)
+         If unsure, say N.
+config FB_FSL_DIU
+        tristate "Freescale DIU framebuffer support"
+        depends on FB && FSL_SOC
+        select FB_MODE_HELPERS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select PPC_LIB_RHEAP
+        ---help---
+          Framebuffer driver for the Freescale SoC DIU
+config FB_W100
+        tristate "W100 frame buffer support"
+        depends on FB && ARCH_PXA
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the w100 as found on the Sharp SL-Cxx series.
+          It can also drive the w3220 chip found on iPAQ hx4700.
+          This driver is also available as a module ( = code which can be
+          inserted and removed from the running kernel whenever you want). The
+          module will be called w100fb. If you want to compile it as a module,
+          say M here and read <file:Documentation/kbuild/modules.txt>.
+          If unsure, say N.
+config FB_SH_MOBILE_LCDC
+        tristate "SuperH Mobile LCDC framebuffer support"
+        depends on FB && (SUPERH || ARCH_SHMOBILE) && HAVE_CLK
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        select FB_BACKLIGHT
+        select SH_MIPI_DSI if SH_LCD_MIPI_DSI
+        ---help---
+          Frame buffer driver for the on-chip SH-Mobile LCD controller.
+config FB_SH_MOBILE_HDMI
+        tristate "SuperH Mobile HDMI controller support"
+        depends on FB_SH_MOBILE_LCDC
+        select FB_MODE_HELPERS
+        select SOUND
+        select SND
+        select SND_SOC
+        ---help---
+          Driver for the on-chip SH-Mobile HDMI controller.
+config FB_TMIO
+        tristate "Toshiba Mobile IO FrameBuffer support"
+        depends on FB && MFD_CORE
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the Toshiba Mobile IO integrated as found
+          on the Sharp SL-6000 series
+          This driver is also available as a module ( = code which can be
+          inserted and removed from the running kernel whenever you want). The
+          module will be called tmiofb. If you want to compile it as a module,
+          say M here and read <file:Documentation/kbuild/modules.txt>.
+          If unsure, say N.
+config FB_TMIO_ACCELL
+        bool "tmiofb acceleration"
+        depends on FB_TMIO
+        default y
+config FB_S3C
+        tristate "Samsung S3C framebuffer support"
+        depends on FB && (CPU_S3C2416 || ARCH_S3C64XX || ARCH_S5P64X0 || \
+                ARCH_S5PC100 || ARCH_S5PV210 || ARCH_EXYNOS)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the built-in FB controller in the Samsung
+          SoC line from the S3C2443 onwards, including the S3C2416, S3C2450,
+          and the S3C64XX series such as the S3C6400 and S3C6410.
+          These chips all have the same basic framebuffer design with the
+          actual capabilities depending on the chip. For instance the S3C6400
+          and S3C6410 support 4 hardware windows whereas the S3C24XX series
+          currently only have two.
+          Currently the support is only for the S3C6400 and S3C6410 SoCs.
+config FB_S3C_DEBUG_REGWRITE
+       bool "Debug register writes"
+       depends on FB_S3C
+       ---help---
+         Show all register writes via pr_debug()
+config FB_S3C2410
+        tristate "S3C2410 LCD framebuffer support"
+        depends on FB && ARCH_S3C24XX
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the built-in LCD controller in the Samsung
+          S3C2410 processor.
+          This driver is also available as a module ( = code which can be
+          inserted and removed from the running kernel whenever you want). The
+          module will be called s3c2410fb. If you want to compile it as a module,
+          say M here and read <file:Documentation/kbuild/modules.txt>.
+          If unsure, say N.
+config FB_S3C2410_DEBUG
+        bool "S3C2410 lcd debug messages"
+        depends on FB_S3C2410
+        help
+          Turn on debugging messages. Note that you can set/unset at run time
+          through sysfs
+config FB_NUC900
+        bool "NUC900 LCD framebuffer support"
+        depends on FB && ARCH_W90X900
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the built-in LCD controller in the Nuvoton
+          NUC900 processor
+config GPM1040A0_320X240
+        bool "Giantplus Technology GPM1040A0 320x240 Color TFT LCD"
+        depends on FB_NUC900
+config FB_SM501
+        tristate "Silicon Motion SM501 framebuffer support"
+        depends on FB && MFD_SM501
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for the CRT and LCD controllers in the Silicon
+          Motion SM501.
+          This driver is also available as a module ( = code which can be
+          inserted and removed from the running kernel whenever you want). The
+          module will be called sm501fb. If you want to compile it as a module,
+          say M here and read <file:Documentation/kbuild/modules.txt>.
+          If unsure, say N.
+config FB_SMSCUFX
+        tristate "SMSC UFX6000/7000 USB Framebuffer support"
+        depends on FB && USB
+        select FB_MODE_HELPERS
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        ---help---
+          This is a kernel framebuffer driver for SMSC UFX USB devices.
+          Supports fbdev clients like xf86-video-fbdev, kdrive, fbi, and
+          mplayer -vo fbdev. Supports both UFX6000 (USB 2.0) and UFX7000
+          (USB 3.0) devices.
+          To compile as a module, choose M here: the module name is smscufx.
+config FB_UDL
+        tristate "Displaylink USB Framebuffer support"
+        depends on FB && USB
+        select FB_MODE_HELPERS
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        ---help---
+          This is a kernel framebuffer driver for DisplayLink USB devices.
+          Supports fbdev clients like xf86-video-fbdev, kdrive, fbi, and
+          mplayer -vo fbdev. Supports all USB 2.0 era DisplayLink devices.
+          To compile as a module, choose M here: the module name is udlfb.
+config FB_IBM_GXT4500
+        tristate "Framebuffer support for IBM GXT4000P/4500P/6000P/6500P adaptors"
+        depends on FB && PPC
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Say Y here to enable support for the IBM GXT4000P/6000P and
+          GXT4500P/6500P display adaptor based on Raster Engine RC1000,
+          found on some IBM System P (pSeries) machines. This driver
+          doesn't use Geometry Engine GT1000.
+config FB_PS3
+        tristate "PS3 GPU framebuffer driver"
+        depends on FB && PS3_PS3AV
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select VT_HW_CONSOLE_BINDING if FRAMEBUFFER_CONSOLE
+        ---help---
+          Include support for the virtual frame buffer in the PS3 platform.
+config FB_PS3_DEFAULT_SIZE_M
+        int "PS3 default frame buffer size (in MiB)"
+        depends on FB_PS3
+        default 9
+        ---help---
+          This is the default size (in MiB) of the virtual frame buffer in
+          the PS3.
+          The default value can be overridden on the kernel command line
+          using the "ps3fb" option (e.g. "ps3fb=9M");
+config FB_XILINX
+        tristate "Xilinx frame buffer support"
+        depends on FB && (XILINX_VIRTEX || MICROBLAZE || ARCH_ZYNQ)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Include support for the Xilinx ML300/ML403 reference design
+          framebuffer. ML300 carries a 640*480 LCD display on the board,
+          ML403 uses a standard DB15 VGA connector.
+config FB_GOLDFISH
+        tristate "Goldfish Framebuffer"
+        depends on FB && HAS_DMA
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Framebuffer driver for Goldfish Virtual Platform
+config FB_COBALT
+        tristate "Cobalt server LCD frame buffer support"
+        depends on FB && (MIPS_COBALT || MIPS_SEAD3)
+config FB_SH7760
+        bool "SH7760/SH7763/SH7720/SH7721 LCDC support"
+        depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
+                || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Support for the SH7760/SH7763/SH7720/SH7721 integrated
+          (D)STN/TFT LCD Controller.
+          Supports display resolutions up to 1024x1024 pixel, grayscale and
+          color operation, with depths ranging from 1 bpp to 8 bpp monochrome
+          and 8, 15 or 16 bpp color; 90 degrees clockwise display rotation for
+          panels <= 320 pixel horizontal resolution.
+config FB_DA8XX
+        tristate "DA8xx/OMAP-L1xx/AM335x Framebuffer support"
+        depends on FB && (ARCH_DAVINCI_DA8XX || SOC_AM33XX)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_CFB_REV_PIXELS_IN_BYTE
+        select FB_MODE_HELPERS
+        select VIDEOMODE_HELPERS
+        ---help---
+          This is the frame buffer device driver for the TI LCD controller
+          found on DA8xx/OMAP-L1xx/AM335x SoCs.
+          If unsure, say N.
+config FB_VIRTUAL
+        tristate "Virtual Frame Buffer support (ONLY FOR TESTING!)"
+        depends on FB
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        ---help---
+          This is a `virtual' frame buffer device. It operates on a chunk of
+          unswappable kernel memory instead of on the memory of a graphics
+          board. This means you cannot see any output sent to this frame
+          buffer device, while it does consume precious memory. The main use
+          of this frame buffer device is testing and debugging the frame
+          buffer subsystem. Do NOT enable it for normal systems! To protect
+          the innocent, it has to be enabled explicitly at boot time using the
+          kernel option `video=vfb:'.
+          To compile this driver as a module, choose M here: the
+          module will be called vfb. In order to load it, you must use
+          the vfb_enable=1 option.
+          If unsure, say N.
+config XEN_FBDEV_FRONTEND
+        tristate "Xen virtual frame buffer support"
+        depends on FB && XEN
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        select INPUT_XEN_KBDDEV_FRONTEND if INPUT_MISC
+        select XEN_XENBUS_FRONTEND
+        default y
+        help
+          This driver implements the front-end of the Xen virtual
+          frame buffer driver.  It communicates with a back-end
+          in another domain.
+config FB_METRONOME
+        tristate "E-Ink Metronome/8track controller support"
+        depends on FB
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        help
+          This driver implements support for the E-Ink Metronome
+          controller. The pre-release name for this device was 8track
+          and could also have been called by some vendors as PVI-nnnn.
+config FB_MB862XX
+        tristate "Fujitsu MB862xx GDC support"
+        depends on FB
+        depends on PCI || (OF && PPC)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Frame buffer driver for Fujitsu Carmine/Coral-P(A)/Lime controllers.
+choice
+        prompt "GDC variant"
+        depends on FB_MB862XX
+config FB_MB862XX_PCI_GDC
+        bool "Carmine/Coral-P(A) GDC"
+        depends on PCI
+        ---help---
+          This enables framebuffer support for Fujitsu Carmine/Coral-P(A)
+          PCI graphics controller devices.
+config FB_MB862XX_LIME
+        bool "Lime GDC"
+        depends on OF && PPC
+        select FB_FOREIGN_ENDIAN
+        select FB_LITTLE_ENDIAN
+        ---help---
+          Framebuffer support for Fujitsu Lime GDC on host CPU bus.
+endchoice
+config FB_MB862XX_I2C
+        bool "Support I2C bus on MB862XX GDC"
+        depends on FB_MB862XX && I2C
+        default y
+        help
+          Selecting this option adds Coral-P(A)/Lime GDC I2C bus adapter
+          driver to support accessing I2C devices on controller's I2C bus.
+          These are usually some video decoder chips.
+config FB_EP93XX
+        tristate "EP93XX frame buffer support"
+        depends on FB && ARCH_EP93XX
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        ---help---
+          Framebuffer driver for the Cirrus Logic EP93XX series of processors.
+          This driver is also available as a module. The module will be called
+          ep93xx-fb.
+config FB_PRE_INIT_FB
+        bool "Don't reinitialize, use bootloader's GDC/Display configuration"
+        depends on FB && FB_MB862XX_LIME
+        ---help---
+          Select this option if display contents should be inherited as set by
+          the bootloader.
+config FB_MSM
+        tristate "MSM Framebuffer support"
+        depends on FB && ARCH_MSM
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+config FB_MX3
+        tristate "MX3 Framebuffer support"
+        depends on FB && MX3_IPU
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        default y
+        help
+          This is a framebuffer device for the i.MX31 LCD Controller. So
+          far only synchronous displays are supported. If you plan to use
+          an LCD display with your i.MX31 system, say Y here.
+config FB_BROADSHEET
+        tristate "E-Ink Broadsheet/Epson S1D13521 controller support"
+        depends on FB
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        help
+          This driver implements support for the E-Ink Broadsheet
+          controller. The release name for this device was Epson S1D13521
+          and could also have been called by other names when coupled with
+          a bridge adapter.
+config FB_AUO_K190X
+        tristate "AUO-K190X EPD controller support"
+        depends on FB
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        help
+          Provides support for epaper controllers from the K190X series
+          of AUO. These controllers can be used to drive epaper displays
+          from Sipix.
+          This option enables the common support, shared by the individual
+          controller drivers. You will also have to enable the driver
+          for the controller type used in your device.
+config FB_AUO_K1900
+        tristate "AUO-K1900 EPD controller support"
+        depends on FB && FB_AUO_K190X
+        help
+          This driver implements support for the AUO K1900 epd-controller.
+          This controller can drive Sipix epaper displays but can only do
+          serial updates, reducing the number of possible frames per second.
+config FB_AUO_K1901
+        tristate "AUO-K1901 EPD controller support"
+        depends on FB && FB_AUO_K190X
+        help
+          This driver implements support for the AUO K1901 epd-controller.
+          This controller can drive Sipix epaper displays and supports
+          concurrent updates, making higher frames per second possible.
+config FB_JZ4740
+        tristate "JZ4740 LCD framebuffer support"
+        depends on FB && MACH_JZ4740
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        help
+          Framebuffer support for the JZ4740 SoC.
+config FB_MXS
+        tristate "MXS LCD framebuffer support"
+        depends on FB && ARCH_MXS
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_MODE_HELPERS
+        select VIDEOMODE_HELPERS
+        help
+          Framebuffer support for the MXS SoC.
+config FB_PUV3_UNIGFX
+        tristate "PKUnity v3 Unigfx framebuffer support"
+        depends on FB && UNICORE32 && ARCH_PUV3
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        help
+          Choose this option if you want to use the Unigfx device as a
+          framebuffer device. Without the support of PCI & AGP.
+config FB_HYPERV
+        tristate "Microsoft Hyper-V Synthetic Video support"
+        depends on FB && HYPERV
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          This framebuffer driver supports Microsoft Hyper-V Synthetic Video.
+config FB_SIMPLE
+        bool "Simple framebuffer support"
+        depends on (FB = y)
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Say Y if you want support for a simple frame-buffer.
+          This driver assumes that the display hardware has been initialized
+          before the kernel boots, and the kernel will simply render to the
+          pre-allocated frame buffer surface.
+          Configuration re: surface address, size, and format must be provided
+          through device tree, or plain old platform data.
+source "drivers/video/fbdev/omap/Kconfig"
+source "drivers/video/fbdev/omap2/Kconfig"
+source "drivers/video/fbdev/exynos/Kconfig"
+source "drivers/video/fbdev/mmp/Kconfig"
+config FB_SH_MOBILE_MERAM
+        tristate "SuperH Mobile MERAM read ahead support"
+        depends on (SUPERH || ARCH_SHMOBILE)
+        select GENERIC_ALLOCATOR
+        ---help---
+          Enable MERAM support for the SuperH controller.
+          This will allow for caching of the framebuffer to provide more
+          reliable access under heavy main memory bus traffic situations.
+          Up to 4 memory channels can be configured, allowing 4 RGB or
+          2 YCbCr framebuffers to be configured.
+config FB_SSD1307
+        tristate "Solomon SSD1307 framebuffer support"
+        depends on FB && I2C
+        depends on OF
+        depends on GPIOLIB
+        select FB_SYS_FOPS
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_DEFERRED_IO
+        select PWM
+        help
+          This driver implements support for the Solomon SSD1307
+          OLED controller over I2C.
diff --git a/drivers/video/fbdev/Makefile b/drivers/video/fbdev/Makefile
new file mode 100644
index 000000000000..0284f2a12538
--- /dev/null
+++ b/drivers/video/fbdev/Makefile
@@ -0,0 +1,152 @@
+# Makefile for the Linux video drivers.
+# 5 Aug 1999, James Simmons, <mailto:jsimmons@users.sf.net>
+# Rewritten to use lists instead of if-statements.
+# Each configuration option enables a list of files.
+obj-y                           += core/
+obj-$(CONFIG_EXYNOS_VIDEO)     += exynos/
+obj-$(CONFIG_FB_MACMODES)      += macmodes.o
+obj-$(CONFIG_FB_WMT_GE_ROPS)   += wmt_ge_rops.o
+# Hardware specific drivers go first
+obj-$(CONFIG_FB_AMIGA)            += amifb.o c2p_planar.o
+obj-$(CONFIG_FB_ARC)              += arcfb.o
+obj-$(CONFIG_FB_CLPS711X)         += clps711xfb.o
+obj-$(CONFIG_FB_CYBER2000)        += cyber2000fb.o
+obj-$(CONFIG_FB_GRVGA)            += grvga.o
+obj-$(CONFIG_FB_PM2)              += pm2fb.o
+obj-$(CONFIG_FB_PM3)              += pm3fb.o
+obj-$(CONFIG_FB_I740)             += i740fb.o
+obj-$(CONFIG_FB_MATROX)           += matrox/
+obj-$(CONFIG_FB_RIVA)             += riva/
+obj-$(CONFIG_FB_NVIDIA)           += nvidia/
+obj-$(CONFIG_FB_ATY)              += aty/ macmodes.o
+obj-$(CONFIG_FB_ATY128)           += aty/ macmodes.o
+obj-$(CONFIG_FB_RADEON)           += aty/
+obj-$(CONFIG_FB_SIS)              += sis/
+obj-$(CONFIG_FB_VIA)              += via/
+obj-$(CONFIG_FB_KYRO)             += kyro/
+obj-$(CONFIG_FB_SAVAGE)           += savage/
+obj-$(CONFIG_FB_GEODE)            += geode/
+obj-$(CONFIG_FB_MBX)              += mbx/
+obj-$(CONFIG_FB_NEOMAGIC)         += neofb.o
+obj-$(CONFIG_FB_3DFX)             += tdfxfb.o
+obj-$(CONFIG_FB_CONTROL)          += controlfb.o
+obj-$(CONFIG_FB_PLATINUM)         += platinumfb.o
+obj-$(CONFIG_FB_VALKYRIE)         += valkyriefb.o
+obj-$(CONFIG_FB_CT65550)          += chipsfb.o
+obj-$(CONFIG_FB_IMSTT)            += imsttfb.o
+obj-$(CONFIG_FB_FM2)              += fm2fb.o
+obj-$(CONFIG_FB_VT8623)           += vt8623fb.o
+obj-$(CONFIG_FB_TRIDENT)          += tridentfb.o
+obj-$(CONFIG_FB_LE80578)          += vermilion/
+obj-$(CONFIG_FB_S3)               += s3fb.o
+obj-$(CONFIG_FB_ARK)              += arkfb.o
+obj-$(CONFIG_FB_STI)              += stifb.o
+obj-$(CONFIG_FB_FFB)              += ffb.o sbuslib.o
+obj-$(CONFIG_FB_CG6)              += cg6.o sbuslib.o
+obj-$(CONFIG_FB_CG3)              += cg3.o sbuslib.o
+obj-$(CONFIG_FB_BW2)              += bw2.o sbuslib.o
+obj-$(CONFIG_FB_CG14)             += cg14.o sbuslib.o
+obj-$(CONFIG_FB_P9100)            += p9100.o sbuslib.o
+obj-$(CONFIG_FB_TCX)              += tcx.o sbuslib.o
+obj-$(CONFIG_FB_LEO)              += leo.o sbuslib.o
+obj-$(CONFIG_FB_ACORN)            += acornfb.o
+obj-$(CONFIG_FB_ATARI)            += atafb.o c2p_iplan2.o atafb_mfb.o \
+                                     atafb_iplan2p2.o atafb_iplan2p4.o atafb_iplan2p8.o
+obj-$(CONFIG_FB_MAC)              += macfb.o
+obj-$(CONFIG_FB_HECUBA)           += hecubafb.o
+obj-$(CONFIG_FB_N411)             += n411.o
+obj-$(CONFIG_FB_HGA)              += hgafb.o
+obj-$(CONFIG_FB_XVR500)           += sunxvr500.o
+obj-$(CONFIG_FB_XVR2500)          += sunxvr2500.o
+obj-$(CONFIG_FB_XVR1000)          += sunxvr1000.o
+obj-$(CONFIG_FB_IGA)              += igafb.o
+obj-$(CONFIG_FB_APOLLO)           += dnfb.o
+obj-$(CONFIG_FB_Q40)              += q40fb.o
+obj-$(CONFIG_FB_TGA)              += tgafb.o
+obj-$(CONFIG_FB_HP300)            += hpfb.o
+obj-$(CONFIG_FB_G364)             += g364fb.o
+obj-$(CONFIG_FB_EP93XX)           += ep93xx-fb.o
+obj-$(CONFIG_FB_SA1100)           += sa1100fb.o
+obj-$(CONFIG_FB_HIT)              += hitfb.o
+obj-$(CONFIG_FB_ATMEL)            += atmel_lcdfb.o
+obj-$(CONFIG_FB_PVR2)             += pvr2fb.o
+obj-$(CONFIG_FB_VOODOO1)          += sstfb.o
+obj-$(CONFIG_FB_ARMCLCD)          += amba-clcd.o
+obj-$(CONFIG_FB_GOLDFISH)         += goldfishfb.o
+obj-$(CONFIG_FB_68328)            += 68328fb.o
+obj-$(CONFIG_FB_GBE)              += gbefb.o
+obj-$(CONFIG_FB_CIRRUS)           += cirrusfb.o
+obj-$(CONFIG_FB_ASILIANT)         += asiliantfb.o
+obj-$(CONFIG_FB_PXA)              += pxafb.o
+obj-$(CONFIG_FB_PXA168)           += pxa168fb.o
+obj-$(CONFIG_PXA3XX_GCU)          += pxa3xx-gcu.o
+obj-$(CONFIG_MMP_DISP)           += mmp/
+obj-$(CONFIG_FB_W100)             += w100fb.o
+obj-$(CONFIG_FB_TMIO)             += tmiofb.o
+obj-$(CONFIG_FB_AU1100)           += au1100fb.o
+obj-$(CONFIG_FB_AU1200)           += au1200fb.o
+obj-$(CONFIG_FB_VT8500)           += vt8500lcdfb.o
+obj-$(CONFIG_FB_WM8505)           += wm8505fb.o
+obj-$(CONFIG_FB_PMAG_AA)          += pmag-aa-fb.o
+obj-$(CONFIG_FB_PMAG_BA)          += pmag-ba-fb.o
+obj-$(CONFIG_FB_PMAGB_B)          += pmagb-b-fb.o
+obj-$(CONFIG_FB_MAXINE)           += maxinefb.o
+obj-$(CONFIG_FB_METRONOME)        += metronomefb.o
+obj-$(CONFIG_FB_BROADSHEET)       += broadsheetfb.o
+obj-$(CONFIG_FB_AUO_K190X)        += auo_k190x.o
+obj-$(CONFIG_FB_AUO_K1900)        += auo_k1900fb.o
+obj-$(CONFIG_FB_AUO_K1901)        += auo_k1901fb.o
+obj-$(CONFIG_FB_S1D13XXX)         += s1d13xxxfb.o
+obj-$(CONFIG_FB_SH7760)           += sh7760fb.o
+obj-$(CONFIG_FB_IMX)              += imxfb.o
+obj-$(CONFIG_FB_S3C)              += s3c-fb.o
+obj-$(CONFIG_FB_S3C2410)          += s3c2410fb.o
+obj-$(CONFIG_FB_FSL_DIU)          += fsl-diu-fb.o
+obj-$(CONFIG_FB_COBALT)           += cobalt_lcdfb.o
+obj-$(CONFIG_FB_IBM_GXT4500)      += gxt4500.o
+obj-$(CONFIG_FB_PS3)              += ps3fb.o
+obj-$(CONFIG_FB_SM501)            += sm501fb.o
+obj-$(CONFIG_FB_UDL)              += udlfb.o
+obj-$(CONFIG_FB_SMSCUFX)          += smscufx.o
+obj-$(CONFIG_FB_XILINX)           += xilinxfb.o
+obj-$(CONFIG_SH_MIPI_DSI)         += sh_mipi_dsi.o
+obj-$(CONFIG_FB_SH_MOBILE_HDMI)   += sh_mobile_hdmi.o
+obj-$(CONFIG_FB_SH_MOBILE_MERAM)  += sh_mobile_meram.o
+obj-$(CONFIG_FB_SH_MOBILE_LCDC)   += sh_mobile_lcdcfb.o
+obj-$(CONFIG_FB_OMAP)             += omap/
+obj-y                             += omap2/
+obj-$(CONFIG_XEN_FBDEV_FRONTEND)  += xen-fbfront.o
+obj-$(CONFIG_FB_CARMINE)          += carminefb.o
+obj-$(CONFIG_FB_MB862XX)          += mb862xx/
+obj-$(CONFIG_FB_MSM)              += msm/
+obj-$(CONFIG_FB_NUC900)           += nuc900fb.o
+obj-$(CONFIG_FB_JZ4740)           += jz4740_fb.o
+obj-$(CONFIG_FB_PUV3_UNIGFX)      += fb-puv3.o
+obj-$(CONFIG_FB_HYPERV)           += hyperv_fb.o
+obj-$(CONFIG_FB_OPENCORES)        += ocfb.o
+# Platform or fallback drivers go here
+obj-$(CONFIG_FB_UVESA)            += uvesafb.o
+obj-$(CONFIG_FB_VESA)             += vesafb.o
+obj-$(CONFIG_FB_EFI)              += efifb.o
+obj-$(CONFIG_FB_VGA16)            += vga16fb.o
+obj-$(CONFIG_FB_OF)               += offb.o
+obj-$(CONFIG_FB_BF537_LQ035)      += bf537-lq035.o
+obj-$(CONFIG_FB_BF54X_LQ043)      += bf54x-lq043fb.o
+obj-$(CONFIG_FB_BFIN_LQ035Q1)     += bfin-lq035q1-fb.o
+obj-$(CONFIG_FB_BFIN_T350MCQB)    += bfin-t350mcqb-fb.o
+obj-$(CONFIG_FB_BFIN_7393)        += bfin_adv7393fb.o
+obj-$(CONFIG_FB_MX3)              += mx3fb.o
+obj-$(CONFIG_FB_DA8XX)            += da8xx-fb.o
+obj-$(CONFIG_FB_MXS)              += mxsfb.o
+obj-$(CONFIG_FB_SSD1307)          += ssd1307fb.o
+obj-$(CONFIG_FB_SIMPLE)           += simplefb.o
+# the test framebuffer is last
+obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
diff --git a/drivers/video/acornfb.c b/drivers/video/fbdev/acornfb.c
index a305caea58ee..a305caea58ee 100644
--- a/drivers/video/acornfb.c
+++ b/drivers/video/fbdev/acornfb.c
diff --git a/drivers/video/acornfb.h b/drivers/video/fbdev/acornfb.h
index 175c8ff3367c..175c8ff3367c 100644
--- a/drivers/video/acornfb.h
+++ b/drivers/video/fbdev/acornfb.h
diff --git a/drivers/video/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
index 14d6b3793e0a..14d6b3793e0a 100644
--- a/drivers/video/amba-clcd.c
+++ b/drivers/video/fbdev/amba-clcd.c
diff --git a/drivers/video/amifb.c b/drivers/video/fbdev/amifb.c
index 518f790ef88a..518f790ef88a 100644
--- a/drivers/video/amifb.c
+++ b/drivers/video/fbdev/amifb.c
diff --git a/drivers/video/arcfb.c b/drivers/video/fbdev/arcfb.c
index 1b0b233b8b39..1b0b233b8b39 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/fbdev/arcfb.c
diff --git a/drivers/video/arkfb.c b/drivers/video/fbdev/arkfb.c
index adc4ea2cc5a0..adc4ea2cc5a0 100644
--- a/drivers/video/arkfb.c
+++ b/drivers/video/fbdev/arkfb.c
diff --git a/drivers/video/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c
index 7e8ddf00ccc2..7e8ddf00ccc2 100644
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/fbdev/asiliantfb.c
diff --git a/drivers/video/atafb.c b/drivers/video/fbdev/atafb.c
index e21d1f58554c..e21d1f58554c 100644
--- a/drivers/video/atafb.c
+++ b/drivers/video/fbdev/atafb.c
diff --git a/drivers/video/atafb.h b/drivers/video/fbdev/atafb.h
index 014e05906cb1..014e05906cb1 100644
--- a/drivers/video/atafb.h
+++ b/drivers/video/fbdev/atafb.h
diff --git a/drivers/video/atafb_iplan2p2.c b/drivers/video/fbdev/atafb_iplan2p2.c
index 8cc9c50379d0..8cc9c50379d0 100644
--- a/drivers/video/atafb_iplan2p2.c
+++ b/drivers/video/fbdev/atafb_iplan2p2.c
diff --git a/drivers/video/atafb_iplan2p4.c b/drivers/video/fbdev/atafb_iplan2p4.c
index bee0d89463f7..bee0d89463f7 100644
--- a/drivers/video/atafb_iplan2p4.c
+++ b/drivers/video/fbdev/atafb_iplan2p4.c
diff --git a/drivers/video/atafb_iplan2p8.c b/drivers/video/fbdev/atafb_iplan2p8.c
index 356fb52ce443..356fb52ce443 100644
--- a/drivers/video/atafb_iplan2p8.c
+++ b/drivers/video/fbdev/atafb_iplan2p8.c
diff --git a/drivers/video/atafb_mfb.c b/drivers/video/fbdev/atafb_mfb.c
index 6a352d62eecf..6a352d62eecf 100644
--- a/drivers/video/atafb_mfb.c
+++ b/drivers/video/fbdev/atafb_mfb.c
diff --git a/drivers/video/atafb_utils.h b/drivers/video/fbdev/atafb_utils.h
index ac9e19dc5057..ac9e19dc5057 100644
--- a/drivers/video/atafb_utils.h
+++ b/drivers/video/fbdev/atafb_utils.h
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index e683b6ef9594..e683b6ef9594 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
diff --git a/drivers/video/aty/Makefile b/drivers/video/fbdev/aty/Makefile
index a6cc0e9ec790..a6cc0e9ec790 100644
--- a/drivers/video/aty/Makefile
+++ b/drivers/video/fbdev/aty/Makefile
diff --git a/drivers/video/aty/ati_ids.h b/drivers/video/fbdev/aty/ati_ids.h
index 3e9d28bcd9f8..3e9d28bcd9f8 100644
--- a/drivers/video/aty/ati_ids.h
+++ b/drivers/video/fbdev/aty/ati_ids.h
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/fbdev/aty/aty128fb.c
index 52108be69e77..52108be69e77 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/fbdev/aty/aty128fb.c
diff --git a/drivers/video/aty/atyfb.h b/drivers/video/fbdev/aty/atyfb.h
index 1f39a62f899b..1f39a62f899b 100644
--- a/drivers/video/aty/atyfb.h
+++ b/drivers/video/fbdev/aty/atyfb.h
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
index c3d0074a32db..c3d0074a32db 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/fbdev/aty/atyfb_base.c
diff --git a/drivers/video/aty/mach64_accel.c b/drivers/video/fbdev/aty/mach64_accel.c
index 182bd680141f..182bd680141f 100644
--- a/drivers/video/aty/mach64_accel.c
+++ b/drivers/video/fbdev/aty/mach64_accel.c
diff --git a/drivers/video/aty/mach64_ct.c b/drivers/video/fbdev/aty/mach64_ct.c
index 51f29d627ceb..51f29d627ceb 100644
--- a/drivers/video/aty/mach64_ct.c
+++ b/drivers/video/fbdev/aty/mach64_ct.c
diff --git a/drivers/video/aty/mach64_cursor.c b/drivers/video/fbdev/aty/mach64_cursor.c
index 0fe02e22d9a4..2fa0317ab3c7 100644
--- a/drivers/video/aty/mach64_cursor.c
+++ b/drivers/video/fbdev/aty/mach64_cursor.c
@@ -5,7 +5,7 @@
 #include <linux/fb.h>
 #include <linux/init.h>
 #include <linux/string.h>
-#include "../fb_draw.h"
+#include "../core/fb_draw.h"
 #include <asm/io.h>
diff --git a/drivers/video/aty/mach64_gx.c b/drivers/video/fbdev/aty/mach64_gx.c
index 10c988aef58e..10c988aef58e 100644
--- a/drivers/video/aty/mach64_gx.c
+++ b/drivers/video/fbdev/aty/mach64_gx.c
diff --git a/drivers/video/aty/radeon_accel.c b/drivers/video/fbdev/aty/radeon_accel.c
index a469a3d6edcb..a469a3d6edcb 100644
--- a/drivers/video/aty/radeon_accel.c
+++ b/drivers/video/fbdev/aty/radeon_accel.c
diff --git a/drivers/video/aty/radeon_backlight.c b/drivers/video/fbdev/aty/radeon_backlight.c
index db572df7e1ef..db572df7e1ef 100644
--- a/drivers/video/aty/radeon_backlight.c
+++ b/drivers/video/fbdev/aty/radeon_backlight.c
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c
index 26d80a4486fb..26d80a4486fb 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/fbdev/aty/radeon_base.c
diff --git a/drivers/video/aty/radeon_i2c.c b/drivers/video/fbdev/aty/radeon_i2c.c
index ab1d0fd76316..ab1d0fd76316 100644
--- a/drivers/video/aty/radeon_i2c.c
+++ b/drivers/video/fbdev/aty/radeon_i2c.c
diff --git a/drivers/video/aty/radeon_monitor.c b/drivers/video/fbdev/aty/radeon_monitor.c
index bc078d50d8f1..bc078d50d8f1 100644
--- a/drivers/video/aty/radeon_monitor.c
+++ b/drivers/video/fbdev/aty/radeon_monitor.c
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/fbdev/aty/radeon_pm.c
index 46a12f1a93c3..46a12f1a93c3 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/fbdev/aty/radeon_pm.c
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/fbdev/aty/radeonfb.h
index cb846044f57c..cb846044f57c 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/fbdev/aty/radeonfb.h
diff --git a/drivers/video/au1100fb.c b/drivers/video/fbdev/au1100fb.c
index 372d4aea9d1c..372d4aea9d1c 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/fbdev/au1100fb.c
diff --git a/drivers/video/au1100fb.h b/drivers/video/fbdev/au1100fb.h
index 12d9642d5465..12d9642d5465 100644
--- a/drivers/video/au1100fb.h
+++ b/drivers/video/fbdev/au1100fb.h
diff --git a/drivers/video/au1200fb.c b/drivers/video/fbdev/au1200fb.c
index 4cfba78a1458..4cfba78a1458 100644
--- a/drivers/video/au1200fb.c
+++ b/drivers/video/fbdev/au1200fb.c
diff --git a/drivers/video/au1200fb.h b/drivers/video/fbdev/au1200fb.h
index e2672714d8d4..e2672714d8d4 100644
--- a/drivers/video/au1200fb.h
+++ b/drivers/video/fbdev/au1200fb.h
diff --git a/drivers/video/auo_k1900fb.c b/drivers/video/fbdev/auo_k1900fb.c
index f5b668e77af3..f5b668e77af3 100644
--- a/drivers/video/auo_k1900fb.c
+++ b/drivers/video/fbdev/auo_k1900fb.c
diff --git a/drivers/video/auo_k1901fb.c b/drivers/video/fbdev/auo_k1901fb.c
index 12b9adcb75c5..12b9adcb75c5 100644
--- a/drivers/video/auo_k1901fb.c
+++ b/drivers/video/fbdev/auo_k1901fb.c
diff --git a/drivers/video/auo_k190x.c b/drivers/video/fbdev/auo_k190x.c
index 8d2499d1cafb..8d2499d1cafb 100644
--- a/drivers/video/auo_k190x.c
+++ b/drivers/video/fbdev/auo_k190x.c
diff --git a/drivers/video/auo_k190x.h b/drivers/video/fbdev/auo_k190x.h
index e35af1f51b28..e35af1f51b28 100644
--- a/drivers/video/auo_k190x.h
+++ b/drivers/video/fbdev/auo_k190x.h
diff --git a/drivers/video/bf537-lq035.c b/drivers/video/fbdev/bf537-lq035.c
index a82d2578d976..a82d2578d976 100644
--- a/drivers/video/bf537-lq035.c
+++ b/drivers/video/fbdev/bf537-lq035.c
diff --git a/drivers/video/bf54x-lq043fb.c b/drivers/video/fbdev/bf54x-lq043fb.c
index 42b8f9d11018..e2c42ad8515a 100644
--- a/drivers/video/bf54x-lq043fb.c
+++ b/drivers/video/fbdev/bf54x-lq043fb.c
@@ -49,13 +49,13 @@
 #include <linux/spinlock.h>
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
+#include <linux/gpio.h>
 #include <asm/blackfin.h>
 #include <asm/irq.h>
 #include <asm/dpmc.h>
 #include <asm/dma-mapping.h>
 #include <asm/dma.h>
-#include <asm/gpio.h>
 #include <asm/portmux.h>
 #include <mach/bf54x-lq043.h>
diff --git a/drivers/video/bfin-lq035q1-fb.c b/drivers/video/fbdev/bfin-lq035q1-fb.c
index b594a58ff21d..b594a58ff21d 100644
--- a/drivers/video/bfin-lq035q1-fb.c
+++ b/drivers/video/fbdev/bfin-lq035q1-fb.c
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/fbdev/bfin-t350mcqb-fb.c
index b5cf1307a3d9..b5cf1307a3d9 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/fbdev/bfin-t350mcqb-fb.c
diff --git a/drivers/video/bfin_adv7393fb.c b/drivers/video/fbdev/bfin_adv7393fb.c
index a54f7f7d763b..a54f7f7d763b 100644
--- a/drivers/video/bfin_adv7393fb.c
+++ b/drivers/video/fbdev/bfin_adv7393fb.c
diff --git a/drivers/video/bfin_adv7393fb.h b/drivers/video/fbdev/bfin_adv7393fb.h
index cd591b5152a5..cd591b5152a5 100644
--- a/drivers/video/bfin_adv7393fb.h
+++ b/drivers/video/fbdev/bfin_adv7393fb.h
diff --git a/drivers/video/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
index 8556264b16b7..8556264b16b7 100644
--- a/drivers/video/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
diff --git a/drivers/video/bt431.h b/drivers/video/fbdev/bt431.h
index 04e0cfbba538..04e0cfbba538 100644
--- a/drivers/video/bt431.h
+++ b/drivers/video/fbdev/bt431.h
diff --git a/drivers/video/bt455.h b/drivers/video/fbdev/bt455.h
index 80f61b03e9ae..80f61b03e9ae 100644
--- a/drivers/video/bt455.h
+++ b/drivers/video/fbdev/bt455.h
diff --git a/drivers/video/bw2.c b/drivers/video/fbdev/bw2.c
index bc123d6947a4..bc123d6947a4 100644
--- a/drivers/video/bw2.c
+++ b/drivers/video/fbdev/bw2.c
diff --git a/drivers/video/c2p.h b/drivers/video/fbdev/c2p.h
index 6c38d40427d8..6c38d40427d8 100644
--- a/drivers/video/c2p.h
+++ b/drivers/video/fbdev/c2p.h
diff --git a/drivers/video/c2p_core.h b/drivers/video/fbdev/c2p_core.h
index e1035a865fb9..e1035a865fb9 100644
--- a/drivers/video/c2p_core.h
+++ b/drivers/video/fbdev/c2p_core.h
diff --git a/drivers/video/c2p_iplan2.c b/drivers/video/fbdev/c2p_iplan2.c
index 19156dc6158c..19156dc6158c 100644
--- a/drivers/video/c2p_iplan2.c
+++ b/drivers/video/fbdev/c2p_iplan2.c
diff --git a/drivers/video/c2p_planar.c b/drivers/video/fbdev/c2p_planar.c
index ec7ac8526f06..ec7ac8526f06 100644
--- a/drivers/video/c2p_planar.c
+++ b/drivers/video/fbdev/c2p_planar.c
diff --git a/drivers/video/carminefb.c b/drivers/video/fbdev/carminefb.c
index 65f7c15f5fdb..65f7c15f5fdb 100644
--- a/drivers/video/carminefb.c
+++ b/drivers/video/fbdev/carminefb.c
diff --git a/drivers/video/carminefb.h b/drivers/video/fbdev/carminefb.h
index 05306de0c6b6..05306de0c6b6 100644
--- a/drivers/video/carminefb.h
+++ b/drivers/video/fbdev/carminefb.h
diff --git a/drivers/video/carminefb_regs.h b/drivers/video/fbdev/carminefb_regs.h
index 045215600b73..045215600b73 100644
--- a/drivers/video/carminefb_regs.h
+++ b/drivers/video/fbdev/carminefb_regs.h
diff --git a/drivers/video/cg14.c b/drivers/video/fbdev/cg14.c
index c79745b136bb..c79745b136bb 100644
--- a/drivers/video/cg14.c
+++ b/drivers/video/fbdev/cg14.c
diff --git a/drivers/video/cg3.c b/drivers/video/fbdev/cg3.c
index 64a89d5747ed..64a89d5747ed 100644
--- a/drivers/video/cg3.c
+++ b/drivers/video/fbdev/cg3.c
diff --git a/drivers/video/cg6.c b/drivers/video/fbdev/cg6.c
index 70781fea092a..70781fea092a 100644
--- a/drivers/video/cg6.c
+++ b/drivers/video/fbdev/cg6.c
diff --git a/drivers/video/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index 206a66b61072..206a66b61072 100644
--- a/drivers/video/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
diff --git a/drivers/video/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c
index d992aa5eb3f0..d992aa5eb3f0 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/fbdev/cirrusfb.c
diff --git a/drivers/video/clps711xfb.c b/drivers/video/fbdev/clps711xfb.c
index f00980607b8f..f00980607b8f 100644
--- a/drivers/video/clps711xfb.c
+++ b/drivers/video/fbdev/clps711xfb.c
diff --git a/drivers/video/cobalt_lcdfb.c b/drivers/video/fbdev/cobalt_lcdfb.c
index d5533f4db1cf..d5533f4db1cf 100644
--- a/drivers/video/cobalt_lcdfb.c
+++ b/drivers/video/fbdev/cobalt_lcdfb.c
diff --git a/drivers/video/controlfb.c b/drivers/video/fbdev/controlfb.c
index fdadef979238..fdadef979238 100644
--- a/drivers/video/controlfb.c
+++ b/drivers/video/fbdev/controlfb.c
diff --git a/drivers/video/controlfb.h b/drivers/video/fbdev/controlfb.h
index 6026c60fc100..6026c60fc100 100644
--- a/drivers/video/controlfb.h
+++ b/drivers/video/fbdev/controlfb.h
diff --git a/drivers/video/fbdev/core/Makefile b/drivers/video/fbdev/core/Makefile
new file mode 100644
index 000000000000..fa306538dac2
--- /dev/null
+++ b/drivers/video/fbdev/core/Makefile
@@ -0,0 +1,16 @@
+obj-y                             += fb_notify.o
+obj-$(CONFIG_FB)                  += fb.o
+fb-y                              := fbmem.o fbmon.o fbcmap.o fbsysfs.o \
+                                     modedb.o fbcvt.o
+fb-objs                           := $(fb-y)
+obj-$(CONFIG_FB_CFB_FILLRECT)  += cfbfillrect.o
+obj-$(CONFIG_FB_CFB_COPYAREA)  += cfbcopyarea.o
+obj-$(CONFIG_FB_CFB_IMAGEBLIT) += cfbimgblt.o
+obj-$(CONFIG_FB_SYS_FILLRECT)  += sysfillrect.o
+obj-$(CONFIG_FB_SYS_COPYAREA)  += syscopyarea.o
+obj-$(CONFIG_FB_SYS_IMAGEBLIT) += sysimgblt.o
+obj-$(CONFIG_FB_SYS_FOPS)      += fb_sys_fops.o
+obj-$(CONFIG_FB_SVGALIB)       += svgalib.o
+obj-$(CONFIG_FB_DDC)           += fb_ddc.o
+obj-$(CONFIG_FB_DEFERRED_IO)   += fb_defio.o
diff --git a/drivers/video/cfbcopyarea.c b/drivers/video/fbdev/core/cfbcopyarea.c
index bcb57235fcc7..bcb57235fcc7 100644
--- a/drivers/video/cfbcopyarea.c
+++ b/drivers/video/fbdev/core/cfbcopyarea.c
diff --git a/drivers/video/cfbfillrect.c b/drivers/video/fbdev/core/cfbfillrect.c
index ba9f58b2a5e8..ba9f58b2a5e8 100644
--- a/drivers/video/cfbfillrect.c
+++ b/drivers/video/fbdev/core/cfbfillrect.c
diff --git a/drivers/video/cfbimgblt.c b/drivers/video/fbdev/core/cfbimgblt.c
index a2bb276a8b24..a2bb276a8b24 100644
--- a/drivers/video/cfbimgblt.c
+++ b/drivers/video/fbdev/core/cfbimgblt.c
diff --git a/drivers/video/fb_ddc.c b/drivers/video/fbdev/core/fb_ddc.c
index 2b106f046fde..94322ccfedde 100644
--- a/drivers/video/fb_ddc.c
+++ b/drivers/video/fbdev/core/fb_ddc.c
@@ -15,7 +15,7 @@
 #include <linux/i2c-algo-bit.h>
 #include <linux/slab.h>
-#include "edid.h"
+#include "../edid.h"
 #define DDC_ADDR        0x50
diff --git a/drivers/video/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c
index 900aa4ecd617..900aa4ecd617 100644
--- a/drivers/video/fb_defio.c
+++ b/drivers/video/fbdev/core/fb_defio.c
diff --git a/drivers/video/fb_draw.h b/drivers/video/fbdev/core/fb_draw.h
index 624ee115f129..624ee115f129 100644
--- a/drivers/video/fb_draw.h
+++ b/drivers/video/fbdev/core/fb_draw.h
diff --git a/drivers/video/fb_notify.c b/drivers/video/fbdev/core/fb_notify.c
index 74c2da528884..74c2da528884 100644
--- a/drivers/video/fb_notify.c
+++ b/drivers/video/fbdev/core/fb_notify.c
diff --git a/drivers/video/fb_sys_fops.c b/drivers/video/fbdev/core/fb_sys_fops.c
index ff275d7f3eaf..ff275d7f3eaf 100644
--- a/drivers/video/fb_sys_fops.c
+++ b/drivers/video/fbdev/core/fb_sys_fops.c
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
index f89245b8ba8e..f89245b8ba8e 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbdev/core/fbcmap.c
diff --git a/drivers/video/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c
index 7cb715dfc0e1..7cb715dfc0e1 100644
--- a/drivers/video/fbcvt.c
+++ b/drivers/video/fbdev/core/fbcvt.c
diff --git a/drivers/video/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index b6d5008f361f..b6d5008f361f 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
diff --git a/drivers/video/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 6103fa6fb54f..c204ebe6187e 100644
--- a/drivers/video/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -37,7 +37,7 @@
 #include <asm/prom.h>
 #include <asm/pci-bridge.h>
 #endif
-#include "edid.h"
+#include "../edid.h"
 /*
 * EDID parser
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c
index 53444ac19fe0..53444ac19fe0 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbdev/core/fbsysfs.c
diff --git a/drivers/video/modedb.c b/drivers/video/fbdev/core/modedb.c
index a9a907c440d7..a9a907c440d7 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/fbdev/core/modedb.c
diff --git a/drivers/video/svgalib.c b/drivers/video/fbdev/core/svgalib.c
index 9e01322fabe3..9e01322fabe3 100644
--- a/drivers/video/svgalib.c
+++ b/drivers/video/fbdev/core/svgalib.c
diff --git a/drivers/video/syscopyarea.c b/drivers/video/fbdev/core/syscopyarea.c
index 844a32fd38ed..844a32fd38ed 100644
--- a/drivers/video/syscopyarea.c
+++ b/drivers/video/fbdev/core/syscopyarea.c
diff --git a/drivers/video/sysfillrect.c b/drivers/video/fbdev/core/sysfillrect.c
index 33ee3d34f9d2..33ee3d34f9d2 100644
--- a/drivers/video/sysfillrect.c
+++ b/drivers/video/fbdev/core/sysfillrect.c
diff --git a/drivers/video/sysimgblt.c b/drivers/video/fbdev/core/sysimgblt.c
index a4d05b1b17d7..a4d05b1b17d7 100644
--- a/drivers/video/sysimgblt.c
+++ b/drivers/video/fbdev/core/sysimgblt.c
diff --git a/drivers/video/cyber2000fb.c b/drivers/video/fbdev/cyber2000fb.c
index b0a950f36970..b0a950f36970 100644
--- a/drivers/video/cyber2000fb.c
+++ b/drivers/video/fbdev/cyber2000fb.c
diff --git a/drivers/video/cyber2000fb.h b/drivers/video/fbdev/cyber2000fb.h
index bad69102e774..bad69102e774 100644
--- a/drivers/video/cyber2000fb.h
+++ b/drivers/video/fbdev/cyber2000fb.h
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
index 0c0ba920ea48..6b23508ff0a5 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/fbdev/da8xx-fb.c
@@ -663,15 +663,7 @@ static int fb_setcolreg(unsigned regno, unsigned red, unsigned green,
                        (green << info->var.green.offset) |
                        (blue << info->var.blue.offset);
-                switch (info->var.bits_per_pixel) {
+                ((u32 *) (info->pseudo_palette))[regno] = v;
-                case 16:
-                        ((u16 *) (info->pseudo_palette))[regno] = v;
-                        break;
-                case 24:
-                case 32:
-                        ((u32 *) (info->pseudo_palette))[regno] = v;
-                        break;
-                }
                if (palette[0] != 0x4000) {
                        update_hw = 1;
                        palette[0] = 0x4000;
diff --git a/drivers/video/dnfb.c b/drivers/video/fbdev/dnfb.c
index 3526899da61b..3526899da61b 100644
--- a/drivers/video/dnfb.c
+++ b/drivers/video/fbdev/dnfb.c
diff --git a/drivers/video/edid.h b/drivers/video/fbdev/edid.h
index d03a232d90b2..d03a232d90b2 100644
--- a/drivers/video/edid.h
+++ b/drivers/video/fbdev/edid.h
diff --git a/drivers/video/efifb.c b/drivers/video/fbdev/efifb.c
index ae9618ff6735..ae9618ff6735 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/fbdev/efifb.c
diff --git a/drivers/video/ep93xx-fb.c b/drivers/video/fbdev/ep93xx-fb.c
index 35a0f533f1a2..35a0f533f1a2 100644
--- a/drivers/video/ep93xx-fb.c
+++ b/drivers/video/fbdev/ep93xx-fb.c
diff --git a/drivers/video/exynos/Kconfig b/drivers/video/fbdev/exynos/Kconfig
index fcf2d48ac6d1..fcf2d48ac6d1 100644
--- a/drivers/video/exynos/Kconfig
+++ b/drivers/video/fbdev/exynos/Kconfig
diff --git a/drivers/video/exynos/Makefile b/drivers/video/fbdev/exynos/Makefile
index b5b1bd228abb..b5b1bd228abb 100644
--- a/drivers/video/exynos/Makefile
+++ b/drivers/video/fbdev/exynos/Makefile
diff --git a/drivers/video/exynos/exynos_mipi_dsi.c b/drivers/video/fbdev/exynos/exynos_mipi_dsi.c
index cee9602f9a7b..cee9602f9a7b 100644
--- a/drivers/video/exynos/exynos_mipi_dsi.c
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi.c
diff --git a/drivers/video/exynos/exynos_mipi_dsi_common.c b/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.c
index 85edabfdef5a..85edabfdef5a 100644
--- a/drivers/video/exynos/exynos_mipi_dsi_common.c
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.c
diff --git a/drivers/video/exynos/exynos_mipi_dsi_common.h b/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.h
index 412552274df3..412552274df3 100644
--- a/drivers/video/exynos/exynos_mipi_dsi_common.h
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi_common.h
diff --git a/drivers/video/exynos/exynos_mipi_dsi_lowlevel.c b/drivers/video/fbdev/exynos/exynos_mipi_dsi_lowlevel.c
index c148d06540c1..c148d06540c1 100644
--- a/drivers/video/exynos/exynos_mipi_dsi_lowlevel.c
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi_lowlevel.c
diff --git a/drivers/video/exynos/exynos_mipi_dsi_lowlevel.h b/drivers/video/fbdev/exynos/exynos_mipi_dsi_lowlevel.h
index 85460701c7ea..85460701c7ea 100644
--- a/drivers/video/exynos/exynos_mipi_dsi_lowlevel.h
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi_lowlevel.h
diff --git a/drivers/video/exynos/exynos_mipi_dsi_regs.h b/drivers/video/fbdev/exynos/exynos_mipi_dsi_regs.h
index 4227106d3fd0..4227106d3fd0 100644
--- a/drivers/video/exynos/exynos_mipi_dsi_regs.h
+++ b/drivers/video/fbdev/exynos/exynos_mipi_dsi_regs.h
diff --git a/drivers/video/exynos/s6e8ax0.c b/drivers/video/fbdev/exynos/s6e8ax0.c
index 29e70ed3f154..29e70ed3f154 100644
--- a/drivers/video/exynos/s6e8ax0.c
+++ b/drivers/video/fbdev/exynos/s6e8ax0.c
diff --git a/drivers/video/fb-puv3.c b/drivers/video/fbdev/fb-puv3.c
index 6db9ebd042a3..6db9ebd042a3 100644
--- a/drivers/video/fb-puv3.c
+++ b/drivers/video/fbdev/fb-puv3.c
diff --git a/drivers/video/ffb.c b/drivers/video/fbdev/ffb.c
index 4c4ffa61ae26..4c4ffa61ae26 100644
--- a/drivers/video/ffb.c
+++ b/drivers/video/fbdev/ffb.c
diff --git a/drivers/video/fm2fb.c b/drivers/video/fbdev/fm2fb.c
index e69d47af9932..e69d47af9932 100644
--- a/drivers/video/fm2fb.c
+++ b/drivers/video/fbdev/fm2fb.c
diff --git a/drivers/video/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
index e8758b9c3bcc..e8758b9c3bcc 100644
--- a/drivers/video/fsl-diu-fb.c
+++ b/drivers/video/fbdev/fsl-diu-fb.c
diff --git a/drivers/video/g364fb.c b/drivers/video/fbdev/g364fb.c
index 223896cc5f7d..223896cc5f7d 100644
--- a/drivers/video/g364fb.c
+++ b/drivers/video/fbdev/g364fb.c
diff --git a/drivers/video/gbefb.c b/drivers/video/fbdev/gbefb.c
index 3ec65a878ac8..3ec65a878ac8 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/fbdev/gbefb.c
diff --git a/drivers/video/geode/Kconfig b/drivers/video/fbdev/geode/Kconfig
index 1e8555284786..1e8555284786 100644
--- a/drivers/video/geode/Kconfig
+++ b/drivers/video/fbdev/geode/Kconfig
diff --git a/drivers/video/geode/Makefile b/drivers/video/fbdev/geode/Makefile
index 5c98da126883..5c98da126883 100644
--- a/drivers/video/geode/Makefile
+++ b/drivers/video/fbdev/geode/Makefile
diff --git a/drivers/video/geode/display_gx.c b/drivers/video/fbdev/geode/display_gx.c
index f0af911a096d..f0af911a096d 100644
--- a/drivers/video/geode/display_gx.c
+++ b/drivers/video/fbdev/geode/display_gx.c
diff --git a/drivers/video/geode/display_gx1.c b/drivers/video/fbdev/geode/display_gx1.c
index 926d53eeb549..926d53eeb549 100644
--- a/drivers/video/geode/display_gx1.c
+++ b/drivers/video/fbdev/geode/display_gx1.c
diff --git a/drivers/video/geode/display_gx1.h b/drivers/video/fbdev/geode/display_gx1.h
index 671c05558c79..671c05558c79 100644
--- a/drivers/video/geode/display_gx1.h
+++ b/drivers/video/fbdev/geode/display_gx1.h
diff --git a/drivers/video/geode/geodefb.h b/drivers/video/fbdev/geode/geodefb.h
index ae04820e0c57..ae04820e0c57 100644
--- a/drivers/video/geode/geodefb.h
+++ b/drivers/video/fbdev/geode/geodefb.h
diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/fbdev/geode/gx1fb_core.c
index 2794ba11f332..2794ba11f332 100644
--- a/drivers/video/geode/gx1fb_core.c
+++ b/drivers/video/fbdev/geode/gx1fb_core.c
diff --git a/drivers/video/geode/gxfb.h b/drivers/video/fbdev/geode/gxfb.h
index d19e9378b0c0..d19e9378b0c0 100644
--- a/drivers/video/geode/gxfb.h
+++ b/drivers/video/fbdev/geode/gxfb.h
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/fbdev/geode/gxfb_core.c
index 1790f14bab15..1790f14bab15 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/fbdev/geode/gxfb_core.c
diff --git a/drivers/video/geode/lxfb.h b/drivers/video/fbdev/geode/lxfb.h
index cfcd8090f313..cfcd8090f313 100644
--- a/drivers/video/geode/lxfb.h
+++ b/drivers/video/fbdev/geode/lxfb.h
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/fbdev/geode/lxfb_core.c
index 9e1d19d673a1..9e1d19d673a1 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/fbdev/geode/lxfb_core.c
diff --git a/drivers/video/geode/lxfb_ops.c b/drivers/video/fbdev/geode/lxfb_ops.c
index 79e9abc72b83..79e9abc72b83 100644
--- a/drivers/video/geode/lxfb_ops.c
+++ b/drivers/video/fbdev/geode/lxfb_ops.c
diff --git a/drivers/video/geode/suspend_gx.c b/drivers/video/fbdev/geode/suspend_gx.c
index 1bb043d70c64..1bb043d70c64 100644
--- a/drivers/video/geode/suspend_gx.c
+++ b/drivers/video/fbdev/geode/suspend_gx.c
diff --git a/drivers/video/geode/video_cs5530.c b/drivers/video/fbdev/geode/video_cs5530.c
index 649c3943d431..649c3943d431 100644
--- a/drivers/video/geode/video_cs5530.c
+++ b/drivers/video/fbdev/geode/video_cs5530.c
diff --git a/drivers/video/geode/video_cs5530.h b/drivers/video/fbdev/geode/video_cs5530.h
index 56cecca7f1ce..56cecca7f1ce 100644
--- a/drivers/video/geode/video_cs5530.h
+++ b/drivers/video/fbdev/geode/video_cs5530.h
diff --git a/drivers/video/geode/video_gx.c b/drivers/video/fbdev/geode/video_gx.c
index 6082f653c68a..6082f653c68a 100644
--- a/drivers/video/geode/video_gx.c
+++ b/drivers/video/fbdev/geode/video_gx.c
diff --git a/drivers/video/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c
index 7f6c9e6cfc6c..7f6c9e6cfc6c 100644
--- a/drivers/video/goldfishfb.c
+++ b/drivers/video/fbdev/goldfishfb.c
diff --git a/drivers/video/grvga.c b/drivers/video/fbdev/grvga.c
index c078701f15f6..c078701f15f6 100644
--- a/drivers/video/grvga.c
+++ b/drivers/video/fbdev/grvga.c
diff --git a/drivers/video/gxt4500.c b/drivers/video/fbdev/gxt4500.c
index 135d78a02588..135d78a02588 100644
--- a/drivers/video/gxt4500.c
+++ b/drivers/video/fbdev/gxt4500.c
diff --git a/drivers/video/hecubafb.c b/drivers/video/fbdev/hecubafb.c
index f64120ec9192..f64120ec9192 100644
--- a/drivers/video/hecubafb.c
+++ b/drivers/video/fbdev/hecubafb.c
diff --git a/drivers/video/hgafb.c b/drivers/video/fbdev/hgafb.c
index 5ff9fe2116a4..5ff9fe2116a4 100644
--- a/drivers/video/hgafb.c
+++ b/drivers/video/fbdev/hgafb.c
diff --git a/drivers/video/hitfb.c b/drivers/video/fbdev/hitfb.c
index a648d5186c6e..a648d5186c6e 100644
--- a/drivers/video/hitfb.c
+++ b/drivers/video/fbdev/hitfb.c
diff --git a/drivers/video/hpfb.c b/drivers/video/fbdev/hpfb.c
index a1b7e5fa9b09..a1b7e5fa9b09 100644
--- a/drivers/video/hpfb.c
+++ b/drivers/video/fbdev/hpfb.c
diff --git a/drivers/video/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
index e23392ec5af3..e23392ec5af3 100644
--- a/drivers/video/hyperv_fb.c
+++ b/drivers/video/fbdev/hyperv_fb.c
diff --git a/drivers/video/i740_reg.h b/drivers/video/fbdev/i740_reg.h
index 91bac76549d7..91bac76549d7 100644
--- a/drivers/video/i740_reg.h
+++ b/drivers/video/fbdev/i740_reg.h
diff --git a/drivers/video/i740fb.c b/drivers/video/fbdev/i740fb.c
index ca7c9df193b0..ca7c9df193b0 100644
--- a/drivers/video/i740fb.c
+++ b/drivers/video/fbdev/i740fb.c
diff --git a/drivers/video/i810/Makefile b/drivers/video/fbdev/i810/Makefile
index 96e08c8ded97..96e08c8ded97 100644
--- a/drivers/video/i810/Makefile
+++ b/drivers/video/fbdev/i810/Makefile
diff --git a/drivers/video/i810/i810-i2c.c b/drivers/video/fbdev/i810/i810-i2c.c
index 7db17d0d8a8c..7db17d0d8a8c 100644
--- a/drivers/video/i810/i810-i2c.c
+++ b/drivers/video/fbdev/i810/i810-i2c.c
diff --git a/drivers/video/i810/i810.h b/drivers/video/fbdev/i810/i810.h
index 1414b73ac55b..1414b73ac55b 100644
--- a/drivers/video/i810/i810.h
+++ b/drivers/video/fbdev/i810/i810.h
diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/fbdev/i810/i810_accel.c
index 7672d2ea9b35..7672d2ea9b35 100644
--- a/drivers/video/i810/i810_accel.c
+++ b/drivers/video/fbdev/i810/i810_accel.c
diff --git a/drivers/video/i810/i810_dvt.c b/drivers/video/fbdev/i810/i810_dvt.c
index b4b3670667ab..b4b3670667ab 100644
--- a/drivers/video/i810/i810_dvt.c
+++ b/drivers/video/fbdev/i810/i810_dvt.c
diff --git a/drivers/video/i810/i810_gtf.c b/drivers/video/fbdev/i810/i810_gtf.c
index 9743d51e7f8c..9743d51e7f8c 100644
--- a/drivers/video/i810/i810_gtf.c
+++ b/drivers/video/fbdev/i810/i810_gtf.c
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/fbdev/i810/i810_main.c
index bb674e431741..bb674e431741 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/fbdev/i810/i810_main.c
diff --git a/drivers/video/i810/i810_main.h b/drivers/video/fbdev/i810/i810_main.h
index a25afaa534ba..a25afaa534ba 100644
--- a/drivers/video/i810/i810_main.h
+++ b/drivers/video/fbdev/i810/i810_main.h
diff --git a/drivers/video/i810/i810_regs.h b/drivers/video/fbdev/i810/i810_regs.h
index 91c6bd9d0d0d..91c6bd9d0d0d 100644
--- a/drivers/video/i810/i810_regs.h
+++ b/drivers/video/fbdev/i810/i810_regs.h
diff --git a/drivers/video/igafb.c b/drivers/video/fbdev/igafb.c
index 486f18897414..486f18897414 100644
--- a/drivers/video/igafb.c
+++ b/drivers/video/fbdev/igafb.c
diff --git a/drivers/video/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index aae10ce74f14..aae10ce74f14 100644
--- a/drivers/video/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
diff --git a/drivers/video/imxfb.c b/drivers/video/fbdev/imxfb.c
index f6e621684953..f6e621684953 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
diff --git a/drivers/video/intelfb/Makefile b/drivers/video/fbdev/intelfb/Makefile
index f7d631ebee8e..f7d631ebee8e 100644
--- a/drivers/video/intelfb/Makefile
+++ b/drivers/video/fbdev/intelfb/Makefile
diff --git a/drivers/video/intelfb/intelfb.h b/drivers/video/fbdev/intelfb/intelfb.h
index 6b51175629c7..6b51175629c7 100644
--- a/drivers/video/intelfb/intelfb.h
+++ b/drivers/video/fbdev/intelfb/intelfb.h
diff --git a/drivers/video/intelfb/intelfb_i2c.c b/drivers/video/fbdev/intelfb/intelfb_i2c.c
index 3300bd31d9d7..3300bd31d9d7 100644
--- a/drivers/video/intelfb/intelfb_i2c.c
+++ b/drivers/video/fbdev/intelfb/intelfb_i2c.c
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c
index b847d530471a..b847d530471a 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/fbdev/intelfb/intelfbdrv.c
diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/fbdev/intelfb/intelfbhw.c
index fbad61da359f..fbad61da359f 100644
--- a/drivers/video/intelfb/intelfbhw.c
+++ b/drivers/video/fbdev/intelfb/intelfbhw.c
diff --git a/drivers/video/intelfb/intelfbhw.h b/drivers/video/fbdev/intelfb/intelfbhw.h
index 216ca20f259f..216ca20f259f 100644
--- a/drivers/video/intelfb/intelfbhw.h
+++ b/drivers/video/fbdev/intelfb/intelfbhw.h
diff --git a/drivers/video/jz4740_fb.c b/drivers/video/fbdev/jz4740_fb.c
index 87790e9644d0..87790e9644d0 100644
--- a/drivers/video/jz4740_fb.c
+++ b/drivers/video/fbdev/jz4740_fb.c
diff --git a/drivers/video/kyro/Makefile b/drivers/video/fbdev/kyro/Makefile
index 2fd66f551bae..2fd66f551bae 100644
--- a/drivers/video/kyro/Makefile
+++ b/drivers/video/fbdev/kyro/Makefile
diff --git a/drivers/video/kyro/STG4000InitDevice.c b/drivers/video/fbdev/kyro/STG4000InitDevice.c
index 1d3f2080aa6f..1d3f2080aa6f 100644
--- a/drivers/video/kyro/STG4000InitDevice.c
+++ b/drivers/video/fbdev/kyro/STG4000InitDevice.c
diff --git a/drivers/video/kyro/STG4000Interface.h b/drivers/video/fbdev/kyro/STG4000Interface.h
index b7c83d5dfb13..b7c83d5dfb13 100644
--- a/drivers/video/kyro/STG4000Interface.h
+++ b/drivers/video/fbdev/kyro/STG4000Interface.h
diff --git a/drivers/video/kyro/STG4000OverlayDevice.c b/drivers/video/fbdev/kyro/STG4000OverlayDevice.c
index 0aeeaa10708b..0aeeaa10708b 100644
--- a/drivers/video/kyro/STG4000OverlayDevice.c
+++ b/drivers/video/fbdev/kyro/STG4000OverlayDevice.c
diff --git a/drivers/video/kyro/STG4000Ramdac.c b/drivers/video/fbdev/kyro/STG4000Ramdac.c
index e6ad037e4396..e6ad037e4396 100644
--- a/drivers/video/kyro/STG4000Ramdac.c
+++ b/drivers/video/fbdev/kyro/STG4000Ramdac.c
diff --git a/drivers/video/kyro/STG4000Reg.h b/drivers/video/fbdev/kyro/STG4000Reg.h
index 50f4670e9252..50f4670e9252 100644
--- a/drivers/video/kyro/STG4000Reg.h
+++ b/drivers/video/fbdev/kyro/STG4000Reg.h
diff --git a/drivers/video/kyro/STG4000VTG.c b/drivers/video/fbdev/kyro/STG4000VTG.c
index bd389709d234..bd389709d234 100644
--- a/drivers/video/kyro/STG4000VTG.c
+++ b/drivers/video/fbdev/kyro/STG4000VTG.c
diff --git a/drivers/video/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 65041e15fd59..65041e15fd59 100644
--- a/drivers/video/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
diff --git a/drivers/video/leo.c b/drivers/video/fbdev/leo.c
index 2c7f7d479fe2..2c7f7d479fe2 100644
--- a/drivers/video/leo.c
+++ b/drivers/video/fbdev/leo.c
diff --git a/drivers/video/macfb.c b/drivers/video/fbdev/macfb.c
index cda7587cbc86..cda7587cbc86 100644
--- a/drivers/video/macfb.c
+++ b/drivers/video/fbdev/macfb.c
diff --git a/drivers/video/macmodes.c b/drivers/video/fbdev/macmodes.c
index af86c081d2be..af86c081d2be 100644
--- a/drivers/video/macmodes.c
+++ b/drivers/video/fbdev/macmodes.c
diff --git a/drivers/video/macmodes.h b/drivers/video/fbdev/macmodes.h
index b86ba08aac9e..b86ba08aac9e 100644
--- a/drivers/video/macmodes.h
+++ b/drivers/video/fbdev/macmodes.h
diff --git a/drivers/video/matrox/Makefile b/drivers/video/fbdev/matrox/Makefile
index f9c00ebe2530..f9c00ebe2530 100644
--- a/drivers/video/matrox/Makefile
+++ b/drivers/video/fbdev/matrox/Makefile
diff --git a/drivers/video/matrox/g450_pll.c b/drivers/video/fbdev/matrox/g450_pll.c
index c15f8a57498e..c15f8a57498e 100644
--- a/drivers/video/matrox/g450_pll.c
+++ b/drivers/video/fbdev/matrox/g450_pll.c
diff --git a/drivers/video/matrox/g450_pll.h b/drivers/video/fbdev/matrox/g450_pll.h
index aac615d18440..aac615d18440 100644
--- a/drivers/video/matrox/g450_pll.h
+++ b/drivers/video/fbdev/matrox/g450_pll.h
diff --git a/drivers/video/matrox/i2c-matroxfb.c b/drivers/video/fbdev/matrox/i2c-matroxfb.c
index 0fb280ead3dc..0fb280ead3dc 100644
--- a/drivers/video/matrox/i2c-matroxfb.c
+++ b/drivers/video/fbdev/matrox/i2c-matroxfb.c
diff --git a/drivers/video/matrox/matroxfb_DAC1064.c b/drivers/video/fbdev/matrox/matroxfb_DAC1064.c
index a01147fdf270..a01147fdf270 100644
--- a/drivers/video/matrox/matroxfb_DAC1064.c
+++ b/drivers/video/fbdev/matrox/matroxfb_DAC1064.c
diff --git a/drivers/video/matrox/matroxfb_DAC1064.h b/drivers/video/fbdev/matrox/matroxfb_DAC1064.h
index 1e6e45b57b78..1e6e45b57b78 100644
--- a/drivers/video/matrox/matroxfb_DAC1064.h
+++ b/drivers/video/fbdev/matrox/matroxfb_DAC1064.h
diff --git a/drivers/video/matrox/matroxfb_Ti3026.c b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
index 195ad7cac1ba..195ad7cac1ba 100644
--- a/drivers/video/matrox/matroxfb_Ti3026.c
+++ b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
diff --git a/drivers/video/matrox/matroxfb_Ti3026.h b/drivers/video/fbdev/matrox/matroxfb_Ti3026.h
index 27872aaa0a17..27872aaa0a17 100644
--- a/drivers/video/matrox/matroxfb_Ti3026.h
+++ b/drivers/video/fbdev/matrox/matroxfb_Ti3026.h
diff --git a/drivers/video/matrox/matroxfb_accel.c b/drivers/video/fbdev/matrox/matroxfb_accel.c
index 0d5cb85d071a..0d5cb85d071a 100644
--- a/drivers/video/matrox/matroxfb_accel.c
+++ b/drivers/video/fbdev/matrox/matroxfb_accel.c
diff --git a/drivers/video/matrox/matroxfb_accel.h b/drivers/video/fbdev/matrox/matroxfb_accel.h
index 1e418e62c22d..1e418e62c22d 100644
--- a/drivers/video/matrox/matroxfb_accel.h
+++ b/drivers/video/fbdev/matrox/matroxfb_accel.h
diff --git a/drivers/video/matrox/matroxfb_base.c b/drivers/video/fbdev/matrox/matroxfb_base.c
index 7116c5309c7d..7116c5309c7d 100644
--- a/drivers/video/matrox/matroxfb_base.c
+++ b/drivers/video/fbdev/matrox/matroxfb_base.c
diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/fbdev/matrox/matroxfb_base.h
index 556d96ce40bf..556d96ce40bf 100644
--- a/drivers/video/matrox/matroxfb_base.h
+++ b/drivers/video/fbdev/matrox/matroxfb_base.h
diff --git a/drivers/video/matrox/matroxfb_crtc2.c b/drivers/video/fbdev/matrox/matroxfb_crtc2.c
index 02796a4317a9..02796a4317a9 100644
--- a/drivers/video/matrox/matroxfb_crtc2.c
+++ b/drivers/video/fbdev/matrox/matroxfb_crtc2.c
diff --git a/drivers/video/matrox/matroxfb_crtc2.h b/drivers/video/fbdev/matrox/matroxfb_crtc2.h
index 1005582e843e..1005582e843e 100644
--- a/drivers/video/matrox/matroxfb_crtc2.h
+++ b/drivers/video/fbdev/matrox/matroxfb_crtc2.h
diff --git a/drivers/video/matrox/matroxfb_g450.c b/drivers/video/fbdev/matrox/matroxfb_g450.c
index cff0546ea6fd..cff0546ea6fd 100644
--- a/drivers/video/matrox/matroxfb_g450.c
+++ b/drivers/video/fbdev/matrox/matroxfb_g450.c
diff --git a/drivers/video/matrox/matroxfb_g450.h b/drivers/video/fbdev/matrox/matroxfb_g450.h
index 3a3e654444b8..3a3e654444b8 100644
--- a/drivers/video/matrox/matroxfb_g450.h
+++ b/drivers/video/fbdev/matrox/matroxfb_g450.h
diff --git a/drivers/video/matrox/matroxfb_maven.c b/drivers/video/fbdev/matrox/matroxfb_maven.c
index ee41a0f276b2..ee41a0f276b2 100644
--- a/drivers/video/matrox/matroxfb_maven.c
+++ b/drivers/video/fbdev/matrox/matroxfb_maven.c
diff --git a/drivers/video/matrox/matroxfb_maven.h b/drivers/video/fbdev/matrox/matroxfb_maven.h
index 99eddec9f30c..99eddec9f30c 100644
--- a/drivers/video/matrox/matroxfb_maven.h
+++ b/drivers/video/fbdev/matrox/matroxfb_maven.h
diff --git a/drivers/video/matrox/matroxfb_misc.c b/drivers/video/fbdev/matrox/matroxfb_misc.c
index 9948ca2a3046..9948ca2a3046 100644
--- a/drivers/video/matrox/matroxfb_misc.c
+++ b/drivers/video/fbdev/matrox/matroxfb_misc.c
diff --git a/drivers/video/matrox/matroxfb_misc.h b/drivers/video/fbdev/matrox/matroxfb_misc.h
index 351c823f1f74..351c823f1f74 100644
--- a/drivers/video/matrox/matroxfb_misc.h
+++ b/drivers/video/fbdev/matrox/matroxfb_misc.h
diff --git a/drivers/video/maxinefb.c b/drivers/video/fbdev/maxinefb.c
index 5cf52d3c8e75..5cf52d3c8e75 100644
--- a/drivers/video/maxinefb.c
+++ b/drivers/video/fbdev/maxinefb.c
diff --git a/drivers/video/mb862xx/Makefile b/drivers/video/fbdev/mb862xx/Makefile
index 5707ed0e31a7..5707ed0e31a7 100644
--- a/drivers/video/mb862xx/Makefile
+++ b/drivers/video/fbdev/mb862xx/Makefile
diff --git a/drivers/video/mb862xx/mb862xx-i2c.c b/drivers/video/fbdev/mb862xx/mb862xx-i2c.c
index c87e17afb3e2..c87e17afb3e2 100644
--- a/drivers/video/mb862xx/mb862xx-i2c.c
+++ b/drivers/video/fbdev/mb862xx/mb862xx-i2c.c
diff --git a/drivers/video/mb862xx/mb862xx_reg.h b/drivers/video/fbdev/mb862xx/mb862xx_reg.h
index 9df48b8edc94..9df48b8edc94 100644
--- a/drivers/video/mb862xx/mb862xx_reg.h
+++ b/drivers/video/fbdev/mb862xx/mb862xx_reg.h
diff --git a/drivers/video/mb862xx/mb862xxfb.h b/drivers/video/fbdev/mb862xx/mb862xxfb.h
index 8550630c1e01..8550630c1e01 100644
--- a/drivers/video/mb862xx/mb862xxfb.h
+++ b/drivers/video/fbdev/mb862xx/mb862xxfb.h
diff --git a/drivers/video/mb862xx/mb862xxfb_accel.c b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
index fe92eed6da70..fe92eed6da70 100644
--- a/drivers/video/mb862xx/mb862xxfb_accel.c
+++ b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.c
diff --git a/drivers/video/mb862xx/mb862xxfb_accel.h b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.h
index 96a2dfef0f60..96a2dfef0f60 100644
--- a/drivers/video/mb862xx/mb862xxfb_accel.h
+++ b/drivers/video/fbdev/mb862xx/mb862xxfb_accel.h
diff --git a/drivers/video/mb862xx/mb862xxfbdrv.c b/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c
index 0cd4c3318511..0cd4c3318511 100644
--- a/drivers/video/mb862xx/mb862xxfbdrv.c
+++ b/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c
diff --git a/drivers/video/mbx/Makefile b/drivers/video/fbdev/mbx/Makefile
index 16c1165cf9c7..16c1165cf9c7 100644
--- a/drivers/video/mbx/Makefile
+++ b/drivers/video/fbdev/mbx/Makefile
diff --git a/drivers/video/mbx/mbxdebugfs.c b/drivers/video/fbdev/mbx/mbxdebugfs.c
index 4449f249b0e7..4449f249b0e7 100644
--- a/drivers/video/mbx/mbxdebugfs.c
+++ b/drivers/video/fbdev/mbx/mbxdebugfs.c
diff --git a/drivers/video/mbx/mbxfb.c b/drivers/video/fbdev/mbx/mbxfb.c
index f0a5392f5fd3..f0a5392f5fd3 100644
--- a/drivers/video/mbx/mbxfb.c
+++ b/drivers/video/fbdev/mbx/mbxfb.c
diff --git a/drivers/video/mbx/reg_bits.h b/drivers/video/fbdev/mbx/reg_bits.h
index 5f14b4befd71..5f14b4befd71 100644
--- a/drivers/video/mbx/reg_bits.h
+++ b/drivers/video/fbdev/mbx/reg_bits.h
diff --git a/drivers/video/mbx/regs.h b/drivers/video/fbdev/mbx/regs.h
index 063099d48839..063099d48839 100644
--- a/drivers/video/mbx/regs.h
+++ b/drivers/video/fbdev/mbx/regs.h
diff --git a/drivers/video/metronomefb.c b/drivers/video/fbdev/metronomefb.c
index 195cc2db4c2c..195cc2db4c2c 100644
--- a/drivers/video/metronomefb.c
+++ b/drivers/video/fbdev/metronomefb.c
diff --git a/drivers/video/mmp/Kconfig b/drivers/video/fbdev/mmp/Kconfig
index e9ea39e13722..d4a4ffc24749 100644
--- a/drivers/video/mmp/Kconfig
+++ b/drivers/video/fbdev/mmp/Kconfig
@@ -5,7 +5,7 @@ menuconfig MMP_DISP
          Marvell Display Subsystem support.
 if MMP_DISP
-source "drivers/video/mmp/hw/Kconfig"
+source "drivers/video/fbdev/mmp/hw/Kconfig"
-source "drivers/video/mmp/panel/Kconfig"
+source "drivers/video/fbdev/mmp/panel/Kconfig"
-source "drivers/video/mmp/fb/Kconfig"
+source "drivers/video/fbdev/mmp/fb/Kconfig"
 endif
diff --git a/drivers/video/mmp/Makefile b/drivers/video/fbdev/mmp/Makefile
index a014cb358bf8..a014cb358bf8 100644
--- a/drivers/video/mmp/Makefile
+++ b/drivers/video/fbdev/mmp/Makefile
diff --git a/drivers/video/mmp/core.c b/drivers/video/fbdev/mmp/core.c
index b563b920f159..b563b920f159 100644
--- a/drivers/video/mmp/core.c
+++ b/drivers/video/fbdev/mmp/core.c
diff --git a/drivers/video/mmp/fb/Kconfig b/drivers/video/fbdev/mmp/fb/Kconfig
index 9b0141f105f5..9b0141f105f5 100644
--- a/drivers/video/mmp/fb/Kconfig
+++ b/drivers/video/fbdev/mmp/fb/Kconfig
diff --git a/drivers/video/mmp/fb/Makefile b/drivers/video/fbdev/mmp/fb/Makefile
index 709fd1f76abe..709fd1f76abe 100644
--- a/drivers/video/mmp/fb/Makefile
+++ b/drivers/video/fbdev/mmp/fb/Makefile
diff --git a/drivers/video/mmp/fb/mmpfb.c b/drivers/video/fbdev/mmp/fb/mmpfb.c
index 7ab31eb76a8c..7ab31eb76a8c 100644
--- a/drivers/video/mmp/fb/mmpfb.c
+++ b/drivers/video/fbdev/mmp/fb/mmpfb.c
diff --git a/drivers/video/mmp/fb/mmpfb.h b/drivers/video/fbdev/mmp/fb/mmpfb.h
index 88c23c10a9ec..88c23c10a9ec 100644
--- a/drivers/video/mmp/fb/mmpfb.h
+++ b/drivers/video/fbdev/mmp/fb/mmpfb.h
diff --git a/drivers/video/mmp/hw/Kconfig b/drivers/video/fbdev/mmp/hw/Kconfig
index 02f109a20cd0..02f109a20cd0 100644
--- a/drivers/video/mmp/hw/Kconfig
+++ b/drivers/video/fbdev/mmp/hw/Kconfig
diff --git a/drivers/video/mmp/hw/Makefile b/drivers/video/fbdev/mmp/hw/Makefile
index 0000a714fedf..0000a714fedf 100644
--- a/drivers/video/mmp/hw/Makefile
+++ b/drivers/video/fbdev/mmp/hw/Makefile
diff --git a/drivers/video/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
index 8621a9f2bdcc..8621a9f2bdcc 100644
--- a/drivers/video/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
diff --git a/drivers/video/mmp/hw/mmp_ctrl.h b/drivers/video/fbdev/mmp/hw/mmp_ctrl.h
index 53301cfdb1ae..53301cfdb1ae 100644
--- a/drivers/video/mmp/hw/mmp_ctrl.h
+++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.h
diff --git a/drivers/video/mmp/hw/mmp_spi.c b/drivers/video/fbdev/mmp/hw/mmp_spi.c
index e62ca7bf0d5e..e62ca7bf0d5e 100644
--- a/drivers/video/mmp/hw/mmp_spi.c
+++ b/drivers/video/fbdev/mmp/hw/mmp_spi.c
diff --git a/drivers/video/mmp/panel/Kconfig b/drivers/video/fbdev/mmp/panel/Kconfig
index 4b2c4f457b11..4b2c4f457b11 100644
--- a/drivers/video/mmp/panel/Kconfig
+++ b/drivers/video/fbdev/mmp/panel/Kconfig
diff --git a/drivers/video/mmp/panel/Makefile b/drivers/video/fbdev/mmp/panel/Makefile
index 2f91611c7e5e..2f91611c7e5e 100644
--- a/drivers/video/mmp/panel/Makefile
+++ b/drivers/video/fbdev/mmp/panel/Makefile
diff --git a/drivers/video/mmp/panel/tpo_tj032md01bw.c b/drivers/video/fbdev/mmp/panel/tpo_tj032md01bw.c
index 998978b08f5e..998978b08f5e 100644
--- a/drivers/video/mmp/panel/tpo_tj032md01bw.c
+++ b/drivers/video/fbdev/mmp/panel/tpo_tj032md01bw.c
diff --git a/drivers/video/msm/Makefile b/drivers/video/fbdev/msm/Makefile
index 802d6ae523fb..802d6ae523fb 100644
--- a/drivers/video/msm/Makefile
+++ b/drivers/video/fbdev/msm/Makefile
diff --git a/drivers/video/msm/mddi.c b/drivers/video/fbdev/msm/mddi.c
index e0f8011a3c4b..e0f8011a3c4b 100644
--- a/drivers/video/msm/mddi.c
+++ b/drivers/video/fbdev/msm/mddi.c
diff --git a/drivers/video/msm/mddi_client_dummy.c b/drivers/video/fbdev/msm/mddi_client_dummy.c
index f1b0dfcc9717..f1b0dfcc9717 100644
--- a/drivers/video/msm/mddi_client_dummy.c
+++ b/drivers/video/fbdev/msm/mddi_client_dummy.c
diff --git a/drivers/video/msm/mddi_client_nt35399.c b/drivers/video/fbdev/msm/mddi_client_nt35399.c
index f96df32e5509..f96df32e5509 100644
--- a/drivers/video/msm/mddi_client_nt35399.c
+++ b/drivers/video/fbdev/msm/mddi_client_nt35399.c
diff --git a/drivers/video/msm/mddi_client_toshiba.c b/drivers/video/fbdev/msm/mddi_client_toshiba.c
index 061d7dfebbf3..061d7dfebbf3 100644
--- a/drivers/video/msm/mddi_client_toshiba.c
+++ b/drivers/video/fbdev/msm/mddi_client_toshiba.c
diff --git a/drivers/video/msm/mddi_hw.h b/drivers/video/fbdev/msm/mddi_hw.h
index 45cc01fc1e7f..45cc01fc1e7f 100644
--- a/drivers/video/msm/mddi_hw.h
+++ b/drivers/video/fbdev/msm/mddi_hw.h
diff --git a/drivers/video/msm/mdp.c b/drivers/video/fbdev/msm/mdp.c
index 113c7876c855..113c7876c855 100644
--- a/drivers/video/msm/mdp.c
+++ b/drivers/video/fbdev/msm/mdp.c
diff --git a/drivers/video/msm/mdp_csc_table.h b/drivers/video/fbdev/msm/mdp_csc_table.h
index d1cde30ead52..d1cde30ead52 100644
--- a/drivers/video/msm/mdp_csc_table.h
+++ b/drivers/video/fbdev/msm/mdp_csc_table.h
diff --git a/drivers/video/msm/mdp_hw.h b/drivers/video/fbdev/msm/mdp_hw.h
index 35848d741001..35848d741001 100644
--- a/drivers/video/msm/mdp_hw.h
+++ b/drivers/video/fbdev/msm/mdp_hw.h
diff --git a/drivers/video/msm/mdp_ppp.c b/drivers/video/fbdev/msm/mdp_ppp.c
index be6079cdfbb6..be6079cdfbb6 100644
--- a/drivers/video/msm/mdp_ppp.c
+++ b/drivers/video/fbdev/msm/mdp_ppp.c
diff --git a/drivers/video/msm/mdp_scale_tables.c b/drivers/video/fbdev/msm/mdp_scale_tables.c
index 604783b2e17c..604783b2e17c 100644
--- a/drivers/video/msm/mdp_scale_tables.c
+++ b/drivers/video/fbdev/msm/mdp_scale_tables.c
diff --git a/drivers/video/msm/mdp_scale_tables.h b/drivers/video/fbdev/msm/mdp_scale_tables.h
index 34077b1af603..34077b1af603 100644
--- a/drivers/video/msm/mdp_scale_tables.h
+++ b/drivers/video/fbdev/msm/mdp_scale_tables.h
diff --git a/drivers/video/msm/msm_fb.c b/drivers/video/fbdev/msm/msm_fb.c
index 1374803fbcd9..1374803fbcd9 100644
--- a/drivers/video/msm/msm_fb.c
+++ b/drivers/video/fbdev/msm/msm_fb.c
diff --git a/drivers/video/mx3fb.c b/drivers/video/fbdev/mx3fb.c
index 142e860fb527..142e860fb527 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/fbdev/mx3fb.c
diff --git a/drivers/video/mxsfb.c b/drivers/video/fbdev/mxsfb.c
index accf48a2cce4..accf48a2cce4 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/fbdev/mxsfb.c
diff --git a/drivers/video/n411.c b/drivers/video/fbdev/n411.c
index 935830fea7b6..935830fea7b6 100644
--- a/drivers/video/n411.c
+++ b/drivers/video/fbdev/n411.c
diff --git a/drivers/video/neofb.c b/drivers/video/fbdev/neofb.c
index 44f99a60bb9b..44f99a60bb9b 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/fbdev/neofb.c
diff --git a/drivers/video/nuc900fb.c b/drivers/video/fbdev/nuc900fb.c
index 478f9808dee4..478f9808dee4 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/fbdev/nuc900fb.c
diff --git a/drivers/video/nuc900fb.h b/drivers/video/fbdev/nuc900fb.h
index 9a1ca6dbb6b2..9a1ca6dbb6b2 100644
--- a/drivers/video/nuc900fb.h
+++ b/drivers/video/fbdev/nuc900fb.h
diff --git a/drivers/video/nvidia/Makefile b/drivers/video/fbdev/nvidia/Makefile
index ca47432113e0..ca47432113e0 100644
--- a/drivers/video/nvidia/Makefile
+++ b/drivers/video/fbdev/nvidia/Makefile
diff --git a/drivers/video/nvidia/nv_accel.c b/drivers/video/fbdev/nvidia/nv_accel.c
index ad6472a894ea..ad6472a894ea 100644
--- a/drivers/video/nvidia/nv_accel.c
+++ b/drivers/video/fbdev/nvidia/nv_accel.c
diff --git a/drivers/video/nvidia/nv_backlight.c b/drivers/video/fbdev/nvidia/nv_backlight.c
index 8471008aa6ff..8471008aa6ff 100644
--- a/drivers/video/nvidia/nv_backlight.c
+++ b/drivers/video/fbdev/nvidia/nv_backlight.c
diff --git a/drivers/video/nvidia/nv_dma.h b/drivers/video/fbdev/nvidia/nv_dma.h
index a7ed1c0acbbb..a7ed1c0acbbb 100644
--- a/drivers/video/nvidia/nv_dma.h
+++ b/drivers/video/fbdev/nvidia/nv_dma.h
diff --git a/drivers/video/nvidia/nv_hw.c b/drivers/video/fbdev/nvidia/nv_hw.c
index 81c80ac3c76f..81c80ac3c76f 100644
--- a/drivers/video/nvidia/nv_hw.c
+++ b/drivers/video/fbdev/nvidia/nv_hw.c
diff --git a/drivers/video/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c
index d7994a173245..d7994a173245 100644
--- a/drivers/video/nvidia/nv_i2c.c
+++ b/drivers/video/fbdev/nvidia/nv_i2c.c
diff --git a/drivers/video/nvidia/nv_local.h b/drivers/video/fbdev/nvidia/nv_local.h
index 68e508daa417..68e508daa417 100644
--- a/drivers/video/nvidia/nv_local.h
+++ b/drivers/video/fbdev/nvidia/nv_local.h
diff --git a/drivers/video/nvidia/nv_of.c b/drivers/video/fbdev/nvidia/nv_of.c
index 3bc13df4b120..3bc13df4b120 100644
--- a/drivers/video/nvidia/nv_of.c
+++ b/drivers/video/fbdev/nvidia/nv_of.c
diff --git a/drivers/video/nvidia/nv_proto.h b/drivers/video/fbdev/nvidia/nv_proto.h
index ff5c410355ea..ff5c410355ea 100644
--- a/drivers/video/nvidia/nv_proto.h
+++ b/drivers/video/fbdev/nvidia/nv_proto.h
diff --git a/drivers/video/nvidia/nv_setup.c b/drivers/video/fbdev/nvidia/nv_setup.c
index 2f2e162134fa..2f2e162134fa 100644
--- a/drivers/video/nvidia/nv_setup.c
+++ b/drivers/video/fbdev/nvidia/nv_setup.c
diff --git a/drivers/video/nvidia/nv_type.h b/drivers/video/fbdev/nvidia/nv_type.h
index c03f7f55c76d..c03f7f55c76d 100644
--- a/drivers/video/nvidia/nv_type.h
+++ b/drivers/video/fbdev/nvidia/nv_type.h
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
index def041204676..def041204676 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
diff --git a/drivers/video/ocfb.c b/drivers/video/fbdev/ocfb.c
index 7f9dc9bec309..7f9dc9bec309 100644
--- a/drivers/video/ocfb.c
+++ b/drivers/video/fbdev/ocfb.c
diff --git a/drivers/video/offb.c b/drivers/video/fbdev/offb.c
index 7d44d669d5b6..7d44d669d5b6 100644
--- a/drivers/video/offb.c
+++ b/drivers/video/fbdev/offb.c
diff --git a/drivers/video/omap/Kconfig b/drivers/video/fbdev/omap/Kconfig
index 0bc3a936ce2b..0bc3a936ce2b 100644
--- a/drivers/video/omap/Kconfig
+++ b/drivers/video/fbdev/omap/Kconfig
diff --git a/drivers/video/omap/Makefile b/drivers/video/fbdev/omap/Makefile
index 1927faffb5bc..1927faffb5bc 100644
--- a/drivers/video/omap/Makefile
+++ b/drivers/video/fbdev/omap/Makefile
diff --git a/drivers/video/omap/hwa742.c b/drivers/video/fbdev/omap/hwa742.c
index a4ee65b8f918..a4ee65b8f918 100644
--- a/drivers/video/omap/hwa742.c
+++ b/drivers/video/fbdev/omap/hwa742.c
diff --git a/drivers/video/omap/lcd_ams_delta.c b/drivers/video/fbdev/omap/lcd_ams_delta.c
index 4a5f2cd3d3bf..4a5f2cd3d3bf 100644
--- a/drivers/video/omap/lcd_ams_delta.c
+++ b/drivers/video/fbdev/omap/lcd_ams_delta.c
diff --git a/drivers/video/omap/lcd_h3.c b/drivers/video/fbdev/omap/lcd_h3.c
index 49bdeca81e50..49bdeca81e50 100644
--- a/drivers/video/omap/lcd_h3.c
+++ b/drivers/video/fbdev/omap/lcd_h3.c
diff --git a/drivers/video/omap/lcd_htcherald.c b/drivers/video/fbdev/omap/lcd_htcherald.c
index 20f477851d54..20f477851d54 100644
--- a/drivers/video/omap/lcd_htcherald.c
+++ b/drivers/video/fbdev/omap/lcd_htcherald.c
diff --git a/drivers/video/omap/lcd_inn1510.c b/drivers/video/fbdev/omap/lcd_inn1510.c
index 2ee423279e35..2ee423279e35 100644
--- a/drivers/video/omap/lcd_inn1510.c
+++ b/drivers/video/fbdev/omap/lcd_inn1510.c
diff --git a/drivers/video/omap/lcd_inn1610.c b/drivers/video/fbdev/omap/lcd_inn1610.c
index e3d3d135aa48..e3d3d135aa48 100644
--- a/drivers/video/omap/lcd_inn1610.c
+++ b/drivers/video/fbdev/omap/lcd_inn1610.c
diff --git a/drivers/video/omap/lcd_mipid.c b/drivers/video/fbdev/omap/lcd_mipid.c
index 803fee618d57..803fee618d57 100644
--- a/drivers/video/omap/lcd_mipid.c
+++ b/drivers/video/fbdev/omap/lcd_mipid.c
diff --git a/drivers/video/omap/lcd_osk.c b/drivers/video/fbdev/omap/lcd_osk.c
index 7fbe04bce0ed..7fbe04bce0ed 100644
--- a/drivers/video/omap/lcd_osk.c
+++ b/drivers/video/fbdev/omap/lcd_osk.c
diff --git a/drivers/video/omap/lcd_palmte.c b/drivers/video/fbdev/omap/lcd_palmte.c
index ff4fb624b904..ff4fb624b904 100644
--- a/drivers/video/omap/lcd_palmte.c
+++ b/drivers/video/fbdev/omap/lcd_palmte.c
diff --git a/drivers/video/omap/lcd_palmtt.c b/drivers/video/fbdev/omap/lcd_palmtt.c
index aaf3c8ba1243..aaf3c8ba1243 100644
--- a/drivers/video/omap/lcd_palmtt.c
+++ b/drivers/video/fbdev/omap/lcd_palmtt.c
diff --git a/drivers/video/omap/lcd_palmz71.c b/drivers/video/fbdev/omap/lcd_palmz71.c
index 3b7d8aa1cf34..3b7d8aa1cf34 100644
--- a/drivers/video/omap/lcd_palmz71.c
+++ b/drivers/video/fbdev/omap/lcd_palmz71.c
diff --git a/drivers/video/omap/lcdc.c b/drivers/video/fbdev/omap/lcdc.c
index b52f62595f65..b52f62595f65 100644
--- a/drivers/video/omap/lcdc.c
+++ b/drivers/video/fbdev/omap/lcdc.c
diff --git a/drivers/video/omap/lcdc.h b/drivers/video/fbdev/omap/lcdc.h
index 845222270db3..845222270db3 100644
--- a/drivers/video/omap/lcdc.h
+++ b/drivers/video/fbdev/omap/lcdc.h
diff --git a/drivers/video/omap/omapfb.h b/drivers/video/fbdev/omap/omapfb.h
index 2921d20e4fba..2921d20e4fba 100644
--- a/drivers/video/omap/omapfb.h
+++ b/drivers/video/fbdev/omap/omapfb.h
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
index e4fc6d9b5371..e4fc6d9b5371 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/fbdev/omap/omapfb_main.c
diff --git a/drivers/video/omap/sossi.c b/drivers/video/fbdev/omap/sossi.c
index d4e7684e7045..d4e7684e7045 100644
--- a/drivers/video/omap/sossi.c
+++ b/drivers/video/fbdev/omap/sossi.c
diff --git a/drivers/video/fbdev/omap2/Kconfig b/drivers/video/fbdev/omap2/Kconfig
new file mode 100644
index 000000000000..c22955d2de9a
--- /dev/null
+++ b/drivers/video/fbdev/omap2/Kconfig
@@ -0,0 +1,10 @@
+config OMAP2_VRFB
+        bool
+if ARCH_OMAP2PLUS
+source "drivers/video/fbdev/omap2/dss/Kconfig"
+source "drivers/video/fbdev/omap2/omapfb/Kconfig"
+source "drivers/video/fbdev/omap2/displays-new/Kconfig"
+endif
diff --git a/drivers/video/omap2/Makefile b/drivers/video/fbdev/omap2/Makefile
index bf8127df8c71..bf8127df8c71 100644
--- a/drivers/video/omap2/Makefile
+++ b/drivers/video/fbdev/omap2/Makefile
diff --git a/drivers/video/omap2/displays-new/Kconfig b/drivers/video/fbdev/omap2/displays-new/Kconfig
index e6cfc38160d3..e6cfc38160d3 100644
--- a/drivers/video/omap2/displays-new/Kconfig
+++ b/drivers/video/fbdev/omap2/displays-new/Kconfig
diff --git a/drivers/video/omap2/displays-new/Makefile b/drivers/video/fbdev/omap2/displays-new/Makefile
index 0323a8a1c682..0323a8a1c682 100644
--- a/drivers/video/omap2/displays-new/Makefile
+++ b/drivers/video/fbdev/omap2/displays-new/Makefile
diff --git a/drivers/video/omap2/displays-new/connector-analog-tv.c b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
index 5ee3b5505f7f..5ee3b5505f7f 100644
--- a/drivers/video/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
diff --git a/drivers/video/omap2/displays-new/connector-dvi.c b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
index 74de2bc50c4f..74de2bc50c4f 100644
--- a/drivers/video/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
diff --git a/drivers/video/omap2/displays-new/connector-hdmi.c b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
index 29ed21b9dce5..29ed21b9dce5 100644
--- a/drivers/video/omap2/displays-new/connector-hdmi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
diff --git a/drivers/video/omap2/displays-new/encoder-tfp410.c b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
index b4e9a42a79e6..b4e9a42a79e6 100644
--- a/drivers/video/omap2/displays-new/encoder-tfp410.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
diff --git a/drivers/video/omap2/displays-new/encoder-tpd12s015.c b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
index 7e33686171e3..7e33686171e3 100644
--- a/drivers/video/omap2/displays-new/encoder-tpd12s015.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
diff --git a/drivers/video/omap2/displays-new/panel-dpi.c b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
index 5f8f7e7c81ef..5f8f7e7c81ef 100644
--- a/drivers/video/omap2/displays-new/panel-dpi.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
diff --git a/drivers/video/omap2/displays-new/panel-dsi-cm.c b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
index d6f14e8717e8..d6f14e8717e8 100644
--- a/drivers/video/omap2/displays-new/panel-dsi-cm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
diff --git a/drivers/video/omap2/displays-new/panel-lgphilips-lb035q02.c b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
index 2e6b513222d9..2e6b513222d9 100644
--- a/drivers/video/omap2/displays-new/panel-lgphilips-lb035q02.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
diff --git a/drivers/video/omap2/displays-new/panel-nec-nl8048hl11.c b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
index 996fa004b48c..996fa004b48c 100644
--- a/drivers/video/omap2/displays-new/panel-nec-nl8048hl11.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
diff --git a/drivers/video/omap2/displays-new/panel-sharp-ls037v7dw01.c b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
index b2f710be565d..b2f710be565d 100644
--- a/drivers/video/omap2/displays-new/panel-sharp-ls037v7dw01.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
diff --git a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
index c7ba4d8b928a..c7ba4d8b928a 100644
--- a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
diff --git a/drivers/video/omap2/displays-new/panel-tpo-td028ttec1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
index fae6adc005a7..fae6adc005a7 100644
--- a/drivers/video/omap2/displays-new/panel-tpo-td028ttec1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
diff --git a/drivers/video/omap2/displays-new/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
index 875b40263b33..875b40263b33 100644
--- a/drivers/video/omap2/displays-new/panel-tpo-td043mtea1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
diff --git a/drivers/video/omap2/dss/Kconfig b/drivers/video/fbdev/omap2/dss/Kconfig
index dde4281663b1..dde4281663b1 100644
--- a/drivers/video/omap2/dss/Kconfig
+++ b/drivers/video/fbdev/omap2/dss/Kconfig
diff --git a/drivers/video/omap2/dss/Makefile b/drivers/video/fbdev/omap2/dss/Makefile
index 8aec8bda27cc..8aec8bda27cc 100644
--- a/drivers/video/omap2/dss/Makefile
+++ b/drivers/video/fbdev/omap2/dss/Makefile
diff --git a/drivers/video/omap2/dss/apply.c b/drivers/video/fbdev/omap2/dss/apply.c
index 0a0b084ce65d..0a0b084ce65d 100644
--- a/drivers/video/omap2/dss/apply.c
+++ b/drivers/video/fbdev/omap2/dss/apply.c
diff --git a/drivers/video/omap2/dss/core.c b/drivers/video/fbdev/omap2/dss/core.c
index ffa45c894cd4..ffa45c894cd4 100644
--- a/drivers/video/omap2/dss/core.c
+++ b/drivers/video/fbdev/omap2/dss/core.c
diff --git a/drivers/video/omap2/dss/dispc-compat.c b/drivers/video/fbdev/omap2/dss/dispc-compat.c
index 83779c2b292a..83779c2b292a 100644
--- a/drivers/video/omap2/dss/dispc-compat.c
+++ b/drivers/video/fbdev/omap2/dss/dispc-compat.c
diff --git a/drivers/video/omap2/dss/dispc-compat.h b/drivers/video/fbdev/omap2/dss/dispc-compat.h
index 14a69b3d4fb0..14a69b3d4fb0 100644
--- a/drivers/video/omap2/dss/dispc-compat.h
+++ b/drivers/video/fbdev/omap2/dss/dispc-compat.h
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/fbdev/omap2/dss/dispc.c
index 2bbdb7ff7daf..f18397c33e8f 100644
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/fbdev/omap2/dss/dispc.c
@@ -101,6 +101,8 @@ static struct {
        void __iomem    *base;
        int irq;
+        irq_handler_t user_handler;
+        void *user_data;
        unsigned long core_clk_rate;
        unsigned long tv_pclk_rate;
@@ -113,6 +115,8 @@ static struct {
        u32             ctx[DISPC_SZ_REGS / sizeof(u32)];
        const struct dispc_features *feat;
+        bool is_enabled;
 } dispc;
 enum omap_color_component {
@@ -141,12 +145,18 @@ enum mgr_reg_fields {
        DISPC_MGR_FLD_NUM,
 };
+struct dispc_reg_field {
+        u16 reg;
+        u8 high;
+        u8 low;
+};
 static const struct {
        const char *name;
        u32 vsync_irq;
        u32 framedone_irq;
        u32 sync_lost_irq;
-        struct reg_field reg_desc[DISPC_MGR_FLD_NUM];
+        struct dispc_reg_field reg_desc[DISPC_MGR_FLD_NUM];
 } mgr_desc[] = {
        [OMAP_DSS_CHANNEL_LCD] = {
                .name           = "LCD",
@@ -238,13 +248,13 @@ static inline u32 dispc_read_reg(const u16 idx)
 static u32 mgr_fld_read(enum omap_channel channel, enum mgr_reg_fields regfld)
 {
-        const struct reg_field rfld = mgr_desc[channel].reg_desc[regfld];
+        const struct dispc_reg_field rfld = mgr_desc[channel].reg_desc[regfld];
        return REG_GET(rfld.reg, rfld.high, rfld.low);
 }
 static void mgr_fld_write(enum omap_channel channel,
                                        enum mgr_reg_fields regfld, int val) {
-        const struct reg_field rfld = mgr_desc[channel].reg_desc[regfld];
+        const struct dispc_reg_field rfld = mgr_desc[channel].reg_desc[regfld];
        REG_FLD_MOD(rfld.reg, val, rfld.high, rfld.low);
 }
@@ -3669,16 +3679,44 @@ static int __init dispc_init_features(struct platform_device *pdev)
        return 0;
 }
+static irqreturn_t dispc_irq_handler(int irq, void *arg)
+{
+        if (!dispc.is_enabled)
+                return IRQ_NONE;
+        return dispc.user_handler(irq, dispc.user_data);
+}
 int dispc_request_irq(irq_handler_t handler, void *dev_id)
 {
-        return devm_request_irq(&dispc.pdev->dev, dispc.irq, handler,
+        int r;
-                             IRQF_SHARED, "OMAP DISPC", dev_id);
+        if (dispc.user_handler != NULL)
+                return -EBUSY;
+        dispc.user_handler = handler;
+        dispc.user_data = dev_id;
+        /* ensure the dispc_irq_handler sees the values above */
+        smp_wmb();
+        r = devm_request_irq(&dispc.pdev->dev, dispc.irq, dispc_irq_handler,
+                             IRQF_SHARED, "OMAP DISPC", &dispc);
+        if (r) {
+                dispc.user_handler = NULL;
+                dispc.user_data = NULL;
+        }
+        return r;
 }
 EXPORT_SYMBOL(dispc_request_irq);
 void dispc_free_irq(void *dev_id)
 {
-        devm_free_irq(&dispc.pdev->dev, dispc.irq, dev_id);
+        devm_free_irq(&dispc.pdev->dev, dispc.irq, &dispc);
+        dispc.user_handler = NULL;
+        dispc.user_data = NULL;
 }
 EXPORT_SYMBOL(dispc_free_irq);
@@ -3750,6 +3788,12 @@ static int __exit omap_dispchw_remove(struct platform_device *pdev)
 static int dispc_runtime_suspend(struct device *dev)
 {
+        dispc.is_enabled = false;
+        /* ensure the dispc_irq_handler sees the is_enabled value */
+        smp_wmb();
+        /* wait for current handler to finish before turning the DISPC off */
+        synchronize_irq(dispc.irq);
        dispc_save_context();
        return 0;
@@ -3763,12 +3807,15 @@ static int dispc_runtime_resume(struct device *dev)
         * _omap_dispc_initial_config(). We can thus use it to detect if
         * we have lost register context.
         */
-        if (REG_GET(DISPC_CONFIG, 2, 1) == OMAP_DSS_LOAD_FRAME_ONLY)
+        if (REG_GET(DISPC_CONFIG, 2, 1) != OMAP_DSS_LOAD_FRAME_ONLY) {
-                return 0;
+                _omap_dispc_initial_config();
-        _omap_dispc_initial_config();
+                dispc_restore_context();
+        }
-        dispc_restore_context();
+        dispc.is_enabled = true;
+        /* ensure the dispc_irq_handler sees the is_enabled value */
+        smp_wmb();
        return 0;
 }
diff --git a/drivers/video/omap2/dss/dispc.h b/drivers/video/fbdev/omap2/dss/dispc.h
index 78edb449c763..78edb449c763 100644
--- a/drivers/video/omap2/dss/dispc.h
+++ b/drivers/video/fbdev/omap2/dss/dispc.h
diff --git a/drivers/video/omap2/dss/dispc_coefs.c b/drivers/video/fbdev/omap2/dss/dispc_coefs.c
index 038c15b04215..038c15b04215 100644
--- a/drivers/video/omap2/dss/dispc_coefs.c
+++ b/drivers/video/fbdev/omap2/dss/dispc_coefs.c
diff --git a/drivers/video/omap2/dss/display-sysfs.c b/drivers/video/fbdev/omap2/dss/display-sysfs.c
index 5a2095a98ed8..5a2095a98ed8 100644
--- a/drivers/video/omap2/dss/display-sysfs.c
+++ b/drivers/video/fbdev/omap2/dss/display-sysfs.c
diff --git a/drivers/video/omap2/dss/display.c b/drivers/video/fbdev/omap2/dss/display.c
index 2412a0dd0c13..2412a0dd0c13 100644
--- a/drivers/video/omap2/dss/display.c
+++ b/drivers/video/fbdev/omap2/dss/display.c
diff --git a/drivers/video/omap2/dss/dpi.c b/drivers/video/fbdev/omap2/dss/dpi.c
index 157921db447a..157921db447a 100644
--- a/drivers/video/omap2/dss/dpi.c
+++ b/drivers/video/fbdev/omap2/dss/dpi.c
diff --git a/drivers/video/omap2/dss/dsi.c b/drivers/video/fbdev/omap2/dss/dsi.c
index 121d1049d0bc..8be9b04d8849 100644
--- a/drivers/video/omap2/dss/dsi.c
+++ b/drivers/video/fbdev/omap2/dss/dsi.c
@@ -297,6 +297,8 @@ struct dsi_data {
        int irq;
+        bool is_enabled;
        struct clk *dss_clk;
        struct clk *sys_clk;
@@ -795,6 +797,9 @@ static irqreturn_t omap_dsi_irq_handler(int irq, void *arg)
        dsidev = (struct platform_device *) arg;
        dsi = dsi_get_dsidrv_data(dsidev);
+        if (!dsi->is_enabled)
+                return IRQ_NONE;
        spin_lock(&dsi->irq_lock);
        irqstatus = dsi_read_reg(dsidev, DSI_IRQSTATUS);
@@ -5671,6 +5676,15 @@ static int __exit omap_dsihw_remove(struct platform_device *dsidev)
 static int dsi_runtime_suspend(struct device *dev)
 {
+        struct platform_device *pdev = to_platform_device(dev);
+        struct dsi_data *dsi = dsi_get_dsidrv_data(pdev);
+        dsi->is_enabled = false;
+        /* ensure the irq handler sees the is_enabled value */
+        smp_wmb();
+        /* wait for current handler to finish before turning the DSI off */
+        synchronize_irq(dsi->irq);
        dispc_runtime_put();
        return 0;
@@ -5678,12 +5692,18 @@ static int dsi_runtime_suspend(struct device *dev)
 static int dsi_runtime_resume(struct device *dev)
 {
+        struct platform_device *pdev = to_platform_device(dev);
+        struct dsi_data *dsi = dsi_get_dsidrv_data(pdev);
        int r;
        r = dispc_runtime_get();
        if (r)
                return r;
+        dsi->is_enabled = true;
+        /* ensure the irq handler sees the is_enabled value */
+        smp_wmb();
        return 0;
 }
diff --git a/drivers/video/omap2/dss/dss-of.c b/drivers/video/fbdev/omap2/dss/dss-of.c
index a4b20aaf6142..a4b20aaf6142 100644
--- a/drivers/video/omap2/dss/dss-of.c
+++ b/drivers/video/fbdev/omap2/dss/dss-of.c
diff --git a/drivers/video/omap2/dss/dss.c b/drivers/video/fbdev/omap2/dss/dss.c
index 825c019ddee7..d55266c0e029 100644
--- a/drivers/video/omap2/dss/dss.c
+++ b/drivers/video/fbdev/omap2/dss/dss.c
@@ -457,7 +457,7 @@ bool dss_div_calc(unsigned long pck, unsigned long fck_min,
        fckd_stop = max(DIV_ROUND_UP(prate * m, fck_hw_max), 1ul);
        for (fckd = fckd_start; fckd >= fckd_stop; --fckd) {
-                fck = prate / fckd * m;
+                fck = DIV_ROUND_UP(prate, fckd) * m;
                if (func(fck, data))
                        return true;
@@ -506,7 +506,7 @@ static int dss_setup_default_clock(void)
                fck_div = DIV_ROUND_UP(prate * dss.feat->dss_fck_multiplier,
                                max_dss_fck);
-                fck = prate / fck_div * dss.feat->dss_fck_multiplier;
+                fck = DIV_ROUND_UP(prate, fck_div) * dss.feat->dss_fck_multiplier;
        }
        r = dss_set_fck_rate(fck);
diff --git a/drivers/video/omap2/dss/dss.h b/drivers/video/fbdev/omap2/dss/dss.h
index 918fec182424..560078fcb198 100644
--- a/drivers/video/omap2/dss/dss.h
+++ b/drivers/video/fbdev/omap2/dss/dss.h
@@ -131,12 +131,6 @@ struct dsi_clock_info {
        u16 lp_clk_div;
 };
-struct reg_field {
-        u16 reg;
-        u8 high;
-        u8 low;
-};
 struct dss_lcd_mgr_config {
        enum dss_io_pad_mode io_pad_mode;
diff --git a/drivers/video/omap2/dss/dss_features.c b/drivers/video/fbdev/omap2/dss/dss_features.c
index 7f8969191dc6..7f8969191dc6 100644
--- a/drivers/video/omap2/dss/dss_features.c
+++ b/drivers/video/fbdev/omap2/dss/dss_features.c
diff --git a/drivers/video/omap2/dss/dss_features.h b/drivers/video/fbdev/omap2/dss/dss_features.h
index e3ef3b714896..e3ef3b714896 100644
--- a/drivers/video/omap2/dss/dss_features.h
+++ b/drivers/video/fbdev/omap2/dss/dss_features.h
diff --git a/drivers/video/omap2/dss/hdmi.h b/drivers/video/fbdev/omap2/dss/hdmi.h
index e25681ff5a70..e25681ff5a70 100644
--- a/drivers/video/omap2/dss/hdmi.h
+++ b/drivers/video/fbdev/omap2/dss/hdmi.h
diff --git a/drivers/video/omap2/dss/hdmi4.c b/drivers/video/fbdev/omap2/dss/hdmi4.c
index f5f7944a1fd1..f5f7944a1fd1 100644
--- a/drivers/video/omap2/dss/hdmi4.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi4.c
diff --git a/drivers/video/omap2/dss/hdmi4_core.c b/drivers/video/fbdev/omap2/dss/hdmi4_core.c
index 2eb04dcf807c..2eb04dcf807c 100644
--- a/drivers/video/omap2/dss/hdmi4_core.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi4_core.c
diff --git a/drivers/video/omap2/dss/hdmi4_core.h b/drivers/video/fbdev/omap2/dss/hdmi4_core.h
index bb646896fa82..bb646896fa82 100644
--- a/drivers/video/omap2/dss/hdmi4_core.h
+++ b/drivers/video/fbdev/omap2/dss/hdmi4_core.h
diff --git a/drivers/video/omap2/dss/hdmi_common.c b/drivers/video/fbdev/omap2/dss/hdmi_common.c
index b11afac8e068..0b12a3f62fe1 100644
--- a/drivers/video/omap2/dss/hdmi_common.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_common.c
@@ -347,17 +347,17 @@ int hdmi_compute_acr(u32 pclk, u32 sample_freq, u32 *n, u32 *cts)
        case 96000:
        case 192000:
                if (deep_color == 125)
-                        if (pclk == 27027 || pclk == 74250)
+                        if (pclk == 27027000 || pclk == 74250000)
                                deep_color_correct = true;
                if (deep_color == 150)
-                        if (pclk == 27027)
+                        if (pclk == 27027000)
                                deep_color_correct = true;
                break;
        case 44100:
        case 88200:
        case 176400:
                if (deep_color == 125)
-                        if (pclk == 27027)
+                        if (pclk == 27027000)
                                deep_color_correct = true;
                break;
        default:
@@ -418,7 +418,7 @@ int hdmi_compute_acr(u32 pclk, u32 sample_freq, u32 *n, u32 *cts)
                }
        }
        /* Calculate CTS. See HDMI 1.3a or 1.4a specifications */
-        *cts = pclk * (*n / 128) * deep_color / (sample_freq / 10);
+        *cts = (pclk/1000) * (*n / 128) * deep_color / (sample_freq / 10);
        return 0;
 }
diff --git a/drivers/video/omap2/dss/hdmi_phy.c b/drivers/video/fbdev/omap2/dss/hdmi_phy.c
index dd376ce8da01..dd376ce8da01 100644
--- a/drivers/video/omap2/dss/hdmi_phy.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_phy.c
diff --git a/drivers/video/omap2/dss/hdmi_pll.c b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
index 5fc71215c303..5fc71215c303 100644
--- a/drivers/video/omap2/dss/hdmi_pll.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
diff --git a/drivers/video/omap2/dss/hdmi_wp.c b/drivers/video/fbdev/omap2/dss/hdmi_wp.c
index f5f4ccf50d90..f5f4ccf50d90 100644
--- a/drivers/video/omap2/dss/hdmi_wp.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_wp.c
diff --git a/drivers/video/omap2/dss/manager-sysfs.c b/drivers/video/fbdev/omap2/dss/manager-sysfs.c
index 37b59fe28dc8..37b59fe28dc8 100644
--- a/drivers/video/omap2/dss/manager-sysfs.c
+++ b/drivers/video/fbdev/omap2/dss/manager-sysfs.c
diff --git a/drivers/video/omap2/dss/manager.c b/drivers/video/fbdev/omap2/dss/manager.c
index 1aac9b4191a9..1aac9b4191a9 100644
--- a/drivers/video/omap2/dss/manager.c
+++ b/drivers/video/fbdev/omap2/dss/manager.c
diff --git a/drivers/video/omap2/dss/output.c b/drivers/video/fbdev/omap2/dss/output.c
index 2ab3afa615e8..2ab3afa615e8 100644
--- a/drivers/video/omap2/dss/output.c
+++ b/drivers/video/fbdev/omap2/dss/output.c
diff --git a/drivers/video/omap2/dss/overlay-sysfs.c b/drivers/video/fbdev/omap2/dss/overlay-sysfs.c
index 4cc5ddebfb34..4cc5ddebfb34 100644
--- a/drivers/video/omap2/dss/overlay-sysfs.c
+++ b/drivers/video/fbdev/omap2/dss/overlay-sysfs.c
diff --git a/drivers/video/omap2/dss/overlay.c b/drivers/video/fbdev/omap2/dss/overlay.c
index 2f7cee985cdd..2f7cee985cdd 100644
--- a/drivers/video/omap2/dss/overlay.c
+++ b/drivers/video/fbdev/omap2/dss/overlay.c
diff --git a/drivers/video/omap2/dss/rfbi.c b/drivers/video/fbdev/omap2/dss/rfbi.c
index c8a81a2b879c..c8a81a2b879c 100644
--- a/drivers/video/omap2/dss/rfbi.c
+++ b/drivers/video/fbdev/omap2/dss/rfbi.c
diff --git a/drivers/video/omap2/dss/sdi.c b/drivers/video/fbdev/omap2/dss/sdi.c
index 911dcc9173a6..911dcc9173a6 100644
--- a/drivers/video/omap2/dss/sdi.c
+++ b/drivers/video/fbdev/omap2/dss/sdi.c
diff --git a/drivers/video/omap2/dss/venc.c b/drivers/video/fbdev/omap2/dss/venc.c
index 21d81113962b..21d81113962b 100644
--- a/drivers/video/omap2/dss/venc.c
+++ b/drivers/video/fbdev/omap2/dss/venc.c
diff --git a/drivers/video/omap2/dss/venc_panel.c b/drivers/video/fbdev/omap2/dss/venc_panel.c
index af68cd444d7e..af68cd444d7e 100644
--- a/drivers/video/omap2/dss/venc_panel.c
+++ b/drivers/video/fbdev/omap2/dss/venc_panel.c
diff --git a/drivers/video/omap2/omapfb/Kconfig b/drivers/video/fbdev/omap2/omapfb/Kconfig
index 4cb12ce68855..4cb12ce68855 100644
--- a/drivers/video/omap2/omapfb/Kconfig
+++ b/drivers/video/fbdev/omap2/omapfb/Kconfig
diff --git a/drivers/video/omap2/omapfb/Makefile b/drivers/video/fbdev/omap2/omapfb/Makefile
index 51c2e00d9bf8..51c2e00d9bf8 100644
--- a/drivers/video/omap2/omapfb/Makefile
+++ b/drivers/video/fbdev/omap2/omapfb/Makefile
diff --git a/drivers/video/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
index 146b6f5428db..146b6f5428db 100644
--- a/drivers/video/omap2/omapfb/omapfb-ioctl.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
diff --git a/drivers/video/omap2/omapfb/omapfb-main.c b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
index ec2d132c782d..ec2d132c782d 100644
--- a/drivers/video/omap2/omapfb/omapfb-main.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
diff --git a/drivers/video/omap2/omapfb/omapfb-sysfs.c b/drivers/video/fbdev/omap2/omapfb/omapfb-sysfs.c
index 18fa9e1d0033..18fa9e1d0033 100644
--- a/drivers/video/omap2/omapfb/omapfb-sysfs.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-sysfs.c
diff --git a/drivers/video/omap2/omapfb/omapfb.h b/drivers/video/fbdev/omap2/omapfb/omapfb.h
index 623cd872a367..623cd872a367 100644
--- a/drivers/video/omap2/omapfb/omapfb.h
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb.h
diff --git a/drivers/video/omap2/vrfb.c b/drivers/video/fbdev/omap2/vrfb.c
index f346b02eee1d..f346b02eee1d 100644
--- a/drivers/video/omap2/vrfb.c
+++ b/drivers/video/fbdev/omap2/vrfb.c
diff --git a/drivers/video/p9100.c b/drivers/video/fbdev/p9100.c
index 367cea8f43f3..367cea8f43f3 100644
--- a/drivers/video/p9100.c
+++ b/drivers/video/fbdev/p9100.c
diff --git a/drivers/video/platinumfb.c b/drivers/video/fbdev/platinumfb.c
index 4c9299576827..4c9299576827 100644
--- a/drivers/video/platinumfb.c
+++ b/drivers/video/fbdev/platinumfb.c
diff --git a/drivers/video/platinumfb.h b/drivers/video/fbdev/platinumfb.h
index f6bd77cafd17..f6bd77cafd17 100644
--- a/drivers/video/platinumfb.h
+++ b/drivers/video/fbdev/platinumfb.h
diff --git a/drivers/video/pm2fb.c b/drivers/video/fbdev/pm2fb.c
index 3b85b647bc10..3b85b647bc10 100644
--- a/drivers/video/pm2fb.c
+++ b/drivers/video/fbdev/pm2fb.c
diff --git a/drivers/video/pm3fb.c b/drivers/video/fbdev/pm3fb.c
index 4bf3273d0433..4bf3273d0433 100644
--- a/drivers/video/pm3fb.c
+++ b/drivers/video/fbdev/pm3fb.c
diff --git a/drivers/video/pmag-aa-fb.c b/drivers/video/fbdev/pmag-aa-fb.c
index 838424817de2..838424817de2 100644
--- a/drivers/video/pmag-aa-fb.c
+++ b/drivers/video/fbdev/pmag-aa-fb.c
diff --git a/drivers/video/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c
index 914a52ba8477..914a52ba8477 100644
--- a/drivers/video/pmag-ba-fb.c
+++ b/drivers/video/fbdev/pmag-ba-fb.c
diff --git a/drivers/video/pmagb-b-fb.c b/drivers/video/fbdev/pmagb-b-fb.c
index 0822b6f8dddc..0822b6f8dddc 100644
--- a/drivers/video/pmagb-b-fb.c
+++ b/drivers/video/fbdev/pmagb-b-fb.c
diff --git a/drivers/video/ps3fb.c b/drivers/video/fbdev/ps3fb.c
index b269abd932aa..b269abd932aa 100644
--- a/drivers/video/ps3fb.c
+++ b/drivers/video/fbdev/ps3fb.c
diff --git a/drivers/video/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c
index 167cffff3d4e..167cffff3d4e 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
diff --git a/drivers/video/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c
index c95b9e46d48f..c95b9e46d48f 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/fbdev/pxa168fb.c
diff --git a/drivers/video/pxa168fb.h b/drivers/video/fbdev/pxa168fb.h
index eee09279c524..eee09279c524 100644
--- a/drivers/video/pxa168fb.h
+++ b/drivers/video/fbdev/pxa168fb.h
diff --git a/drivers/video/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c
index 417f9a27eb7d..417f9a27eb7d 100644
--- a/drivers/video/pxa3xx-gcu.c
+++ b/drivers/video/fbdev/pxa3xx-gcu.c
diff --git a/drivers/video/pxa3xx-gcu.h b/drivers/video/fbdev/pxa3xx-gcu.h
index 0428ed03dc49..0428ed03dc49 100644
--- a/drivers/video/pxa3xx-gcu.h
+++ b/drivers/video/fbdev/pxa3xx-gcu.h
diff --git a/drivers/video/pxafb.c b/drivers/video/fbdev/pxafb.c
index 1ecd9cec2921..1ecd9cec2921 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/fbdev/pxafb.c
diff --git a/drivers/video/pxafb.h b/drivers/video/fbdev/pxafb.h
index 26ba9fa3f737..26ba9fa3f737 100644
--- a/drivers/video/pxafb.h
+++ b/drivers/video/fbdev/pxafb.h
diff --git a/drivers/video/q40fb.c b/drivers/video/fbdev/q40fb.c
index 7487f76f6275..7487f76f6275 100644
--- a/drivers/video/q40fb.c
+++ b/drivers/video/fbdev/q40fb.c
diff --git a/drivers/video/riva/Makefile b/drivers/video/fbdev/riva/Makefile
index 8898c9915b02..8898c9915b02 100644
--- a/drivers/video/riva/Makefile
+++ b/drivers/video/fbdev/riva/Makefile
diff --git a/drivers/video/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
index 8a8d7f060784..8a8d7f060784 100644
--- a/drivers/video/riva/fbdev.c
+++ b/drivers/video/fbdev/riva/fbdev.c
diff --git a/drivers/video/riva/nv_driver.c b/drivers/video/fbdev/riva/nv_driver.c
index f3694cf17e58..f3694cf17e58 100644
--- a/drivers/video/riva/nv_driver.c
+++ b/drivers/video/fbdev/riva/nv_driver.c
diff --git a/drivers/video/riva/nv_type.h b/drivers/video/fbdev/riva/nv_type.h
index a69480c9a67c..a69480c9a67c 100644
--- a/drivers/video/riva/nv_type.h
+++ b/drivers/video/fbdev/riva/nv_type.h
diff --git a/drivers/video/riva/nvreg.h b/drivers/video/fbdev/riva/nvreg.h
index abfc167ae8d8..abfc167ae8d8 100644
--- a/drivers/video/riva/nvreg.h
+++ b/drivers/video/fbdev/riva/nvreg.h
diff --git a/drivers/video/riva/riva_hw.c b/drivers/video/fbdev/riva/riva_hw.c
index 78fdbf5178d7..78fdbf5178d7 100644
--- a/drivers/video/riva/riva_hw.c
+++ b/drivers/video/fbdev/riva/riva_hw.c
diff --git a/drivers/video/riva/riva_hw.h b/drivers/video/fbdev/riva/riva_hw.h
index c2769f73e0b2..c2769f73e0b2 100644
--- a/drivers/video/riva/riva_hw.h
+++ b/drivers/video/fbdev/riva/riva_hw.h
diff --git a/drivers/video/riva/riva_tbl.h b/drivers/video/fbdev/riva/riva_tbl.h
index 7ee7d72932d4..7ee7d72932d4 100644
--- a/drivers/video/riva/riva_tbl.h
+++ b/drivers/video/fbdev/riva/riva_tbl.h
diff --git a/drivers/video/riva/rivafb-i2c.c b/drivers/video/fbdev/riva/rivafb-i2c.c
index 6a183375ced1..6a183375ced1 100644
--- a/drivers/video/riva/rivafb-i2c.c
+++ b/drivers/video/fbdev/riva/rivafb-i2c.c
diff --git a/drivers/video/riva/rivafb.h b/drivers/video/fbdev/riva/rivafb.h
index d9f107b704c6..d9f107b704c6 100644
--- a/drivers/video/riva/rivafb.h
+++ b/drivers/video/fbdev/riva/rivafb.h
diff --git a/drivers/video/s1d13xxxfb.c b/drivers/video/fbdev/s1d13xxxfb.c
index 83433cb0dfba..83433cb0dfba 100644
--- a/drivers/video/s1d13xxxfb.c
+++ b/drivers/video/fbdev/s1d13xxxfb.c
diff --git a/drivers/video/s3c-fb.c b/drivers/video/fbdev/s3c-fb.c
index 62acae2694a9..62acae2694a9 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/fbdev/s3c-fb.c
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/fbdev/s3c2410fb.c
index 81af5a63e9e1..81af5a63e9e1 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/fbdev/s3c2410fb.c
diff --git a/drivers/video/s3c2410fb.h b/drivers/video/fbdev/s3c2410fb.h
index 47a17bd23011..47a17bd23011 100644
--- a/drivers/video/s3c2410fb.h
+++ b/drivers/video/fbdev/s3c2410fb.h
diff --git a/drivers/video/s3fb.c b/drivers/video/fbdev/s3fb.c
index 9a3f8f1c6aab..9a3f8f1c6aab 100644
--- a/drivers/video/s3fb.c
+++ b/drivers/video/fbdev/s3fb.c
diff --git a/drivers/video/sa1100fb.c b/drivers/video/fbdev/sa1100fb.c
index 580c444ec301..580c444ec301 100644
--- a/drivers/video/sa1100fb.c
+++ b/drivers/video/fbdev/sa1100fb.c
diff --git a/drivers/video/sa1100fb.h b/drivers/video/fbdev/sa1100fb.h
index fc5d4292fad6..fc5d4292fad6 100644
--- a/drivers/video/sa1100fb.h
+++ b/drivers/video/fbdev/sa1100fb.h
diff --git a/drivers/video/savage/Makefile b/drivers/video/fbdev/savage/Makefile
index e09770fff8ea..e09770fff8ea 100644
--- a/drivers/video/savage/Makefile
+++ b/drivers/video/fbdev/savage/Makefile
diff --git a/drivers/video/savage/savagefb-i2c.c b/drivers/video/fbdev/savage/savagefb-i2c.c
index 80fa87e2ae2f..80fa87e2ae2f 100644
--- a/drivers/video/savage/savagefb-i2c.c
+++ b/drivers/video/fbdev/savage/savagefb-i2c.c
diff --git a/drivers/video/savage/savagefb.h b/drivers/video/fbdev/savage/savagefb.h
index dcaab9012ca2..dcaab9012ca2 100644
--- a/drivers/video/savage/savagefb.h
+++ b/drivers/video/fbdev/savage/savagefb.h
diff --git a/drivers/video/savage/savagefb_accel.c b/drivers/video/fbdev/savage/savagefb_accel.c
index bfefa6234cf0..bfefa6234cf0 100644
--- a/drivers/video/savage/savagefb_accel.c
+++ b/drivers/video/fbdev/savage/savagefb_accel.c
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c
index 4dbf45f3b21a..4dbf45f3b21a 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/fbdev/savage/savagefb_driver.c
diff --git a/drivers/video/sbuslib.c b/drivers/video/fbdev/sbuslib.c
index a350209ffbd3..a350209ffbd3 100644
--- a/drivers/video/sbuslib.c
+++ b/drivers/video/fbdev/sbuslib.c
diff --git a/drivers/video/sbuslib.h b/drivers/video/fbdev/sbuslib.h
index 7ba3250236bd..7ba3250236bd 100644
--- a/drivers/video/sbuslib.h
+++ b/drivers/video/fbdev/sbuslib.h
diff --git a/drivers/video/sh7760fb.c b/drivers/video/fbdev/sh7760fb.c
index 1265b25f9f99..1265b25f9f99 100644
--- a/drivers/video/sh7760fb.c
+++ b/drivers/video/fbdev/sh7760fb.c
diff --git a/drivers/video/sh_mipi_dsi.c b/drivers/video/fbdev/sh_mipi_dsi.c
index 8f6e8ff620d4..8f6e8ff620d4 100644
--- a/drivers/video/sh_mipi_dsi.c
+++ b/drivers/video/fbdev/sh_mipi_dsi.c
diff --git a/drivers/video/sh_mobile_hdmi.c b/drivers/video/fbdev/sh_mobile_hdmi.c
index 9a33ee0413fb..9a33ee0413fb 100644
--- a/drivers/video/sh_mobile_hdmi.c
+++ b/drivers/video/fbdev/sh_mobile_hdmi.c
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
index 2bcc84ac18c7..2bcc84ac18c7 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c
diff --git a/drivers/video/sh_mobile_lcdcfb.h b/drivers/video/fbdev/sh_mobile_lcdcfb.h
index f839adef1d90..f839adef1d90 100644
--- a/drivers/video/sh_mobile_lcdcfb.h
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.h
diff --git a/drivers/video/sh_mobile_meram.c b/drivers/video/fbdev/sh_mobile_meram.c
index a297de5cc859..a297de5cc859 100644
--- a/drivers/video/sh_mobile_meram.c
+++ b/drivers/video/fbdev/sh_mobile_meram.c
diff --git a/drivers/video/simplefb.c b/drivers/video/fbdev/simplefb.c
index 210f3a02121a..210f3a02121a 100644
--- a/drivers/video/simplefb.c
+++ b/drivers/video/fbdev/simplefb.c
diff --git a/drivers/video/sis/300vtbl.h b/drivers/video/fbdev/sis/300vtbl.h
index e4b4a2626da4..e4b4a2626da4 100644
--- a/drivers/video/sis/300vtbl.h
+++ b/drivers/video/fbdev/sis/300vtbl.h
diff --git a/drivers/video/sis/310vtbl.h b/drivers/video/fbdev/sis/310vtbl.h
index 54fcbbf4ef63..54fcbbf4ef63 100644
--- a/drivers/video/sis/310vtbl.h
+++ b/drivers/video/fbdev/sis/310vtbl.h
diff --git a/drivers/video/sis/Makefile b/drivers/video/fbdev/sis/Makefile
index f7c0046e5b1d..f7c0046e5b1d 100644
--- a/drivers/video/sis/Makefile
+++ b/drivers/video/fbdev/sis/Makefile
diff --git a/drivers/video/sis/init.c b/drivers/video/fbdev/sis/init.c
index bd40f5ecd901..bd40f5ecd901 100644
--- a/drivers/video/sis/init.c
+++ b/drivers/video/fbdev/sis/init.c
diff --git a/drivers/video/sis/init.h b/drivers/video/fbdev/sis/init.h
index 85d6738b6c64..85d6738b6c64 100644
--- a/drivers/video/sis/init.h
+++ b/drivers/video/fbdev/sis/init.h
diff --git a/drivers/video/sis/init301.c b/drivers/video/fbdev/sis/init301.c
index a89e3cafd5ad..a89e3cafd5ad 100644
--- a/drivers/video/sis/init301.c
+++ b/drivers/video/fbdev/sis/init301.c
diff --git a/drivers/video/sis/init301.h b/drivers/video/fbdev/sis/init301.h
index 2112d6d7feda..2112d6d7feda 100644
--- a/drivers/video/sis/init301.h
+++ b/drivers/video/fbdev/sis/init301.h
diff --git a/drivers/video/sis/initdef.h b/drivers/video/fbdev/sis/initdef.h
index 264b55a5947b..264b55a5947b 100644
--- a/drivers/video/sis/initdef.h
+++ b/drivers/video/fbdev/sis/initdef.h
diff --git a/drivers/video/sis/initextlfb.c b/drivers/video/fbdev/sis/initextlfb.c
index 3ab18f5a3759..3ab18f5a3759 100644
--- a/drivers/video/sis/initextlfb.c
+++ b/drivers/video/fbdev/sis/initextlfb.c
diff --git a/drivers/video/sis/oem300.h b/drivers/video/fbdev/sis/oem300.h
index b73f26840143..b73f26840143 100644
--- a/drivers/video/sis/oem300.h
+++ b/drivers/video/fbdev/sis/oem300.h
diff --git a/drivers/video/sis/oem310.h b/drivers/video/fbdev/sis/oem310.h
index 8fce56e4482c..8fce56e4482c 100644
--- a/drivers/video/sis/oem310.h
+++ b/drivers/video/fbdev/sis/oem310.h
diff --git a/drivers/video/sis/sis.h b/drivers/video/fbdev/sis/sis.h
index 1987f1b7212f..1987f1b7212f 100644
--- a/drivers/video/sis/sis.h
+++ b/drivers/video/fbdev/sis/sis.h
diff --git a/drivers/video/sis/sis_accel.c b/drivers/video/fbdev/sis/sis_accel.c
index ceb434c95c0d..ceb434c95c0d 100644
--- a/drivers/video/sis/sis_accel.c
+++ b/drivers/video/fbdev/sis/sis_accel.c
diff --git a/drivers/video/sis/sis_accel.h b/drivers/video/fbdev/sis/sis_accel.h
index 30e03cdf6b85..30e03cdf6b85 100644
--- a/drivers/video/sis/sis_accel.h
+++ b/drivers/video/fbdev/sis/sis_accel.h
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/fbdev/sis/sis_main.c
index 22ad028bf123..22ad028bf123 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/fbdev/sis/sis_main.c
diff --git a/drivers/video/sis/sis_main.h b/drivers/video/fbdev/sis/sis_main.h
index 32e23c209430..32e23c209430 100644
--- a/drivers/video/sis/sis_main.h
+++ b/drivers/video/fbdev/sis/sis_main.h
diff --git a/drivers/video/sis/vgatypes.h b/drivers/video/fbdev/sis/vgatypes.h
index e3f9976cfef0..e3f9976cfef0 100644
--- a/drivers/video/sis/vgatypes.h
+++ b/drivers/video/fbdev/sis/vgatypes.h
diff --git a/drivers/video/sis/vstruct.h b/drivers/video/fbdev/sis/vstruct.h
index ea94d214dcff..ea94d214dcff 100644
--- a/drivers/video/sis/vstruct.h
+++ b/drivers/video/fbdev/sis/vstruct.h
diff --git a/drivers/video/skeletonfb.c b/drivers/video/fbdev/skeletonfb.c
index fefde7c6add7..fefde7c6add7 100644
--- a/drivers/video/skeletonfb.c
+++ b/drivers/video/fbdev/skeletonfb.c
diff --git a/drivers/video/sm501fb.c b/drivers/video/fbdev/sm501fb.c
index 1501979099dc..1501979099dc 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/fbdev/sm501fb.c
diff --git a/drivers/video/smscufx.c b/drivers/video/fbdev/smscufx.c
index d513ed6a49f2..d513ed6a49f2 100644
--- a/drivers/video/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
diff --git a/drivers/video/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index f4daa59f0a80..f4daa59f0a80 100644
--- a/drivers/video/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
diff --git a/drivers/video/sstfb.c b/drivers/video/fbdev/sstfb.c
index f0cb279ef333..f0cb279ef333 100644
--- a/drivers/video/sstfb.c
+++ b/drivers/video/fbdev/sstfb.c
diff --git a/drivers/video/sticore.h b/drivers/video/fbdev/sticore.h
index af1619536ac8..af1619536ac8 100644
--- a/drivers/video/sticore.h
+++ b/drivers/video/fbdev/sticore.h
diff --git a/drivers/video/stifb.c b/drivers/video/fbdev/stifb.c
index cfe8a2f905c5..cfe8a2f905c5 100644
--- a/drivers/video/stifb.c
+++ b/drivers/video/fbdev/stifb.c
diff --git a/drivers/video/sunxvr1000.c b/drivers/video/fbdev/sunxvr1000.c
index 58241b47a96d..58241b47a96d 100644
--- a/drivers/video/sunxvr1000.c
+++ b/drivers/video/fbdev/sunxvr1000.c
diff --git a/drivers/video/sunxvr2500.c b/drivers/video/fbdev/sunxvr2500.c
index 843b6bab0483..843b6bab0483 100644
--- a/drivers/video/sunxvr2500.c
+++ b/drivers/video/fbdev/sunxvr2500.c
diff --git a/drivers/video/sunxvr500.c b/drivers/video/fbdev/sunxvr500.c
index 387350d004df..387350d004df 100644
--- a/drivers/video/sunxvr500.c
+++ b/drivers/video/fbdev/sunxvr500.c
diff --git a/drivers/video/tcx.c b/drivers/video/fbdev/tcx.c
index 7fb2d696fac7..7fb2d696fac7 100644
--- a/drivers/video/tcx.c
+++ b/drivers/video/fbdev/tcx.c
diff --git a/drivers/video/tdfxfb.c b/drivers/video/fbdev/tdfxfb.c
index f761fe375f5b..f761fe375f5b 100644
--- a/drivers/video/tdfxfb.c
+++ b/drivers/video/fbdev/tdfxfb.c
diff --git a/drivers/video/tgafb.c b/drivers/video/fbdev/tgafb.c
index 65ba9921506e..65ba9921506e 100644
--- a/drivers/video/tgafb.c
+++ b/drivers/video/fbdev/tgafb.c
diff --git a/drivers/video/tmiofb.c b/drivers/video/fbdev/tmiofb.c
index 7fb4e321a431..7fb4e321a431 100644
--- a/drivers/video/tmiofb.c
+++ b/drivers/video/fbdev/tmiofb.c
diff --git a/drivers/video/tridentfb.c b/drivers/video/fbdev/tridentfb.c
index 7ed9a227f5ea..7ed9a227f5ea 100644
--- a/drivers/video/tridentfb.c
+++ b/drivers/video/fbdev/tridentfb.c
diff --git a/drivers/video/udlfb.c b/drivers/video/fbdev/udlfb.c
index 77b890e4d296..77b890e4d296 100644
--- a/drivers/video/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
diff --git a/drivers/video/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 509d452e8f91..509d452e8f91 100644
--- a/drivers/video/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
diff --git a/drivers/video/valkyriefb.c b/drivers/video/fbdev/valkyriefb.c
index 97cb9bd1d1dd..97cb9bd1d1dd 100644
--- a/drivers/video/valkyriefb.c
+++ b/drivers/video/fbdev/valkyriefb.c
diff --git a/drivers/video/valkyriefb.h b/drivers/video/fbdev/valkyriefb.h
index d787441e5a42..d787441e5a42 100644
--- a/drivers/video/valkyriefb.h
+++ b/drivers/video/fbdev/valkyriefb.h
diff --git a/drivers/video/vermilion/Makefile b/drivers/video/fbdev/vermilion/Makefile
index cc21a656153d..cc21a656153d 100644
--- a/drivers/video/vermilion/Makefile
+++ b/drivers/video/fbdev/vermilion/Makefile
diff --git a/drivers/video/vermilion/cr_pll.c b/drivers/video/fbdev/vermilion/cr_pll.c
index ebc6e6e0dd0f..ebc6e6e0dd0f 100644
--- a/drivers/video/vermilion/cr_pll.c
+++ b/drivers/video/fbdev/vermilion/cr_pll.c
diff --git a/drivers/video/vermilion/vermilion.c b/drivers/video/fbdev/vermilion/vermilion.c
index 048a66640b03..048a66640b03 100644
--- a/drivers/video/vermilion/vermilion.c
+++ b/drivers/video/fbdev/vermilion/vermilion.c
diff --git a/drivers/video/vermilion/vermilion.h b/drivers/video/fbdev/vermilion/vermilion.h
index 43d11ec197fc..43d11ec197fc 100644
--- a/drivers/video/vermilion/vermilion.h
+++ b/drivers/video/fbdev/vermilion/vermilion.h
diff --git a/drivers/video/vesafb.c b/drivers/video/fbdev/vesafb.c
index 6170e7f58640..6170e7f58640 100644
--- a/drivers/video/vesafb.c
+++ b/drivers/video/fbdev/vesafb.c
diff --git a/drivers/video/vfb.c b/drivers/video/fbdev/vfb.c
index 70a897b1e458..70a897b1e458 100644
--- a/drivers/video/vfb.c
+++ b/drivers/video/fbdev/vfb.c
diff --git a/drivers/video/vga16fb.c b/drivers/video/fbdev/vga16fb.c
index 283d335a759f..283d335a759f 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/fbdev/vga16fb.c
diff --git a/drivers/video/via/Makefile b/drivers/video/fbdev/via/Makefile
index 159f26e6adb5..159f26e6adb5 100644
--- a/drivers/video/via/Makefile
+++ b/drivers/video/fbdev/via/Makefile
diff --git a/drivers/video/via/accel.c b/drivers/video/fbdev/via/accel.c
index 4b67b8e6030a..4b67b8e6030a 100644
--- a/drivers/video/via/accel.c
+++ b/drivers/video/fbdev/via/accel.c
diff --git a/drivers/video/via/accel.h b/drivers/video/fbdev/via/accel.h
index 79d5e10cc835..79d5e10cc835 100644
--- a/drivers/video/via/accel.h
+++ b/drivers/video/fbdev/via/accel.h
diff --git a/drivers/video/via/chip.h b/drivers/video/fbdev/via/chip.h
index d32a5076c20f..d32a5076c20f 100644
--- a/drivers/video/via/chip.h
+++ b/drivers/video/fbdev/via/chip.h
diff --git a/drivers/video/via/debug.h b/drivers/video/fbdev/via/debug.h
index 86eacc2017f3..86eacc2017f3 100644
--- a/drivers/video/via/debug.h
+++ b/drivers/video/fbdev/via/debug.h
diff --git a/drivers/video/via/dvi.c b/drivers/video/fbdev/via/dvi.c
index 7789553952d3..7789553952d3 100644
--- a/drivers/video/via/dvi.c
+++ b/drivers/video/fbdev/via/dvi.c
diff --git a/drivers/video/via/dvi.h b/drivers/video/fbdev/via/dvi.h
index 4c6bfba57d11..4c6bfba57d11 100644
--- a/drivers/video/via/dvi.h
+++ b/drivers/video/fbdev/via/dvi.h
diff --git a/drivers/video/via/global.c b/drivers/video/fbdev/via/global.c
index 3102171c1674..3102171c1674 100644
--- a/drivers/video/via/global.c
+++ b/drivers/video/fbdev/via/global.c
diff --git a/drivers/video/via/global.h b/drivers/video/fbdev/via/global.h
index 275dbbbd6b81..275dbbbd6b81 100644
--- a/drivers/video/via/global.h
+++ b/drivers/video/fbdev/via/global.h
diff --git a/drivers/video/via/hw.c b/drivers/video/fbdev/via/hw.c
index 22450908306c..22450908306c 100644
--- a/drivers/video/via/hw.c
+++ b/drivers/video/fbdev/via/hw.c
diff --git a/drivers/video/via/hw.h b/drivers/video/fbdev/via/hw.h
index 3be073c58b03..3be073c58b03 100644
--- a/drivers/video/via/hw.h
+++ b/drivers/video/fbdev/via/hw.h
diff --git a/drivers/video/via/ioctl.c b/drivers/video/fbdev/via/ioctl.c
index ea1c51428823..ea1c51428823 100644
--- a/drivers/video/via/ioctl.c
+++ b/drivers/video/fbdev/via/ioctl.c
diff --git a/drivers/video/via/ioctl.h b/drivers/video/fbdev/via/ioctl.h
index 6010d10b59e8..6010d10b59e8 100644
--- a/drivers/video/via/ioctl.h
+++ b/drivers/video/fbdev/via/ioctl.h
diff --git a/drivers/video/via/lcd.c b/drivers/video/fbdev/via/lcd.c
index 5d21ff436ec8..5d21ff436ec8 100644
--- a/drivers/video/via/lcd.c
+++ b/drivers/video/fbdev/via/lcd.c
diff --git a/drivers/video/via/lcd.h b/drivers/video/fbdev/via/lcd.h
index 5c988a063ad5..5c988a063ad5 100644
--- a/drivers/video/via/lcd.h
+++ b/drivers/video/fbdev/via/lcd.h
diff --git a/drivers/video/via/share.h b/drivers/video/fbdev/via/share.h
index 65c65c611e0a..65c65c611e0a 100644
--- a/drivers/video/via/share.h
+++ b/drivers/video/fbdev/via/share.h
diff --git a/drivers/video/via/tblDPASetting.c b/drivers/video/fbdev/via/tblDPASetting.c
index 73bb554e7c1e..73bb554e7c1e 100644
--- a/drivers/video/via/tblDPASetting.c
+++ b/drivers/video/fbdev/via/tblDPASetting.c
diff --git a/drivers/video/via/tblDPASetting.h b/drivers/video/fbdev/via/tblDPASetting.h
index 6db61519cb5d..6db61519cb5d 100644
--- a/drivers/video/via/tblDPASetting.h
+++ b/drivers/video/fbdev/via/tblDPASetting.h
diff --git a/drivers/video/via/via-core.c b/drivers/video/fbdev/via/via-core.c
index 6e274825fb31..6e274825fb31 100644
--- a/drivers/video/via/via-core.c
+++ b/drivers/video/fbdev/via/via-core.c
diff --git a/drivers/video/via/via-gpio.c b/drivers/video/fbdev/via/via-gpio.c
index e408679081ab..e408679081ab 100644
--- a/drivers/video/via/via-gpio.c
+++ b/drivers/video/fbdev/via/via-gpio.c
diff --git a/drivers/video/via/via_aux.c b/drivers/video/fbdev/via/via_aux.c
index 4a0a55cdac3d..4a0a55cdac3d 100644
--- a/drivers/video/via/via_aux.c
+++ b/drivers/video/fbdev/via/via_aux.c
diff --git a/drivers/video/via/via_aux.h b/drivers/video/fbdev/via/via_aux.h
index a8de3f038cea..a8de3f038cea 100644
--- a/drivers/video/via/via_aux.h
+++ b/drivers/video/fbdev/via/via_aux.h
diff --git a/drivers/video/via/via_aux_ch7301.c b/drivers/video/fbdev/via/via_aux_ch7301.c
index 1cbe5037a6b0..1cbe5037a6b0 100644
--- a/drivers/video/via/via_aux_ch7301.c
+++ b/drivers/video/fbdev/via/via_aux_ch7301.c
diff --git a/drivers/video/via/via_aux_edid.c b/drivers/video/fbdev/via/via_aux_edid.c
index 754d4509033f..754d4509033f 100644
--- a/drivers/video/via/via_aux_edid.c
+++ b/drivers/video/fbdev/via/via_aux_edid.c
diff --git a/drivers/video/via/via_aux_sii164.c b/drivers/video/fbdev/via/via_aux_sii164.c
index ca1b35f033b1..ca1b35f033b1 100644
--- a/drivers/video/via/via_aux_sii164.c
+++ b/drivers/video/fbdev/via/via_aux_sii164.c
diff --git a/drivers/video/via/via_aux_vt1621.c b/drivers/video/fbdev/via/via_aux_vt1621.c
index 38eca8479898..38eca8479898 100644
--- a/drivers/video/via/via_aux_vt1621.c
+++ b/drivers/video/fbdev/via/via_aux_vt1621.c
diff --git a/drivers/video/via/via_aux_vt1622.c b/drivers/video/fbdev/via/via_aux_vt1622.c
index 8c79c68ba683..8c79c68ba683 100644
--- a/drivers/video/via/via_aux_vt1622.c
+++ b/drivers/video/fbdev/via/via_aux_vt1622.c
diff --git a/drivers/video/via/via_aux_vt1625.c b/drivers/video/fbdev/via/via_aux_vt1625.c
index 03eb30165d36..03eb30165d36 100644
--- a/drivers/video/via/via_aux_vt1625.c
+++ b/drivers/video/fbdev/via/via_aux_vt1625.c
diff --git a/drivers/video/via/via_aux_vt1631.c b/drivers/video/fbdev/via/via_aux_vt1631.c
index 06e742f1f723..06e742f1f723 100644
--- a/drivers/video/via/via_aux_vt1631.c
+++ b/drivers/video/fbdev/via/via_aux_vt1631.c
diff --git a/drivers/video/via/via_aux_vt1632.c b/drivers/video/fbdev/via/via_aux_vt1632.c
index d24f4cd97401..d24f4cd97401 100644
--- a/drivers/video/via/via_aux_vt1632.c
+++ b/drivers/video/fbdev/via/via_aux_vt1632.c
diff --git a/drivers/video/via/via_aux_vt1636.c b/drivers/video/fbdev/via/via_aux_vt1636.c
index 9e015c101d4d..9e015c101d4d 100644
--- a/drivers/video/via/via_aux_vt1636.c
+++ b/drivers/video/fbdev/via/via_aux_vt1636.c
diff --git a/drivers/video/via/via_clock.c b/drivers/video/fbdev/via/via_clock.c
index db1e39277e32..db1e39277e32 100644
--- a/drivers/video/via/via_clock.c
+++ b/drivers/video/fbdev/via/via_clock.c
diff --git a/drivers/video/via/via_clock.h b/drivers/video/fbdev/via/via_clock.h
index 88714ae0d157..88714ae0d157 100644
--- a/drivers/video/via/via_clock.h
+++ b/drivers/video/fbdev/via/via_clock.h
diff --git a/drivers/video/via/via_i2c.c b/drivers/video/fbdev/via/via_i2c.c
index dd53058bbbb7..dd53058bbbb7 100644
--- a/drivers/video/via/via_i2c.c
+++ b/drivers/video/fbdev/via/via_i2c.c
diff --git a/drivers/video/via/via_modesetting.c b/drivers/video/fbdev/via/via_modesetting.c
index 0b414b09b9b4..0b414b09b9b4 100644
--- a/drivers/video/via/via_modesetting.c
+++ b/drivers/video/fbdev/via/via_modesetting.c
diff --git a/drivers/video/via/via_modesetting.h b/drivers/video/fbdev/via/via_modesetting.h
index f6a6503da3b3..f6a6503da3b3 100644
--- a/drivers/video/via/via_modesetting.h
+++ b/drivers/video/fbdev/via/via_modesetting.h
diff --git a/drivers/video/via/via_utility.c b/drivers/video/fbdev/via/via_utility.c
index 35458a5eadc8..35458a5eadc8 100644
--- a/drivers/video/via/via_utility.c
+++ b/drivers/video/fbdev/via/via_utility.c
diff --git a/drivers/video/via/via_utility.h b/drivers/video/fbdev/via/via_utility.h
index f23be1708c14..f23be1708c14 100644
--- a/drivers/video/via/via_utility.h
+++ b/drivers/video/fbdev/via/via_utility.h
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index 325c43c6ff97..325c43c6ff97 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
diff --git a/drivers/video/via/viafbdev.h b/drivers/video/fbdev/via/viafbdev.h
index f6b2ddf56e94..f6b2ddf56e94 100644
--- a/drivers/video/via/viafbdev.h
+++ b/drivers/video/fbdev/via/viafbdev.h
diff --git a/drivers/video/via/viamode.c b/drivers/video/fbdev/via/viamode.c
index 0666ab01cf4a..0666ab01cf4a 100644
--- a/drivers/video/via/viamode.c
+++ b/drivers/video/fbdev/via/viamode.c
diff --git a/drivers/video/via/viamode.h b/drivers/video/fbdev/via/viamode.h
index dd19106698e7..dd19106698e7 100644
--- a/drivers/video/via/viamode.h
+++ b/drivers/video/fbdev/via/viamode.h
diff --git a/drivers/video/via/vt1636.c b/drivers/video/fbdev/via/vt1636.c
index ee2903b472cf..ee2903b472cf 100644
--- a/drivers/video/via/vt1636.c
+++ b/drivers/video/fbdev/via/vt1636.c
diff --git a/drivers/video/via/vt1636.h b/drivers/video/fbdev/via/vt1636.h
index 4c1314e57468..4c1314e57468 100644
--- a/drivers/video/via/vt1636.h
+++ b/drivers/video/fbdev/via/vt1636.h
diff --git a/drivers/video/vt8500lcdfb.c b/drivers/video/fbdev/vt8500lcdfb.c
index a8f2b280f796..a8f2b280f796 100644
--- a/drivers/video/vt8500lcdfb.c
+++ b/drivers/video/fbdev/vt8500lcdfb.c
diff --git a/drivers/video/vt8500lcdfb.h b/drivers/video/fbdev/vt8500lcdfb.h
index 36ca3ca09d83..36ca3ca09d83 100644
--- a/drivers/video/vt8500lcdfb.h
+++ b/drivers/video/fbdev/vt8500lcdfb.h
diff --git a/drivers/video/vt8623fb.c b/drivers/video/fbdev/vt8623fb.c
index 5c7cbc6c6236..5c7cbc6c6236 100644
--- a/drivers/video/vt8623fb.c
+++ b/drivers/video/fbdev/vt8623fb.c
diff --git a/drivers/video/w100fb.c b/drivers/video/fbdev/w100fb.c
index 10951c82f6ed..10951c82f6ed 100644
--- a/drivers/video/w100fb.c
+++ b/drivers/video/fbdev/w100fb.c
diff --git a/drivers/video/w100fb.h b/drivers/video/fbdev/w100fb.h
index fffae7b4f6e9..fffae7b4f6e9 100644
--- a/drivers/video/w100fb.h
+++ b/drivers/video/fbdev/w100fb.h
diff --git a/drivers/video/wm8505fb.c b/drivers/video/fbdev/wm8505fb.c
index 537d199612af..537d199612af 100644
--- a/drivers/video/wm8505fb.c
+++ b/drivers/video/fbdev/wm8505fb.c
diff --git a/drivers/video/wm8505fb_regs.h b/drivers/video/fbdev/wm8505fb_regs.h
index 4dd41668c6d1..4dd41668c6d1 100644
--- a/drivers/video/wm8505fb_regs.h
+++ b/drivers/video/fbdev/wm8505fb_regs.h
diff --git a/drivers/video/wmt_ge_rops.c b/drivers/video/fbdev/wmt_ge_rops.c
index b0a9f34b2e01..9df6fe78a44b 100644
--- a/drivers/video/wmt_ge_rops.c
+++ b/drivers/video/fbdev/wmt_ge_rops.c
@@ -18,7 +18,7 @@
 #include <linux/module.h>
 #include <linux/fb.h>
 #include <linux/platform_device.h>
-#include "fb_draw.h"
+#include "core/fb_draw.h"
 #define GE_COMMAND_OFF          0x00
 #define GE_DEPTH_OFF            0x04
diff --git a/drivers/video/wmt_ge_rops.h b/drivers/video/fbdev/wmt_ge_rops.h
index f73ec6377a46..f73ec6377a46 100644
--- a/drivers/video/wmt_ge_rops.h
+++ b/drivers/video/fbdev/wmt_ge_rops.h
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index 901014bbc821..901014bbc821 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
diff --git a/drivers/video/xilinxfb.c b/drivers/video/fbdev/xilinxfb.c
index 553cff2f3f4c..553cff2f3f4c 100644
--- a/drivers/video/xilinxfb.c
+++ b/drivers/video/fbdev/xilinxfb.c
diff --git a/drivers/video/omap2/Kconfig b/drivers/video/omap2/Kconfig
deleted file mode 100644
index 63b23f87081d..000000000000
--- a/drivers/video/omap2/Kconfig
+++ /dev/null
@@ -1,10 +0,0 @@
-config OMAP2_VRFB
-        bool
-if ARCH_OMAP2PLUS
-source "drivers/video/omap2/dss/Kconfig"
-source "drivers/video/omap2/omapfb/Kconfig"
-source "drivers/video/omap2/displays-new/Kconfig"
-endif
diff --git a/drivers/vme/bridges/vme_tsi148.c b/drivers/vme/bridges/vme_tsi148.c
index 06990c6a1a69..61e706c0e00c 100644
--- a/drivers/vme/bridges/vme_tsi148.c
+++ b/drivers/vme/bridges/vme_tsi148.c
@@ -320,7 +320,7 @@ static int tsi148_irq_init(struct vme_bridge *tsi148_bridge)
        struct pci_dev *pdev;
        struct tsi148_driver *bridge;
-        pdev = container_of(tsi148_bridge->parent, struct pci_dev, dev);
+        pdev = to_pci_dev(tsi148_bridge->parent);
        bridge = tsi148_bridge->driver_priv;
@@ -433,9 +433,7 @@ static void tsi148_irq_set(struct vme_bridge *tsi148_bridge, int level,
                iowrite32be(tmp, bridge->base + TSI148_LCSR_INTEO);
                if (sync != 0) {
-                        pdev = container_of(tsi148_bridge->parent,
+                        pdev = to_pci_dev(tsi148_bridge->parent);
-                                struct pci_dev, dev);
                        synchronize_irq(pdev->irq);
                }
        } else {
@@ -741,7 +739,7 @@ static int tsi148_slave_get(struct vme_slave_resource *image, int *enabled,
        reg_join(vme_bound_high, vme_bound_low, &vme_bound);
        reg_join(pci_offset_high, pci_offset_low, &pci_offset);
-        *pci_base = (dma_addr_t)vme_base + pci_offset;
+        *pci_base = (dma_addr_t)(*vme_base + pci_offset);
        *enabled = 0;
        *aspace = 0;
@@ -814,7 +812,7 @@ static int tsi148_alloc_resource(struct vme_master_resource *image,
        tsi148_bridge = image->parent;
-        pdev = container_of(tsi148_bridge->parent, struct pci_dev, dev);
+        pdev = to_pci_dev(tsi148_bridge->parent);
        existing_size = (unsigned long long)(image->bus_resource.end -
                image->bus_resource.start);
@@ -910,11 +908,15 @@ static int tsi148_master_set(struct vme_master_resource *image, int enabled,
        unsigned long long pci_bound, vme_offset, pci_base;
        struct vme_bridge *tsi148_bridge;
        struct tsi148_driver *bridge;
+        struct pci_bus_region region;
+        struct pci_dev *pdev;
        tsi148_bridge = image->parent;
        bridge = tsi148_bridge->driver_priv;
+        pdev = to_pci_dev(tsi148_bridge->parent);
        /* Verify input data */
        if (vme_base & 0xFFFF) {
                dev_err(tsi148_bridge->parent, "Invalid VME Window "
@@ -949,7 +951,9 @@ static int tsi148_master_set(struct vme_master_resource *image, int enabled,
                pci_bound = 0;
                vme_offset = 0;
        } else {
-                pci_base = (unsigned long long)image->bus_resource.start;
+                pcibios_resource_to_bus(pdev->bus, &region,
+                                        &image->bus_resource);
+                pci_base = region.start;
                /*
                 * Bound address is a valid address for the window, adjust
@@ -2232,7 +2236,7 @@ static void *tsi148_alloc_consistent(struct device *parent, size_t size,
        struct pci_dev *pdev;
        /* Find pci_dev container of dev */
-        pdev = container_of(parent, struct pci_dev, dev);
+        pdev = to_pci_dev(parent);
        return pci_alloc_consistent(pdev, size, dma);
 }
@@ -2243,7 +2247,7 @@ static void tsi148_free_consistent(struct device *parent, size_t size,
        struct pci_dev *pdev;
        /* Find pci_dev container of dev */
-        pdev = container_of(parent, struct pci_dev, dev);
+        pdev = to_pci_dev(parent);
        pci_free_consistent(pdev, size, vaddr, dma);
 }
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index b96f61b15dc6..ff52618cafbe 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -614,27 +614,11 @@ end:
        return err;
 }
-/*
+static int w1_family_notify(unsigned long action, struct w1_slave *sl)
- * Handle sysfs file creation and removal here, before userspace is told that
- * the device is added / removed from the system
- */
-static int w1_bus_notify(struct notifier_block *nb, unsigned long action,
-                         void *data)
 {
-        struct device *dev = data;
-        struct w1_slave *sl;
        struct w1_family_ops *fops;
        int err;
-        /*
-         * Only care about slave devices at the moment.  Yes, we should use a
-         * separate "type" for this, but for now, look at the release function
-         * to know which type it is...
-         */
-        if (dev->release != w1_slave_release)
-                return 0;
-        sl = dev_to_w1_slave(dev);
        fops = sl->family->fops;
        if (!fops)
@@ -673,10 +657,6 @@ static int w1_bus_notify(struct notifier_block *nb, unsigned long action,
        return 0;
 }
-static struct notifier_block w1_bus_nb = {
-        .notifier_call = w1_bus_notify,
-};
 static int __w1_attach_slave_device(struct w1_slave *sl)
 {
        int err;
@@ -698,6 +678,9 @@ static int __w1_attach_slave_device(struct w1_slave *sl)
        dev_dbg(&sl->dev, "%s: registering %s as %p.\n", __func__,
                dev_name(&sl->dev), sl);
+        /* suppress for w1_family_notify before sending KOBJ_ADD */
+        dev_set_uevent_suppress(&sl->dev, true);
        err = device_register(&sl->dev);
        if (err < 0) {
                dev_err(&sl->dev,
@@ -705,7 +688,7 @@ static int __w1_attach_slave_device(struct w1_slave *sl)
                        dev_name(&sl->dev), err);
                return err;
        }
+        w1_family_notify(BUS_NOTIFY_ADD_DEVICE, sl);
        dev_set_uevent_suppress(&sl->dev, false);
        kobject_uevent(&sl->dev.kobj, KOBJ_ADD);
@@ -799,6 +782,7 @@ int w1_unref_slave(struct w1_slave *sl)
                msg.type = W1_SLAVE_REMOVE;
                w1_netlink_send(sl->master, &msg);
+                w1_family_notify(BUS_NOTIFY_DEL_DEVICE, sl);
                device_unregister(&sl->dev);
                #ifdef DEBUG
                memset(sl, 0, sizeof(*sl));
@@ -1186,10 +1170,6 @@ static int __init w1_init(void)
                goto err_out_exit_init;
        }
-        retval = bus_register_notifier(&w1_bus_type, &w1_bus_nb);
-        if (retval)
-                goto err_out_bus_unregister;
        retval = driver_register(&w1_master_driver);
        if (retval) {
                printk(KERN_ERR
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c
index 5234964fe001..a02704a59321 100644
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -300,12 +300,6 @@ static int w1_process_command_root(struct cn_msg *msg,
        struct w1_netlink_msg *w;
        u32 *id;
-        if (mcmd->type != W1_LIST_MASTERS) {
-                printk(KERN_NOTICE "%s: msg: %x.%x, wrong type: %u, len: %u.\n",
-                        __func__, msg->id.idx, msg->id.val, mcmd->type, mcmd->len);
-                return -EPROTO;
-        }
        cn = kmalloc(PAGE_SIZE, GFP_KERNEL);
        if (!cn)
                return -ENOMEM;
@@ -441,6 +435,9 @@ static void w1_process_cb(struct w1_master *dev, struct w1_async_cmd *async_cmd)
                w1_netlink_send_error(&node->block->msg, node->m, cmd,
                        node->block->portid, err);
+        /* ref taken in w1_search_slave or w1_search_master_id when building
+         * the block
+         */
        if (sl)
                w1_unref_slave(sl);
        else
@@ -503,30 +500,42 @@ static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
        msg_len = msg->len;
        while (msg_len && !err) {
-                struct w1_reg_num id;
-                u16 mlen = m->len;
                dev = NULL;
                sl = NULL;
-                memcpy(&id, m->id.id, sizeof(id));
-#if 0
-                printk("%s: %02x.%012llx.%02x: type=%02x, len=%u.\n",
-                                __func__, id.family, (unsigned long long)id.id, id.crc, m->type, m->len);
-#endif
                if (m->len + sizeof(struct w1_netlink_msg) > msg_len) {
                        err = -E2BIG;
                        break;
                }
+                /* execute on this thread, no need to process later */
+                if (m->type == W1_LIST_MASTERS) {
+                        err = w1_process_command_root(msg, m, nsp->portid);
+                        goto out_cont;
+                }
+                /* All following message types require additional data,
+                 * check here before references are taken.
+                 */
+                if (!m->len) {
+                        err = -EPROTO;
+                        goto out_cont;
+                }
+                /* both search calls take reference counts */
                if (m->type == W1_MASTER_CMD) {
                        dev = w1_search_master_id(m->id.mst.id);
                } else if (m->type == W1_SLAVE_CMD) {
-                        sl = w1_search_slave(&id);
+                        sl = w1_search_slave((struct w1_reg_num *)m->id.id);
                        if (sl)
                                dev = sl->master;
                } else {
-                        err = w1_process_command_root(msg, m, nsp->portid);
+                        printk(KERN_NOTICE
+                                "%s: msg: %x.%x, wrong type: %u, len: %u.\n",
+                                __func__, msg->id.idx, msg->id.val,
+                                m->type, m->len);
+                        err = -EPROTO;
                        goto out_cont;
                }
@@ -536,8 +545,6 @@ static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
                }
                err = 0;
-                if (!mlen)
-                        goto out_cont;
                atomic_inc(&block->refcnt);
                node->async.cb = w1_process_cb;
@@ -557,7 +564,8 @@ out_cont:
                if (err)
                        w1_netlink_send_error(msg, m, NULL, nsp->portid, err);
                msg_len -= sizeof(struct w1_netlink_msg) + m->len;
-                m = (struct w1_netlink_msg *)(((u8 *)m) + sizeof(struct w1_netlink_msg) + m->len);
+                m = (struct w1_netlink_msg *)(((u8 *)m) +
+                        sizeof(struct w1_netlink_msg) + m->len);
                /*
                 * Let's allow requests for nonexisting devices.
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index 96109a9972b6..84b4bfb84344 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -66,7 +66,22 @@ static DEFINE_PER_CPU(struct evtchn_fifo_queue, cpu_queue);
 static event_word_t *event_array[MAX_EVENT_ARRAY_PAGES] __read_mostly;
 static unsigned event_array_pages __read_mostly;
+/*
+ * sync_set_bit() and friends must be unsigned long aligned on non-x86
+ * platforms.
+ */
+#if !defined(CONFIG_X86) && BITS_PER_LONG > 32
+#define BM(w) (unsigned long *)((unsigned long)w & ~0x7UL)
+#define EVTCHN_FIFO_BIT(b, w) \
+    (((unsigned long)w & 0x4UL) ? (EVTCHN_FIFO_ ##b + 32) : EVTCHN_FIFO_ ##b)
+#else
 #define BM(w) ((unsigned long *)(w))
+#define EVTCHN_FIFO_BIT(b, w) EVTCHN_FIFO_ ##b
+#endif
 static inline event_word_t *event_word_from_port(unsigned port)
 {
@@ -161,33 +176,38 @@ static void evtchn_fifo_bind_to_cpu(struct irq_info *info, unsigned cpu)
 static void evtchn_fifo_clear_pending(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        sync_clear_bit(EVTCHN_FIFO_PENDING, BM(word));
+        sync_clear_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 static void evtchn_fifo_set_pending(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        sync_set_bit(EVTCHN_FIFO_PENDING, BM(word));
+        sync_set_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 static bool evtchn_fifo_is_pending(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        return sync_test_bit(EVTCHN_FIFO_PENDING, BM(word));
+        return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 static bool evtchn_fifo_test_and_set_mask(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        return sync_test_and_set_bit(EVTCHN_FIFO_MASKED, BM(word));
+        return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
 }
 static void evtchn_fifo_mask(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
-        sync_set_bit(EVTCHN_FIFO_MASKED, BM(word));
+        sync_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
 }
+static bool evtchn_fifo_is_masked(unsigned port)
+{
+        event_word_t *word = event_word_from_port(port);
+        return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
+}
 /*
 * Clear MASKED, spinning if BUSY is set.
 */
@@ -211,7 +231,7 @@ static void evtchn_fifo_unmask(unsigned port)
        BUG_ON(!irqs_disabled());
        clear_masked(word);
-        if (sync_test_bit(EVTCHN_FIFO_PENDING, BM(word))) {
+        if (evtchn_fifo_is_pending(port)) {
                struct evtchn_unmask unmask = { .port = port };
                (void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
        }
@@ -243,7 +263,7 @@ static void handle_irq_for_port(unsigned port)
 static void consume_one_event(unsigned cpu,
                              struct evtchn_fifo_control_block *control_block,
-                              unsigned priority, uint32_t *ready)
+                              unsigned priority, unsigned long *ready)
 {
        struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
        uint32_t head;
@@ -273,10 +293,9 @@ static void consume_one_event(unsigned cpu,
         * copy of the ready word.
         */
        if (head == 0)
-                clear_bit(priority, BM(ready));
+                clear_bit(priority, ready);
-        if (sync_test_bit(EVTCHN_FIFO_PENDING, BM(word))
+        if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port))
-            && !sync_test_bit(EVTCHN_FIFO_MASKED, BM(word)))
                handle_irq_for_port(port);
        q->head[priority] = head;
@@ -285,7 +304,7 @@ static void consume_one_event(unsigned cpu,
 static void evtchn_fifo_handle_events(unsigned cpu)
 {
        struct evtchn_fifo_control_block *control_block;
-        uint32_t ready;
+        unsigned long ready;
        unsigned q;
        control_block = per_cpu(cpu_control_block, cpu);
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index fc6c94c0b436..32f9236c959f 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -198,10 +198,32 @@ struct shutdown_handler {
        void (*cb)(void);
 };
+static int poweroff_nb(struct notifier_block *cb, unsigned long code, void *unused)
+{
+        switch (code) {
+        case SYS_DOWN:
+        case SYS_HALT:
+        case SYS_POWER_OFF:
+                shutting_down = SHUTDOWN_POWEROFF;
+        default:
+                break;
+        }
+        return NOTIFY_DONE;
+}
 static void do_poweroff(void)
 {
-        shutting_down = SHUTDOWN_POWEROFF;
+        switch (system_state) {
-        orderly_poweroff(false);
+        case SYSTEM_BOOTING:
+                orderly_poweroff(true);
+                break;
+        case SYSTEM_RUNNING:
+                orderly_poweroff(false);
+                break;
+        default:
+                /* Don't do it when we are halting/rebooting. */
+                pr_info("Ignoring Xen toolstack shutdown.\n");
+                break;
+        }
 }
 static void do_reboot(void)
@@ -307,6 +329,10 @@ static struct xenbus_watch shutdown_watch = {
        .callback = shutdown_handler
 };
+static struct notifier_block xen_reboot_nb = {
+        .notifier_call = poweroff_nb,
+};
 static int setup_shutdown_watcher(void)
 {
        int err;
@@ -317,6 +343,7 @@ static int setup_shutdown_watcher(void)
                return err;
        }
 #ifdef CONFIG_MAGIC_SYSRQ
        err = register_xenbus_watch(&sysrq_watch);
        if (err) {
@@ -345,6 +372,7 @@ int xen_setup_shutdown_event(void)
        if (!xen_domain())
                return -ENODEV;
        register_xenstore_notifier(&xenstore_notifier);
+        register_reboot_notifier(&xen_reboot_nb);
        return 0;
 }
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 929dd46bb40c..607e41460c0d 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -217,7 +217,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
        if (result == 0) {
                for (i = 0; i < op->value; i++) {
                        op->msix_entries[i].entry = entries[i].entry;
-                        if (entries[i].vector)
+                        if (entries[i].vector) {
                                op->msix_entries[i].vector =
                                        xen_pirq_from_irq(entries[i].vector);
                                if (unlikely(verbose_request))
@@ -225,6 +225,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
                                                "MSI-X[%d]: %d\n",
                                                pci_name(dev), i,
                                                op->msix_entries[i].vector);
+                        }
                }
        } else
                pr_warn_ratelimited("%s: error enabling MSI-X for guest %u: err %d!\n",
diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c
index 3165ce361b00..51afff96c515 100644
--- a/drivers/xen/xen-pciback/vpci.c
+++ b/drivers/xen/xen-pciback/vpci.c
@@ -137,6 +137,8 @@ unlock:
        /* Publish this device. */
        if (!err)
                err = publish_cb(pdev, 0, 0, PCI_DEVFN(slot, func), devid);
+        else
+                kfree(dev_entry);
 out:
        return err;
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index b6d5fff43d16..ba804f3d8278 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -50,6 +50,7 @@
 #include <xen/xenbus.h>
 #include <xen/xen.h>
 #include "xenbus_comms.h"
+#include "xenbus_probe.h"
 struct xs_stored_msg {
        struct list_head list;
@@ -139,6 +140,29 @@ static int get_error(const char *errorstring)
        return xsd_errors[i].errnum;
 }
+static bool xenbus_ok(void)
+{
+        switch (xen_store_domain_type) {
+        case XS_LOCAL:
+                switch (system_state) {
+                case SYSTEM_POWER_OFF:
+                case SYSTEM_RESTART:
+                case SYSTEM_HALT:
+                        return false;
+                default:
+                        break;
+                }
+                return true;
+        case XS_PV:
+        case XS_HVM:
+                /* FIXME: Could check that the remote domain is alive,
+                 * but it is normally initial domain. */
+                return true;
+        default:
+                break;
+        }
+        return false;
+}
 static void *read_reply(enum xsd_sockmsg_type *type, unsigned int *len)
 {
        struct xs_stored_msg *msg;
@@ -148,9 +172,20 @@ static void *read_reply(enum xsd_sockmsg_type *type, unsigned int *len)
        while (list_empty(&xs_state.reply_list)) {
                spin_unlock(&xs_state.reply_lock);
-                /* XXX FIXME: Avoid synchronous wait for response here. */
+                if (xenbus_ok())
-                wait_event(xs_state.reply_waitq,
+                        /* XXX FIXME: Avoid synchronous wait for response here. */
-                           !list_empty(&xs_state.reply_list));
+                        wait_event_timeout(xs_state.reply_waitq,
+                                           !list_empty(&xs_state.reply_list),
+                                           msecs_to_jiffies(500));
+                else {
+                        /*
+                         * If we are in the process of being shut-down there is
+                         * no point of trying to contact XenBus - it is either
+                         * killed (xenstored application) or the other domain
+                         * has been killed or is unreachable.
+                         */
+                        return ERR_PTR(-EIO);
+                }
                spin_lock(&xs_state.reply_lock);
        }
@@ -215,6 +250,9 @@ void *xenbus_dev_request_and_reply(struct xsd_sockmsg *msg)
        mutex_unlock(&xs_state.request_mutex);
+        if (IS_ERR(ret))
+                return ret;
        if ((msg->type == XS_TRANSACTION_END) ||
            ((req_msg.type == XS_TRANSACTION_START) &&
             (msg->type == XS_ERROR)))